diff --git a/wlan/prima/Android.mk b/wlan/prima/Android.mk
index 456f6f4..ad25367 100644
--- a/wlan/prima/Android.mk
+++ b/wlan/prima/Android.mk
@@ -1,7 +1,57 @@
 # Android makefile for the WLAN Module
 
+# Assume no targets will be supported
+WLAN_CHIPSET :=
+
+# Build/Package options for 8960 target
+ifeq ($(TARGET_BOARD_PLATFORM),msm8960)
+WLAN_CHIPSET := prima
+WLAN_SELECT := CONFIG_PRIMA_WLAN=m
+endif
+
+# Build/Package options for 8916, 8974, 8226, 8610, 8909, 8952, 8937, 8953 targets
+ifneq (,$(filter msm8916 msm8974 msm8226 msm8610 msm8909 msm8952 msm8937 msm8953 titanium,$(TARGET_BOARD_PLATFORM)))
+WLAN_CHIPSET := pronto
+WLAN_SELECT := CONFIG_PRONTO_WLAN=m
+endif
+
+# Build/Package only in case of supported target
+ifneq ($(WLAN_CHIPSET),)
+
 LOCAL_PATH := $(call my-dir)
 
+# This makefile is only for DLKM
+ifneq ($(findstring vendor,$(LOCAL_PATH)),)
+
+# Determine if we are Proprietary or Open Source
+ifneq ($(findstring opensource,$(LOCAL_PATH)),)
+    WLAN_PROPRIETARY := 0
+else
+    WLAN_PROPRIETARY := 1
+endif
+
+ifeq ($(WLAN_PROPRIETARY),1)
+    WLAN_BLD_DIR := vendor/qcom/proprietary/wlan
+else
+    WLAN_BLD_DIR := vendor/qcom/opensource/wlan
+endif
+
+# DLKM_DIR was moved for JELLY_BEAN (PLATFORM_SDK 16)
+ifeq (1,$(filter 1,$(shell echo "$$(( $(PLATFORM_SDK_VERSION) >= 16 ))" )))
+       DLKM_DIR := $(TOP)/device/qcom/common/dlkm
+else
+       DLKM_DIR := build/dlkm
+endif
+
+# Copy WCNSS_cfg.dat file from firmware_bin/ folder to target out directory.
+ifeq ($(WLAN_PROPRIETARY),0)
+
+$(shell mkdir -p $(TARGET_OUT_ETC)/firmware/wlan/prima)
+$(shell rm -f $(TARGET_OUT_ETC)/firmware/wlan/prima/WCNSS_cfg.dat)
+$(shell cp $(LOCAL_PATH)/firmware_bin/WCNSS_cfg.dat $(TARGET_OUT_ETC)/firmware/wlan/prima)
+
+else
+
 include $(CLEAR_VARS)
 LOCAL_MODULE       := WCNSS_qcom_wlan_nv.bin
 LOCAL_MODULE_TAGS  := optional
@@ -26,7 +76,50 @@
 LOCAL_SRC_FILES    := firmware_bin/$(LOCAL_MODULE)
 include $(BUILD_PREBUILT)
 
+endif
+
+ifeq ($(TARGET_KERNEL_VERSION),)
+$(info "WLAN: TARGET_KERNEL_VERSION is not defined, assuming default")
+TARGET_KERNEL_SOURCE := kernel
+KERNEL_TO_BUILD_ROOT_OFFSET := ../
+endif
+
+ifeq ($(KERNEL_TO_BUILD_ROOT_OFFSET),)
+$(info "WLAN: KERNEL_TO_BUILD_ROOT_OFFSET is not defined, assuming default")
+KERNEL_TO_BUILD_ROOT_OFFSET := ../
+endif
+
+# Build wlan.ko as either prima_wlan.ko or pronto_wlan.ko
+###########################################################
+
+# This is set once per LOCAL_PATH, not per (kernel) module
+KBUILD_OPTIONS := WLAN_ROOT=$(KERNEL_TO_BUILD_ROOT_OFFSET)$(WLAN_BLD_DIR)/prima
+# We are actually building wlan.ko here, as per the
+# requirement we are specifying <chipset>_wlan.ko as LOCAL_MODULE.
+# This means we need to rename the module to <chipset>_wlan.ko
+# after wlan.ko is built.
+KBUILD_OPTIONS += MODNAME=wlan
+KBUILD_OPTIONS += BOARD_PLATFORM=$(TARGET_BOARD_PLATFORM)
+KBUILD_OPTIONS += $(WLAN_SELECT)
+
+
+VERSION=$(shell grep -w "VERSION =" $(TOP)/kernel/Makefile | sed 's/^VERSION = //' )
+PATCHLEVEL=$(shell grep -w "PATCHLEVEL =" $(TOP)/kernel/Makefile | sed 's/^PATCHLEVEL = //' )
+
+include $(CLEAR_VARS)
+LOCAL_MODULE              := $(WLAN_CHIPSET)_wlan.ko
+LOCAL_MODULE_KBUILD_NAME  := wlan.ko
+LOCAL_MODULE_TAGS         := debug
+LOCAL_MODULE_DEBUG_ENABLE := true
+LOCAL_MODULE_PATH         := $(TARGET_OUT)/lib/modules/$(WLAN_CHIPSET)
+include $(DLKM_DIR)/AndroidKernelModule.mk
+###########################################################
+
 #Create symbolic link
 $(shell mkdir -p $(TARGET_OUT)/lib/modules; \
         ln -sf /system/lib/modules/$(WLAN_CHIPSET)/$(WLAN_CHIPSET)_wlan.ko \
                $(TARGET_OUT)/lib/modules/wlan.ko)
+
+endif # DLKM check
+
+endif # supported target check
diff --git a/wlan/prima/CORE/BAP/src/bapModule.c b/wlan/prima/CORE/BAP/src/bapModule.c
index ee72d8c..5cda7f5 100644
--- a/wlan/prima/CORE/BAP/src/bapModule.c
+++ b/wlan/prima/CORE/BAP/src/bapModule.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -580,7 +580,7 @@
   if( btampContext->isBapSessionOpen == TRUE )
   {
     halStatus = sme_CloseSession(halHandle, 
-            btampContext->sessionId, VOS_TRUE, NULL, NULL);
+            btampContext->sessionId, FALSE, VOS_TRUE, NULL, NULL);
     if(eHAL_STATUS_SUCCESS == halStatus)
     {
       btampContext->isBapSessionOpen = FALSE;
diff --git a/wlan/prima/CORE/BAP/src/btampHCI.c b/wlan/prima/CORE/BAP/src/btampHCI.c
index 0c6d85e..157b8d4 100644
--- a/wlan/prima/CORE/BAP/src/btampHCI.c
+++ b/wlan/prima/CORE/BAP/src/btampHCI.c
@@ -795,7 +795,7 @@
     else
     {
         /* Maximum of 5 triplets allowed, based on size of triplets definition */
-        if (tlvlen / 3 > 5)
+        if (tlvlen > 15)
         {
             tlvlen = 15;
         }
diff --git a/wlan/prima/CORE/DXE/src/wlan_qct_dxe.c b/wlan/prima/CORE/DXE/src/wlan_qct_dxe.c
index ca813be..c7f7235 100644
--- a/wlan/prima/CORE/DXE/src/wlan_qct_dxe.c
+++ b/wlan/prima/CORE/DXE/src/wlan_qct_dxe.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -90,13 +90,17 @@
 /* CSR max retry count */
 #define WLANDXE_CSR_MAX_READ_COUNT         30
 
+/* DXETRACE max records count */
+#define MAX_DXE_TRACE_RECORDS              512
+#define INVALID_TRACE_ADDR                 0xffffffff
 
 /* This is temporary fot the compile
  * WDI will release official version
  * This must be removed */
 #define WDI_GET_PAL_CTX()                  NULL
 
-
+#define TRACE_WLANDXE_VAR_ENABLE           1
+#define TRACE_WLANDXE_VAR_DISABLE          0
 /*-------------------------------------------------------------------------
   *  Local Varables
   *-------------------------------------------------------------------------*/
@@ -113,6 +117,9 @@
    };
 static  wpt_packet               *rx_reaped_buf[WLANDXE_MAX_REAPED_RX_FRAMES];
 static WLANDXE_EnvInformation    dxeEnvBlk;
+static dxeTraceData              gdxeTraceData;
+static dxeTraceRecord            gdxeTraceTbl[MAX_DXE_TRACE_RECORDS];
+static spinlock_t                dtraceLock;
 
 /*-------------------------------------------------------------------------
   *  External Function Proto Type
@@ -144,6 +151,11 @@
    WLANDXE_CtrlBlkType     *hostCtxt
 );
 
+static void dxeTrace
+(
+  v_U8_t chan, v_U8_t code, v_U32_t data
+);
+
 /*-------------------------------------------------------------------------
   *  Local Function
   *-------------------------------------------------------------------------*/
@@ -498,21 +510,9 @@
     wpt_uint32                chStatusReg
 )
 {
-   wpt_log_data_stall_channel_type channelLog;
    wpt_uint32 chLDescReg, channelLoop;
    WLANDXE_DescCtrlBlkType *targetCtrlBlk;
 
-   dxeChannelMonitor("INT_ERR", channelCb, &channelLog);
-   dxeDescriptorDump(channelCb, channelCb->headCtrlBlk->linkedDesc, 0);
-   dxeChannelRegisterDump(channelCb, "INT_ERR", &channelLog);
-   dxeChannelAllDescDump(channelCb, channelCb->channelType, &channelLog);
-   wpalMemoryCopy(channelLog.channelName,
-                  "INT_ERR",
-                  WPT_TRPT_CHANNEL_NAME);
-   wpalPacketStallUpdateInfo(NULL, NULL, &channelLog, channelCb->channelType);
-#ifdef FEATURE_WLAN_DIAG_SUPPORT
-   wpalPacketStallDumpLog();
-#endif /* FEATURE_WLAN_DIAG_SUPPORT */
    switch ((chStatusReg & WLANDXE_CH_STAT_ERR_CODE_MASK) >>
             WLANDXE_CH_STAT_ERR_CODE_OFFSET)
    {
@@ -571,11 +571,11 @@
       {
           wpt_uint32 regValue, regValueLocal;
           wpt_uint32 count = 0;
-          HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+          HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO,
                    "%s: DXE Abort Error from S/W", __func__);
 
           wpalReadRegister(WALNDEX_DMA_CSR_ADDRESS, &regValue);
-          HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+          HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO,
                    "%s: DXE CSR Value: %08x", __func__,regValue);
 
           //Execute the BMU recovery only if firmware triggered the ABORT
@@ -592,15 +592,9 @@
                        "%s: Host DXE Cleanup Failed!!!!", __func__);
               }
 
-              // Debug DXE channel after cleanup
-              dxeChannelMonitor("INT_ERR", channelCb, &channelLog);
-              dxeDescriptorDump(channelCb, channelCb->headCtrlBlk->linkedDesc, 0);
-              dxeChannelRegisterDump(channelCb, "INT_ERR", &channelLog);
-              dxeChannelAllDescDump(channelCb, channelCb->channelType, &channelLog);
-
               // Unblock the firmware
               regValue |= WLANDXE_DMA_CSR_HOST_RECOVERY_DONE;
-              HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+              HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO,
                        "%s: Host DXE Cleanup done %08x", __func__,regValue);
               wpalWriteRegister(WALNDEX_DMA_CSR_ADDRESS, regValue);
 
@@ -625,11 +619,13 @@
               //check if the h/w resources have recovered
               wpalReadRegister(WLANDXE_BMU_AVAILABLE_BD_PDU, &regValue);
               wpalReadRegister(WLANDXE_BMU_AVAILABLE_BD_PDU_LOCAL, &regValueLocal);
-              HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+              HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO,
                        "===== count %d ABD %d, ABD LOCAL %d =====", count,
                        regValue, regValueLocal);
               if(regValue == 0 || regValueLocal == 0)
               {
+                  HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                           "%s:  HW resources have not recovered", __func__);
                   return eWLAN_PAL_STATUS_E_FAILURE;
               }
 
@@ -1914,17 +1910,33 @@
 
    /* First check if a packet pointer has already been provided by a previously
       invoked Rx packet available callback. If so use that packet. */
-   if(dxeCtxt->rxPalPacketUnavailable && (NULL != dxeCtxt->freeRXPacket))
+   if (dxeCtxt->rxPalPacketUnavailable)
    {
-      currentPalPacketBuffer = dxeCtxt->freeRXPacket;
-      dxeCtxt->rxPalPacketUnavailable = eWLAN_PAL_FALSE;
-      dxeCtxt->freeRXPacket = NULL;
-
-      if (channelEntry->doneIntDisabled)
+      if (NULL != dxeCtxt->freeRXPacket)
       {
-         wpalWriteRegister(channelEntry->channelRegister.chDXECtrlRegAddr,
-                           channelEntry->extraConfig.chan_mask);
-         channelEntry->doneIntDisabled = 0;
+         currentPalPacketBuffer = dxeCtxt->freeRXPacket;
+         dxeCtxt->rxPalPacketUnavailable = eWLAN_PAL_FALSE;
+         dxeCtxt->freeRXPacket = NULL;
+
+         if (channelEntry->doneIntDisabled)
+         {
+            wpalWriteRegister(channelEntry->channelRegister.chDXECtrlRegAddr,
+                              channelEntry->extraConfig.chan_mask);
+            channelEntry->doneIntDisabled = 0;
+         }
+      }
+      else if (VOS_TIMER_STATE_RUNNING !=
+               wpalTimerGetCurStatus(&dxeCtxt->rxResourceAvailableTimer))
+      {
+         if (eWLAN_PAL_STATUS_SUCCESS !=
+             wpalTimerStart(&dxeCtxt->rxResourceAvailableTimer,
+                            wpalGetDxeReplenishRXTimerVal()))
+         {
+             HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                      "RX resource available timer not started");
+         }
+         else
+            dxeEnvBlk.rx_low_resource_timer = 1;
       }
    }
    else if(!dxeCtxt->rxPalPacketUnavailable)
@@ -1946,8 +1958,15 @@
          {
             HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_WARN,
                      "RX Low resource, wait available resource");
-            wpalTimerStart(&dxeCtxt->rxResourceAvailableTimer,
-                           wpalGetDxeReplenishRXTimerVal());
+            if (eWLAN_PAL_STATUS_SUCCESS !=
+                wpalTimerStart(&dxeCtxt->rxResourceAvailableTimer,
+                           wpalGetDxeReplenishRXTimerVal()))
+            {
+                HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                         "RX resource available timer not started");
+            }
+            else
+               dxeEnvBlk.rx_low_resource_timer = 1;
          }
 #endif
       }
@@ -2624,7 +2643,7 @@
    if((WLANDXE_POWER_STATE_IMPS == dxeCtxt->hostPowerState) ||
       (WLANDXE_POWER_STATE_DOWN == dxeCtxt->hostPowerState))
    {
-      if (WLANDXE_POWER_STATE_IMPS == dxeCtxt->hostPowerState)
+      if (WLANDXE_POWER_STATE_DOWN != dxeCtxt->hostPowerState)
       {
         if(0 == intSrc)
         {
@@ -2643,8 +2662,8 @@
         }
       }
 
-      HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_WARN,
-         "%s Riva is in %d, Just Pull frames without any register touch ",
+      HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
+         "%s Riva is in %d, Just Pull frames without any register touch",
            __func__, dxeCtxt->hostPowerState);
 
       /* Not to touch any register, just pull frame directly from chain ring
@@ -2656,7 +2675,7 @@
       if(eWLAN_PAL_STATUS_SUCCESS != status)
       {
          HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
-                  "dxeRXEventHandler Pull from RX high channel fail");        
+                  "dxeRXEventHandler Pull from RX high channel fail");
       }
       /* In case FW could not power collapse in IMPS mode
        * Next power restore might have empty interrupt
@@ -2695,7 +2714,10 @@
       /* Interrupt will not enabled at here, it will be enabled at PS mode change */
       tempDxeCtrlBlk->rxIntDisabledByIMPS = eWLAN_PAL_TRUE;
       dxeEnvBlk.rxIntDisableReturn = VOS_RETURN_ADDRESS;
-
+      dxeEnvBlk.rxIntDisableFrame = __builtin_frame_address(0);
+      HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
+            "%s Host is in %d RX Int Disabled",
+            __func__, dxeCtxt->hostPowerState);
       return;
    }
 
@@ -3033,7 +3055,8 @@
                "dxeRXEventHandler Enable RX Ready interrupt fail");
       return;
    }
-
+   DXTRACE(dxeTrace(WLANDXE_DMA_CHANNEL_MAX, TRACE_RXINT_STATE,
+                    TRACE_WLANDXE_VAR_ENABLE));
    HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO_LOW,
             "%s Exit", __func__);
    return;
@@ -3087,6 +3110,7 @@
       wpalTimerGetCurStatus(&dxeCtxt->rxResourceAvailableTimer))
    {
       wpalTimerStop(&dxeCtxt->rxResourceAvailableTimer);
+      dxeEnvBlk.rx_low_resource_timer = 0;
    }
 #endif
 
@@ -3129,6 +3153,9 @@
       /* Interrupt will not enabled at here, it will be enabled at PS mode change */
       tempDxeCtrlBlk->rxIntDisabledByIMPS = eWLAN_PAL_TRUE;
       dxeEnvBlk.rxIntDisableReturn = VOS_RETURN_ADDRESS;
+      dxeEnvBlk.rxIntDisableFrame = __builtin_frame_address(0);
+      HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
+            "dxeRXPacketAvailableEventHandler Int Disabled by IMPS");
    }
 }
 
@@ -3158,6 +3185,7 @@
    WLANDXE_CtrlBlkType      *dxeCtxt    = (WLANDXE_CtrlBlkType *)hostCtxt;
    wpt_status                status     = eWLAN_PAL_STATUS_SUCCESS;
    wpt_uint32                regValue;
+   wpt_uint32                intSrc     = 0;
 
    /* Set Interrupt processing bit
     * During this bit set, WLAN HW may not power collapse */
@@ -3185,6 +3213,12 @@
       return;         
    }
 
+   wpalReadRegister(WLANDXE_INT_SRC_RAW_ADDRESS,
+                                  &intSrc);
+   /* Note: intSrc which holds the INT_SRC_RAW_ADDRESS reg value
+      While debugging crash dump convert to power of 2 for channel type */
+   DXTRACE(dxeTrace(intSrc, TRACE_RXINT_STATE, TRACE_WLANDXE_VAR_DISABLE));
+
    /* Serialize RX Ready interrupt upon RX thread */
    if(NULL == dxeCtxt->rxIsrMsg)
    {
@@ -3394,6 +3428,7 @@
          dxeNotifySmsm(eWLAN_PAL_FALSE, eWLAN_PAL_TRUE);
          dxeNotifySmsm(eWLAN_PAL_TRUE, eWLAN_PAL_FALSE);
          tempDxeCtrlBlk->smsmToggled = eWLAN_PAL_TRUE;
+         DXTRACE(dxeTrace(channelEntry->channelType, TRACE_SMSM_NOTIFY, TRACE_WLANDXE_VAR_ENABLE));
       }
       return status;
    }
@@ -3420,6 +3455,7 @@
                   "dxeTXPushFrame Write Channel Ctrl Register fail");
          return status;
       }
+      DXTRACE(dxeTrace(channelEntry->channelType, TRACE_CH_ENABLE, TRACE_WLANDXE_VAR_ENABLE));
 
       /* Update channel head as next avaliable linked slot */
       channelEntry->headCtrlBlk = currentCtrlBlk;
@@ -3768,7 +3804,7 @@
       channelEntry = &tempDxeCtrlBlk->dxeChannel[idx];
       if(idx != WDTS_CHANNEL_TX_LOW_PRI && idx != WDTS_CHANNEL_TX_HIGH_PRI)
       {
-         HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+         HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO,
                   "%s: %11s continue",__func__,
                   channelType[channelEntry->channelType]);
           continue;
@@ -3788,7 +3824,7 @@
 
       if( currentCtrlBlk == channelEntry->headCtrlBlk )
       {
-         HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+         HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO,
                   "%s: %11s Head and Tail are Same",__func__,
                   channelType[channelEntry->channelType]);
 
@@ -3855,7 +3891,7 @@
           * in theory, COMP CB must be called already ??? */
          if(currentCtrlBlk == channelEntry->headCtrlBlk)
          {
-            HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+            HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO,
                      "%s: %11s caught up with head ptr",__func__,
                      channelType[channelEntry->channelType]);
             break;
@@ -4156,6 +4192,10 @@
       }
    }
 
+   if(eWLAN_PAL_TRUE == dxeCtxt->txIntEnable)
+      DXTRACE(dxeTrace(WLANDXE_DMA_CHANNEL_MAX, TRACE_TXINT_STATE,
+                       TRACE_WLANDXE_VAR_ENABLE));
+
    dxeEnvBlk.txCmpIntChanlSrc = 0;
 
    /*Kicking the DXE after the TX Complete interrupt was enabled - to avoid 
@@ -4452,8 +4492,9 @@
    void                    *hostCtxt
 )
 {
-   WLANDXE_CtrlBlkType      *dxeCtxt    = (WLANDXE_CtrlBlkType *)hostCtxt;
+   WLANDXE_CtrlBlkType      *dxeCtxt = (WLANDXE_CtrlBlkType *)hostCtxt;
    wpt_status                status  = eWLAN_PAL_STATUS_SUCCESS;
+   wpt_uint32                intSrc  = 0;
 
    HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO_LOW,
             "%s Enter", __func__);
@@ -4487,6 +4528,11 @@
    }
    dxeCtxt->txIntEnable = eWLAN_PAL_FALSE;
 
+   wpalReadRegister(WLANDXE_INT_SRC_RAW_ADDRESS,
+                                  &intSrc);
+   /* intSrc which holds the INT_SRC_RAW_ADDRESS reg value
+      While debugging crash dump convert to power of 2 for channel type */
+   DXTRACE(dxeTrace(intSrc, TRACE_TXINT_STATE, TRACE_WLANDXE_VAR_DISABLE));
 
    if( dxeCtxt->ucTxMsgCnt )
    {
@@ -4494,7 +4540,7 @@
                  "Avoiding serializing TX Complete event");
     return;
    }
-   
+
    dxeCtxt->ucTxMsgCnt = 1;
 
    /* Serialize TX complete interrupt upon TX thread */
@@ -4505,6 +4551,7 @@
        HDXE_ASSERT(0);
        return;
    }
+
    status = wpalPostTxMsg(WDI_GET_PAL_CTX(),
                           dxeCtxt->txIsrMsg);
    if(eWLAN_PAL_STATUS_SUCCESS != status)
@@ -4518,6 +4565,97 @@
    return;
 }
 
+/*==========================================================================
+  @  Function Name
+      dxeTraceInit
+
+  @  Description
+      Initialize the DXTRACE when enabled
+
+  @  Parameters
+      NONE
+
+  @  Return
+      NONE
+===========================================================================*/
+void dxeTraceInit(void)
+{
+   gdxeTraceData.head   = INVALID_VOS_TRACE_ADDR;
+   gdxeTraceData.tail   = INVALID_VOS_TRACE_ADDR;
+   gdxeTraceData.num    = 0;
+   gdxeTraceData.enable = eWLAN_PAL_TRUE;
+}
+
+/*==========================================================================
+  @  Function Name
+      dxeTrace
+
+  @  Description
+       puts the messages in to ring-buffer
+
+  @  Parameters
+      v_U8_t   chan
+               Rx/Tx path record
+      v_U8_t   code
+               Rx/Tx Event
+      v_U32_t  data
+               Actual message contents
+  @  Return
+      NONE
+===========================================================================*/
+void dxeTrace(v_U8_t chan, v_U8_t code, v_U32_t data)
+{
+    pdxeTraceRecord rec = NULL;
+    unsigned long flags;
+
+    if (!gdxeTraceData.enable)
+    {
+        return;
+    }
+
+    /* Aquire the lock and only one thread can access the buffer at a time */
+    spin_lock_irqsave(&dtraceLock, flags);
+
+    gdxeTraceData.num++;
+
+    if (gdxeTraceData.num > MAX_DXE_TRACE_RECORDS)
+    {
+        gdxeTraceData.num = MAX_DXE_TRACE_RECORDS;
+    }
+    if (INVALID_VOS_TRACE_ADDR == gdxeTraceData.head)
+    {
+        /* first record */
+        gdxeTraceData.head = 0;
+        gdxeTraceData.tail = 0;
+    }
+    else
+    {
+        /* queue is not empty */
+        v_U32_t tail = gdxeTraceData.tail + 1;
+        if (MAX_DXE_TRACE_RECORDS == tail)
+        {
+            tail = 0;
+        }
+        if (gdxeTraceData.head == tail)
+        {
+            /* full */
+            if (MAX_DXE_TRACE_RECORDS == ++gdxeTraceData.head)
+            {
+                gdxeTraceData.head = 0;
+            }
+        }
+        gdxeTraceData.tail = tail;
+    }
+
+    rec = &gdxeTraceTbl[gdxeTraceData.tail];
+    rec->code = code;
+    rec->data = data;
+    rec->time = vos_timer_get_system_time();
+    rec->chan = chan;
+
+    spin_unlock_irqrestore(&dtraceLock, flags);
+}
+
 /*-------------------------------------------------------------------------
  *  Global Function
  *-------------------------------------------------------------------------*/
@@ -4690,6 +4828,12 @@
    wpalTimerInit(&tempDxeCtrlBlk->dxeSSRTimer,
                  dxeSSRTimerExpHandler, tempDxeCtrlBlk);
 
+   spin_lock_init(&dtraceLock);
+
+#ifdef DXE_TRACE
+   DXTRACE(dxeTraceInit());
+#endif
+
    HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_WARN,
             "WLANDXE_Open Success");
    HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO_LOW,
@@ -5376,6 +5520,8 @@
          break;
    }
 
+   DXTRACE(dxeTrace(WLANDXE_DMA_CHANNEL_MAX, TRACE_POWER_STATE, dxeCtxt->hostPowerState));
+
    if(WLANDXE_POWER_STATE_BMPS_PENDING != dxeCtxt->hostPowerState)
    {
       dxeCtxt->setPowerStateCb(status, 
@@ -5462,6 +5608,7 @@
    WLANDXE_PowerStateType   hostPowerState;
    wpt_msg                 *rxCompMsg;
    wpt_msg                 *txDescReSyncMsg;
+   int                      state;
 
    HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO_LOW,
             "%s Enter", __func__);
@@ -5476,6 +5623,7 @@
    switch(powerState)
    {
       case WDTS_POWER_STATE_FULL:
+         dxeEnvBlk.dxe_prev_ps = pDxeCtrlBlk->hostPowerState;
          if(WLANDXE_POWER_STATE_IMPS == pDxeCtrlBlk->hostPowerState)
          {
             txDescReSyncMsg = (wpt_msg *)wpalMemoryAllocate(sizeof(wpt_msg));
@@ -5605,6 +5753,17 @@
       {
          HDXE_ASSERT(0);
       }
+      DXTRACE(dxeTrace(WLANDXE_DMA_CHANNEL_MAX, TRACE_POWER_STATE,
+                                                pDxeCtrlBlk->hostPowerState));
+   }
+
+   if (WDTS_POWER_STATE_FULL == powerState &&
+       WLANDXE_POWER_STATE_FULL == pDxeCtrlBlk->hostPowerState) {
+      state = wpal_get_int_state(DXE_INTERRUPT_RX_READY);
+      if (0 == state && eWLAN_PAL_TRUE == pDxeCtrlBlk->rxIntDisabledByIMPS) {
+          dxeEnvBlk.rx_imps_set_fp = 1;
+          WARN_ON(1);
+      }
    }
 
    HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO_LOW,
@@ -5758,11 +5917,13 @@
 ===========================================================================*/
 void WLANDXE_KickDxe(void)
 {
-   HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
+   HDXE_MSG(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_INFO,
                "%s: Kick Dxe for HDD TX timeout",__func__);
    /* Make wake up HW */
    dxeNotifySmsm(eWLAN_PAL_FALSE, eWLAN_PAL_TRUE);
    dxeNotifySmsm(eWLAN_PAL_TRUE, eWLAN_PAL_FALSE);
+   DXTRACE(dxeTrace(WLANDXE_DMA_CHANNEL_MAX, TRACE_SMSM_NOTIFY,
+                      TRACE_WLANDXE_VAR_ENABLE));
 }
 
 wpt_uint32 WLANDXE_SetupLogTransfer(wpt_uint64 bufferAddr, wpt_uint32 bufferLen)
diff --git a/wlan/prima/CORE/DXE/src/wlan_qct_dxe_i.h b/wlan/prima/CORE/DXE/src/wlan_qct_dxe_i.h
index 23f3b29..9c2eb8f 100644
--- a/wlan/prima/CORE/DXE/src/wlan_qct_dxe_i.h
+++ b/wlan/prima/CORE/DXE/src/wlan_qct_dxe_i.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -73,6 +73,12 @@
  * -------------------------------------------------------------------------*/
 #define WLANDXE_CTXT_COOKIE              0xC00CC111
 
+#ifdef DXE_TRACE
+#define DXTRACE(p) p
+#else
+#define DXTRACE(p) {  }
+#endif
+
 #define foreach_valid_channel(idx)                \
     for (idx = 0; idx < WDTS_CHANNEL_MAX; idx++)  \
         if (!(dxeGetEnabledChannels() & 1<<idx))  \
@@ -509,6 +515,15 @@
    WLANDXE_DMA_CHANNEL_MAX
 } WLANDXE_DMAChannelType;
 
+enum
+{
+   TRACE_CH_ENABLE,
+   TRACE_POWER_STATE,
+   TRACE_RXINT_STATE,
+   TRACE_TXINT_STATE,
+   TRACE_SMSM_NOTIFY
+};
+
 /** DXE HW Long Descriptor format */
 typedef struct
 {
@@ -717,9 +732,33 @@
 typedef struct
 {
    u64                             *rxIntDisableReturn;
+   u64                             *rxIntDisableFrame;
    wpt_uint8                       rxIntChanlSrc;
    wpt_uint8                       txCmpIntChanlSrc;
+   wpt_uint8                       rx_low_resource_timer;
+   wpt_uint8                       dxe_prev_ps;
+   wpt_uint8                       rx_imps_set_fp;
 } WLANDXE_EnvInformation;
+
+typedef struct
+{
+    /* Records are stored in ring buffer */
+    v_U32_t head;
+    v_U32_t tail;
+    v_U32_t num;
+
+    /* Config for controlling the trace */
+    v_U8_t enable;
+}dxeTraceData;
+
+typedef struct
+{
+    v_U32_t time;
+    v_U8_t chan;
+    v_U8_t code;
+    v_U32_t data;
+}dxeTraceRecord, *pdxeTraceRecord;
+
 /*==========================================================================
   @  Function Name 
       dxeCommonDefaultConfig
diff --git a/wlan/prima/CORE/HDD/inc/qc_sap_ioctl.h b/wlan/prima/CORE/HDD/inc/qc_sap_ioctl.h
index 994f957..2bc3b6a 100644
--- a/wlan/prima/CORE/HDD/inc/qc_sap_ioctl.h
+++ b/wlan/prima/CORE/HDD/inc/qc_sap_ioctl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,6 +40,7 @@
 #define QCSAP_MAX_OPT_IE        256
 #define QCSAP_MAX_WSC_IE        256
 #define QCSAP_MAX_GET_STA_INFO  512
+#define QCSAP_MAX_STR_LEN      1024
 
 typedef struct sSSID
 {
@@ -142,7 +143,7 @@
 #define QCSAP_IOCTL_COMMIT            (SIOCIWFIRSTPRIV+2)
 
 #define QCSAP_IOCTL_GET_STAWPAIE      (SIOCIWFIRSTPRIV+4)
-#define QCSAP_IOCTL_SETWPAIE          (SIOCIWFIRSTPRIV+5)
+
 #define QCSAP_IOCTL_STOPBSS           (SIOCIWFIRSTPRIV+6)
 #define QCSAP_IOCTL_VERSION           (SIOCIWFIRSTPRIV+7)
 #define QCSAP_IOCTL_GET_WPS_PBC_PROBE_REQ_IES       (SIOCIWFIRSTPRIV+8)
@@ -185,6 +186,7 @@
     QCSAP_PARAM_SET_MC_RATE = 10,
     QCSAP_PARAM_SET_AUTO_CHANNEL = 11,
     QCSAP_PARAM_GET_FRAME_LOGS = 12,
+    QCSAP_PARAM_SET_PROXIMITY = 13
 };
 
 int iw_softap_get_channel_list(struct net_device *dev, 
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_assoc.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_assoc.h
index ea3642b..35930df 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_assoc.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_assoc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -42,6 +42,12 @@
 /* Timeout (in ms) for Link to Up before Registering Station */
 #define ASSOC_LINKUP_TIMEOUT 60
 #define IBSS_BROADCAST_STAID 0
+
+#ifdef WLAN_FEATURE_RMC
+/* Timeout in ms for peer info request commpletion */
+#define IBSS_PEER_INFO_REQ_TIMOEUT 1000
+#endif
+
 typedef enum 
 {
    /** Not associated in Infra or participating in an IBSS / Ad-hoc network.*/
@@ -105,6 +111,8 @@
 
    /** Dot11Mode */
    tANI_U32 dot11Mode;
+
+   uint32_t  rate_flags;
    
 }connection_info_t;
 /*Forward declaration of Adapter*/
@@ -145,4 +153,6 @@
                                        const tANI_U8 numBss);
 #endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 
+void iw_full_power_cbfn (void *pContext, eHalStatus status);
+
 #endif
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_cfg.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_cfg.h
index 42d63e5..74e6d78 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -263,11 +263,32 @@
 #define CFG_ENABLE_AUTO_BMPS_TIMER_MIN         ( 0 )
 #define CFG_ENABLE_AUTO_BMPS_TIMER_MAX         ( 1 )
 #define CFG_ENABLE_AUTO_BMPS_TIMER_DEFAULT     ( 1 )
+/*
+ * gEnableDynamicRAstartRate usage:
+ *
+ * 11B and 11A/G rates can be specified in multiples of 0.5
+ * So for 5.5 mbps, gEnableDynamicRAstartRate=11
+ * and for 12 mbps, gEnableDynamicRAstartRate=24 etc.
+ *
+ * for MCS 0 - 7 rates, Bit 7 should set to 1 and Bit 0-6
+ * represent the MCS index.
+ * So for MCS0, gEnableDynamicRAstartRate=128
+ * and for MCS2, gEnableDynamicRAstartRate=130 etc.
+ *
+ * Any invalid non-zero value will set the start rate
+ * to 6 mbps (value 1 will also set it to 6 mbps)
+ *
+ * Bit 8 is used to enable PER discount logic in RA
+ * Ex: if PER discount logic needs to be enabled along with
+ * RA start rate as 6mbps:
+ * (Bit 8 for PER discount logic and Bit 0 for 6 mbps)
+ * gEnableDynamicRAstartRate=257
+ */
 
 #define CFG_ENABLE_DYNAMIC_RA_START_RATE_NAME    "gEnableDynamicRAstartRate"
-#define CFG_ENABLE_DYNAMIC_RA_START_RATE_MIN     ( 0 )
-#define CFG_ENABLE_DYNAMIC_RA_START_RATE_MAX     ( 1 )
-#define CFG_ENABLE_DYNAMIC_RA_START_RATE_DEFAULT ( 0 )
+#define CFG_ENABLE_DYNAMIC_RA_START_RATE_MIN     (0)
+#define CFG_ENABLE_DYNAMIC_RA_START_RATE_MAX     (65535)
+#define CFG_ENABLE_DYNAMIC_RA_START_RATE_DEFAULT (0)
 
 /* Bit mask value to enable RTS/CTS for different modes
  * for 2.4 GHz, HT20 - 0x0001, for 2.4 GHz, HT40 - 0x0002
@@ -583,12 +604,12 @@
 #define CFG_ACTIVE_MAX_CHANNEL_TIME_NAME       "gActiveMaxChannelTime"
 #define CFG_ACTIVE_MAX_CHANNEL_TIME_MIN        ( 0 )
 #define CFG_ACTIVE_MAX_CHANNEL_TIME_MAX        ( 10000 )
-#define CFG_ACTIVE_MAX_CHANNEL_TIME_DEFAULT    ( 40 )
+#define CFG_ACTIVE_MAX_CHANNEL_TIME_DEFAULT    ( 50 )
 
 #define CFG_ACTIVE_MIN_CHANNEL_TIME_NAME       "gActiveMinChannelTime"
 #define CFG_ACTIVE_MIN_CHANNEL_TIME_MIN        ( 0 )
 #define CFG_ACTIVE_MIN_CHANNEL_TIME_MAX        ( 10000 )
-#define CFG_ACTIVE_MIN_CHANNEL_TIME_DEFAULT    ( 20 )
+#define CFG_ACTIVE_MIN_CHANNEL_TIME_DEFAULT    ( 30 )
 
 #define CFG_ACTIVE_MAX_CHANNEL_TIME_BTC_NAME       "gActiveMaxChannelTimeBtc"
 #define CFG_ACTIVE_MAX_CHANNEL_TIME_BTC_MIN        ( 0 )
@@ -882,6 +903,78 @@
 #define CFG_ROAM_SCAN_OFFLOAD_ENABLED_MIN                   (0)
 #define CFG_ROAM_SCAN_OFFLOAD_ENABLED_MAX                   (1)
 #define CFG_ROAM_SCAN_OFFLOAD_ENABLED_DEFAULT               (1)
+
+/* Enable/disable PER based roaming */
+#define CFG_PER_ROAM_SCAN_OFFLOAD_ENABLED                  "gPERRoamEnable"
+#define CFG_PER_ROAM_SCAN_OFFLOAD_ENABLED_MIN              (0)
+#define CFG_PER_ROAM_SCAN_OFFLOAD_ENABLED_MAX              (1)
+#define CFG_PER_ROAM_SCAN_OFFLOAD_ENABLED_DEFAULT          (0)
+
+/*
+ * Rate at which to stop monitoring data rates for PER based Roam
+ * Value: MBPS * 10
+ * Min: Minimum rate of data transfer
+ * Max: Max rate for 1x1 transmission
+ */
+#define CFG_PER_ROAM_SCAN_RATE_UP_THRESHOLD                "gPERRoamUpThresholdRate"
+#define CFG_PER_ROAM_SCAN_RATE_UP_THRESHOLD_MIN            (10)
+#define CFG_PER_ROAM_SCAN_RATE_UP_THRESHOLD_MAX            (3330)
+#define CFG_PER_ROAM_SCAN_RATE_UP_THRESHOLD_DEFAULT        (400)
+
+/*
+ * rate at which to start monitoring data rates for PER based roam
+ * Value: MBPS * 10
+ */
+#define CFG_PER_ROAM_SCAN_RATE_DOWN_THRESHOLD              "gPERRoamDownThresholdRate"
+#define CFG_PER_ROAM_SCAN_RATE_DOWN_THRESHOLD_MIN          (10)
+#define CFG_PER_ROAM_SCAN_RATE_DOWN_THRESHOLD_MAX          (3330)
+#define CFG_PER_ROAM_SCAN_RATE_DOWN_THRESHOLD_DEFAULT      (100)
+
+/*
+ * time to wait before start monitoring again once a roam scan has been
+ * triggered. (Minimum time difference between two scans)
+ * Value : seconds
+ */
+#define CFG_PER_ROAM_SCAN_WAIT_TIME                        "gPERRoamScanInterval"
+#define CFG_PER_ROAM_SCAN_WAIT_TIME_MIN                    (0)
+#define CFG_PER_ROAM_SCAN_WAIT_TIME_MAX                    (3600)
+#define CFG_PER_ROAM_SCAN_WAIT_TIME_DEFAULT                (1200)
+
+/* Time to collect stats to trigger roam scan for Tx path */
+#define CFG_PER_ROAM_SCAN_PER_TIME_THRESHOLD               "gPERRoamStatsTime"
+#define CFG_PER_ROAM_SCAN_PER_TIME_THRESHOLD_MIN           (0)
+#define CFG_PER_ROAM_SCAN_PER_TIME_THRESHOLD_MAX           (25)
+#define CFG_PER_ROAM_SCAN_PER_TIME_THRESHOLD_DEFAULT       (20)
+
+/* Rx monitoring is enabled to trigger a PER based roam scan */
+#define CFG_PER_ROAM_SCAN_RX_MONITOR_ENABLED               "gPERRoamRxMonitorEnable"
+#define CFG_PER_ROAM_SCAN_RX_MONITOR_ENABLED_MIN           (0)
+#define CFG_PER_ROAM_SCAN_RX_MONITOR_ENABLED_MAX           (1)
+#define CFG_PER_ROAM_SCAN_RX_MONITOR_ENABLED_DEFAULT       (0)
+
+/*
+ * Minimum number of packets required to consider if PER based roam scan
+ * needs to be triggered in Rx
+ */
+#define CFG_PER_ROAM_SCAN_RX_MIN_PACKETS               "gPERRoamRxPktThreshold"
+#define CFG_PER_ROAM_SCAN_RX_MIN_PACKETS_MIN           (10)
+#define CFG_PER_ROAM_SCAN_RX_MIN_PACKETS_MAX           (10000)
+#define CFG_PER_ROAM_SCAN_RX_MIN_PACKETS_DEFAULT       (100)
+
+/*
+ * Minimum percentage of packets needs to be below gPERRoamScanRateDownThreshold
+ * to trigger a roam scan
+ */
+#define CFG_PER_ROAM_SCAN_MIN_PERCENTAGE               "gPERRoamTriggerPercent"
+#define CFG_PER_ROAM_SCAN_MIN_PERCENTAGE_MIN           (20)
+#define CFG_PER_ROAM_SCAN_MIN_PERCENTAGE_MAX           (100)
+#define CFG_PER_ROAM_SCAN_MIN_PERCENTAGE_DEFAULT       (60)
+
+/* Channel sensing is enabled/disabled for PER based roam scan */
+#define CFG_PER_ROAM_SCAN_CCA_ENABLED                  "gPERRoamCCAEnabled"
+#define CFG_PER_ROAM_SCAN_CCA_ENABLED_MIN              (0)
+#define CFG_PER_ROAM_SCAN_CCA_ENABLED_MAX              (1)
+#define CFG_PER_ROAM_SCAN_CCA_ENABLED_DEFAULT          (0)
 #endif
 
 #define CFG_QOS_WMM_PKT_CLASSIFY_BASIS_NAME                "PktClassificationBasis" // DSCP or 802.1Q
@@ -1007,7 +1100,7 @@
 #define CFG_TL_WFQ_VI_WEIGHT_NAME                           "WfqViWeight"
 #define CFG_TL_WFQ_VI_WEIGHT_MIN                            1
 #define CFG_TL_WFQ_VI_WEIGHT_MAX                            0xFF
-#define CFG_TL_WFQ_VI_WEIGHT_DEFAULT                        5
+#define CFG_TL_WFQ_VI_WEIGHT_DEFAULT                        7
 
 #define CFG_TL_WFQ_VO_WEIGHT_NAME                           "WfqVoWeight"
 #define CFG_TL_WFQ_VO_WEIGHT_MIN                            1
@@ -1069,7 +1162,7 @@
 #define CFG_ENABLE_LOGP_NAME                                "gEnableLogp"
 #define CFG_ENABLE_LOGP_MIN                                 ( 0 )
 #define CFG_ENABLE_LOGP_MAX                                 ( 1 )
-#define CFG_ENABLE_LOGP_DEFAULT                             ( 0 )
+#define CFG_ENABLE_LOGP_DEFAULT                             ( 1 )
 
 #define CFG_BTC_EXECUTION_MODE_NAME                         "BtcExecutionMode"
 #define CFG_BTC_EXECUTION_MODE_MIN                          ( 0 )
@@ -1531,6 +1624,10 @@
 #define CFG_MULTICAST_HOST_FW_MSGS_MAX      (1)
 #define CFG_MULTICAST_HOST_FW_MSGS_DEFAULT  (1)
 
+#define CFG_ENABLE_TCP_DELACK_NAME           "gEnableDelAck"
+#define CFG_ENABLE_TCP_DELACK_MIN            (0)
+#define CFG_ENABLE_TCP_DELACK_MAX            (1)
+#define CFG_ENABLE_TCP_DELACK_DEFAULT        (1)
 
 /* In cfg.dat 1=1MBPS, 2=2MBPS, 3=5_5MBPS, 4=11MBPS, 5=6MBPS, 6=9MBPS,
  * 7=12MBPS, 8=18MBPS, 9=24MBPS. But 6=9MBPS and 8=18MBPS are not basic
@@ -1549,14 +1646,14 @@
 #define CFG_DEFAULT_RATE_INDEX_24GH_MAX           ( 7 )
 #define CFG_DEFAULT_RATE_INDEX_24GH_DEFAULT       ( 1 )
 
-
 /*
  * This INI item is used to control subsystem restart(SSR) test framework
  * Set its value to 1 to enable APPS trigerred SSR testing
  */
-#define CFG_ENABLE_CRASH_INJECT "gEnableForceTargetAssert"
-#define CFG_ENABLE_CRASH_INJECT_MIN (0)
-#define CFG_ENABLE_CRASH_INJECT_MAX (1)
+
+#define CFG_ENABLE_CRASH_INJECT         "gEnableForceTargetAssert"
+#define CFG_ENABLE_CRASH_INJECT_MIN     (0)
+#define CFG_ENABLE_CRASH_INJECT_MAX     (1)
 #define CFG_ENABLE_CRASH_INJECT_DEFAULT (0)
 
 static __inline tANI_U32 defHddRateToDefCfgRate( tANI_U32 defRateIndex )
@@ -1842,14 +1939,14 @@
 #define CFG_TDLS_IMPLICIT_TRIGGER_DEFAULT           ( 0 )
 
 #define CFG_TDLS_TX_STATS_PERIOD                    "gTDLSTxStatsPeriod"
-#define CFG_TDLS_TX_STATS_PERIOD_MIN                ( 10 )
+#define CFG_TDLS_TX_STATS_PERIOD_MIN                (1000)
 #define CFG_TDLS_TX_STATS_PERIOD_MAX                ( 4294967295UL )
-#define CFG_TDLS_TX_STATS_PERIOD_DEFAULT            ( 5000 )
+#define CFG_TDLS_TX_STATS_PERIOD_DEFAULT            (2000)
 
 #define CFG_TDLS_TX_PACKET_THRESHOLD                "gTDLSTxPacketThreshold"
 #define CFG_TDLS_TX_PACKET_THRESHOLD_MIN            ( 0 )
 #define CFG_TDLS_TX_PACKET_THRESHOLD_MAX            ( 4294967295UL )
-#define CFG_TDLS_TX_PACKET_THRESHOLD_DEFAULT        ( 100 )
+#define CFG_TDLS_TX_PACKET_THRESHOLD_DEFAULT        (40)
 
 #define CFG_TDLS_DISCOVERY_PERIOD                   "gTDLSDiscoveryPeriod"
 #define CFG_TDLS_DISCOVERY_PERIOD_MIN               ( 5000 )
@@ -1859,7 +1956,7 @@
 #define CFG_TDLS_MAX_DISCOVERY_ATTEMPT              "gTDLSMaxDiscoveryAttempt"
 #define CFG_TDLS_MAX_DISCOVERY_ATTEMPT_MIN          ( 1 )
 #define CFG_TDLS_MAX_DISCOVERY_ATTEMPT_MAX          ( 100 )
-#define CFG_TDLS_MAX_DISCOVERY_ATTEMPT_DEFAULT      ( 3 )
+#define CFG_TDLS_MAX_DISCOVERY_ATTEMPT_DEFAULT      (5)
 
 #define CFG_TDLS_IDLE_TIMEOUT                       "gTDLSIdleTimeout"
 #define CFG_TDLS_IDLE_TIMEOUT_MIN                   ( 2000 )
@@ -1937,6 +2034,12 @@
 #define CFG_TDLS_SCAN_ENABLE_MIN        (0)
 #define CFG_TDLS_SCAN_ENABLE_MAX        (2)
 #define CFG_TDLS_SCAN_ENABLE_DEFAULT    (0)
+
+#define CFG_TDLS_ENABLE_DEFER_TIMER           "gTDLSEnableDeferTime"
+#define CFG_TDLS_ENABLE_DEFER_TIMER_MIN       (2000)
+#define CFG_TDLS_ENABLE_DEFER_TIMER_MAX       (6000)
+#define CFG_TDLS_ENABLE_DEFER_TIMER_DEFAULT   (5000)
+
 #endif
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -1950,7 +2053,7 @@
 #define CFG_EXTSCAN_ENABLE                  "gEnableEXTScan"
 #define CFG_EXTSCAN_ENABLE_MIN              (0)
 #define CFG_EXTSCAN_ENABLE_MAX              (1)
-#define CFG_EXTSCAN_ENABLE_DEFAULT          (0)
+#define CFG_EXTSCAN_ENABLE_DEFAULT          (1)
 #endif
 
 #ifdef WLAN_ACTIVEMODE_OFFLOAD_FEATURE
@@ -2224,13 +2327,13 @@
 #define CFG_BTC_FAST_WLAN_CONN_PREF_MAX         ( 5 )
 
 #define CFG_BTC_STATIC_OPP_WLAN_IDLE_WLAN_LEN             "gBtcStaticOppWlanIdleWlanLen"
-#define CFG_BTC_STATIC_OPP_WLAN_IDLE_WLAN_LEN_DEFAULT     ( 40000 )
+#define CFG_BTC_STATIC_OPP_WLAN_IDLE_WLAN_LEN_DEFAULT     ( 30000 )
 #define CFG_BTC_STATIC_OPP_WLAN_IDLE_WLAN_LEN_MIN         ( 0 )
 #define CFG_BTC_STATIC_OPP_WLAN_IDLE_WLAN_LEN_MAX         ( 250000 )
 
 
 #define CFG_BTC_STATIC_OPP_WLAN_IDLE_BT_LEN             "gBtcStaticOppWlanIdleBtLen"
-#define CFG_BTC_STATIC_OPP_WLAN_IDLE_BT_LEN_DEFAULT     ( 40000 )
+#define CFG_BTC_STATIC_OPP_WLAN_IDLE_BT_LEN_DEFAULT     ( 120000 )
 #define CFG_BTC_STATIC_OPP_WLAN_IDLE_BT_LEN_MIN         ( 0 )
 #define CFG_BTC_STATIC_OPP_WLAN_IDLE_BT_LEN_MAX         ( 250000 )
 /*
@@ -2270,6 +2373,21 @@
 #define CFG_ROAMING_DFS_CHANNEL_MAX                 (1)
 #define CFG_ROAMING_DFS_CHANNEL_DEFAULT             (1)
 
+#define CFG_TCP_DELACK_COMPUTE_INTERVAL         "gTcpDelAckComputeInterval"
+#define CFG_TCP_DELACK_COMPUTE_INTERVAL_DEFAULT ( 2000 )
+#define CFG_TCP_DELACK_COMPUTE_INTERVAL_MIN     ( 1000 )
+#define CFG_TCP_DELACK_COMPUTE_INTERVAL_MAX     ( 10000 )
+
+#define CFG_TCP_DELACK_THRESHOLD_HIGH              "gTcpDelAckThresholdHigh"
+#define CFG_TCP_DELACK_THRESHOLD_HIGH_DEFAULT      ( 17000 )
+#define CFG_TCP_DELACK_THRESHOLD_HIGH_MIN          ( 1000 )
+#define CFG_TCP_DELACK_THRESHOLD_HIGH_MAX          ( 25000 )
+
+#define CFG_TCP_DELACK_THRESHOLD_LOW               "gTcpDelAckThresholdLow"
+#define CFG_TCP_DELACK_THRESHOLD_LOW_DEFAULT       ( 12000 )
+#define CFG_TCP_DELACK_THRESHOLD_LOW_MIN           ( 0 )
+#define CFG_TCP_DELACK_THRESHOLD_LOW_MAX           ( 25000 )
+
 
 #ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
 //Enable WLAN Logging to app space
@@ -2289,8 +2407,21 @@
 #define CFG_WLAN_LOGGING_NUM_BUF_MIN      ( 4  )
 #define CFG_WLAN_LOGGING_NUM_BUF_MAX      ( 64 )
 #define CFG_WLAN_LOGGING_NUM_BUF_DEFAULT  ( 32 )
+
+//Number of buffers to be used for WLAN logging
+#define CFG_WLAN_PKT_STATS_NUM_BUF_NAME     "wlanPerPktStatsNumBuf"
+#define CFG_WLAN_PKT_STATS_NUM_BUF_MIN      ( 4  )
+#define CFG_WLAN_PKT_STATS_NUM_BUF_MAX      ( 64 )
+#define CFG_WLAN_PKT_STATS_NUM_BUF_DEFAULT  ( 16 )
+
 #endif //WLAN_LOGGING_SOCK_SVC_ENABLE
 
+//Enable PerPKT stats Logging
+#define CFG_WLAN_PKT_STATS_LOGGING_NAME            "wlanPerPktStatsLogEnable"
+#define CFG_WLAN_PKT_STATS_LOGGING_ENABLE          ( 1 )
+#define CFG_WLAN_PKT_STATS_LOGGING_DISABLE         ( 0 )
+#define CFG_WLAN_PKT_STATS_LOGGING_DEFAULT         ( 1 )
+
 #define CFG_IGNORE_PEER_ERP_INFO_NAME      "gIgnorePeerErpInfo"
 #define CFG_IGNORE_PEER_ERP_INFO_MIN       ( 0 )
 #define CFG_IGNORE_PEER_ERP_INFO_MAX       ( 1 )
@@ -2370,7 +2501,12 @@
 #define CFG_DISABLE_P2P_MAC_ADDR_SPOOFING              "gDisableP2PMacAddrSpoof"
 #define CFG_DISABLE_P2P_MAC_ADDR_SPOOFING_MIN          (0)
 #define CFG_DISABLE_P2P_MAC_ADDR_SPOOFING_MAX          (1)
-#define CFG_DISABLE_P2P_MAC_ADDR_SPOOFING_DEFAULT      (0)
+#define CFG_DISABLE_P2P_MAC_ADDR_SPOOFING_DEFAULT      (1)
+
+#define CFG_ENABLE_FATAL_EVENT_TRIGGER                 "gEnableFatalEvent"
+#define CFG_ENABLE_FATAL_EVENT_TRIGGER_MIN             (0)
+#define CFG_ENABLE_FATAL_EVENT_TRIGGER_MAX             (1)
+#define CFG_ENABLE_FATAL_EVENT_TRIGGER_DEFAULT         (1)
 
 
 #define CFG_ENABLE_MGMT_LOGGING                         "gEnableMgmtLogging"
@@ -2529,6 +2665,25 @@
 #define CFG_TOGGLE_ARP_BDRATES_MAX         2
 #define CFG_TOGGLE_ARP_BDRATES_DEFAULT     0
 
+#define CFG_DISABLE_BAR_WAKEUP_HOST_NAME       "gDisableBarWakeUp"
+#define CFG_DISABLE_BAR_WAKEUP_HOST_MIN         0
+#define CFG_DISABLE_BAR_WAKEUP_HOST_MAX         1
+#define CFG_DISABLE_BAR_WAKEUP_HOST_DEFAULT     0
+
+
+/*
+ * gExtScanConcMode is used to manage EXT Scan during concurrency
+ * This can be useful during WFD session. To avoid glitches during WFD
+ * either ext scan has to be disabled or use split scan
+ * 0: Disable EXT Scan
+ * 1: Use Split scan
+ * 2: Enable EXT Scan
+ */
+#define CFG_EXT_SCAN_CONC_MODE                             "gExtScanConcMode"
+#define CFG_EXT_SCAN_CONC_MODE_MIN                          (0)
+#define CFG_EXT_SCAN_CONC_MODE_MAX                          (2)
+#define CFG_EXT_SCAN_CONC_MODE_DEFAULT                      (0)
+
 /*
  * If within gLinkFailTimeout period(values is mentioned in msec) if FW
  * doesn't receive acks for gLinkFailTxCnt number of packets, then link will
@@ -2550,16 +2705,135 @@
 #define CFG_OPTIMIZE_CA_EVENT_ENABLE     ( 1 )
 #define CFG_OPTIMIZE_CA_EVENT_DEFAULT    ( 0 )
 
+#define CFG_FWR_MEM_DUMP_NAME       "gEnableFwrMemDump"
+#define CFG_FWR_MEM_DUMP_MAX        ( 1 )
+#define CFG_FWR_MEM_DUMP_MIN        ( 0 )
+#define CFG_FWR_MEM_DUMP_DEF        ( 1 )
+
+#define CFG_ACTIVE_PASSIVE_CHAN_CONV_NAME "gActivePassiveChCon"
+#define CFG_ACTIVE_PASSIVE_CHAN_CONV_MIN  (0)
+#define CFG_ACTIVE_PASSIVE_CHAN_CONV_MAX  (1)
+#define CFG_ACTIVE_PASSIVE_CHAN_CONV_DEF  (1)
+
+#define CFG_WIFI_CONFIG_ENABLE                  "gEnableWifiConfig"
+#define CFG_WIFI_CONFIG_MIN                          (0)
+#define CFG_WIFI_CONFIG_MAX                          (1)
+#define CFG_WIFI_CONFIG_DEFAULT                      (1)
+
+#define CFG_MAXCHAN_FOR_CHANTIME_CORR_NAME       "gMaxChannelForMoreDwellTime"
+#define CFG_MAXCHAN_FOR_CHANTIME_CORR_MIN        (0)
+#define CFG_MAXCHAN_FOR_CHANTIME_CORR_MAX        (35)
+#define CFG_MAXCHAN_FOR_CHANTIME_CORR_DEFAULT    (10)
+
 /*
  * BOffsetCorrectionEnable : This ini will control enabling/disabling
  * of rate dependent power offsets in firmware
  */
-
 #define CFG_SAR_BOFFSET_SET_CORRECTION_NAME      "gBOffsetCorrectionEnable"
 #define CFG_SAR_BOFFSET_SET_CORRECTION_MIN       (0)
 #define CFG_SAR_BOFFSET_SET_CORRECTION_MAX       (1)
 #define CFG_SAR_BOFFSET_SET_CORRECTION_DEFAULT   (0)
 
+/*
+ * If gEnableEdcaParams is set to 1, params gEdcaVoCwmin,
+ * gEdcaViCwmin, gEdcaBkCwmin, gEdcaBeCwmin, gEdcaVoCwmax,
+ * gEdcaViCwmax, gEdcaBkCwmax, gEdcaBeCwmax, gEdcaVoAifs,
+ * gEdcaViAifs, gEdcaBkAifs and gEdcaBeAifs values are used
+ * to overwrite the values received from AP
+ */
+#define CFG_ENABLE_EDCA_INI_NAME       "gEnableEdcaParams"
+#define CFG_ENABLE_EDCA_INI_MIN        (0)
+#define CFG_ENABLE_EDCA_INI_MAX        (1)
+#define CFG_ENABLE_EDCA_INI_DEFAULT    (0)
+
+/* Cwmin value for EDCA_AC_VO. CWVomin = 2^gEdcaVoCwmin -1 */
+#define CFG_EDCA_VO_CWMIN_VALUE_NAME      "gEdcaVoCwmin"
+#define CFG_EDCA_VO_CWMIN_VALUE_MIN       (0x0)
+#define CFG_EDCA_VO_CWMIN_VALUE_MAX       (15)
+#define CFG_EDCA_VO_CWMIN_VALUE_DEFAULT   (2)
+
+/* Cwmin value for EDCA_AC_VI. CWVimin = 2^gEdcaViCwmin -1 */
+#define CFG_EDCA_VI_CWMIN_VALUE_NAME      "gEdcaViCwmin"
+#define CFG_EDCA_VI_CWMIN_VALUE_MIN       (0x0)
+#define CFG_EDCA_VI_CWMIN_VALUE_MAX       (15)
+#define CFG_EDCA_VI_CWMIN_VALUE_DEFAULT   (3)
+
+/* Cwmin value for EDCA_AC_BK. CWBkmin = 2^gEdcaBkCwmin -1 */
+#define CFG_EDCA_BK_CWMIN_VALUE_NAME      "gEdcaBkCwmin"
+#define CFG_EDCA_BK_CWMIN_VALUE_MIN       (0x0)
+#define CFG_EDCA_BK_CWMIN_VALUE_MAX       (15)
+#define CFG_EDCA_BK_CWMIN_VALUE_DEFAULT   (4)
+
+/* Cwmin value for EDCA_AC_BE. CWBemin = 2^gEdcaBeCwmin -1 */
+#define CFG_EDCA_BE_CWMIN_VALUE_NAME      "gEdcaBeCwmin"
+#define CFG_EDCA_BE_CWMIN_VALUE_MIN       (0x0)
+#define CFG_EDCA_BE_CWMIN_VALUE_MAX       (15)
+#define CFG_EDCA_BE_CWMIN_VALUE_DEFAULT   (4)
+
+/* Cwmax value for EDCA_AC_VO. CWVomax = 2^gEdcaVoCwmax -1 */
+#define CFG_EDCA_VO_CWMAX_VALUE_NAME      "gEdcaVoCwmax"
+#define CFG_EDCA_VO_CWMAX_VALUE_MIN       (0)
+#define CFG_EDCA_VO_CWMAX_VALUE_MAX       (15)
+#define CFG_EDCA_VO_CWMAX_VALUE_DEFAULT   (3)
+
+/* Cwmax value for EDCA_AC_VI. CWVimax = 2^gEdcaViCwmax -1 */
+#define CFG_EDCA_VI_CWMAX_VALUE_NAME      "gEdcaViCwmax"
+#define CFG_EDCA_VI_CWMAX_VALUE_MIN       (0)
+#define CFG_EDCA_VI_CWMAX_VALUE_MAX       (15)
+#define CFG_EDCA_VI_CWMAX_VALUE_DEFAULT   (4)
+
+/* Cwmax value for EDCA_AC_BK. CWBkmax = 2^gEdcaBkCwmax -1 */
+#define CFG_EDCA_BK_CWMAX_VALUE_NAME      "gEdcaBkCwmax"
+#define CFG_EDCA_BK_CWMAX_VALUE_MIN       (0)
+#define CFG_EDCA_BK_CWMAX_VALUE_MAX       (15)
+#define CFG_EDCA_BK_CWMAX_VALUE_DEFAULT   (10)
+
+/* Cwmax value for EDCA_AC_BE. CWBemax = 2^gEdcaBeCwmax -1 */
+#define CFG_EDCA_BE_CWMAX_VALUE_NAME      "gEdcaBeCwmax"
+#define CFG_EDCA_BE_CWMAX_VALUE_MIN       (0)
+#define CFG_EDCA_BE_CWMAX_VALUE_MAX       (15)
+#define CFG_EDCA_BE_CWMAX_VALUE_DEFAULT   (10)
+
+/* Aifs value for EDCA_AC_VO.*/
+#define CFG_EDCA_VO_AIFS_VALUE_NAME       "gEdcaVoAifs"
+#define CFG_EDCA_VO_AIFS_VALUE_MIN        (0)
+#define CFG_EDCA_VO_AIFS_VALUE_MAX        (15)
+#define CFG_EDCA_VO_AIFS_VALUE_DEFAULT    (2)
+
+/* Aifs value for EDCA_AC_VI.*/
+#define CFG_EDCA_VI_AIFS_VALUE_NAME       "gEdcaViAifs"
+#define CFG_EDCA_VI_AIFS_VALUE_MIN        (0)
+#define CFG_EDCA_VI_AIFS_VALUE_MAX        (15)
+#define CFG_EDCA_VI_AIFS_VALUE_DEFAULT    (2)
+
+/* Aifs value for EDCA_AC_BK.*/
+#define CFG_EDCA_BK_AIFS_VALUE_NAME       "gEdcaBkAifs"
+#define CFG_EDCA_BK_AIFS_VALUE_MIN        (0)
+#define CFG_EDCA_BK_AIFS_VALUE_MAX        (15)
+#define CFG_EDCA_BK_AIFS_VALUE_DEFAULT    (7)
+
+/* Aifs value for EDCA_AC_BE.*/
+#define CFG_EDCA_BE_AIFS_VALUE_NAME       "gEdcaBeAifs"
+#define CFG_EDCA_BE_AIFS_VALUE_MIN        (0)
+#define CFG_EDCA_BE_AIFS_VALUE_MAX        (15)
+#define CFG_EDCA_BE_AIFS_VALUE_DEFAULT    (3)
+
+/* If gSendMgmtPktViaWQ5 is enabled, mgmt packet will go via WQ5 */
+#define CFG_SEND_MGMT_PKT_VIA_WQ5_NAME    "gSendMgmtPktViaWQ5"
+#define CFG_SEND_MGMT_PKT_VIA_WQ5_MIN      ( 0 )
+#define CFG_SEND_MGMT_PKT_VIA_WQ5_MAX      ( 1)
+#define CFG_SEND_MGMT_PKT_VIA_WQ5_DEF      ( 0 )
+
+/*
+ * gSapProbeRespOffload: when set in sap, offloads the
+ * probe response transmission to firmware
+ */
+#define CFG_SAP_PROBE_RESP_OFFLOAD_NAME    "gSapProbeRespOffload"
+#define CFG_SAP_PROBE_RESP_OFFLOAD_MIN     (0)
+#define CFG_SAP_PROBE_RESP_OFFLOAD_MAX     (1)
+#define CFG_SAP_PROBE_RESP_OFFLOAD_DEFAULT (1)
+
+
 /*--------------------------------------------------------------------------- 
   Type declarations
   -------------------------------------------------------------------------*/ 
@@ -2776,6 +3050,15 @@
 #endif
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
    v_BOOL_t                     isRoamOffloadScanEnabled;
+   v_BOOL_t                     isPERRoamEnabled;
+   v_BOOL_t                     isPERRoamRxPathEnabled;
+   v_BOOL_t                     isPERRoamCCAEnabled;
+   v_U16_t                      rateUpThreshold;
+   v_U16_t                      rateDownThreshold;
+   v_U16_t                      PERroamTriggerPercent;
+   v_U32_t                      waitPeriodForNextPERScan;
+   v_U32_t                      PERtimerThreshold;
+   v_U32_t                      PERroamRxPktsThreshold;
 #endif
    hdd_wmm_classification_t     PktClassificationBasis; // DSCP or 802.1Q
    v_BOOL_t                     bImplicitQosEnabled;
@@ -3019,6 +3302,8 @@
    v_U32_t                     wlanLoggingEnable;
    v_U32_t                     wlanLoggingFEToConsole;
    v_U32_t                     wlanLoggingNumBuf;
+   v_U32_t                     wlanPerPktStatsLogEnable;
+   v_U32_t                     wlanPerPktStatsNumBuf;
 #endif
    v_BOOL_t                    ignorePeerErpInfo;
    v_BOOL_t                    initialScanSkipDFSCh;
@@ -3026,6 +3311,9 @@
    v_U32_t                     cfgBtcCriticalHidnSniffBlkGuidance;
    v_U32_t                     cfgBtcA2dpTxQueueThold;
    v_U32_t                     cfgBtcOppTxQueueThold;
+   v_U32_t                     tcpDelAckComputeInterval;
+   v_U32_t                     tcpDelAckThresholdHigh;
+   v_U32_t                     tcpDelAckThresholdLow;
 
 #ifdef WLAN_FEATURE_11W
    v_U32_t                     pmfSaQueryMaxRetries;
@@ -3035,6 +3323,7 @@
    v_BOOL_t                    sendDeauthBeforeCon;
    v_U8_t                      enableMacSpoofing;
    v_BOOL_t                    disableP2PMacSpoofing;
+   v_BOOL_t                    enableFatalEvent;
    v_BOOL_t                    enableMgmtLogging;
    v_BOOL_t                    enableBMUHWtracing;
    v_BOOL_t                    enableFWLogging;
@@ -3073,9 +3362,32 @@
    v_U32_t                     linkFailTxCnt;
    v_BOOL_t                    ignorePeerHTopMode;
    v_U8_t                      gOptimizeCAevent;
+   v_BOOL_t                    enableFwrMemDump;
+   v_U8_t                      gActivePassiveChCon;
+   v_U32_t                     cfgExtScanConcMode;
+   v_U16_t                     rps_mask;
+   v_BOOL_t                    fEnableWifiConfig;
    v_BOOL_t                    crash_inject_enabled;
-   v_U16_t                      rps_mask;
+   v_U32_t                     enable_delack;
+   v_BOOL_t                    disableBarWakeUp;
+   v_U8_t                      max_chan_for_dwell_time_cfg;
+   v_U16_t                     tdls_enable_defer_time;
    v_U8_t                      boffset_correction_enable;
+   uint32_t                    enable_edca_params;
+   uint32_t                    edca_vo_cwmin;
+   uint32_t                    edca_vi_cwmin;
+   uint32_t                    edca_bk_cwmin;
+   uint32_t                    edca_be_cwmin;
+   uint32_t                    edca_vo_cwmax;
+   uint32_t                    edca_vi_cwmax;
+   uint32_t                    edca_bk_cwmax;
+   uint32_t                    edca_be_cwmax;
+   uint32_t                    edca_vo_aifs;
+   uint32_t                    edca_vi_aifs;
+   uint32_t                    edca_bk_aifs;
+   uint32_t                    edca_be_aifs;
+   v_BOOL_t                    sendMgmtPktViaWQ5;
+   v_BOOL_t                    sap_probe_resp_offload;
 } hdd_config_t;
 
 /*--------------------------------------------------------------------------- 
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_cfg80211.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_cfg80211.h
index a2869a6..b673717 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_cfg80211.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_cfg80211.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -100,7 +100,7 @@
 #endif
 #endif
 
-#define MAX_CHANNEL MAX_2_4GHZ_CHANNEL + NUM_5GHZ_CHANNELS
+#define MAX_CHANNEL NUM_2_4GHZ_CHANNELS + NUM_5GHZ_CHANNELS
 
 typedef struct {
    u8 element_id;
@@ -149,9 +149,6 @@
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_FOUND = 28,
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_BSSID_HOTLIST = 29,
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_BSSID_HOTLIST = 30,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SIGNIFICANT_CHANGE = 31,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SIGNIFICANT_CHANGE = 32,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SIGNIFICANT_CHANGE = 33,
     /* EXT TDLS */
     QCA_NL80211_VENDOR_SUBCMD_TDLS_ENABLE = 34,
     QCA_NL80211_VENDOR_SUBCMD_TDLS_DISABLE = 35,
@@ -162,8 +159,35 @@
     QCA_NL80211_VENDOR_SUBCMD_MAC_OUI = 39,
     /* Set nodfs_flag */
     QCA_NL80211_VENDOR_SUBCMD_NO_DFS_FLAG = 40,
+
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_LOST = 41,
+
     /* Get Concurrency Matrix */
     QCA_NL80211_VENDOR_SUBCMD_GET_CONCURRENCY_MATRIX = 42,
+    /* Start Wifi Logger */
+    QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_START = 62,
+
+    /* Get Wifi Specific Info */
+    QCA_NL80211_VENDOR_SUBCMD_GET_WIFI_INFO = 61,
+    /* Start Wifi Memory Dump */
+    QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP = 63,
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST = 65,
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SSID_HOTLIST = 66,
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND = 67,
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST = 68,
+
+    /* Wi-Fi Configuration subcommands */
+    QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION = 74,
+    QCA_NL80211_VENDOR_SUBCMD_GET_WIFI_CONFIGURATION = 75,
+    QCA_NL80211_VENDOR_SUBCMD_GET_RING_DATA = 77,
+
+    QCA_NL80211_VENDOR_SUBCMD_MONITOR_RSSI = 80,
+
+    QCA_NL80211_VENDOR_SUBCMD_OFFLOADED_PACKETS = 79,
+
+    /* subcommand to get link properties */
+    QCA_NL80211_VENDOR_SUBCMD_LINK_PROPERTIES = 101,
+
     QCA_NL80211_VENDOR_SUBCMD_SETBAND = 105,
 };
 
@@ -188,12 +212,18 @@
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_FOUND_INDEX,
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_BSSID_HOTLIST_INDEX,
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_BSSID_HOTLIST_INDEX,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SIGNIFICANT_CHANGE_INDEX,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SIGNIFICANT_CHANGE_INDEX,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SIGNIFICANT_CHANGE_INDEX,
     /*EXT TDLS*/
     QCA_NL80211_VENDOR_SUBCMD_TDLS_STATE_CHANGE_INDEX,
     QCA_NL80211_VENDOR_SUBCMD_NAN_INDEX,
+    QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP_INDEX,
+
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST_INDEX,
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SSID_HOTLIST_INDEX,
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND_INDEX,
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST_INDEX,
+
+    QCA_NL80211_VENDOR_SUBCMD_MONITOR_RSSI_INDEX,
+    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_LOST_INDEX,
 };
 
 enum qca_wlan_vendor_attr
@@ -602,22 +632,22 @@
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_INVALID = 0,
 
     /* Unsigned 32-bit value; Middleware provides it to the driver. Middle ware
-      * either gets it from caller, e.g., framework, or generates one if
-      * framework doesn't provide it.
-      */
+     * either gets it from caller, e.g., framework, or generates one if
+     * framework doesn't provide it.
+     */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID,
 
     /* NL attributes for data used by
-      * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_GET_VALID_CHANNELS sub command.
-      */
+     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_GET_VALID_CHANNELS sub command.
+     */
     /* Unsigned 32-bit value */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_WIFI_BAND,
     /* Unsigned 32-bit value */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_MAX_CHANNELS,
 
     /* NL attributes for input params used by
-      * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_START sub command.
-      */
+     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_START sub command.
+     */
 
     /* Unsigned 32-bit value; channel frequency */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_CHANNEL,
@@ -636,35 +666,35 @@
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_PERIOD,
     /* Unsigned 8-bit value; report events semantics. */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_REPORT_EVENTS,
-    /* Unsigned 32-bit value. Followed by a nested array of
-     * EXTSCAN_CHANNEL_SPECS attributes.
-      */
+    /* Unsigned 32-bit value.
+     * Followed by a nested array of EXTSCAN_CHANNEL_SPEC_* attributes.
+     */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS,
 
     /* Array of QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_* attributes.
-      * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS
-      */
+     * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS
+     */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC,
 
     /* Unsigned 32-bit value; base timer period in ms. */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_BASE_PERIOD,
     /* Unsigned 32-bit value; number of APs to store in each scan in the
-      * BSSID/RSSI history buffer (keep the highest RSSI APs).
-      */
+     * BSSID/RSSI history buffer (keep the highest RSSI APs).
+     */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_MAX_AP_PER_SCAN,
-    /* Unsigned 8-bit value; In %, when scan buffer is this much full, wake up
-      * APPS.
-      */
-    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD,
+    /* Unsigned 8-bit value; in %, when scan buffer is this much full, wake up
+     * APPS.
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_PERCENT,
     /* Unsigned 8-bit value; number of scan bucket specs; followed by a nested
-      * array of_EXTSCAN_BUCKET_SPEC_* attributes and values. The size of the
-      * array is determined by NUM_BUCKETS.
-      */
+     * array of_EXTSCAN_BUCKET_SPEC_* attributes and values. The size of the
+     * array is determined by NUM_BUCKETS.
+     */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS,
 
     /* Array of QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_* attributes.
-      * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS
-      */
+     * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS
+     */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC,
 
     /* Unsigned 8-bit value */
@@ -681,16 +711,15 @@
     /* Unsigned 32-bit value */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_CHANNEL,
 
-
     /* Number of hotlist APs as unsigned 32-bit value, followed by a nested
      * array of AP_THRESHOLD_PARAM attributes and values. The size of the
      * array is determined by NUM_AP.
-      */
+     */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_NUM_AP,
 
     /* Array of QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_* attributes.
-      * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS
-      */
+     * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS
+     */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM,
 
     /* Unsigned 32bit value; number of samples for averaging RSSI. */
@@ -700,15 +729,58 @@
     /* Unsigned 32bit value; number of APs breaching threshold. */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_MIN_BREACHING,
     /* Unsigned 32bit value; number of APs. Followed by an array of
-      * AP_THRESHOLD_PARAM attributes. Size of the array is NUM_AP.
-      */
+     * AP_THRESHOLD_PARAM attributes. Size of the array is NUM_AP.
+     */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP,
+    /* Unsigned 32bit value; number of samples to confirm AP loss. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_LOST_AP_SAMPLE_SIZE,
+
+    /* Unsigned 32-bit value. If max_period is non zero or different than
+     * period, then this bucket is an exponential backoff bucket.
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_MAX_PERIOD,
+    /* Unsigned 32-bit value. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_EXPONENT,
+    /* Unsigned 32-bit value. For exponential back off bucket, number of scans
+     * performed at a given period and until the exponent is applied.
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_STEP_COUNT,
+    /* Unsigned 8-bit value; in number of scans, wake up AP after these
+     * many scans.
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_NUM_SCANS,
+
+    /* NL attributes for data used by
+     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST sub command.
+     */
+    /* Unsigned 32bit value; number of samples to confirm SSID loss. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_LOST_SSID_SAMPLE_SIZE,
+    /* Number of hotlist SSIDs as unsigned 32-bit value, followed by a nested
+     * array of SSID_THRESHOLD_PARAM_* attributes and values. The size of the
+     * array is determined by NUM_SSID.
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_NUM_SSID,
+    /* Array of QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_* attributes.
+     * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_NUM_SSID
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM,
+
+    /* An array of 33 x Unsigned 8-bit value; NULL terminated SSID */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_SSID,
+    /* Unsigned 8-bit value */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_BAND,
+    /* Signed 32-bit value */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_LOW,
+    /* Signed 32-bit value */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_HIGH,
+
+    /* Unsigned 32-bit value; a bitmask w/additional extscan config flag. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_CONFIGURATION_FLAGS,
 
     /* keep last */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_AFTER_LAST,
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX =
         QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_AFTER_LAST - 1,
-
 };
 
 enum qca_wlan_vendor_attr_extscan_results
@@ -746,7 +818,7 @@
     /* Signed 32bit value */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SCAN_REPORTING_THRESHOLD,
     /* Unsigned 32bit value */
-    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_HOTLIST_APS,
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_HOTLIST_BSSIDS,
     /* Unsigned 32bit value */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SIGNIFICANT_WIFI_CHANGE_APS,
     /* Unsigned 32bit value */
@@ -802,30 +874,35 @@
       */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_MORE_DATA,
 
+    /* Use attr QCA_WLAN_VENDOR_ATTR_EXTSCAN_NUM_RESULTS_AVAILABLE
+     * to indicate number of wifi scan results/bssids retrieved by the scan.
+     * Also, use QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_LIST to indicate the list
+     * of wifi scan results returned for each cached result block.
+     */
+
     /* EXTSCAN attributes for
-      * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SCAN_EVENT sub-command.
-      */
+     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SCAN_EVENT sub-command.
+     */
     /* Unsigned 8-bit value */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_EVENT_TYPE,
     /* Unsigned 32-bit value */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_EVENT_STATUS,
 
     /* EXTSCAN attributes for
-      * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_FOUND sub-command.
-      */
-    /* Use attr QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE
-      * to indicate number of results.
-      */
+     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_FOUND sub-command.
+     */
+    /* Use attr QCA_WLAN_VENDOR_ATTR_EXTSCAN_NUM_RESULTS_AVAILABLE
+     * to indicate number of results.
+     */
 
     /* EXTSCAN attributes for
-      * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SIGNIFICANT_CHANGE sub-command.
-      */
+     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SIGNIFICANT_CHANGE sub-command.
+     */
     /* An array of 6 x Unsigned 8-bit value */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SIGNIFICANT_CHANGE_RESULT_BSSID,
     /* Unsigned 32-bit value */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SIGNIFICANT_CHANGE_RESULT_CHANNEL,
-    /* Unsigned 32-bit value  - followed by a nested array of signed 32-bit
-      * RSSI values. Size of the array is determined by NUM_RSSI.
+    /* Unsigned 32-bit value.
       */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SIGNIFICANT_CHANGE_RESULT_NUM_RSSI,
     /* A nested array of signed 32-bit RSSI values. Size of the array is
@@ -833,6 +910,80 @@
      */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SIGNIFICANT_CHANGE_RESULT_RSSI_LIST,
 
+    /* EXTSCAN attributes used with
+     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_GET_CACHED_RESULTS sub-command.
+     */
+    /* Use attr QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE
+     * to indicate number of gscan cached results returned.
+     * Also, use QCA_WLAN_VENDOR_ATTR_EXTSCAN_CACHED_RESULTS_LIST to indicate
+     *  the list of gscan cached results.
+     */
+
+    /* An array of NUM_RESULTS_AVAILABLE x
+     * QCA_NL80211_VENDOR_ATTR_EXTSCAN_CACHED_RESULTS_*
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_CACHED_RESULTS_LIST,
+    /* Unsigned 32-bit value; a unique identifier for the scan unit. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_CACHED_RESULTS_SCAN_ID,
+    /* Unsigned 32-bit value; a bitmask w/additional information about scan. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_CACHED_RESULTS_FLAGS,
+    /* Use attr QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE
+     * to indicate number of wifi scan results/bssids retrieved by the scan.
+     * Also, use QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_LIST to indicate the list
+     * of wifi scan results returned for each cached result block.
+     */
+
+    /* EXTSCAN attributes for
+     * QCA_NL80211_VENDOR_SUBCMD_PNO_NETWORK_FOUND sub-command.
+     */
+    /* Use QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE for number
+     * of results.
+     * Use QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_LIST to indicate the nested
+     * list of wifi scan results returned for each wifi_passpoint_match_result block.
+     * Array size: QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE.
+     */
+
+    /* EXTSCAN attributes for
+     * QCA_NL80211_VENDOR_SUBCMD_PNO_PASSPOINT_NETWORK_FOUND sub-command.
+     */
+    /* Unsigned 32-bit value */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_PNO_RESULTS_PASSPOINT_NETWORK_FOUND_NUM_MATCHES,
+    /* A nested array of
+     * QCA_WLAN_VENDOR_ATTR_EXTSCAN_PNO_RESULTS_PASSPOINT_MATCH_*
+     * attributes. Array size =
+     * *_ATTR_EXTSCAN_PNO_RESULTS_PASSPOINT_NETWORK_FOUND_NUM_MATCHES.
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_PNO_RESULTS_PASSPOINT_MATCH_RESULT_LIST,
+
+    /* Unsigned 32-bit value; network block id for the matched network */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_PNO_RESULTS_PASSPOINT_MATCH_ID,
+    /* Use QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_LIST to indicate the nested
+     * list of wifi scan results returned for each wifi_passpoint_match_result block.
+     */
+    /* Unsigned 32-bit value */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_PNO_RESULTS_PASSPOINT_MATCH_ANQP_LEN,
+    /* An array size of PASSPOINT_MATCH_ANQP_LEN of unsigned 8-bit values;
+     * ANQP data in the information_element format.
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_PNO_RESULTS_PASSPOINT_MATCH_ANQP,
+
+    /* Unsigned 32bit value; a EXTSCAN Capabilities attribute. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_HOTLIST_SSIDS,
+    /* Unsigned 32bit value; a EXTSCAN Capabilities attribute. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_NUM_EPNO_NETS,
+    /* Unsigned 32bit value; a EXTSCAN Capabilities attribute. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_NUM_EPNO_NETS_BY_SSID,
+    /* Unsigned 32bit value; a EXTSCAN Capabilities attribute. */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_NUM_WHITELISTED_SSID,
+
+    /* EXTSCAN attributes for
+     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND sub-command &
+     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST sub-command
+     */
+    /* Use attr QCA_WLAN_VENDOR_ATTR_EXTSCAN_NUM_RESULTS_AVAILABLE
+     * to indicate number of results.
+     */
+
     /* keep last */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_AFTER_LAST,
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_MAX =
@@ -849,6 +1000,20 @@
         QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI_AFTER_LAST - 1,
 };
 
+/* NL attributes for data used by
+ * QCA_NL80211_VENDOR_SUBCMD_GET_WIFI_INFO sub command.
+ */
+enum qca_wlan_vendor_attr_get_wifi_info {
+    QCA_WLAN_VENDOR_ATTR_WIFI_INFO_GET_INVALID = 0,
+    QCA_WLAN_VENDOR_ATTR_WIFI_INFO_DRIVER_VERSION     = 1,
+    QCA_WLAN_VENDOR_ATTR_WIFI_INFO_FIRMWARE_VERSION   = 2,
+
+    /* keep last */
+    QCA_WLAN_VENDOR_ATTR_WIFI_INFO_GET_AFTER_LAST,
+    QCA_WLAN_VENDOR_ATTR_WIFI_INFO_GET_MAX  =
+        QCA_WLAN_VENDOR_ATTR_WIFI_INFO_GET_AFTER_LAST - 1,
+};
+
 enum qca_wlan_vendor_attr_get_supported_features {
     QCA_WLAN_VENDOR_ATTR_FEATURE_SET_INVALID = 0,
     /* Unsigned 32-bit value */
@@ -878,6 +1043,68 @@
         QCA_WLAN_VENDOR_ATTR_GET_CONCURRENCY_MATRIX_AFTER_LAST - 1,
 };
 
+/**
+ * enum qca_wlan_vendor_attr_wifi_logger_start - Enum for wifi logger starting
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_INVALID: Invalid attribute
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_RING_ID: Ring ID
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_VERBOSE_LEVEL: Verbose level
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_FLAGS: Flag
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_AFTER_LAST: Last value
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_MAX: Max value
+ */
+enum qca_wlan_vendor_attr_wifi_logger_start {
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_INVALID = 0,
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_RING_ID = 1,
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_VERBOSE_LEVEL = 2,
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_FLAGS = 3,
+    /* keep last */
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_AFTER_LAST,
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_MAX =
+       QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_AFTER_LAST - 1,
+};
+
+/* NL attributes for data used by
+ * QCA_NL80211_VENDOR_SUBCMD_LINK_PROPERTIES.
+ */
+enum qca_wlan_vendor_attr_link_properties {
+    QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_INVALID    = 0,
+    /* Unsigned 8bit value for specifying nof spatial streams */
+    QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_NSS        = 1,
+    /* Unsigned 8bit value for the rate flags */
+    QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_RATE_FLAGS = 2,
+    /* Unsigned 32bit value for operating frequency */
+    QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_FREQ       = 3,
+
+    /* KEEP LAST */
+    QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_AFTER_LAST,
+    QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_MAX =
+    QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_AFTER_LAST - 1,
+};
+
+/**
+ * enum qca_wlan_vendor_config: wifi config attr
+ *
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_INVALID: invalid config
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_MODULATED_DTIM: dynamic dtim
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR: stats avg. factor
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME: guard time
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_LAST: last config
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_MAX: max config
+ */
+enum qca_wlan_vendor_config {
+    QCA_WLAN_VENDOR_ATTR_CONFIG_INVALID = 0,
+    QCA_WLAN_VENDOR_ATTR_CONFIG_MODULATED_DTIM,
+    QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR,
+    QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME,
+    QCA_WLAN_VENDOR_ATTR_CONFIG_FINE_TIME_MEASUREMENT,
+    QCA_WLAN_VENDOR_ATTR_CONFIG_TX_RATE,
+    QCA_WLAN_VENDOR_ATTR_CONFIG_PENALIZE_AFTER_NCONS_BEACON_MISS,
+    /* keep last */
+    QCA_WLAN_VENDOR_ATTR_CONFIG_LAST,
+    QCA_WLAN_VENDOR_ATTR_CONFIG_MAX =
+    QCA_WLAN_VENDOR_ATTR_CONFIG_LAST - 1
+};
+
 /* Feature defines */
 #define WIFI_FEATURE_INFRA              0x0001   /* Basic infrastructure mode */
 #define WIFI_FEATURE_INFRA_5G           0x0002   /* Support for 5 GHz Band */
@@ -901,6 +1128,13 @@
                                                     Concurrency */
 #define WIFI_FEATURE_LINK_LAYER_STATS   0x10000  /* Link layer stats */
 
+#define WIFI_FEATURE_RTT3               0x20000  /* RTT3 */
+
+/* WIFI CONFIG Parameter defines */
+#define WIFI_CONFIG_SET_AVG_STATS_FACTOR 0x0001  /* Average stats factor */
+#define WIFI_CONFIG_SET_GUARD_TIME      0x0002  /* Guard Time */
+#define WIFI_CONFIG_SET_BCNMISS_PENALTY_COUNT 0x0001 /* BCNMISS_PENALTY_COUNT */
+
 /* Add more features here */
 enum qca_wlan_vendor_attr_set_no_dfs_flag
 {
@@ -912,6 +1146,21 @@
     QCA_WLAN_VENDOR_ATTR_SET_NO_DFS_FLAG_MAX =
         QCA_WLAN_VENDOR_ATTR_SET_NO_DFS_FLAG_AFTER_LAST - 1,
 };
+/*
+ * enum qca_wlan_vendor_attr_wifi_logger_get_ring_data - Get ring data
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_INVALID: Invalid attribute
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_ID: Ring ID
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_AFTER_LAST: Last value
+ * @QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_MAX: Max value
+ */
+enum qca_wlan_vendor_attr_wifi_logger_get_ring_data {
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_INVALID = 0,
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_ID = 1,
+    /* keep last */
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_AFTER_LAST,
+    QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_MAX =
+        QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_AFTER_LAST - 1,
+};
 
 
 /* Vendor id to be used in vendor specific command and events
@@ -920,7 +1169,6 @@
  */
 #define QCA_NL80211_VENDOR_ID                0x001374
 
-
 #ifdef FEATURE_WLAN_CH_AVOID
 #define HDD_MAX_AVOID_FREQ_RANGES   15
 typedef struct sHddAvoidFreqRange
@@ -936,6 +1184,93 @@
 } tHddAvoidFreqList;
 #endif /* FEATURE_WLAN_CH_AVOID */
 
+
+/**
+ * enum qca_wlan_rssi_monitoring_control - rssi control commands
+ * @QCA_WLAN_RSSI_MONITORING_CONTROL_INVALID: invalid
+ * @QCA_WLAN_RSSI_MONITORING_START: rssi monitoring start
+ * @QCA_WLAN_RSSI_MONITORING_STOP: rssi monitoring stop
+ */
+enum qca_wlan_rssi_monitoring_control {
+        QCA_WLAN_RSSI_MONITORING_CONTROL_INVALID = 0,
+        QCA_WLAN_RSSI_MONITORING_START,
+        QCA_WLAN_RSSI_MONITORING_STOP,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_rssi_monitoring - rssi monitoring
+ * @QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_INVALID: Invalid
+ * @QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_CONTROL: control
+ * @QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_MAX_RSSI: max rssi
+ * @QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_MIN_RSSI: min rssi
+ * @QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_CUR_BSSID: current bssid
+ * @QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_CUR_RSSI: current rssi
+ * @QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_AFTER_LAST: after last
+ * @QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_MAX: max
+ */
+enum qca_wlan_vendor_attr_rssi_monitoring {
+        QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_INVALID = 0,
+
+        QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_CONTROL,
+        QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_REQUEST_ID,
+
+        QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_MAX_RSSI,
+        QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_MIN_RSSI,
+
+        /* attributes to be used/received in callback */
+        QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_CUR_BSSID,
+        QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_CUR_RSSI,
+
+        /* keep last */
+        QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_AFTER_LAST,
+        QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_MAX =
+                QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_AFTER_LAST - 1,
+};
+
+#ifdef WLAN_FEATURE_OFFLOAD_PACKETS
+/**
+ * enum wlan_offloaded_packets_control - control commands
+ * @WLAN_START_OFFLOADED_PACKETS: start offloaded packets
+ * @WLAN_STOP_OFFLOADED_PACKETS: stop offloaded packets
+ *
+ */
+enum wlan_offloaded_packets_control
+{
+    WLAN_START_OFFLOADED_PACKETS = 1,
+    WLAN_STOP_OFFLOADED_PACKETS  = 2
+};
+
+/**
+ * enum qca_wlan_vendor_attr_offloaded_packets - offloaded packets
+ * @QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_INVALID: invalid
+ * @QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_SENDING_CONTROL: control
+ * @QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_REQUEST_ID: request id
+ * @QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_IP_PACKET_DATA: ip packet data
+ * @QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_SRC_MAC_ADDR: src mac address
+ * @QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_DST_MAC_ADDR: destination mac address
+ * @QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_PERIOD: period in milli seconds
+ * @QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_AFTER_LAST: after last
+ * @QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_MAX: max
+ */
+enum qca_wlan_vendor_attr_offloaded_packets
+{
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_INVALID = 0,
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_SENDING_CONTROL,
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_REQUEST_ID,
+
+    /* Packet in hex format */
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_IP_PACKET_DATA,
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_SRC_MAC_ADDR,
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_DST_MAC_ADDR,
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_PERIOD,
+
+    /* keep last */
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_AFTER_LAST,
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_MAX =
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_AFTER_LAST - 1,
+};
+#endif
+
 struct cfg80211_bss* wlan_hdd_cfg80211_update_bss_db( hdd_adapter_t *pAdapter,
                                       tCsrRoamInfo *pRoamInfo
                                       );
@@ -1026,8 +1361,16 @@
                                       void *pMsg);
 #endif /* WLAN_FEATURE_EXTSCAN */
 
+void hdd_rssi_threshold_breached_cb(void *hddctx,
+                                 struct rssi_breach_event *data);
+
 void wlan_hdd_cfg80211_nan_init(hdd_context_t *pHddCtx);
 
+#ifdef FEATURE_OEM_DATA_SUPPORT
+void wlan_hdd_cfg80211_oemdata_callback(void *ctx, const tANI_U16 evType,
+                                      void *pMsg,  tANI_U32 evLen);
+#endif /* FEATURE_OEM_DATA_SUPPORT */
+
 #if !(defined (SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC))
 static inline struct sk_buff *
 backported_cfg80211_vendor_event_alloc(struct wiphy *wiphy,
@@ -1042,4 +1385,49 @@
 #define cfg80211_vendor_event_alloc backported_cfg80211_vendor_event_alloc
 #endif
 
+/**
+ * enum qca_wlan_vendor_attr_memory_dump - values for memory dump attributes
+ * @QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_INVALID - Invalid
+ * @QCA_WLAN_VENDOR_ATTR_REQUEST_ID - Indicate request ID
+ * @QCA_WLAN_VENDOR_ATTR_MEMDUMP_SIZE - Indicate size of the memory dump
+ * @QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_AFTER_LAST - To keep track of the last enum
+ * @QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_MAX - max value possible for this type
+ *
+ * enum values are used for NL attributes for data used by
+ * QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP sub command.
+ */
+enum qca_wlan_vendor_attr_memory_dump {
+    QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_INVALID = 0,
+    QCA_WLAN_VENDOR_ATTR_REQUEST_ID = 1,
+    QCA_WLAN_VENDOR_ATTR_MEMDUMP_SIZE = 2,
+
+    QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_AFTER_LAST,
+    QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_MAX =
+    QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_AFTER_LAST - 1,
+};
+
+#if defined(CFG80211_DISCONNECTED_V2) || \
+(LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0))
+static inline void wlan_hdd_cfg80211_indicate_disconnect(struct net_device *dev,
+                                                         bool locally_generated,
+                                                         int reason)
+{
+    cfg80211_disconnected(dev, reason, NULL, 0,
+                          locally_generated, GFP_KERNEL);
+}
+#else
+static inline void wlan_hdd_cfg80211_indicate_disconnect(struct net_device *dev,
+                                                         bool locally_generated,
+                                                         int reason)
+{
+    cfg80211_disconnected(dev, reason, NULL, 0,
+                          GFP_KERNEL);
+}
+#endif
+
+struct cfg80211_bss* wlan_hdd_cfg80211_update_bss_list(
+   hdd_adapter_t *pAdapter, tSirMacAddr bssid);
+
+struct cfg80211_bss *wlan_hdd_cfg80211_inform_bss_frame(hdd_adapter_t *pAdapter,
+		tSirBssDescription *bss_desc);
 #endif
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_ftm.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_ftm.h
index a28f178..7c7fa9c 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_ftm.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_ftm.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -64,6 +64,7 @@
 #define WE_ENABLE_DPD        12
 #define WE_SET_CB            13
 #define WE_TX_CW_RF_GEN      14
+#define WE_SET_POWER_INDEX   15
 
 /* Private ioctls and their sub-ioctls */
 #define WLAN_FTM_PRIV_SET_NONE_GET_INT    (SIOCIWFIRSTPRIV + 1)
@@ -97,6 +98,7 @@
 
 #define WLAN_FTM_PRIV_SET_VAR_INT_GET_NONE   (SIOCIWFIRSTPRIV + 7)
 #define WE_SET_TX_WF_GAIN  1
+#define WE_SET_DUMP        2
 
 #define WE_FTM_MAX_STR_LEN 1024
 #define MAX_FTM_VAR_ARGS  7
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_host_offload.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_host_offload.h
index 4eb1176..07d609b 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_host_offload.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_host_offload.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -60,5 +60,15 @@
     v_MACADDR_t bssId;
 } tHostOffloadRequest, *tpHostOffloadRequest;
 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+void hdd_wlan_offload_event(uint8_t type, uint8_t state);
+#else
+static inline
+void hdd_wlan_offload_event(uint8_t type, uint8_t state)
+{
+    return;
+}
+#endif /* FEATURE_WLAN_DIAG_SUPPORT */
+
 #endif // __WLAN_HDD_HOST_OFFLOAD_H__
 
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_main.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_main.h
index f0e0e79..f989f5a 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_main.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_main.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -63,6 +63,8 @@
 #endif
 #include "wlan_hdd_cfg80211.h"
 
+#include <linux/proc_fs.h> /* Necessary because we use the proc fs */
+#include <linux/fs.h>
 /*--------------------------------------------------------------------------- 
   Preprocessor definitions and constants
   -------------------------------------------------------------------------*/
@@ -234,6 +236,9 @@
 #define MIN(a, b) (a > b ? b : a)
 
 #endif
+
+#define WLAN_WAIT_TIME_EXTSCAN  1000
+
 /*
  * Generic asynchronous request/response support
  *
@@ -290,7 +295,7 @@
 #define FW_STATS_CONTEXT_MAGIC  0x5022474E //FW STATS
 #define GET_FRAME_LOG_MAGIC   0x464c4f47   //FLOG
 #define MON_MODE_MSG_MAGIC 0x51436B3A //MON_MODE
-
+#define ANTENNA_CONTEXT_MAGIC 0x414E544E //ANTN
 #define MON_MODE_MSG_TIMEOUT 5000
 #define MON_MODE_START 1
 #define MON_MODE_STOP  0
@@ -649,6 +654,9 @@
   struct sk_buff *skb;
   hdd_remain_on_chan_ctx_t* remain_on_chan_ctx;
   eP2PActionFrameState actionFrmState;
+  /*is_go_neg_ack_received flag is set to 1 when the
+    pending ack for GO negotiation req is received*/
+  v_BOOL_t is_go_neg_ack_received;
 }hdd_cfg80211_state_t;
 
 
@@ -658,6 +666,7 @@
     HDD_SSR_DISABLED,
 }e_hdd_ssr_required;
 
+#ifdef WLAN_FEATURE_RMC
 /*---------------------------------------------------------------------------
   hdd_ibss_peer_info_params_t
 ---------------------------------------------------------------------------*/
@@ -716,6 +725,7 @@
     /** Peer Info parameters */
     hdd_ibss_peer_info_params_t  ibssPeerList[HDD_MAX_NUM_IBSS_STA];
 }hdd_ibss_peer_info_t;
+#endif
 
 struct hdd_station_ctx
 {
@@ -744,8 +754,9 @@
 
    /*Save the wep/wpa-none keys*/
    tCsrRoamSetKey ibss_enc_key;
-
+#ifdef WLAN_FEATURE_RMC
    hdd_ibss_peer_info_t ibss_peer_info;
+#endif
 
    v_BOOL_t hdd_ReassocScenario;
 
@@ -871,6 +882,19 @@
 
 }hdd_scaninfo_t;
 
+typedef struct
+{
+    struct wiphy *wiphy;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+    struct net_device *dev;
+#endif
+    struct cfg80211_scan_request *scan_request;
+    int magic;
+    int attempt;
+    int reject;
+    struct delayed_work scan_work;
+}scan_context_t;
+
 /* Changing value from 10 to 240, as later is
    supported by wcnss */
 #define WLAN_HDD_MAX_MC_ADDR_LIST 240
@@ -1025,6 +1049,11 @@
    struct completion tdls_link_establish_req_comp;
    eHalStatus tdlsAddStaStatus;
 #endif
+
+#ifdef WLAN_FEATURE_RMC
+   struct completion ibss_peer_info_comp;
+#endif /* WLAN_FEATURE_RMC */
+
    /* Track whether the linkup handling is needed  */
    v_BOOL_t isLinkUpSvcNeeded;
 
@@ -1136,6 +1165,7 @@
 #endif
    /* Flag to ensure PSB is configured through framework */
    v_U8_t psbChanged;
+   v_ULONG_t prev_rx_packets;
    /* UAPSD psb value configured through framework */
    v_U8_t configuredPsb;
    v_BOOL_t is_roc_inprogress;
@@ -1157,6 +1187,12 @@
 
    /* Time stamp for start RoC request */
    v_TIME_t startRocTs;
+
+   /* Wireless statistics */
+   struct iw_statistics iwStats;
+
+   /* Currently used antenna Index*/
+   int antennaIndex;
 };
 
 #define WLAN_HDD_GET_STATION_CTX_PTR(pAdapter) (&(pAdapter)->sessionCtx.station)
@@ -1212,8 +1248,41 @@
    struct mutex macSpoofingLock;
 }macAddrSpoof_t;
 
-#define WLAN_WAIT_TIME_LL_STATS 5000
+#define WLAN_WAIT_TIME_LL_STATS 800
 
+/* FW memory dump feature
+@TODO : Move this code to a separate file later */
+#define PROCFS_MEMDUMP_DIR  "debug"
+#define PROCFS_MEMDUMP_NAME "fwdump"
+#define FW_MEM_DUMP_REQ_ID 1
+#define FW_MEM_DUMP_TIMEOUT_MS 800
+#define FW_MEM_DUMP_MAGIC 0x3C3A2D44
+
+/**
+ * struct hdd_fw_mem_dump_req_ctx - hdd fw mem dump req context
+ *
+ * @magic : magic for validating cfg80211 requests
+ * @status: status for cfg80211 requests
+ * @pHDDCtx: ptr to HDD context
+ * @req_completion: completion variable for fw mem dump
+ */
+struct hdd_fw_mem_dump_req_ctx {
+   uint32_t magic;
+   bool status;
+   struct completion req_completion;
+};
+
+/**
+ * callback type to check fw mem dump request.Called from SVC
+ * context and update status in HDD.
+ */
+typedef void (*hdd_fw_mem_dump_req_cb)(struct hdd_fw_mem_dump_req_ctx *);
+
+int memdump_init(void);
+int memdump_deinit(void);
+void wlan_hdd_fw_mem_dump_cb(void *,tAniFwrDumpRsp *);
+int wlan_hdd_fw_mem_dump_req(hdd_context_t * pHddCtx);
+void wlan_hdd_fw_mem_dump_req_cb(struct hdd_fw_mem_dump_req_ctx*);
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
 /**
  * struct hdd_ll_stats_context - hdd link layer stats context
@@ -1228,6 +1297,49 @@
     struct completion response_event;
 };
 #endif /* End of WLAN_FEATURE_LINK_LAYER_STATS */
+#ifdef WLAN_FEATURE_EXTSCAN
+/**
+ * struct hdd_ext_scan_context - hdd ext scan context
+ *
+ * @request_id: userspace-assigned ID associated with the request
+ * @response_status: Status returned by FW in response to a request
+ * @ignore_cached_results: Flag to ignore cached results or not
+ * @capability_response: Ext scan capability response data from target
+ */
+
+struct hdd_ext_scan_context {
+    v_U32_t request_id;
+    int response_status;
+    bool ignore_cached_results;
+    struct completion response_event;
+    tSirEXTScanCapabilitiesEvent capability_response;
+};
+#endif /* End of WLAN_FEATURE_EXTSCAN */
+
+#ifdef WLAN_FEATURE_OFFLOAD_PACKETS
+/**
+ * struct hdd_offloaded_packets - request id to pattern id mapping
+ * @request_id: request id
+ * @pattern_id: pattern id
+ *
+ */
+struct hdd_offloaded_packets
+{
+    uint32_t request_id;
+    uint8_t  pattern_id;
+};
+
+/**
+ * struct hdd_offloaded_packets_ctx - offloaded packets context
+ * @op_table: request id to pattern id table
+ * @op_lock: mutex lock
+ */
+struct hdd_offloaded_packets_ctx
+{
+    struct hdd_offloaded_packets op_table[MAXNUM_PERIODIC_TX_PTRNS];
+    struct mutex op_lock;
+};
+#endif
 
 /** Adapter stucture definition */
 
@@ -1333,6 +1445,15 @@
 #ifdef WLAN_KD_READY_NOTIFIER
    v_BOOL_t kd_nl_init;
 #endif /* WLAN_KD_READY_NOTIFIER */
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+   /* OEM App registered or not */
+   v_BOOL_t oem_app_registered;
+
+   /* OEM App Process ID */
+   v_SINT_t oem_pid;
+#endif
+
    v_U8_t change_iface;
 
    /** Concurrency Parameters*/
@@ -1381,10 +1502,9 @@
     tdlsConnInfo_t tdlsConnInfo[HDD_MAX_NUM_TDLS_STA];
     /* TDLS peer connected count */
     tANI_U16 connected_peer_count;
-    tdls_scan_context_t tdls_scan_ctxt;
+    scan_context_t scan_ctxt;
     /* Lock to avoid race condition during TDLS operations*/
     struct mutex tdls_lock;
-    v_BOOL_t is_tdls_btc_enabled;
 #endif
 
     hdd_traffic_monitor_t traffic_monitor;
@@ -1450,11 +1570,54 @@
     struct mutex   wmmLock;
     v_BOOL_t mgmt_frame_logging;
     v_BOOL_t isSetBandByNL;
+    v_U8_t fw_Version[SIR_VERSION_STRING_LEN];
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
     struct hdd_ll_stats_context ll_stats_context;
 #endif /* End of WLAN_FEATURE_LINK_LAYER_STATS */
+
+#ifdef WLAN_FEATURE_EXTSCAN
+    struct hdd_ext_scan_context ext_scan_context;
+#endif /* WLAN_FEATURE_EXTSCAN */
+
+    /* Time since boot up to WiFi turn ON (in micro seconds) */
+    v_U64_t wifi_turn_on_time_since_boot;
+    unsigned long  last_suspend_success;
+    v_U32_t  continuous_suspend_fail_cnt;
+
+#ifdef WLAN_FEATURE_OFFLOAD_PACKETS
+    struct hdd_offloaded_packets_ctx op_ctx;
+#endif
+
+   /* work queue to defer mac spoofing */
+   struct delayed_work spoof_mac_addr_work;
+
+    vos_timer_t    delack_timer;
+    struct mutex   cur_rx_level_lock;
+    v_U32_t        cur_rx_level;
+    v_U64_t        prev_rx;
+    v_ULONG_t      mode;
+
+    /* bit map to set/reset TDLS by different sources */
+    unsigned long tdls_source_bitmap;
+
+    /* tdls source timer to enable/disable TDLS on p2p listen */
+    vos_timer_t tdls_source_timer;
+
+    v_U64_t extscan_start_time_since_boot;
 };
 
+typedef enum  {
+        TP_IND_LOW = 1,
+        TP_IND_MEDIUM,
+        TP_IND_HIGH,
+}TP_IND_TYPE;
+
+/* Use to notify the TDLS or BTCOEX is mode enable */
+typedef enum
+{
+   WLAN_TDLS_MODE,
+   WLAN_BTCOEX_MODE,
+} WLAN_MODE_TYPE;
 
 #define WLAN_HDD_IS_LOAD_IN_PROGRESS(pHddCtx)  \
             (pHddCtx->isLoadUnloadInProgress & WLAN_HDD_LOAD_IN_PROGRESS)
@@ -1504,6 +1667,7 @@
    WLAN_BMUHW_TRACE_LOG_EN = 1<<1,
    WLAN_QXDM_LOG_EN = 1<<2,
    WLAN_DPU_TXP_LOG_EN = 1<<3,
+   WLAN_FW_MEM_DUMP_EN = 1<<6,
 } WLAN_ENABLE_HW_FW_LOG_TYPE;
 
 /*--------------------------------------------------------------------------- 
@@ -1567,7 +1731,7 @@
 tSirAbortScanStatus hdd_abort_mac_scan(hdd_context_t* pHddCtx,
                                        tANI_U8 sessionId,
                                        eCsrAbortReason reason);
-VOS_STATUS hdd_processSpoofMacAddrRequest(hdd_context_t *pHddCtx);
+void hdd_processSpoofMacAddrRequest(struct work_struct *work);
 void hdd_cleanup_actionframe( hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter );
 
 void crda_regulatory_entry_default(v_U8_t *countryCode, int domain_id);
@@ -1610,11 +1774,34 @@
 void hdd_ipv6_notifier_work_queue(struct work_struct *work);
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+v_MACADDR_t* hdd_wlan_get_ibss_mac_addr_from_staid(hdd_adapter_t *pAdapter, v_U8_t staIdx);
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef CONFIG_ENABLE_LINUX_REG
 void hdd_checkandupdate_phymode( hdd_context_t *pHddCtx);
 #endif
 int hdd_wmmps_helper(hdd_adapter_t *pAdapter, tANI_U8 *ptr);
 
+/*
+ * start/stop bandwidth compute timer, Based on which tcp delack
+ * value will be configured
+ */
+void hdd_manage_delack_timer(hdd_context_t *pHddCtx);
+
+void hdd_update_prev_rx_packet_count(hdd_context_t *pHddCtx);
+void hdd_start_delack_timer(hdd_context_t *pHddCtx);
+void hdd_set_default_stop_delack_timer(hdd_context_t *pHddCtx);
+v_U8_t hdd_get_total_sessions(hdd_context_t *pHddCtx);
+void hdd_set_delack_value(hdd_context_t *pHddCtx, v_U32_t next_rx_level);
+
+/*
+ *  Calculate the packet channel bandwidth and send notification to cnss demon
+ */
+void hdd_request_tcp_delack(hdd_context_t *pHddCtx,
+                                               uint64_t rx_packets);
+void hdd_tcp_delack_compute_function(void *priv);
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
 /**---------------------------------------------------------------------------
 
@@ -1725,8 +1912,23 @@
     return;
 }
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
-void hdd_wlan_free_wiphy_channels(struct wiphy *wiphy);
 void hdd_initialize_adapter_common(hdd_adapter_t *pAdapter);
-
-
+void hdd_wlan_free_wiphy_channels(struct wiphy *wiphy);
+void wlan_hdd_init_deinit_defer_scan_context(scan_context_t *scan_ctx);
+int wlan_hdd_copy_defer_scan_context(hdd_context_t *pHddCtx,
+                            struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+                            struct net_device *dev,
+#endif
+                            struct cfg80211_scan_request *request);
+void wlan_hdd_schedule_defer_scan(struct work_struct *work);
+void wlan_hdd_defer_scan_init_work(hdd_context_t *pHddCtx,
+                                struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+                                struct net_device *dev,
+#endif
+                                struct cfg80211_scan_request *request,
+                                unsigned long delay);
+int hdd_reassoc(hdd_adapter_t *pAdapter, const tANI_U8 *bssid,
+			const tANI_U8 channel, const handoff_src src);
 #endif    // end #if !defined( WLAN_HDD_MAIN_H )
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_oemdata.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_oemdata.h
index db3857d..5b68187 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_oemdata.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_oemdata.h
@@ -70,6 +70,95 @@
     tANI_U8           oemDataRsp[OEM_DATA_RSP_SIZE];
 };
 
+int oem_activate_service(void *pAdapter);
+
+int iw_get_oem_data_cap(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra);
+
+#define OEM_APP_SIGNATURE_LEN      16
+#define OEM_APP_SIGNATURE_STR      "QUALCOMM-OEM-APP"
+
+#define OEM_TARGET_SIGNATURE_LEN   8
+#define OEM_TARGET_SIGNATURE       "QUALCOMM"
+
+#define OEM_CAP_MAX_NUM_CHANNELS   128
+
+#define TARGET_TYPE_PRONTO   0xa0
+
+#define WLAN_HAL_CHAN_FLAG_DFS         10
+
+typedef enum
+{
+  /* Error null context */
+  OEM_ERR_NULL_CONTEXT = 1,
+
+  /* OEM App is not registered */
+  OEM_ERR_APP_NOT_REGISTERED,
+
+  /* Invalid signature */
+  OEM_ERR_INVALID_SIGNATURE,
+
+  /* Invalid message type */
+  OEM_ERR_NULL_MESSAGE_HEADER,
+
+  /* Invalid message type */
+  OEM_ERR_INVALID_MESSAGE_TYPE,
+
+  /* Invalid length in message body */
+  OEM_ERR_INVALID_MESSAGE_LENGTH
+} eOemErrorCode;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+  tANI_U8 major;
+  tANI_U8 minor;
+  tANI_U8 patch;
+  tANI_U8 build;
+} tDriverVersion;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    /* Signature of chip set vendor, e.g. QUALCOMM */
+    tANI_U8 oem_target_signature[OEM_TARGET_SIGNATURE_LEN];
+    tANI_U32 oem_target_type;         /* Chip type */
+    tANI_U32 oem_fw_version;          /* FW version */
+    tDriverVersion driver_version;    /* CLD version */
+    tANI_U16 allowed_dwell_time_min;  /* Channel dwell time - allowed min */
+    tANI_U16 allowed_dwell_time_max;  /* Channel dwell time - allowed max */
+    tANI_U16 curr_dwell_time_min;     /* Channel dwell time - current min */
+    tANI_U16 curr_dwell_time_max;     /* Channel dwell time - current max */
+    tANI_U16 supported_bands;          /* 2.4G or 5G Hz */
+    tANI_U16 num_channels;             /* Num of channels IDs to follow */
+    tANI_U8 channel_list[OEM_CAP_MAX_NUM_CHANNELS];  /* List of channel IDs */
+} t_iw_oem_data_cap;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    /* channel id */
+    tANI_U32 chan_id;
+
+    /* reserved0 */
+    tANI_U32 reserved0;
+
+    /* Primary 20 MHz channel frequency in MHz */
+    tANI_U32 mhz;
+
+    /* Center frequency 1 in MHz */
+    tANI_U32 band_center_freq1;
+
+    /* Center frequency 2 in MHz - valid only for 11acvht 80plus80 mode */
+    tANI_U32 band_center_freq2;
+
+    /* channel info described below */
+    tANI_U32 info;
+
+    /* contains min power, max power, reg power and reg class id */
+    tANI_U32 reg_info_1;
+
+    /* contains antennamax */
+    tANI_U32 reg_info_2;
+} tHddChannelInfo;
+
 #endif //__WLAN_HDD_OEM_DATA_H__
 
 #endif //FEATURE_OEM_DATA_SUPPORT
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_power.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_power.h
index 9e33c25..87756d4 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_power.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_power.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -108,5 +108,32 @@
 int wlan_hdd_ipv6_changed(struct notifier_block *nb,
                            unsigned long data, void *arg);
 
+/**
+ * enum suspend_resume_state - Suspend resume state
+ * @HDD_WLAN_EARLY_SUSPEND: Early suspend state.
+ * @HDD_WLAN_SUSPEND: Suspend state.
+ * @HDD_WLAN_EARLY_RESUME: Early resume state.
+ * @HDD_WLAN_RESUME: Resume state.
+ *
+ * Suspend state to indicate in diag event of suspend resume.
+ */
+
+enum suspend_resume_state {
+   HDD_WLAN_EARLY_SUSPEND,
+   HDD_WLAN_SUSPEND,
+   HDD_WLAN_EARLY_RESUME,
+   HDD_WLAN_RESUME
+};
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+void hdd_wlan_suspend_resume_event(uint8_t state);
+#else
+static inline
+void hdd_wlan_suspend_resume_event(uint8_t state)
+{
+    return;
+}
+#endif /* FEATURE_WLAN_DIAG_SUPPORT */
+
 
 #endif // if !defined __WLAN_QCT_DRIVER_H
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_softap_tx_rx.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_softap_tx_rx.h
index 249dda1..d7c23ec 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_softap_tx_rx.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_softap_tx_rx.h
@@ -64,6 +64,17 @@
   -------------------------------------------------------------------------*/ 
 
 /**============================================================================
+  @brief hdd_softap_get_connected_sta() - Function to get numbeer of connected
+  stations with softap
+
+  @param pHostapdAdapter      : [in]  pointer to  saftap adapter
+
+  @return         :  Number of connected peer with softap
+  ===========================================================================*/
+
+v_U8_t hdd_softap_get_connected_sta(hdd_adapter_t *pHostapdAdapter);
+
+/**============================================================================
   @brief hdd_softap_hard_start_xmit() - Function registered with the Linux OS for 
   transmitting packets
 
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_tdls.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_tdls.h
index b004f6c..e19f7f5 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_tdls.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_tdls.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -73,6 +73,14 @@
 #define TDLS_CHANNEL_SWITCH_ENABLE  1
 #define TDLS_CHANNEL_SWITCH_DISABLE 2
 
+enum tdls_disable_source {
+    HDD_SET_TDLS_MODE_SOURCE_USER = 1,
+    HDD_SET_TDLS_MODE_SOURCE_SCAN = 2,
+    HDD_SET_TDLS_MODE_SOURCE_OFFCHANNEL = 4,
+    HDD_SET_TDLS_MODE_SOURCE_BTC = 8,
+    HDD_SET_TDLS_MODE_SOURCE_P2P = 16
+};
+
 typedef struct
 {
     tANI_U32    tdls;
@@ -87,19 +95,6 @@
     tANI_S32    rssi_teardown_threshold;
 } tdls_config_params_t;
 
-typedef struct
-{
-    struct wiphy *wiphy;
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
-    struct net_device *dev;
-#endif
-    struct cfg80211_scan_request *scan_request;
-    int magic;
-    int attempt;
-    int reject;
-    struct delayed_work tdls_scan_work;
-} tdls_scan_context_t;
-
 typedef enum {
     eTDLS_SUPPORT_NOT_ENABLED = 0,
     eTDLS_SUPPORT_DISABLED, /* suppress implicit trigger and not respond to the peer */
@@ -122,6 +117,28 @@
     eTDLS_LINK_TEARING,
 } tTDLSLinkStatus;
 
+/**
+ * enum tdls_teardown_reason - Reason for TDLS teardown
+ * @eTDLS_TEARDOWN_EXT_CTRL: Reason ext ctrl.
+ * @eTDLS_TEARDOWN_CONCURRENCY: Reason concurrency.
+ * @eTDLS_TEARDOWN_RSSI_THRESHOLD: Reason rssi threashold.
+ * @eTDLS_TEARDOWN_TXRX_THRESHOLD: Reason txrx threashold.
+ * @eTDLS_TEARDOWN_BTCOEX: Reason BTCOEX.
+ * @eTDLS_TEARDOWN_SCAN: Reason scan.
+ * @eTDLS_TEARDOWN_BSS_DISCONNECT: Reason bss disconnected.
+ *
+ * Reason to indicate in diag event of tdls teardown.
+ */
+
+enum tdls_teardown_reason {
+    eTDLS_TEARDOWN_EXT_CTRL,
+    eTDLS_TEARDOWN_CONCURRENCY,
+    eTDLS_TEARDOWN_RSSI_THRESHOLD,
+    eTDLS_TEARDOWN_TXRX_THRESHOLD,
+    eTDLS_TEARDOWN_BTCOEX,
+    eTDLS_TEARDOWN_SCAN,
+    eTDLS_TEARDOWN_BSS_DISCONNECT,
+};
 
 typedef enum {
     eTDLS_LINK_SUCCESS,                              /* Success */
@@ -248,14 +265,6 @@
 
 void wlan_hdd_tdls_extract_sa(struct sk_buff *skb, u8 *mac);
 
-int wlan_hdd_tdls_increment_pkt_count(hdd_adapter_t *pAdapter,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
-                                      const u8 *mac,
-#else
-                                      u8 *mac,
-#endif
-                                      u8 tx);
-
 int wlan_hdd_tdls_set_sta_id(hdd_adapter_t *pAdapter,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
                              const u8 *mac,
@@ -265,11 +274,7 @@
                              u8 staId);
 
 hddTdlsPeer_t *wlan_hdd_tdls_find_peer(hdd_adapter_t *pAdapter,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
                                        const u8 *mac,
-#else
-                                       u8 *mac,
-#endif
                                        tANI_BOOLEAN mutexLock);
 
 hddTdlsPeer_t *wlan_hdd_tdls_find_all_peer(hdd_context_t *pHddCtx,
@@ -325,7 +330,8 @@
 #endif
                                 tCsrStaParams *StaParams,
                                 tANI_BOOLEAN isBufSta,
-                                tANI_BOOLEAN isOffChannelSupported);
+                                tANI_BOOLEAN isOffChannelSupported,
+                                tANI_BOOLEAN isQosWmmSta);
 
 int wlan_hdd_tdls_set_rssi(hdd_adapter_t *pAdapter,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
@@ -343,8 +349,6 @@
 #endif
                                 tANI_U8 responder);
 
-int wlan_hdd_tdls_get_responder(hdd_adapter_t *pAdapter, u8 *mac);
-
 int wlan_hdd_tdls_set_signature(hdd_adapter_t *pAdapter,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
                                 const u8 *mac,
@@ -379,8 +383,6 @@
 
 void wlan_hdd_tdls_check_bmps(hdd_adapter_t *pAdapter);
 
-u8 wlan_hdd_tdls_is_peer_progress(hdd_adapter_t *pAdapter, u8 *mac);
-
 hddTdlsPeer_t *wlan_hdd_tdls_is_progress(hdd_context_t *pHddCtx,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
                                          const u8 *mac,
@@ -391,21 +393,13 @@
 
 void wlan_hdd_tdls_set_mode(hdd_context_t *pHddCtx,
                             eTDLSSupportMode tdls_mode,
-                            v_BOOL_t bUpdateLast);
+                            v_BOOL_t bUpdateLast,
+                            enum tdls_disable_source source);
 
 tANI_U32 wlan_hdd_tdls_discovery_sent_cnt(hdd_context_t *pHddCtx);
 
 void wlan_hdd_tdls_check_power_save_prohibited(hdd_adapter_t *pAdapter);
 
-void wlan_hdd_tdls_free_scan_request (tdls_scan_context_t *tdls_scan_ctx);
-
-int wlan_hdd_tdls_copy_scan_context(hdd_context_t *pHddCtx,
-                            struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
-                            struct net_device *dev,
-#endif
-                            struct cfg80211_scan_request *request);
-
 int wlan_hdd_tdls_scan_callback (hdd_adapter_t *pAdapter,
                                 struct wiphy *wiphy,
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
@@ -421,6 +415,36 @@
 void wlan_hdd_tdls_indicate_teardown(hdd_adapter_t *pAdapter,
                                      hddTdlsPeer_t *curr_peer,
                                      tANI_U16 reason);
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+void hdd_send_wlan_tdls_teardown_event(uint32_t reason,
+                                      uint8_t *peer_mac);
+void hdd_wlan_tdls_enable_link_event(const uint8_t *peer_mac,
+                           uint8_t is_off_chan_supported,
+                           uint8_t is_off_chan_configured,
+                           uint8_t is_off_chan_established);
+void hdd_wlan_block_scan_by_tdls(void);
+
+#else
+static inline
+void hdd_send_wlan_tdls_teardown_event(uint32_t reason,
+                                      uint8_t *peer_mac)
+{
+    return;
+}
+static inline
+void hdd_wlan_tdls_enable_link_event(const uint8_t *peer_mac,
+                           uint8_t is_off_chan_supported,
+                           uint8_t is_off_chan_configured,
+                           uint8_t is_off_chan_established)
+{
+    return;
+}
+static inline
+void hdd_wlan_block_scan_by_tdls(void)
+{
+    return;
+}
+#endif /* FEATURE_WLAN_DIAG_SUPPORT */
 
 int wlan_hdd_tdls_set_force_peer(hdd_adapter_t *pAdapter,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
@@ -470,6 +494,13 @@
 int wlan_hdd_validate_tdls_context(hdd_context_t *pHddCtx, tdlsCtx_t *pTdlsCtx);
 
 void wlan_hdd_tdls_reenable(hdd_context_t *pHddCtx);
+
+void wlan_hdd_tdls_notify_packet(hdd_adapter_t *adapter, struct sk_buff *skb);
+
+void wlan_hdd_change_tdls_mode(void *hdd_ctx);
+
+void wlan_hdd_start_stop_tdls_source_timer(hdd_context_t *pHddCtx,
+                                           eTDLSSupportMode tdls_mode);
 #else
 static inline void hdd_tdls_notify_mode_change(hdd_adapter_t *pAdapter,
                                                hdd_context_t *pHddCtx)
@@ -483,6 +514,20 @@
 wlan_hdd_tdls_reenable(hdd_context_t *pHddCtx)
 {
 }
+static inline void
+wlan_hdd_tdls_notify_packet(hdd_adapter_t *adapter, struct sk_buff *skb)
+{
+}
+static inline void
+wlan_hdd_change_tdls_mode(void *hdd_ctx)
+{
+}
+
+static inline void
+wlan_hdd_start_stop_tdls_source_timer(hdd_context_t *pHddCtx,
+                                      eTDLSSupportMode tdls_mode)
+{
+}
 #endif
 void wlan_hdd_tdls_update_rx_pkt_cnt_n_rssi(hdd_adapter_t *pAdapter,
         u8 *mac, v_S7_t rssiAvg);
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_trace.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_trace.h
index aef3ef5..b12c6a3 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_trace.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_trace.h
@@ -82,8 +82,6 @@
     TRACE_CODE_HDD_CHANGE_STATION,
     TRACE_CODE_HDD_CFG80211_UPDATE_BSS,
     TRACE_CODE_HDD_CFG80211_SCAN,
-    TRACE_CODE_HDD_CFG80211_SCHED_SCAN_START,
-    TRACE_CODE_HDD_CFG80211_SCHED_SCAN_STOP,
     TRACE_CODE_HDD_REMAIN_ON_CHANNEL,
     TRACE_CODE_HDD_REMAINCHANREADYHANDLER,
     TRACE_CODE_HDD_CFG80211_CANCEL_REMAIN_ON_CHANNEL,
@@ -94,7 +92,6 @@
     TRACE_CODE_HDD_CFG80211_DEL_STA,
     TRACE_CODE_HDD_CFG80211_ADD_STA,
     TRACE_CODE_HDD_CFG80211_SET_PMKSA,
-    TRACE_CODE_HDD_CFG80211_DEL_PMKSA,
     TRACE_CODE_HDD_CFG80211_UPDATE_FT_IES,
     TRACE_CODE_HDD_CFG80211_TDLS_MGMT,
     TRACE_CODE_HDD_CFG80211_TDLS_OPER,
@@ -110,10 +107,15 @@
     TRACE_CODE_HDD_CFG80211_SET_MAC_ACL,
     TRACE_CODE_HDD_CFG80211_TESTMODE,
     TRACE_CODE_HDD_CFG80211_DUMP_SURVEY,
+    TRACE_CODE_HDD_CFG80211_SCHED_SCAN_START,
+    TRACE_CODE_HDD_CFG80211_SCHED_SCAN_STOP,
+    TRACE_CODE_HDD_CFG80211_DEL_PMKSA,
 };
 
 extern void hddTraceDump(void *pMac, tpvosTraceRecord pRecord, tANI_U16 recIndex);
 extern void hddTraceInit(void);
+void hdd_register_debug_callback(void);
+
 #endif
 
 
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_tx_rx.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_tx_rx.h
index 5fab180..68f7174 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_tx_rx.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_tx_rx.h
@@ -76,6 +76,8 @@
 #define SME_QOS_UAPSD_CFG_VI_CHANGED_MASK     0xF4
 #define SME_QOS_UAPSD_CFG_VO_CHANGED_MASK     0xF8
 
+#define HDD_ETH_HEADER_LEN      14
+
 /* WLAN_DHCP_DEBUG */
 #define RX_PATH     ( 0 )
 #define TX_PATH     ( 1 )
diff --git a/wlan/prima/CORE/HDD/inc/wlan_hdd_wext.h b/wlan/prima/CORE/HDD/inc/wlan_hdd_wext.h
index d8d8728..fe8bfed 100644
--- a/wlan/prima/CORE/HDD/inc/wlan_hdd_wext.h
+++ b/wlan/prima/CORE/HDD/inc/wlan_hdd_wext.h
@@ -463,5 +463,6 @@
 int hdd_setBand(struct net_device *dev, u8 ui_band);
 int hdd_setBand_helper(struct net_device *dev, const char *command);
 VOS_STATUS wlan_hdd_get_frame_logs(hdd_adapter_t *pAdapter, v_U8_t flag);
+int wlan_hdd_set_proximity(int set_value);
 #endif // __WEXT_IW_H__
 
diff --git a/wlan/prima/CORE/HDD/src/.wlan_hdd_cfg.c.swp b/wlan/prima/CORE/HDD/src/.wlan_hdd_cfg.c.swp
deleted file mode 100644
index 82862ba..0000000
--- a/wlan/prima/CORE/HDD/src/.wlan_hdd_cfg.c.swp
+++ /dev/null
Binary files differ
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_assoc.c b/wlan/prima/CORE/HDD/src/wlan_hdd_assoc.c
index fde6de9..479b094 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_assoc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -326,6 +326,8 @@
 
           // Save  dot11mode in which STA associated to AP
           pHddStaCtx->conn_info.dot11Mode = pRoamInfo->u.pConnectedProfile->dot11Mode;
+
+          pHddStaCtx->conn_info.rate_flags = pRoamInfo->maxRateFlags;
       }
    }
 
@@ -667,11 +669,14 @@
              }
         }
 #endif
-        pr_info("wlan: " MAC_ADDRESS_STR " connected to " MAC_ADDRESS_STR "\n",
+        hddLog(VOS_TRACE_LEVEL_ERROR, MAC_ADDRESS_STR " connected to "
+                MAC_ADDRESS_STR,
                 MAC_ADDR_ARRAY(pAdapter->macAddressCurrent.bytes),
                 MAC_ADDR_ARRAY(wrqu.ap_addr.sa_data));
         hdd_SendUpdateBeaconIEsEvent(pAdapter, pCsrRoamInfo);
 
+        hdd_manage_delack_timer(pHddCtx);
+
         /* Send IWEVASSOCRESPIE Event if WLAN_FEATURE_CIQ_METRICS is Enabled Or
          * Send IWEVASSOCRESPIE Event if WLAN_FEATURE_VOWIFI_11R is Enabled
          * and fFTEnable is TRUE */
@@ -694,14 +699,19 @@
         wlan_hdd_incr_active_session(pHddCtx, pAdapter->device_mode);
         memcpy(wrqu.ap_addr.sa_data, pHddStaCtx->conn_info.bssId, ETH_ALEN);
         type = WLAN_STA_ASSOC_DONE_IND;
-        pr_info("wlan: new IBSS connection to " MAC_ADDRESS_STR"\n",
-                MAC_ADDR_ARRAY(pHddStaCtx->conn_info.bssId));
+
+        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "wlan: new IBSS connection to " MAC_ADDRESS_STR,
+                 MAC_ADDR_ARRAY(pHddStaCtx->conn_info.bssId));
     }
     else /* Not Associated */
     {
-        pr_info("wlan: disconnected\n");
+        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "wlan: disconnected");
         type = WLAN_STA_DISASSOC_DONE_IND;
         memset(wrqu.ap_addr.sa_data,'\0',ETH_ALEN);
+
+        hdd_manage_delack_timer(pHddCtx);
     }
     hdd_dump_concurrency_info(pHddCtx);
 
@@ -1001,9 +1011,6 @@
     pAdapter->hdd_stats.hddTxRxStats.continuousTxTimeoutCount = 0;
 
     INIT_COMPLETION(pAdapter->disconnect_comp_var);
-    /* HDD has initiated disconnect, do not send disconnect indication
-     * to kernel as it will be handled by __cfg80211_disconnect.
-     */
     /* If only STA mode is on */
     if((pHddCtx->concurrency_mode <= 1) &&
        (pHddCtx->no_of_open_sessions[WLAN_HDD_INFRA_STATION] <= 1))
@@ -1017,7 +1024,14 @@
      */
 
     spin_lock_bh(&pAdapter->lock_for_active_session);
-    if ( eConnectionState_Disconnecting == pHddStaCtx->conn_info.connState )
+
+    /* HDD has initiated disconnect, do not send disconnect indication
+     * to kernel. Sending disconnected event to kernel for userspace
+     * initiated disconnect will be handled by diconnect handler call
+     * to cfg80211_disconnected
+     */
+    if ((eConnectionState_Disconnecting == pHddStaCtx->conn_info.connState) ||
+        (eConnectionState_NotConnected == pHddStaCtx->conn_info.connState))
     {
        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                    FL(" HDD has initiated a disconnect, no need to send"
@@ -1027,7 +1041,7 @@
     else if (eConnectionState_Associated == pHddStaCtx->conn_info.connState)
     {
        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-               FL(" Set HDD connState to eConnectionState_Disconnecting from %d "),
+            FL("Set HDD connState to eConnectionState_Disconnecting from %d "),
                        pHddStaCtx->conn_info.connState);
        hdd_connSetConnectionState( pHddStaCtx, eConnectionState_Disconnecting );
        wlan_hdd_decr_active_session(pHddCtx, pAdapter->device_mode);
@@ -1078,11 +1092,13 @@
                /* To avoid wpa_supplicant sending "HANGED" CMD to ICS UI */
                if ( eCSR_ROAM_LOSTLINK == roamStatus )
                {
-                   cfg80211_disconnected(dev, pRoamInfo->reasonCode, NULL, 0, GFP_KERNEL);
+                    wlan_hdd_cfg80211_indicate_disconnect(dev, false,
+                                                   pRoamInfo->reasonCode);
                }
                else
                {
-                   cfg80211_disconnected(dev, WLAN_REASON_UNSPECIFIED, NULL, 0, GFP_KERNEL);
+                   wlan_hdd_cfg80211_indicate_disconnect(dev, false,
+                                                   WLAN_REASON_UNSPECIFIED);
                }
             }
 
@@ -1128,6 +1144,14 @@
     }
 
      hdd_wmm_adapter_clear(pAdapter);
+     /* Clear PER based roam stats */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+     if (sme_IsFeatureSupportedByFW(PER_BASED_ROAMING) &&
+         (WLAN_HDD_INFRA_STATION == pAdapter->device_mode) &&
+         pHddCtx->cfg_ini && pHddCtx->cfg_ini->isPERRoamEnabled &&
+         pHddCtx->cfg_ini->isPERRoamRxPathEnabled)
+         sme_unset_per_roam_rxconfig(pHddCtx->hHal);
+#endif
 #if defined(WLAN_FEATURE_VOWIFI_11R)
      sme_FTReset(WLAN_HDD_GET_HAL_CTX(pAdapter));
 #endif
@@ -1197,6 +1221,14 @@
     else
     {
        sta_id = pHddStaCtx->conn_info.staId[0];
+       /* clear scan cache for Link Lost */
+       if (pRoamInfo && !pRoamInfo->reasonCode &&
+           (eCSR_ROAM_LOSTLINK == roamStatus)) {
+           wlan_hdd_cfg80211_update_bss_list(pAdapter,
+                               pHddStaCtx->conn_info.bssId);
+           sme_remove_bssid_from_scan_list(pHddCtx->hHal,
+                               pHddStaCtx->conn_info.bssId);
+        }
 
        //We should clear all sta register with TL, for now, only one.
        vstatus = hdd_roamDeregisterSTA( pAdapter, sta_id );
@@ -1552,7 +1584,6 @@
 #endif
     int status;
     v_BOOL_t hddDisconInProgress = FALSE;
-    tANI_U16 reason_code;
 
     /* HDD has initiated disconnect, do not send connect result indication
      * to kernel as it will be handled by __cfg80211_disconnect.
@@ -1580,6 +1611,22 @@
         pAdapter->maxRateFlags = pRoamInfo->maxRateFlags;
         // Save the connection info from CSR...
         hdd_connSaveConnectInfo( pAdapter, pRoamInfo, eCSR_BSS_TYPE_INFRASTRUCTURE );
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+        if (sme_IsFeatureSupportedByFW(PER_BASED_ROAMING) &&
+            (WLAN_HDD_INFRA_STATION == pAdapter->device_mode) &&
+            !hddDisconInProgress &&
+            pHddCtx->cfg_ini && pHddCtx->cfg_ini->isPERRoamEnabled &&
+            pHddCtx->cfg_ini->isPERRoamRxPathEnabled)
+            sme_set_per_roam_rxconfig(pHddCtx->hHal,
+                 pHddStaCtx->conn_info.staId[0],
+                 pHddCtx->cfg_ini->rateDownThreshold,
+                 pHddCtx->cfg_ini->rateUpThreshold,
+                 pHddCtx->cfg_ini->PERroamTriggerPercent,
+                 pHddCtx->cfg_ini->PERroamRxPktsThreshold,
+                 pHddCtx->cfg_ini->waitPeriodForNextPERScan);
+#endif
+
 #ifdef FEATURE_WLAN_WAPI
         if ( pRoamInfo->u.pConnectedProfile->AuthType == eCSR_AUTH_TYPE_WAPI_WAI_CERTIFICATE ||
                 pRoamInfo->u.pConnectedProfile->AuthType == eCSR_AUTH_TYPE_WAPI_WAI_PSK )
@@ -1662,8 +1709,22 @@
             bss = wlan_hdd_cfg80211_update_bss_db(pAdapter, pRoamInfo);
             if (NULL == bss)
             {
-                pr_err("wlan: Not able to create BSS entry\n");
+                hddLog(LOGE,
+                     FL("Not able to create BSS entry"));
                 netif_carrier_off(dev);
+                if (!hddDisconInProgress) {
+                   /*
+                    * Here driver was not able to update cfg80211 database
+                    * this can happen if connected channel is not valid,
+                    * i.e reg domain was changed during connection.
+                    * Queue disconnect for the session if disconnect is
+                    * not in progress.
+                    */
+                    hddLog(LOGE, FL("Disconnecting..."));
+                    sme_RoamDisconnect( WLAN_HDD_GET_HAL_CTX(pAdapter),
+                                 pAdapter->sessionId,
+                                 eCSR_DISCONNECT_REASON_UNSPECIFIED);
+                }
                 return eHAL_STATUS_FAILURE;
             }
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -1887,13 +1948,12 @@
 
         hdd_wext_state_t *pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
         if (pRoamInfo)
-            pr_info("wlan: connection failed with " MAC_ADDRESS_STR
-                    " result:%d and Status:%d",
-                    MAC_ADDR_ARRAY(pRoamInfo->bssid),
-                    roamResult, roamStatus);
+            VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                    "wlan: connection failed with " MAC_ADDRESS_STR " result:%d and Status:%d",
+                    MAC_ADDR_ARRAY(pRoamInfo->bssid), roamResult, roamStatus);
         else
-            pr_info("wlan: connection failed with " MAC_ADDRESS_STR
-                    " result:%d and Status:%d",
+            VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                   "wlan: connection failed with " MAC_ADDRESS_STR " result:%d and Status:%d",
                     MAC_ADDR_ARRAY(pWextState->req_bssId),
                     roamResult, roamStatus);
 
@@ -1903,6 +1963,16 @@
             wlan_hdd_get_frame_logs(pAdapter,
                                 WLAN_HDD_GET_FRAME_LOG_CMD_SEND_AND_CLEAR);
 
+        if ((eCSR_ROAM_RESULT_SCAN_FOR_SSID_FAILURE == roamResult) ||
+           (pRoamInfo &&
+           ((eSIR_SME_JOIN_TIMEOUT_RESULT_CODE == pRoamInfo->statusCode) ||
+           (eSIR_SME_AUTH_TIMEOUT_RESULT_CODE == pRoamInfo->statusCode) ||
+           (eSIR_SME_ASSOC_TIMEOUT_RESULT_CODE == pRoamInfo->statusCode)))) {
+             wlan_hdd_cfg80211_update_bss_list(pAdapter,
+                    pRoamInfo ? pRoamInfo->bssid : pWextState->req_bssId);
+             sme_remove_bssid_from_scan_list(pHddCtx->hHal,
+                    pRoamInfo ? pRoamInfo->bssid : pWextState->req_bssId);
+        }
         /* Set connection state to eConnectionState_NotConnected only when CSR
          * has completed operation - with a ASSOCIATION_FAILURE status
          */
@@ -1996,13 +2066,18 @@
             }
             else
             {
-                reason_code = WLAN_STATUS_UNSPECIFIED_FAILURE;
-
-                if (pRoamInfo && pRoamInfo->reasonCode)
-                    reason_code = (tANI_U16)pRoamInfo->reasonCode;
-
-                cfg80211_connect_result(dev, pWextState->req_bssId,
-                    NULL, 0, NULL, 0, reason_code, GFP_KERNEL);
+                if (pRoamInfo)
+                    cfg80211_connect_result ( dev, pRoamInfo->bssid,
+                        NULL, 0, NULL, 0,
+                        pRoamInfo->reasonCode ?
+                        pRoamInfo->reasonCode :
+                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                        GFP_KERNEL );
+                else
+                    cfg80211_connect_result ( dev, pWextState->req_bssId,
+                        NULL, 0, NULL, 0,
+                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                         GFP_KERNEL );
             }
             /*Clear the roam profile*/
             hdd_clearRoamProfileIe( pAdapter );
@@ -2114,6 +2189,11 @@
                       __func__, pAdapter->dev->name);
                return;
             }
+#ifdef WLAN_FEATURE_RMC
+            netif_carrier_on(pAdapter->dev);
+            hddLog(VOS_TRACE_LEVEL_INFO, FL("Enabling queues"));
+            netif_tx_start_all_queues(pAdapter->dev);
+#endif
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,15,0))
             chan_no = pRoamInfo->pBssDesc->channelId;
 
@@ -2650,19 +2730,12 @@
          hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
          struct station_info staInfo;
 
-         pr_info ( "IBSS New Peer indication from SME "
-                    "with peerMac " MAC_ADDRESS_STR " BSSID: " MAC_ADDRESS_STR " and stationID= %d",
+         VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                   "IBSS New Peer indication from SME with peerMac " MAC_ADDRESS_STR " BSSID: " MAC_ADDRESS_STR " and stationID= %d",
                     MAC_ADDR_ARRAY(pRoamInfo->peerMac),
                     MAC_ADDR_ARRAY(pHddStaCtx->conn_info.bssId),
                     pRoamInfo->staId );
 
-         if ( !roamSaveIbssStation( pAdapter, pRoamInfo->staId, (v_MACADDR_t *)pRoamInfo->peerMac ) )
-         {
-            VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
-                       "New IBSS peer but we already have the max we can handle.  Can't register this one" );
-            break;
-         }
-
          pHddCtx->sta_to_adapter[pRoamInfo->staId] = pAdapter;
 
          pHddCtx->sta_to_adapter[IBSS_BROADCAST_STAID] = pAdapter;
@@ -2681,6 +2754,13 @@
                "Cannot register STA with TL for IBSS.  Failed with vosStatus = %d [%08X]",
                vosStatus, vosStatus );
          }
+         if (!roamSaveIbssStation(pAdapter,
+               pRoamInfo->staId,
+               (v_MACADDR_t *)pRoamInfo->peerMac))
+         {
+            hddLog(LOGW, FL("Not Able to add sta in sta hash"));
+            break;
+         }
          pHddStaCtx->ibss_sta_generation++;
          memset(&staInfo, 0, sizeof(staInfo));
          staInfo.filled = 0;
@@ -2738,8 +2818,8 @@
                     "IBSS peer departed by cannot find peer in our registration table with TL" );
          }
 
-         pr_info ( "IBSS Peer Departed from SME "
-                    "with peerMac " MAC_ADDRESS_STR " BSSID: " MAC_ADDRESS_STR " and stationID= %d",
+          VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                   "IBSS Peer Departed from SME with peerMac " MAC_ADDRESS_STR " BSSID: " MAC_ADDRESS_STR " and stationID= %d",
                     MAC_ADDR_ARRAY(pRoamInfo->peerMac),
                     MAC_ADDR_ARRAY(pHddStaCtx->conn_info.bssId),
                     pRoamInfo->staId );
@@ -2929,7 +3009,9 @@
               roamResult == eCSR_ROAM_RESULT_UPDATE_TDLS_PEER ?
               "UPDATE_TDLS_PEER" :
               roamResult == eCSR_ROAM_RESULT_LINK_ESTABLISH_REQ_RSP ?
-              "LINK_ESTABLISH_REQ_RSP" : "UNKNOWN",
+              "LINK_ESTABLISH_REQ_RSP" :
+              roamResult == eCSR_ROAM_RESULT_CHANNEL_SWITCH_REQ_RSP ?
+              "CHANNEL_SWITCH_REQ_RSP" : "UNKNOWN",
               pRoamInfo->staId, MAC_ADDR_ARRAY(pRoamInfo->peerMac));
     switch( roamResult )
     {
@@ -2937,9 +3019,21 @@
         {
             if(eSIR_SME_SUCCESS != pRoamInfo->statusCode)
             {
+                hddTdlsPeer_t *curr_peer;
+
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                      ("%s: Add Sta is failed. %d"),__func__, pRoamInfo->statusCode);
                 wlan_hdd_tdls_check_bmps(pAdapter);
+
+                mutex_lock(&pHddCtx->tdls_lock);
+                curr_peer = wlan_hdd_tdls_find_peer(pAdapter,
+                                      pRoamInfo->peerMac, FALSE);
+                if (NULL != curr_peer)
+                    curr_peer->link_status = eTDLS_LINK_TEARING;
+                else
+                    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                              "%s %d curr_peer is Null", __func__,__LINE__);
+                mutex_unlock(&pHddCtx->tdls_lock);
             }
             else
             {
@@ -3012,12 +3106,35 @@
         {
             if (eSIR_SME_SUCCESS != pRoamInfo->statusCode)
             {
+                hddTdlsPeer_t *curr_peer;
+
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                      "%s: Link Establish Request failed. %d", __func__, pRoamInfo->statusCode);
+
+                mutex_lock(&pHddCtx->tdls_lock);
+                curr_peer = wlan_hdd_tdls_find_peer(pAdapter,
+                                       pRoamInfo->peerMac, FALSE);
+                if (curr_peer)
+                    curr_peer->link_status = eTDLS_LINK_TEARING;
+                else
+                    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                              "%s %d curr_peer is Null",__func__,__LINE__);
+                mutex_unlock(&pHddCtx->tdls_lock);
             }
             complete(&pAdapter->tdls_link_establish_req_comp);
             break;
         }
+        case eCSR_ROAM_RESULT_CHANNEL_SWITCH_REQ_RSP:
+        {
+            if (eSIR_SME_SUCCESS != pRoamInfo->statusCode)
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                          "%s: Channel switch request failed. %d", __func__,
+                          pRoamInfo->statusCode);
+            else
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                          "%s: Channel switch request Success", __func__);
+            break;
+        }
         case eCSR_ROAM_RESULT_DELETE_TDLS_PEER:
         {
             hddTdlsPeer_t *curr_peer;
@@ -3051,7 +3168,9 @@
                     else
                         mutex_unlock(&pHddCtx->tdls_lock);
 
+                    mutex_lock(&pHddCtx->tdls_lock);
                     wlan_hdd_tdls_reset_peer(pAdapter, pRoamInfo->peerMac);
+                    mutex_unlock(&pHddCtx->tdls_lock);
 
                     pHddCtx->tdlsConnInfo[staIdx].staId = 0 ;
                     pHddCtx->tdlsConnInfo[staIdx].sessionId = 255;
@@ -3077,6 +3196,8 @@
             curr_peer = wlan_hdd_tdls_find_peer(pAdapter, pRoamInfo->peerMac,
                                                 FALSE);
             wlan_hdd_tdls_indicate_teardown(pAdapter, curr_peer, pRoamInfo->reasonCode);
+            hdd_send_wlan_tdls_teardown_event(eTDLS_TEARDOWN_BSS_DISCONNECT,
+                                                          curr_peer->peerMac);
             mutex_unlock(&pHddCtx->tdls_lock);
 #endif
             status = eHAL_STATUS_SUCCESS ;
@@ -3094,7 +3215,11 @@
                               ("hdd_tdlsStatusUpdate: staIdx %d " MAC_ADDRESS_STR),
                                 pHddCtx->tdlsConnInfo[staIdx].staId,
                                 MAC_ADDR_ARRAY(pHddCtx->tdlsConnInfo[staIdx].peerMac.bytes));
+
+                    mutex_lock(&pHddCtx->tdls_lock);
                     wlan_hdd_tdls_reset_peer(pAdapter, pHddCtx->tdlsConnInfo[staIdx].peerMac.bytes);
+                    mutex_unlock(&pHddCtx->tdls_lock);
+
                     hdd_roamDeregisterTDLSSTA ( pAdapter,  pHddCtx->tdlsConnInfo[staIdx].staId );
                     wlan_hdd_tdls_decrement_peer_count(pAdapter);
 
@@ -3119,7 +3244,7 @@
 }
 #endif
 
-static void iw_full_power_cbfn (void *pContext, eHalStatus status)
+void iw_full_power_cbfn (void *pContext, eHalStatus status)
 {
     hdd_adapter_t *pAdapter = (hdd_adapter_t *)pContext;
     hdd_context_t *pHddCtx = NULL;
@@ -3158,6 +3283,7 @@
     hdd_wext_state_t *pWextState = NULL;
     hdd_station_ctx_t *pHddStaCtx = NULL;
     VOS_STATUS status = VOS_STATUS_SUCCESS;
+    struct cfg80211_bss *bss_status;
     hdd_context_t *pHddCtx = NULL;
 
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
@@ -3182,17 +3308,13 @@
        return eHAL_STATUS_FAILURE;
     }
 
-
     MTRACE(vos_trace(VOS_MODULE_ID_HDD, TRACE_CODE_HDD_RX_SME_MSG,
                                pAdapter->sessionId, roamStatus));
     switch( roamStatus )
     {
         case eCSR_ROAM_SESSION_OPENED:
-            if(pAdapter != NULL)
-            {
-                set_bit(SME_SESSION_OPENED, &pAdapter->event_flags);
-                complete(&pAdapter->session_open_comp_var);
-            }
+            set_bit(SME_SESSION_OPENED, &pAdapter->event_flags);
+            complete(&pAdapter->session_open_comp_var);
             break;
 
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
@@ -3371,7 +3493,8 @@
 
                 if((pHddCtx) &&
                    (TRUE == pHddCtx->hdd_wlan_suspended) &&
-                   (eCSR_ROAM_RESULT_NONE == roamResult))
+                   ((eCSR_ROAM_RESULT_NONE == roamResult)||
+                     (pRoamInfo && pRoamInfo->is11rAssoc)))
                 {
                     /* Send DTIM period to the FW; only if the wlan is already
                        in suspend. This is the case with roaming (reassoc),
@@ -3398,7 +3521,8 @@
                 if ((pHddCtx) &&
                     (FULL_POWER == pmcGetPmcState(pHddCtx->hHal)) &&
                     (VOS_TRUE == pHddStaCtx->hdd_ReassocScenario) &&
-                    (eCSR_ROAM_RESULT_NONE == roamResult))
+                    ((eCSR_ROAM_RESULT_NONE == roamResult) ||
+                      (pRoamInfo && pRoamInfo->is11rAssoc)))
                 {
                     hddLog( LOG1, FL("Device in full power."
                            "Stop and start traffic timer for roaming"));
@@ -3411,7 +3535,8 @@
                 }
 
                 halStatus = hdd_RoamSetKeyCompleteHandler( pAdapter, pRoamInfo, roamId, roamStatus, roamResult );
-                if (eCSR_ROAM_RESULT_NONE == roamResult)
+                if ((eCSR_ROAM_RESULT_NONE == roamResult) ||
+                     (pRoamInfo && pRoamInfo->is11rAssoc))
                     pHddStaCtx->hdd_ReassocScenario = FALSE;
             }
             break;
@@ -3523,6 +3648,20 @@
             pAdapter->maxRateFlags = roamResult;
             break;
          }
+       case eCSR_ROAM_UPDATE_SCAN_RESULT:
+         if (pRoamInfo && pRoamInfo->pBssDesc) {
+              bss_status = wlan_hdd_cfg80211_inform_bss_frame(pAdapter,
+                                pRoamInfo->pBssDesc);
+              if (bss_status)
+                  cfg80211_put_bss(
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)) || defined(WITH_BACKPORTS)
+                                   (WLAN_HDD_GET_CTX(pAdapter))->wiphy,
+#endif
+                                   bss_status);
+              else
+                  hddLog(LOG1, FL("UPDATE_SCAN_RESULT returned NULL"));
+         }
+         break;
        default:
             break;
     }
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_cfg.c b/wlan/prima/CORE/HDD/src/wlan_hdd_cfg.c
index d5dffeb..c659b1c 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_cfg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -54,7 +54,6 @@
 #include <wlan_hdd_main.h>
 #include <wlan_hdd_assoc.h>
 #include <wlan_hdd_cfg.h>
-#include <wlan_hdd_tdls.h>
 #include <linux/string.h>
 #include <vos_types.h>
 #include <csrApi.h>
@@ -2777,6 +2776,69 @@
                         CFG_ENABLE_FAST_ROAM_IN_CONCURRENCY_MIN,
                         CFG_ENABLE_FAST_ROAM_IN_CONCURRENCY_MAX,
                         cbNotifySetEnableFastRoamInConcurrency, 0 ),
+
+   REG_VARIABLE(CFG_PER_ROAM_SCAN_OFFLOAD_ENABLED, WLAN_PARAM_Integer,
+                 hdd_config_t, isPERRoamEnabled,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_OFFLOAD_ENABLED_DEFAULT,
+                 CFG_PER_ROAM_SCAN_OFFLOAD_ENABLED_MIN,
+                 CFG_PER_ROAM_SCAN_OFFLOAD_ENABLED_MAX),
+
+   REG_VARIABLE(CFG_PER_ROAM_SCAN_RATE_UP_THRESHOLD, WLAN_PARAM_Integer,
+                 hdd_config_t, rateUpThreshold,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_RATE_UP_THRESHOLD_DEFAULT,
+                 CFG_PER_ROAM_SCAN_RATE_UP_THRESHOLD_MIN,
+                 CFG_PER_ROAM_SCAN_RATE_UP_THRESHOLD_MAX),
+
+   REG_VARIABLE(CFG_PER_ROAM_SCAN_RATE_DOWN_THRESHOLD, WLAN_PARAM_Integer,
+                 hdd_config_t, rateDownThreshold,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_RATE_DOWN_THRESHOLD_DEFAULT,
+                 CFG_PER_ROAM_SCAN_RATE_DOWN_THRESHOLD_MIN,
+                 CFG_PER_ROAM_SCAN_RATE_DOWN_THRESHOLD_MAX),
+
+   REG_VARIABLE(CFG_PER_ROAM_SCAN_WAIT_TIME, WLAN_PARAM_Integer,
+                 hdd_config_t, waitPeriodForNextPERScan,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_WAIT_TIME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_WAIT_TIME_MIN,
+                 CFG_PER_ROAM_SCAN_WAIT_TIME_MAX),
+
+   REG_VARIABLE(CFG_PER_ROAM_SCAN_PER_TIME_THRESHOLD, WLAN_PARAM_Integer,
+                 hdd_config_t, PERtimerThreshold,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_PER_TIME_THRESHOLD_DEFAULT,
+                 CFG_PER_ROAM_SCAN_PER_TIME_THRESHOLD_MIN,
+                 CFG_PER_ROAM_SCAN_PER_TIME_THRESHOLD_MAX),
+
+   REG_VARIABLE(CFG_PER_ROAM_SCAN_RX_MONITOR_ENABLED, WLAN_PARAM_Integer,
+                 hdd_config_t, isPERRoamRxPathEnabled,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_RX_MONITOR_ENABLED_DEFAULT,
+                 CFG_PER_ROAM_SCAN_RX_MONITOR_ENABLED_MIN,
+                 CFG_PER_ROAM_SCAN_RX_MONITOR_ENABLED_MAX),
+
+   REG_VARIABLE(CFG_PER_ROAM_SCAN_MIN_PERCENTAGE, WLAN_PARAM_Integer,
+                 hdd_config_t, PERroamTriggerPercent,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_MIN_PERCENTAGE_DEFAULT,
+                 CFG_PER_ROAM_SCAN_MIN_PERCENTAGE_MIN,
+                 CFG_PER_ROAM_SCAN_MIN_PERCENTAGE_MAX),
+
+   REG_VARIABLE(CFG_PER_ROAM_SCAN_RX_MIN_PACKETS, WLAN_PARAM_Integer,
+                 hdd_config_t, PERroamRxPktsThreshold,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_RX_MIN_PACKETS_DEFAULT,
+                 CFG_PER_ROAM_SCAN_RX_MIN_PACKETS_MIN,
+                 CFG_PER_ROAM_SCAN_RX_MIN_PACKETS_MAX),
+
+   REG_VARIABLE(CFG_PER_ROAM_SCAN_CCA_ENABLED, WLAN_PARAM_Integer,
+                 hdd_config_t, isPERRoamCCAEnabled,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PER_ROAM_SCAN_CCA_ENABLED_DEFAULT,
+                 CFG_PER_ROAM_SCAN_CCA_ENABLED_MIN,
+                 CFG_PER_ROAM_SCAN_CCA_ENABLED_MAX),
 #endif
 
    REG_VARIABLE( CFG_ENABLE_ADAPT_RX_DRAIN_NAME, WLAN_PARAM_Integer,
@@ -3053,6 +3115,21 @@
                  CFG_WLAN_LOGGING_NUM_BUF_DEFAULT,
                  CFG_WLAN_LOGGING_NUM_BUF_MIN,
                  CFG_WLAN_LOGGING_NUM_BUF_MAX ),
+
+   REG_VARIABLE( CFG_WLAN_PKT_STATS_LOGGING_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, wlanPerPktStatsLogEnable,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_WLAN_PKT_STATS_LOGGING_DEFAULT,
+                 CFG_WLAN_PKT_STATS_LOGGING_DISABLE,
+                 CFG_WLAN_PKT_STATS_LOGGING_ENABLE ),
+
+   REG_VARIABLE( CFG_WLAN_PKT_STATS_NUM_BUF_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, wlanPerPktStatsNumBuf,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_WLAN_PKT_STATS_NUM_BUF_DEFAULT,
+                 CFG_WLAN_PKT_STATS_NUM_BUF_MIN,
+                 CFG_WLAN_PKT_STATS_NUM_BUF_MAX ),
+
 #endif //WLAN_LOGGING_SOCK_SVC_ENABLE
 
    REG_VARIABLE( CFG_IGNORE_PEER_ERP_INFO_NAME, WLAN_PARAM_Integer,
@@ -3157,6 +3234,13 @@
                 CFG_DISABLE_P2P_MAC_ADDR_SPOOFING_MIN,
                 CFG_DISABLE_P2P_MAC_ADDR_SPOOFING_MAX),
 
+   REG_VARIABLE(CFG_ENABLE_FATAL_EVENT_TRIGGER, WLAN_PARAM_Integer,
+                hdd_config_t, enableFatalEvent,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_ENABLE_FATAL_EVENT_TRIGGER_DEFAULT,
+                CFG_ENABLE_FATAL_EVENT_TRIGGER_MIN,
+                CFG_ENABLE_FATAL_EVENT_TRIGGER_MAX),
+
    REG_VARIABLE(CFG_ENABLE_MGMT_LOGGING, WLAN_PARAM_Integer,
                 hdd_config_t, enableMgmtLogging,
                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -3377,6 +3461,27 @@
                  CFG_BTC_STATIC_OPP_WLAN_IDLE_BT_LEN_MIN,
                  CFG_BTC_STATIC_OPP_WLAN_IDLE_BT_LEN_MAX ),
 
+   REG_VARIABLE( CFG_TCP_DELACK_COMPUTE_INTERVAL, WLAN_PARAM_Integer,
+                 hdd_config_t, tcpDelAckComputeInterval,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_TCP_DELACK_COMPUTE_INTERVAL_DEFAULT,
+                 CFG_TCP_DELACK_COMPUTE_INTERVAL_MIN,
+                 CFG_TCP_DELACK_COMPUTE_INTERVAL_MAX),
+
+   REG_VARIABLE( CFG_TCP_DELACK_THRESHOLD_HIGH, WLAN_PARAM_Integer,
+                hdd_config_t, tcpDelAckThresholdHigh,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_TCP_DELACK_THRESHOLD_HIGH_DEFAULT,
+                CFG_TCP_DELACK_THRESHOLD_HIGH_MIN,
+                CFG_TCP_DELACK_THRESHOLD_HIGH_MAX ),
+
+   REG_VARIABLE( CFG_TCP_DELACK_THRESHOLD_LOW, WLAN_PARAM_Integer,
+                hdd_config_t, tcpDelAckThresholdLow,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_TCP_DELACK_THRESHOLD_LOW_DEFAULT,
+                CFG_TCP_DELACK_THRESHOLD_LOW_MIN,
+                CFG_TCP_DELACK_THRESHOLD_LOW_MAX ),
+
    REG_VARIABLE( CFG_LINK_FAIL_TIMEOUT_NAME , WLAN_PARAM_Integer,
                  hdd_config_t, linkFailTimeout,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -3390,18 +3495,34 @@
                  CFG_LINK_FAIL_TX_CNT_DEF,
                  CFG_LINK_FAIL_TX_CNT_MIN,
                  CFG_LINK_FAIL_TX_CNT_MAX ),
+
    REG_VARIABLE( CFG_OPTIMIZE_CA_EVENT_NAME, WLAN_PARAM_Integer,
                  hdd_config_t, gOptimizeCAevent,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
                  CFG_OPTIMIZE_CA_EVENT_DEFAULT,
                  CFG_OPTIMIZE_CA_EVENT_DISABLE,
                  CFG_OPTIMIZE_CA_EVENT_ENABLE ),
-   REG_VARIABLE( CFG_ENABLE_CRASH_INJECT, WLAN_PARAM_Integer,
-                 hdd_config_t, crash_inject_enabled,
+
+   REG_VARIABLE(CFG_FWR_MEM_DUMP_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t,enableFwrMemDump,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_ENABLE_CRASH_INJECT_DEFAULT,
-                 CFG_ENABLE_CRASH_INJECT_MIN,
-                 CFG_ENABLE_CRASH_INJECT_MAX),
+                 CFG_FWR_MEM_DUMP_DEF,
+                 CFG_FWR_MEM_DUMP_MIN,
+                 CFG_FWR_MEM_DUMP_MAX),
+
+   REG_VARIABLE( CFG_ACTIVE_PASSIVE_CHAN_CONV_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, gActivePassiveChCon,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_ACTIVE_PASSIVE_CHAN_CONV_DEF,
+                 CFG_ACTIVE_PASSIVE_CHAN_CONV_MIN,
+                 CFG_ACTIVE_PASSIVE_CHAN_CONV_MAX ),
+
+   REG_VARIABLE( CFG_EXT_SCAN_CONC_MODE , WLAN_PARAM_Integer,
+                 hdd_config_t, cfgExtScanConcMode,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_EXT_SCAN_CONC_MODE_DEFAULT,
+                 CFG_EXT_SCAN_CONC_MODE_MIN,
+                 CFG_EXT_SCAN_CONC_MODE_MAX ),
 
     REG_VARIABLE( CFG_RPS_CPU_MAP_NAME, WLAN_PARAM_HexInteger,
                  hdd_config_t, rps_mask,
@@ -3410,12 +3531,173 @@
                  CFG_RPS_CPU_MAP_MIN,
                  CFG_RPS_CPU_MAP_MAX),
 
-    REG_VARIABLE(CFG_SAR_BOFFSET_SET_CORRECTION_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, boffset_correction_enable,
+   REG_VARIABLE( CFG_WIFI_CONFIG_ENABLE, WLAN_PARAM_Integer,
+                 hdd_config_t, fEnableWifiConfig,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_SAR_BOFFSET_SET_CORRECTION_DEFAULT,
-                 CFG_SAR_BOFFSET_SET_CORRECTION_MIN,
-                 CFG_SAR_BOFFSET_SET_CORRECTION_MAX),
+                 CFG_WIFI_CONFIG_DEFAULT,
+                 CFG_WIFI_CONFIG_MIN,
+                 CFG_WIFI_CONFIG_MAX ),
+
+  REG_VARIABLE( CFG_ENABLE_CRASH_INJECT, WLAN_PARAM_Integer,
+                hdd_config_t, crash_inject_enabled,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_ENABLE_CRASH_INJECT_DEFAULT,
+                CFG_ENABLE_CRASH_INJECT_MIN,
+                CFG_ENABLE_CRASH_INJECT_MAX),
+
+  REG_VARIABLE( CFG_ENABLE_TCP_DELACK_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, enable_delack,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_ENABLE_TCP_DELACK_DEFAULT,
+                 CFG_ENABLE_TCP_DELACK_MIN,
+                 CFG_ENABLE_TCP_DELACK_MAX ),
+
+  REG_VARIABLE( CFG_DISABLE_BAR_WAKEUP_HOST_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, disableBarWakeUp,
+                 VAR_FLAGS_OPTIONAL |
+                 VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_DISABLE_BAR_WAKEUP_HOST_DEFAULT,
+                 CFG_DISABLE_BAR_WAKEUP_HOST_MIN,
+                 CFG_DISABLE_BAR_WAKEUP_HOST_MAX),
+
+  REG_VARIABLE( CFG_MAXCHAN_FOR_CHANTIME_CORR_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, max_chan_for_dwell_time_cfg,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_MAXCHAN_FOR_CHANTIME_CORR_DEFAULT,
+                 CFG_MAXCHAN_FOR_CHANTIME_CORR_MIN,
+                 CFG_MAXCHAN_FOR_CHANTIME_CORR_MAX ),
+
+  REG_VARIABLE(CFG_TDLS_ENABLE_DEFER_TIMER, WLAN_PARAM_Integer,
+               hdd_config_t, tdls_enable_defer_time,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_TDLS_ENABLE_DEFER_TIMER_DEFAULT,
+               CFG_TDLS_ENABLE_DEFER_TIMER_MIN,
+               CFG_TDLS_ENABLE_DEFER_TIMER_MAX),
+
+  REG_VARIABLE(CFG_SAR_BOFFSET_SET_CORRECTION_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, boffset_correction_enable,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_SAR_BOFFSET_SET_CORRECTION_DEFAULT,
+               CFG_SAR_BOFFSET_SET_CORRECTION_MIN,
+               CFG_SAR_BOFFSET_SET_CORRECTION_MAX),
+
+  REG_VARIABLE(CFG_ENABLE_EDCA_INI_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, enable_edca_params,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_ENABLE_EDCA_INI_DEFAULT,
+               CFG_ENABLE_EDCA_INI_MIN,
+               CFG_ENABLE_EDCA_INI_MAX),
+
+  REG_VARIABLE(CFG_EDCA_VO_CWMIN_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_vo_cwmin,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_VO_CWMIN_VALUE_DEFAULT,
+               CFG_EDCA_VO_CWMIN_VALUE_MIN,
+               CFG_EDCA_VO_CWMIN_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_VI_CWMIN_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_vi_cwmin,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_VI_CWMIN_VALUE_DEFAULT,
+               CFG_EDCA_VI_CWMIN_VALUE_MIN,
+               CFG_EDCA_VI_CWMIN_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_BK_CWMIN_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_bk_cwmin,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_BK_CWMIN_VALUE_DEFAULT,
+               CFG_EDCA_BK_CWMIN_VALUE_MIN,
+               CFG_EDCA_BK_CWMIN_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_BE_CWMIN_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_be_cwmin,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_BE_CWMIN_VALUE_DEFAULT,
+               CFG_EDCA_BE_CWMIN_VALUE_MIN,
+               CFG_EDCA_BE_CWMIN_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_VO_CWMAX_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_vo_cwmax,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_VO_CWMAX_VALUE_DEFAULT,
+               CFG_EDCA_VO_CWMAX_VALUE_MIN,
+               CFG_EDCA_VO_CWMAX_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_VI_CWMAX_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_vi_cwmax,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_VI_CWMAX_VALUE_DEFAULT,
+               CFG_EDCA_VI_CWMAX_VALUE_MIN,
+               CFG_EDCA_VI_CWMAX_VALUE_MAX),
+
+ REG_VARIABLE(CFG_EDCA_BK_CWMAX_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_bk_cwmax,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_BK_CWMAX_VALUE_DEFAULT,
+               CFG_EDCA_BK_CWMAX_VALUE_MIN,
+               CFG_EDCA_BK_CWMAX_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_BE_CWMAX_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_be_cwmax,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_BE_CWMAX_VALUE_DEFAULT,
+               CFG_EDCA_BE_CWMAX_VALUE_MIN,
+               CFG_EDCA_BE_CWMAX_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_VO_AIFS_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_vo_aifs,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_VO_AIFS_VALUE_DEFAULT,
+               CFG_EDCA_VO_AIFS_VALUE_MIN,
+               CFG_EDCA_VO_AIFS_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_VI_AIFS_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_vi_aifs,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_VI_AIFS_VALUE_DEFAULT,
+               CFG_EDCA_VI_AIFS_VALUE_MIN,
+               CFG_EDCA_VI_AIFS_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_BK_AIFS_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_bk_aifs,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_BK_AIFS_VALUE_DEFAULT,
+               CFG_EDCA_BK_AIFS_VALUE_MIN,
+               CFG_EDCA_BK_AIFS_VALUE_MAX),
+
+  REG_VARIABLE(CFG_EDCA_BE_AIFS_VALUE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, edca_be_aifs,
+               VAR_FLAGS_OPTIONAL |
+               VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_EDCA_BE_AIFS_VALUE_DEFAULT,
+               CFG_EDCA_BE_AIFS_VALUE_MIN,
+               CFG_EDCA_BE_AIFS_VALUE_MAX),
+
+  REG_VARIABLE( CFG_SEND_MGMT_PKT_VIA_WQ5_NAME , WLAN_PARAM_Integer,
+               hdd_config_t, sendMgmtPktViaWQ5,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_SEND_MGMT_PKT_VIA_WQ5_DEF,
+               CFG_SEND_MGMT_PKT_VIA_WQ5_MIN,
+               CFG_SEND_MGMT_PKT_VIA_WQ5_MAX ),
+
+  REG_VARIABLE(CFG_SAP_PROBE_RESP_OFFLOAD_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, sap_probe_resp_offload,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_SAP_PROBE_RESP_OFFLOAD_DEFAULT,
+               CFG_SAP_PROBE_RESP_OFFLOAD_MIN,
+               CFG_SAP_PROBE_RESP_OFFLOAD_MAX),
 };
 
 /*
@@ -3827,6 +4109,9 @@
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
                     "Name = [disableP2PMacSpoofing] Value = [%u] ",
                                        pHddCtx->cfg_ini->disableP2PMacSpoofing);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+                    "Name = [enableFatalEvent] Value = [%u] ",
+                                       pHddCtx->cfg_ini->enableFatalEvent);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gRoamtoDFSChannel] Value = [%u] ",pHddCtx->cfg_ini->allowDFSChannelRoam);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gMaxConcurrentActiveSessions] Value = [%u] ", pHddCtx->cfg_ini->gMaxConcurrentActiveSessions);
 #ifdef WLAN_FEATURE_AP_HT40_24G
@@ -3839,7 +4124,131 @@
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gDxeReplenishRXTimerVal] Value = [%u] ", pHddCtx->cfg_ini->dxeReplenishRXTimerVal);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gDxeSSREnable] Value = [%u] ", pHddCtx->cfg_ini->dxeSSREnable);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [toggleArpBDRates] Value = [%u] ", pHddCtx->cfg_ini->toggleArpBDRates);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [ExtScanConcMode] Value = [%u] ", pHddCtx->cfg_ini->cfgExtScanConcMode);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gEnableForceTargetAssert] Value = [%u] ", pHddCtx->cfg_ini->crash_inject_enabled);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gTcpDelAckComputeInterval] Value = [%u] ",
+          pHddCtx->cfg_ini->tcpDelAckComputeInterval);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gTcpDelAckThresholdHigh] Value = [%u] ",
+          pHddCtx->cfg_ini->tcpDelAckThresholdHigh);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gTcpDelAckThresholdLow] Value = [%u] ",
+          pHddCtx->cfg_ini->tcpDelAckThresholdLow);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gEnableDelAck] Value = [%u] ",
+          pHddCtx->cfg_ini->enable_delack);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [disableBarWakeUp] Value = [%u] ",
+          pHddCtx->cfg_ini->disableBarWakeUp);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gMaxChannelForMoreDwellTime] Value = [%u] ",
+          pHddCtx->cfg_ini->max_chan_for_dwell_time_cfg);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+           "Name = [gTDLSEnableDeferTime] Value = [%u] ",
+           pHddCtx->cfg_ini->tdls_enable_defer_time);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_ENABLE_EDCA_INI_NAME,
+          pHddCtx->cfg_ini->enable_edca_params);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_VO_CWMIN_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_vo_cwmin);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_VI_CWMIN_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_vi_cwmin);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_BK_CWMIN_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_bk_cwmin);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_BE_CWMIN_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_be_cwmin);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_VO_CWMAX_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_vo_cwmax);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_VI_CWMAX_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_vi_cwmax);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_BK_CWMAX_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_bk_cwmax);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_BE_CWMAX_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_be_cwmax);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_VO_AIFS_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_vo_aifs);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_VI_AIFS_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_vi_aifs);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_BK_AIFS_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_bk_aifs);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [%s] Value = [%u] ",
+          CFG_EDCA_BE_AIFS_VALUE_NAME,
+          pHddCtx->cfg_ini->edca_be_aifs);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gSendMgmtPktViaWQ5] Value = [%u] ",
+          pHddCtx->cfg_ini->sendMgmtPktViaWQ5);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+            "Name = [%s] Value = [%u] ", CFG_SAP_PROBE_RESP_OFFLOAD_NAME,
+            pHddCtx->cfg_ini->sap_probe_resp_offload);
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gPERRoamStatsTime] Value = [%lu] ",
+          (long unsigned int)pHddCtx->cfg_ini->PERtimerThreshold);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gPERRoamRxMonitorEnabled] Value = [%u] ",
+          pHddCtx->cfg_ini->isPERRoamRxPathEnabled);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gPERRoamTriggerPercent] Value = [%u] ",
+          pHddCtx->cfg_ini->PERroamTriggerPercent);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gPERRoamRxPktThreshold] Value = [%u] ",
+          pHddCtx->cfg_ini->PERroamRxPktsThreshold);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gPERRoamCCAEnabled] Value = [%u] ",
+          pHddCtx->cfg_ini->isPERRoamCCAEnabled);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gPERRoamScanInterval] Value = [%lu] ",
+          (long unsigned int)pHddCtx->cfg_ini->waitPeriodForNextPERScan);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gPERRoamDownThresholdRate] Value = [%u] ",
+          pHddCtx->cfg_ini->rateDownThreshold);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gPERRoamEnable] Value = [%u] ",
+          pHddCtx->cfg_ini->isPERRoamEnabled);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+          "Name = [gPERRoamUpThresholdRate] Value = [%u] ",
+          pHddCtx->cfg_ini->rateUpThreshold);
+#endif
 }
 
 
@@ -3917,7 +4326,7 @@
       // ideally we want to return the config to the application
       // however the config is too big so we just printk() for now
 #ifdef RETURN_IN_BUFFER
-      if (curlen <= buflen)
+      if (curlen < buflen)
       {
          // copy string + '\0'
          memcpy(pCur, configStr, curlen+1);
@@ -5400,6 +5809,20 @@
       fStatus = FALSE;
       hddLog(LOGE, "Could not pass on WNI_CFG_OPTIMIZE_CA_EVENT ");
    }
+   if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_EXT_SCAN_CONC_MODE, pConfig->cfgExtScanConcMode,
+      NULL, eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE)
+   {
+      fStatus = FALSE;
+      hddLog(LOGE, "Could not pass on WNI_CFG_EXT_SCAN_CONC_MODE to CCM");
+   }
+
+   if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_ACTIVE_PASSIVE_CON,
+                    pConfig->gActivePassiveChCon, NULL,
+                    eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE)
+   {
+      fStatus = FALSE;
+      hddLog(LOGE, "Could not pass on WNI_CFG_ACTIVE_PASSIVE_CON ");
+   }
 
    if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_ENABLE_MAC_ADDR_SPOOFING,
                     pConfig->enableMacSpoofing, NULL,
@@ -5409,6 +5832,14 @@
       hddLog(LOGE, "Could not pass on WNI_CFG_ENABLE_MAC_ADDR_SPOOFING ");
    }
 
+   if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_DISABLE_BAR_WAKE_UP_HOST,
+               pConfig->disableBarWakeUp,
+               NULL, eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE)
+   {
+       fStatus = FALSE;
+       hddLog(LOGE, "Could not pass on WNI_CFG_DISABLE_BAR_WAKE_UP_HOST to CCM");
+   }
+
    if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_SAR_BOFFSET_SET_CORRECTION,
                pConfig->boffset_correction_enable,
                NULL, eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE)
@@ -5416,7 +5847,6 @@
        fStatus = FALSE;
        hddLog(LOGE, "Could not pass on WNI_CFG_SAR_BOFFSET_SET_CORRECTION to CCM");
    }
-
    return fStatus;
 }
 
@@ -5599,8 +6029,20 @@
    smeConfig->csrConfig.isWESModeEnabled = pConfig->isWESModeEnabled;
 #endif
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-   smeConfig->csrConfig.isRoamOffloadScanEnabled = pConfig->isRoamOffloadScanEnabled;
-   smeConfig->csrConfig.bFastRoamInConIniFeatureEnabled = pConfig->bFastRoamInConIniFeatureEnabled;
+   smeConfig->csrConfig.isRoamOffloadScanEnabled =
+           pConfig->isRoamOffloadScanEnabled;
+   smeConfig->csrConfig.bFastRoamInConIniFeatureEnabled =
+           pConfig->bFastRoamInConIniFeatureEnabled;
+   smeConfig->csrConfig.isPERRoamEnabled =
+           pConfig->isPERRoamEnabled;
+   smeConfig->csrConfig.rateUpThreshold = pConfig->rateUpThreshold;
+   smeConfig->csrConfig.rateDownThreshold = pConfig->rateDownThreshold;
+   smeConfig->csrConfig.waitPeriodForNextPERScan =
+           pConfig->waitPeriodForNextPERScan;
+   smeConfig->csrConfig.PERtimerThreshold = pConfig->PERtimerThreshold;
+   smeConfig->csrConfig.isPERRoamCCAEnabled = pConfig->isPERRoamCCAEnabled;
+   smeConfig->csrConfig.PERroamTriggerPercent = pConfig->PERroamTriggerPercent;
+
 
    if (0 == smeConfig->csrConfig.isRoamOffloadScanEnabled)
    {
@@ -5651,6 +6093,7 @@
    smeConfig->csrConfig.ignorePeerErpInfo = pConfig->ignorePeerErpInfo;
    smeConfig->csrConfig.ignorePeerHTopMode = pConfig->ignorePeerHTopMode;
    smeConfig->csrConfig.disableP2PMacSpoofing = pConfig->disableP2PMacSpoofing;
+   smeConfig->csrConfig.enableFatalEvent= pConfig->enableFatalEvent;
    smeConfig->csrConfig.initialScanSkipDFSCh = pConfig->initialScanSkipDFSCh;
 
    smeConfig->csrConfig.isCoalesingInIBSSAllowed =
@@ -5672,6 +6115,42 @@
    smeConfig->fDeferIMPSTime = pHddCtx->cfg_ini->deferImpsTime;
    smeConfig->fBtcEnableIndTimerVal = pHddCtx->cfg_ini->btcEnableIndTimerVal;
    smeConfig->csrConfig.roamDelayStatsEnabled = pHddCtx->cfg_ini->gEnableRoamDelayStats;
+   smeConfig->csrConfig.max_chan_for_dwell_time_cfg =
+                        pHddCtx->cfg_ini->max_chan_for_dwell_time_cfg;
+
+   smeConfig->csrConfig.enable_edca_params =
+                        pHddCtx->cfg_ini->enable_edca_params;
+
+   smeConfig->csrConfig.edca_vo_cwmin =
+                        pHddCtx->cfg_ini->edca_vo_cwmin;
+   smeConfig->csrConfig.edca_vi_cwmin =
+                        pHddCtx->cfg_ini->edca_vi_cwmin;
+   smeConfig->csrConfig.edca_bk_cwmin =
+                        pHddCtx->cfg_ini->edca_bk_cwmin;
+   smeConfig->csrConfig.edca_be_cwmin =
+                        pHddCtx->cfg_ini->edca_be_cwmin;
+
+   smeConfig->csrConfig.edca_vo_cwmax =
+                        pHddCtx->cfg_ini->edca_vo_cwmax;
+   smeConfig->csrConfig.edca_vi_cwmax =
+                        pHddCtx->cfg_ini->edca_vi_cwmax;
+   smeConfig->csrConfig.edca_bk_cwmax =
+                        pHddCtx->cfg_ini->edca_bk_cwmax;
+   smeConfig->csrConfig.edca_be_cwmax =
+                        pHddCtx->cfg_ini->edca_be_cwmax;
+
+   smeConfig->csrConfig.edca_vo_aifs =
+                        pHddCtx->cfg_ini->edca_vo_aifs;
+   smeConfig->csrConfig.edca_vi_aifs =
+                        pHddCtx->cfg_ini->edca_vi_aifs;
+   smeConfig->csrConfig.edca_bk_aifs =
+                        pHddCtx->cfg_ini->edca_bk_aifs;
+   smeConfig->csrConfig.edca_be_aifs =
+                        pHddCtx->cfg_ini->edca_be_aifs;
+
+
+   sme_set_mgmt_frm_via_wq5((tHalHandle)(pHddCtx->hHal),
+           pHddCtx->cfg_ini->sendMgmtPktViaWQ5);
 
    vos_set_multicast_logging(pHddCtx->cfg_ini->multicast_host_msgs);
    halStatus = sme_UpdateConfig( pHddCtx->hHal, smeConfig);
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_cfg80211.c b/wlan/prima/CORE/HDD/src/wlan_hdd_cfg80211.c
index ce7fdfa..d66639b 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -95,6 +95,9 @@
 #include "wlan_qct_wda.h"
 #include "wlan_nv.h"
 #include "wlan_hdd_dev_pwr.h"
+#include "qwlan_version.h"
+#include "wlan_logging_sock_svc.h"
+
 
 #define g_mode_rates_size (12)
 #define a_mode_rates_size (8)
@@ -177,6 +180,8 @@
 #define MAC_ADDR_SPOOFING_FW_HOST_DISABLE           0
 #define MAC_ADDR_SPOOFING_FW_HOST_ENABLE            1
 #define MAC_ADDR_SPOOFING_FW_ENABLE_HOST_DISABLE    2
+#define MAC_ADDR_SPOOFING_DEFER_INTERVAL            10 //in ms
+
 
 static const u32 hdd_cipher_suites[] =
 {
@@ -222,13 +227,6 @@
     HDD2GHZCHAN(2484, 14, 0) ,
 };
 
-static struct ieee80211_channel hdd_social_channels_2_4_GHZ[] =
-{
-    HDD2GHZCHAN(2412, 1, 0) ,
-    HDD2GHZCHAN(2437, 6, 0) ,
-    HDD2GHZCHAN(2462, 11, 0) ,
-};
-
 const static struct ieee80211_channel hdd_channels_5_GHZ[] =
 {
     HDD5GHZCHAN(4920, 240, 0) ,
@@ -314,25 +312,6 @@
     .ht_cap.mcs.tx_params  = IEEE80211_HT_MCS_TX_DEFINED,
 };
 
-static struct ieee80211_supported_band wlan_hdd_band_p2p_2_4_GHZ =
-{
-    .channels = hdd_social_channels_2_4_GHZ,
-    .n_channels = ARRAY_SIZE(hdd_social_channels_2_4_GHZ),
-    .band       = IEEE80211_BAND_2GHZ,
-    .bitrates = g_mode_rates,
-    .n_bitrates = g_mode_rates_size,
-    .ht_cap.ht_supported   = 1,
-    .ht_cap.cap            =  IEEE80211_HT_CAP_SGI_20
-                            | IEEE80211_HT_CAP_GRN_FLD
-                            | IEEE80211_HT_CAP_DSSSCCK40
-                            | IEEE80211_HT_CAP_LSIG_TXOP_PROT,
-    .ht_cap.ampdu_factor   = IEEE80211_HT_MAX_AMPDU_64K,
-    .ht_cap.ampdu_density  = IEEE80211_HT_MPDU_DENSITY_16,
-    .ht_cap.mcs.rx_mask    = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
-    .ht_cap.mcs.rx_highest = cpu_to_le16( 72 ),
-    .ht_cap.mcs.tx_params  = IEEE80211_HT_MCS_TX_DEFINED,
-};
-
 static struct ieee80211_supported_band wlan_hdd_band_5_GHZ =
 {
     .channels = NULL,
@@ -1107,11 +1086,47 @@
                     pWifiIfaceStat->rssiAck))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
-                FL("QCA_WLAN_VENDOR_ATTR put fail"));
-        vos_mem_free(pWifiIfaceStatTL);
+               FL("QCA_WLAN_VENDOR_ATTR put fail"));
+               vos_mem_free(pWifiIfaceStatTL);
         return FALSE;
     }
 
+#ifdef FEATURE_EXT_LL_STAT
+   /*
+    * Ensure when EXT_LL_STAT is supported by both host and fwr,
+    * then host should send Leaky AP stats to upper layer,
+    * otherwise no need to send these stats.
+    */
+   if(sme_IsFeatureSupportedByFW(EXT_LL_STAT) &&
+      sme_IsFeatureSupportedByDriver(EXT_LL_STAT)
+     )
+   {
+       hddLog(VOS_TRACE_LEVEL_INFO,
+              FL("EXT_LL_STAT is supported by fwr and host %u %u %u %llu"),
+              pWifiIfaceStat->leakyApStat.is_leaky_ap,
+              pWifiIfaceStat->leakyApStat.avg_rx_frms_leaked,
+              pWifiIfaceStat->leakyApStat.rx_leak_window,
+              pWifiIfaceStat->leakyApStat.avg_bcn_spread);
+       if (nla_put_u32(vendor_event,
+               QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_LEAKY_AP_DETECTED,
+               pWifiIfaceStat->leakyApStat.is_leaky_ap) ||
+           nla_put_u32(vendor_event,
+               QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_LEAKY_AP_AVG_NUM_FRAMES_LEAKED,
+               pWifiIfaceStat->leakyApStat.avg_rx_frms_leaked) ||
+           nla_put_u32(vendor_event,
+               QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_LEAKY_AP_GUARD_TIME,
+               pWifiIfaceStat->leakyApStat.rx_leak_window) ||
+           nla_put_u64(vendor_event,
+               QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_AVERAGE_TSF_OFFSET,
+               pWifiIfaceStat->leakyApStat.avg_bcn_spread))
+       {
+           hddLog(VOS_TRACE_LEVEL_ERROR,
+                  FL("EXT_LL_STAT put fail"));
+           vos_mem_free(pWifiIfaceStatTL);
+           return FALSE;
+       }
+   }
+#endif
     wmmInfo = nla_nest_start(vendor_event,
                             QCA_WLAN_VENDOR_ATTR_LL_STATS_WMM_INFO);
     if(!wmmInfo)
@@ -1393,6 +1408,7 @@
            "WMI_LINK_STATS_IFACE Data");
 
     cfg80211_vendor_cmd_reply(vendor_event);
+
     EXIT();
 }
 
@@ -1600,13 +1616,14 @@
     {
     case SIR_HAL_LL_STATS_RESULTS_RSP:
         {
-           hddLog(VOS_TRACE_LEVEL_INFO,
+            hddLog(VOS_TRACE_LEVEL_INFO,
                     "LL_STATS RESP paramID = 0x%x, ifaceId = %u MAC: %pM "
                     "respId = %u, moreResultToFollow = %u",
-                    linkLayerStatsResults->paramId, linkLayerStatsResults->ifaceId,
-                    macAddr, linkLayerStatsResults->respId,
-                    linkLayerStatsResults->moreResultToFollow);
-           spin_lock(&hdd_context_lock);
+                 linkLayerStatsResults->paramId, linkLayerStatsResults->ifaceId,
+                 macAddr, linkLayerStatsResults->respId,
+                 linkLayerStatsResults->moreResultToFollow);
+
+            spin_lock(&hdd_context_lock);
             context = &pHddCtx->ll_stats_context;
             /* validate response received from target */
             if ((context->request_id != linkLayerStatsResults->respId) ||
@@ -1859,7 +1876,7 @@
 
     if (!pAdapter->isLinkLayerStatsSet)
     {
-        hddLog(VOS_TRACE_LEVEL_FATAL,
+        hddLog(VOS_TRACE_LEVEL_ERROR,
                "%s: isLinkLayerStatsSet : %d",
                __func__, pAdapter->isLinkLayerStatsSet);
         return -EINVAL;
@@ -2143,13 +2160,21 @@
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_PERIOD] = { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_REPORT_EVENTS] =
                                                             { .type = NLA_U8 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_MAX_PERIOD] =
+                                                            { .type = NLA_U32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_EXPONENT] =
+                                                            { .type = NLA_U32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_STEP_COUNT] =
+                                                            { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS] =
                                                             { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_BASE_PERIOD] =
                                                             { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_MAX_AP_PER_SCAN] =
                                                             { .type = NLA_U32 },
-    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD] =
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_PERCENT] =
+                                                            { .type = NLA_U8 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_NUM_SCANS] =
                                                             { .type = NLA_U8 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS] =
                                                             { .type = NLA_U8 },
@@ -2168,22 +2193,39 @@
                                                             { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_NUM_AP] =
                                                             { .type = NLA_U32 },
-    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_RSSI_SAMPLE_SIZE] =
-                                                         { .type = NLA_U32 },
-    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_LOST_AP_SAMPLE_SIZE]
-                                                         = { .type = NLA_U32 },
-    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_MIN_BREACHING] =
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_LOST_AP_SAMPLE_SIZE] =
+                                                            { .type = NLA_U32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_SSID] =
+                                                          { .type = NLA_BINARY,
+                                           .len = IEEE80211_MAX_SSID_LEN + 1 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_LOST_SSID_SAMPLE_SIZE] =
                                                            { .type = NLA_U32 },
-    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP] = { .type =
-                                                                     NLA_U32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_NUM_SSID] =
+                                                           { .type = NLA_U32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_BAND] =
+                                                            { .type = NLA_U8 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_LOW] =
+                                                           { .type = NLA_S32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_HIGH] =
+                                                           { .type = NLA_S32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_CONFIGURATION_FLAGS] =
+                                                           { .type = NLA_U32 },
 };
 
-static void wlan_hdd_cfg80211_extscan_get_capabilities_ind(void *ctx, void *pMsg)
+/**
+ * wlan_hdd_cfg80211_extscan_get_capabilities_rsp() - response from target
+ * @ctx: hdd global context
+ * @data: capabilities data
+ *
+ * Return: none
+ */
+static void
+wlan_hdd_cfg80211_extscan_get_capabilities_rsp(void *ctx, void *pMsg)
 {
+    struct hdd_ext_scan_context *context;
     hdd_context_t *pHddCtx  = (hdd_context_t *)ctx;
-    struct sk_buff *skb     = NULL;
-    tpSirEXTScanCapabilitiesEvent pData =
-                    (tpSirEXTScanCapabilitiesEvent) pMsg;
+    tSirEXTScanCapabilitiesEvent *data =
+                    (tSirEXTScanCapabilitiesEvent *) pMsg;
 
     ENTER();
 
@@ -2197,116 +2239,173 @@
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
         return;
     }
-    skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
-                        NULL,
-#endif
-                        EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-                        QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_GET_CAPABILITIES_INDEX,
-                        GFP_KERNEL);
 
-    if (!skb) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                  FL("cfg80211_vendor_event_alloc failed"));
+    vos_spin_lock_acquire(&hdd_context_lock);
+
+    context = &pHddCtx->ext_scan_context;
+    /* validate response received from target*/
+    if (context->request_id != data->requestId)
+    {
+        vos_spin_lock_release(&hdd_context_lock);
+        hddLog(LOGE,
+          FL("Target response id did not match: request_id %d resposne_id %d"),
+          context->request_id, data->requestId);
         return;
     }
-
-    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
-    hddLog(VOS_TRACE_LEVEL_INFO, "Scan cache size (%u)", pData->scanCacheSize);
-    hddLog(VOS_TRACE_LEVEL_INFO, "Scan buckets (%u)", pData->scanBuckets);
-    hddLog(VOS_TRACE_LEVEL_INFO, "Max AP per scan (%u)", pData->maxApPerScan);
-    hddLog(VOS_TRACE_LEVEL_INFO, "maxRssiSampleSize (%u)",
-                                        pData->maxRssiSampleSize);
-    hddLog(VOS_TRACE_LEVEL_INFO, "maxScanReportingThreshold (%u)",
-                                        pData->maxScanReportingThreshold);
-    hddLog(VOS_TRACE_LEVEL_INFO, "maxHotlistAPs (%u)", pData->maxHotlistAPs);
-    hddLog(VOS_TRACE_LEVEL_INFO, "maxSignificantWifiChangeAPs (%u)",
-                                        pData->maxSignificantWifiChangeAPs);
-    hddLog(VOS_TRACE_LEVEL_INFO, "maxBsidHistoryEntries (%u)",
-                                        pData->maxBsidHistoryEntries);
-
-    if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-           pData->requestId) ||
-        nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_STATUS, pData->status) ||
-        nla_put_u32(skb,
-           QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SCAN_CACHE_SIZE,
-           pData->scanCacheSize) ||
-        nla_put_u32(skb,
-           QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SCAN_BUCKETS,
-           pData->scanBuckets) ||
-        nla_put_u32(skb,
-           QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_AP_CACHE_PER_SCAN,
-           pData->maxApPerScan) ||
-        nla_put_u32(skb,
-           QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_RSSI_SAMPLE_SIZE,
-           pData->maxRssiSampleSize) ||
-        nla_put_u32(skb,
-           QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SCAN_REPORTING_THRESHOLD,
-           pData->maxScanReportingThreshold) ||
-        nla_put_u32(skb,
-           QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_HOTLIST_APS,
-           pData->maxHotlistAPs) ||
-        nla_put_u32(skb,
-           QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SIGNIFICANT_WIFI_CHANGE_APS,
-           pData->maxSignificantWifiChangeAPs) ||
-        nla_put_u32(skb,
-           QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_BSSID_HISTORY_ENTRIES,
-           pData->maxBsidHistoryEntries)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
-        goto nla_put_failure;
+    else
+    {
+        context->capability_response = *data;
+        complete(&context->response_event);
     }
 
-    cfg80211_vendor_event(skb, GFP_KERNEL);
-    EXIT();
-    return;
+    vos_spin_lock_release(&hdd_context_lock);
 
-nla_put_failure:
-    kfree_skb(skb);
     return;
 }
 
+/*
+ * define short names for the global vendor params
+ * used by wlan_hdd_send_ext_scan_capability()
+ */
+#define PARAM_REQUEST_ID \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID
+#define PARAM_STATUS \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_STATUS
+#define MAX_SCAN_CACHE_SIZE \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SCAN_CACHE_SIZE
+#define MAX_SCAN_BUCKETS \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SCAN_BUCKETS
+#define MAX_AP_CACHE_PER_SCAN \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_AP_CACHE_PER_SCAN
+#define MAX_RSSI_SAMPLE_SIZE \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_RSSI_SAMPLE_SIZE
+#define MAX_SCAN_RPT_THRHOLD \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SCAN_REPORTING_THRESHOLD
+#define MAX_HOTLIST_BSSIDS \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_HOTLIST_BSSIDS
+#define MAX_BSSID_HISTORY_ENTRIES \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_BSSID_HISTORY_ENTRIES
+#define MAX_HOTLIST_SSIDS \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_HOTLIST_SSIDS
+#define MAX_SIGNIFICANT_WIFI_CHANGE_APS \
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_SIGNIFICANT_WIFI_CHANGE_APS
+
+static int wlan_hdd_send_ext_scan_capability(void *ctx)
+{
+    hdd_context_t *pHddCtx  = (hdd_context_t *)ctx;
+    struct sk_buff *skb     = NULL;
+    int ret;
+    tSirEXTScanCapabilitiesEvent *data;
+    tANI_U32 nl_buf_len;
+
+    ret = wlan_hdd_validate_context(pHddCtx);
+    if (0 != ret)
+    {
+        return ret;
+    }
+
+    data = &(pHddCtx->ext_scan_context.capability_response);
+
+    nl_buf_len = NLMSG_HDRLEN;
+    nl_buf_len += (sizeof(data->requestId) + NLA_HDRLEN) +
+    (sizeof(data->status) + NLA_HDRLEN) +
+    (sizeof(data->scanCacheSize) + NLA_HDRLEN) +
+    (sizeof(data->scanBuckets) + NLA_HDRLEN) +
+    (sizeof(data->maxApPerScan) + NLA_HDRLEN) +
+    (sizeof(data->maxRssiSampleSize) + NLA_HDRLEN) +
+    (sizeof(data->maxScanReportingThreshold) + NLA_HDRLEN) +
+    (sizeof(data->maxHotlistAPs) + NLA_HDRLEN) +
+    (sizeof(data->maxBsidHistoryEntries) + NLA_HDRLEN) +
+    (sizeof(data->maxHotlistSSIDs) + NLA_HDRLEN);
+
+    skb = cfg80211_vendor_cmd_alloc_reply_skb(pHddCtx->wiphy, nl_buf_len);
+
+    if (!skb)
+    {
+        hddLog(LOGE, FL("cfg80211_vendor_cmd_alloc_reply_skb failed"));
+        return -ENOMEM;
+    }
+
+    hddLog(LOG1, "Req Id (%u) Status (%u)", data->requestId, data->status);
+    hddLog(LOG1, "Scan cache size (%u) Scan buckets (%u) Max AP per scan (%u)",
+           data->scanCacheSize, data->scanBuckets, data->maxApPerScan);
+    hddLog(LOG1, "max_rssi_sample_size (%u) max_scan_reporting_threshold (%u)",
+           data->maxRssiSampleSize, data->maxScanReportingThreshold);
+    hddLog(LOG1, "max_hotlist_bssids (%u) max_bssid_history_entries (%u)"
+           "max_hotlist_ssids (%u)", data->maxHotlistAPs,
+           data->maxBsidHistoryEntries, data->maxHotlistSSIDs);
+
+    if (nla_put_u32(skb, PARAM_REQUEST_ID, data->requestId) ||
+        nla_put_u32(skb, PARAM_STATUS, data->status) ||
+        nla_put_u32(skb, MAX_SCAN_CACHE_SIZE, data->scanCacheSize) ||
+        nla_put_u32(skb, MAX_SCAN_BUCKETS, data->scanBuckets) ||
+        nla_put_u32(skb, MAX_AP_CACHE_PER_SCAN,
+            data->maxApPerScan) ||
+        nla_put_u32(skb, MAX_RSSI_SAMPLE_SIZE,
+            data->maxRssiSampleSize) ||
+        nla_put_u32(skb, MAX_SCAN_RPT_THRHOLD,
+            data->maxScanReportingThreshold) ||
+        nla_put_u32(skb, MAX_HOTLIST_BSSIDS, data->maxHotlistAPs) ||
+        nla_put_u32(skb, MAX_BSSID_HISTORY_ENTRIES,
+            data->maxBsidHistoryEntries) ||
+        nla_put_u32(skb, MAX_HOTLIST_SSIDS, data->maxHotlistSSIDs) ||
+        nla_put_u32(skb, MAX_SIGNIFICANT_WIFI_CHANGE_APS, 0))
+    {
+        hddLog(LOGE, FL("nla put fail"));
+        goto nla_put_failure;
+    }
+
+    cfg80211_vendor_cmd_reply(skb);
+    return 0;
+
+nla_put_failure:
+    kfree_skb(skb);
+    return -EINVAL;;
+}
+
+/*
+ * done with short names for the global vendor params
+ * used by wlan_hdd_send_ext_scan_capability()
+ */
+#undef PARAM_REQUEST_ID
+#undef PARAM_STATUS
+#undef MAX_SCAN_CACHE_SIZE
+#undef MAX_SCAN_BUCKETS
+#undef MAX_AP_CACHE_PER_SCAN
+#undef MAX_RSSI_SAMPLE_SIZE
+#undef MAX_SCAN_RPT_THRHOLD
+#undef MAX_HOTLIST_BSSIDS
+#undef MAX_BSSID_HISTORY_ENTRIES
+#undef MAX_HOTLIST_SSIDS
 
 static void wlan_hdd_cfg80211_extscan_start_rsp(void *ctx, void *pMsg)
 {
     tpSirEXTScanStartRspParams pData = (tpSirEXTScanStartRspParams) pMsg;
     hdd_context_t *pHddCtx         = (hdd_context_t *)ctx;
-    struct sk_buff *skb            = NULL;
     tpAniSirGlobal pMac = PMAC_STRUCT( pHddCtx->hHal );
+    struct hdd_ext_scan_context *context;
 
     ENTER();
 
-    if (wlan_hdd_validate_context(pHddCtx)){
+    if (wlan_hdd_validate_context(pHddCtx))
         return;
-    }
+
     if (!pMsg)
     {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
         return;
     }
 
-    skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
-                                  NULL,
-#endif
-                                  EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-                                  QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_START_INDEX,
-                                  GFP_KERNEL);
-
-    if (!skb) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                  FL("cfg80211_vendor_event_alloc failed"));
-        return;
-    }
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
     hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
     hddLog(VOS_TRACE_LEVEL_INFO, "Status (%u)", pData->status);
 
-    if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-                         pData->requestId) ||
-        nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_STATUS, pData->status)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
-        goto nla_put_failure;
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    if (context->request_id == pData->requestId) {
+        context->response_status = pData->status ? -EINVAL : 0;
+        complete(&context->response_event);
     }
+    spin_unlock(&hdd_context_lock);
 
     /*
      * Store the Request ID for comparing with the requestID obtained
@@ -2321,14 +2420,8 @@
     if (pData->status == 0)
         pMac->sme.extScanStartReqId = pData->requestId;
 
-
-    cfg80211_vendor_event(skb, GFP_KERNEL);
     EXIT();
     return;
-
-nla_put_failure:
-    kfree_skb(skb);
-    return;
 }
 
 
@@ -2336,111 +2429,77 @@
 {
     tpSirEXTScanStopRspParams pData = (tpSirEXTScanStopRspParams) pMsg;
     hdd_context_t *pHddCtx        = (hdd_context_t *)ctx;
-    struct sk_buff *skb           = NULL;
+    struct hdd_ext_scan_context *context;
 
     ENTER();
 
     if (wlan_hdd_validate_context(pHddCtx)){
         return;
     }
+
     if (!pMsg)
     {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
         return;
     }
 
-    skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
-                                    NULL,
-#endif
-                                    EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-                                    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_STOP_INDEX,
-                                    GFP_KERNEL);
+    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id %u Status %u", pData->requestId,
+                                                        pData->status);
 
-    if (!skb) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                  FL("cfg80211_vendor_event_alloc failed"));
-        return;
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    if (context->request_id == pData->requestId) {
+        context->response_status = pData->status ? -EINVAL : 0;
+        complete(&context->response_event);
     }
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
-    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
+    spin_unlock(&hdd_context_lock);
 
-    if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-                         pData->requestId) ||
-        nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_STATUS, pData->status)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
-        goto nla_put_failure;
-    }
-
-    cfg80211_vendor_event(skb, GFP_KERNEL);
     EXIT();
     return;
-
-nla_put_failure:
-    kfree_skb(skb);
-    return;
 }
 
-
 static void wlan_hdd_cfg80211_extscan_set_bss_hotlist_rsp(void *ctx,
                                                         void *pMsg)
 {
     hdd_context_t *pHddCtx    = (hdd_context_t *)ctx;
-    struct sk_buff *skb       = NULL;
     tpSirEXTScanSetBssidHotListRspParams pData =
                     (tpSirEXTScanSetBssidHotListRspParams) pMsg;
+    struct hdd_ext_scan_context *context;
 
     ENTER();
 
     if (wlan_hdd_validate_context(pHddCtx)){
         return;
     }
+
     if (!pMsg)
     {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
         return;
     }
 
-    skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
-                      NULL,
-#endif
-                      EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-                      QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_BSSID_HOTLIST_INDEX,
-                      GFP_KERNEL);
+    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id %u Status %u", pData->requestId,
+                                                        pData->status);
 
-    if (!skb) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                  FL("cfg80211_vendor_event_alloc failed"));
-        return;
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    if (context->request_id == pData->requestId) {
+        context->response_status = pData->status ? -EINVAL : 0;
+        complete(&context->response_event);
     }
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
-    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
-    hddLog(VOS_TRACE_LEVEL_INFO, "Status (%u)", pData->status);
+    spin_unlock(&hdd_context_lock);
 
-    if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-                         pData->requestId) ||
-        nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_STATUS, pData->status)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
-        goto nla_put_failure;
-    }
-
-    cfg80211_vendor_event(skb, GFP_KERNEL);
     EXIT();
     return;
-
-nla_put_failure:
-    kfree_skb(skb);
-    return;
 }
 
 static void wlan_hdd_cfg80211_extscan_reset_bss_hotlist_rsp(void *ctx,
                                                           void *pMsg)
 {
     hdd_context_t *pHddCtx  = (hdd_context_t *)ctx;
-    struct sk_buff *skb     = NULL;
     tpSirEXTScanResetBssidHotlistRspParams pData =
                     (tpSirEXTScanResetBssidHotlistRspParams) pMsg;
+    struct hdd_ext_scan_context *context;
 
     ENTER();
 
@@ -2453,48 +2512,60 @@
         return;
     }
 
-    skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
-                      NULL,
-#endif
-                      EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-                      QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_BSSID_HOTLIST_INDEX,
-                      GFP_KERNEL);
+    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id %u Status %u", pData->requestId,
+                                                        pData->status);
 
-    if (!skb) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                  FL("cfg80211_vendor_event_alloc failed"));
-        return;
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    if (context->request_id == pData->requestId) {
+        context->response_status = pData->status ? -EINVAL : 0;
+        complete(&context->response_event);
     }
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
-    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
+    spin_unlock(&hdd_context_lock);
 
-    if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-                         pData->requestId) ||
-        nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_STATUS, pData->status)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
-        goto nla_put_failure;
-    }
-
-    cfg80211_vendor_event(skb, GFP_KERNEL);
     EXIT();
     return;
-
-nla_put_failure:
-    kfree_skb(skb);
-    return;
 }
 
+static void wlan_hdd_cfg80211_extscan_set_ssid_hotlist_rsp(void *ctx,
+                                                        void *pMsg)
+{
+    hdd_context_t *pHddCtx    = (hdd_context_t *)ctx;
+    tpSirEXTScanSetSsidHotListRspParams pData =
+                    (tpSirEXTScanSetSsidHotListRspParams) pMsg;
+    struct hdd_ext_scan_context *context;
 
-static void wlan_hdd_cfg80211_extscan_set_signf_wifi_change_rsp(void *ctx,
-                                                              void *pMsg)
+    if (wlan_hdd_validate_context(pHddCtx)){
+        return;
+    }
+
+    if (!pMsg)
+    {
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
+        return;
+    }
+
+    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id %u Status %u", pData->requestId,
+                                                        pData->status);
+
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    if (context->request_id == pData->requestId) {
+        context->response_status = pData->status ? -EINVAL : 0;
+        complete(&context->response_event);
+    }
+    spin_unlock(&hdd_context_lock);
+
+    return;
+}
+
+static void wlan_hdd_cfg80211_extscan_reset_ssid_hotlist_rsp(void *ctx,
+                                                          void *pMsg)
 {
     hdd_context_t *pHddCtx  = (hdd_context_t *)ctx;
-    struct sk_buff *skb     = NULL;
-    tpSirEXTScanSetSignificantChangeRspParams pData =
-                    (tpSirEXTScanSetSignificantChangeRspParams) pMsg;
-
-    ENTER();
+    tpSirEXTScanResetSsidHotlistRspParams pData =
+                    (tpSirEXTScanResetSsidHotlistRspParams) pMsg;
+    struct hdd_ext_scan_context *context;
 
     if (wlan_hdd_validate_context(pHddCtx)) {
         return;
@@ -2505,253 +2576,290 @@
         return;
     }
 
-    skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
-                NULL,
-#endif
-                EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-                QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SIGNIFICANT_CHANGE_INDEX,
-                GFP_KERNEL);
+    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id %u Status %u", pData->requestId,
+                                                        pData->status);
 
-    if (!skb) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                  FL("cfg80211_vendor_event_alloc failed"));
-        return;
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    if (context->request_id == pData->requestId) {
+        context->response_status = pData->status ? -EINVAL : 0;
+        complete(&context->response_event);
     }
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
-    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
-    hddLog(VOS_TRACE_LEVEL_INFO, "Status (%u)", pData->status);
+    spin_unlock(&hdd_context_lock);
 
-    if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-                         pData->requestId) ||
-        nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_STATUS, pData->status)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
-        goto nla_put_failure;
-    }
-
-    cfg80211_vendor_event(skb, GFP_KERNEL);
-    EXIT();
-    return;
-
-nla_put_failure:
-    kfree_skb(skb);
     return;
 }
 
 
-static void wlan_hdd_cfg80211_extscan_reset_signf_wifi_change_rsp(void *ctx,
-                                                                void *pMsg)
-{
-    hdd_context_t *pHddCtx  = (hdd_context_t *)ctx;
-    struct sk_buff *skb     = NULL;
-    tpSirEXTScanResetSignificantChangeRspParams pData =
-                    (tpSirEXTScanResetSignificantChangeRspParams) pMsg;
-
-    ENTER();
-
-    if (wlan_hdd_validate_context(pHddCtx)) {
-        return;
-    }
-    if (!pMsg)
-    {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
-        return;
-    }
-
-    skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
-              NULL,
-#endif
-              EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-              QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SIGNIFICANT_CHANGE_INDEX,
-              GFP_KERNEL);
-
-    if (!skb) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                  FL("cfg80211_vendor_event_alloc failed"));
-        return;
-    }
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
-    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
-    hddLog(VOS_TRACE_LEVEL_INFO, "Status (%u)", pData->status);
-
-    if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-                         pData->requestId) ||
-        nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_STATUS, pData->status)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
-        goto nla_put_failure;
-    }
-
-    cfg80211_vendor_event(skb, GFP_KERNEL);
-    EXIT();
-    return;
-
-nla_put_failure:
-    kfree_skb(skb);
-    return;
-}
-
 static void wlan_hdd_cfg80211_extscan_cached_results_ind(void *ctx,
                                                        void *pMsg)
 {
     hdd_context_t *pHddCtx = (hdd_context_t *)ctx;
     struct sk_buff *skb    = NULL;
-    tANI_U32 i = 0, j, resultsPerEvent;
+    tANI_U32 i = 0, j, resultsPerEvent, scan_id_index;
     tANI_S32 totalResults;
     tpSirWifiScanResultEvent pData = (tpSirWifiScanResultEvent) pMsg;
-    tpSirWifiScanResult pSirWifiScanResult;
+    tpSirWifiScanResult pSirWifiScanResult, head_ptr;
+    struct hdd_ext_scan_context *context;
+    bool ignore_cached_results = false;
+    tExtscanCachedScanResult *result;
+    struct nlattr *nla_results;
+    tANI_U16 ieLength= 0;
+    tANI_U8  *ie = NULL;
 
     ENTER();
 
-    if (wlan_hdd_validate_context(pHddCtx)) {
+    if (wlan_hdd_validate_context(pHddCtx))
         return;
-    }
+
     if (!pMsg)
     {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
         return;
     }
 
-    totalResults = pData->numOfAps;
-    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
-    hddLog(VOS_TRACE_LEVEL_INFO, "Num results (%u)", pData->numOfAps);
-    hddLog(VOS_TRACE_LEVEL_INFO, "More Data (%u)", pData->moreData);
+    spin_lock(&hdd_context_lock);
+    context = &pHddCtx->ext_scan_context;
+    ignore_cached_results = context->ignore_cached_results;
+    spin_unlock(&hdd_context_lock);
 
-    do{
-        resultsPerEvent = ((totalResults >= EXTSCAN_MAX_CACHED_RESULTS_PER_IND) ?
-                EXTSCAN_MAX_CACHED_RESULTS_PER_IND : totalResults);
-        totalResults -= EXTSCAN_MAX_CACHED_RESULTS_PER_IND;
+    if (ignore_cached_results) {
+        hddLog(LOGE,
+               FL("Ignore the cached results received after timeout"));
+        return;
+    }
 
-        skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
-                NULL,
-#endif
-                EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-                QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_GET_CACHED_RESULTS_INDEX,
-                GFP_KERNEL);
+    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id %u More Data %u No of scan ids %u",
+           pData->requestId, pData->moreData, pData->scanResultSize);
 
-        if (!skb) {
-            hddLog(VOS_TRACE_LEVEL_ERROR,
-                    FL("cfg80211_vendor_event_alloc failed"));
-            return;
-        }
+    result = (tExtscanCachedScanResult *)&(pData->result);
 
-        hddLog(VOS_TRACE_LEVEL_INFO, "resultsPerEvent (%u)", resultsPerEvent);
+    for (scan_id_index = 0; scan_id_index < pData->scanResultSize;
+                                                   scan_id_index++) {
+         result+= scan_id_index;
 
-        if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-                    pData->requestId) ||
-                nla_put_u32(skb,
-                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE,
-                    resultsPerEvent)) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-            goto fail;
-        }
-        if (nla_put_u8(skb,
-                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_MORE_DATA,
-                    pData->moreData ? 1 : (totalResults > 0 ? 1 : 0 )))
-        {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-            goto fail;
-        }
+         totalResults = result->num_results;
+         hddLog(VOS_TRACE_LEVEL_INFO, "scan_id %u flags %u Num results %u",
+                result->scan_id, result->flags, totalResults);
+         i = 0;
 
-        if (resultsPerEvent) {
-            struct nlattr *aps;
+        do{
+            resultsPerEvent = ((totalResults >= EXTSCAN_MAX_CACHED_RESULTS_PER_IND) ?
+                    EXTSCAN_MAX_CACHED_RESULTS_PER_IND : totalResults);
+            totalResults -= EXTSCAN_MAX_CACHED_RESULTS_PER_IND;
 
-            aps = nla_nest_start(skb,
-                            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_LIST);
-            if (!aps)
+            skb = cfg80211_vendor_cmd_alloc_reply_skb(pHddCtx->wiphy,
+                                     EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN);
+
+            if (!skb) {
+                hddLog(VOS_TRACE_LEVEL_ERROR,
+                        FL("cfg80211_vendor_event_alloc failed"));
+                return;
+            }
+
+            hddLog(VOS_TRACE_LEVEL_INFO, "resultsPerEvent (%u)", resultsPerEvent);
+
+            if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
+                        pData->requestId) ||
+                    nla_put_u32(skb,
+                        QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE,
+                        resultsPerEvent)) {
+                hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                goto fail;
+            }
+            if (nla_put_u8(skb,
+                        QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_MORE_DATA,
+                        pData->moreData ? 1 : (totalResults > 0 ? 1 : 0 )))
             {
                 hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
                 goto fail;
             }
 
-            for (j = 0; j < resultsPerEvent; j++, i++) {
-                struct nlattr *ap;
-                pSirWifiScanResult =  (tpSirWifiScanResult) ((tANI_U8 *)
-                        pData->ap + ( i* sizeof(tSirWifiScanResult)));
-
-                hddLog(VOS_TRACE_LEVEL_INFO, "[index=%u] Timestamp(%llu) "
-                        "Ssid (%s)"
-                        "Bssid: %pM "
-                        "Channel (%u)"
-                        "Rssi (%d)"
-                        "RTT (%u)"
-                        "RTT_SD (%u)",
-                        i,
-                        pSirWifiScanResult->ts,
-                        pSirWifiScanResult->ssid,
-                        pSirWifiScanResult->bssid,
-                        pSirWifiScanResult->channel,
-                        pSirWifiScanResult->rssi,
-                        pSirWifiScanResult->rtt,
-                        pSirWifiScanResult->rtt_sd);
-
-                ap = nla_nest_start(skb, j + 1);
-                if (!ap)
-                {
-                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-                    goto fail;
-                }
-
-                if (nla_put_u64(skb,
-                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_TIME_STAMP,
-                    pSirWifiScanResult->ts) )
-                {
-                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-                    goto fail;
-                }
-                if (nla_put(skb,
-                         QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_SSID,
-                         sizeof(pSirWifiScanResult->ssid),
-                        pSirWifiScanResult->ssid) )
-                {
-                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-                    goto fail;
-                }
-                if (nla_put(skb,
-                        QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_BSSID,
-                        sizeof(pSirWifiScanResult->bssid),
-                        pSirWifiScanResult->bssid) )
-                {
-                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-                    goto fail;
-                }
-                if (nla_put_u32(skb,
-                       QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_CHANNEL,
-                        pSirWifiScanResult->channel) )
-                {
-                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-                    goto fail;
-                }
-                if (nla_put_s32(skb,
-                        QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RSSI,
-                        pSirWifiScanResult->rssi) )
-                {
-                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-                    goto fail;
-                }
-                if (nla_put_u32(skb,
-                          QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT,
-                          pSirWifiScanResult->rtt) )
-                {
-                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-                    goto fail;
-                }
-                if (nla_put_u32(skb,
-                        QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT_SD,
-                        pSirWifiScanResult->rtt_sd))
-                {
-                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
-                    goto fail;
-                }
-
-                nla_nest_end(skb, ap);
+            if (nla_put_u32(skb,
+                QCA_WLAN_VENDOR_ATTR_EXTSCAN_CACHED_RESULTS_SCAN_ID,
+                result->scan_id)) {
+                hddLog(LOGE, FL("put fail"));
+                goto fail;
             }
-            nla_nest_end(skb, aps);
 
-        }
-        cfg80211_vendor_event(skb, GFP_KERNEL);
-    } while (totalResults > 0);
+            nla_results = nla_nest_start(skb,
+                          QCA_WLAN_VENDOR_ATTR_EXTSCAN_CACHED_RESULTS_LIST);
+            if (!nla_results)
+                goto fail;
+
+            if (resultsPerEvent) {
+                struct nlattr *aps;
+                struct nlattr *nla_result;
+
+                nla_result = nla_nest_start(skb, scan_id_index);
+                if(!nla_result)
+                   goto fail;
+
+                if (nla_put_u32(skb,
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_CACHED_RESULTS_SCAN_ID,
+                    result->scan_id) ||
+                    nla_put_u32(skb,
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_CACHED_RESULTS_FLAGS,
+                    result->flags) ||
+                    nla_put_u32(skb,
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE,
+                    totalResults)) {
+                    hddLog(LOGE, FL("put fail"));
+                    goto fail;
+                }
+
+                aps = nla_nest_start(skb,
+                                QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_LIST);
+                if (!aps)
+                {
+                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                    goto fail;
+                }
+
+                head_ptr = (tpSirWifiScanResult) &(result->ap);
+
+                for (j = 0; j < resultsPerEvent; j++, i++) {
+                    struct nlattr *ap;
+                    pSirWifiScanResult = head_ptr + i;
+
+                    /*
+                     * Firmware returns timestamp from extscan_start till
+                     * BSSID was cached (in micro seconds). Add this with
+                     * time gap between system boot up to extscan_start
+                     * to derive the time since boot when the
+                     * BSSID was cached.
+                     */
+                    pSirWifiScanResult->ts +=
+                                     pHddCtx->extscan_start_time_since_boot;
+                    hddLog(VOS_TRACE_LEVEL_INFO, "[index=%u] Timestamp(%llu) "
+                            "Ssid (%s)"
+                            "Bssid: %pM "
+                            "Channel (%u)"
+                            "Rssi (%d)"
+                            "RTT (%u)"
+                            "RTT_SD (%u)"
+                            "Beacon Period %u"
+                            "Capability 0x%x "
+                            "Ie length %d",
+                            i,
+                            pSirWifiScanResult->ts,
+                            pSirWifiScanResult->ssid,
+                            pSirWifiScanResult->bssid,
+                            pSirWifiScanResult->channel,
+                            pSirWifiScanResult->rssi,
+                            pSirWifiScanResult->rtt,
+                            pSirWifiScanResult->rtt_sd,
+                            pSirWifiScanResult->beaconPeriod,
+                            pSirWifiScanResult->capability,
+                            ieLength);
+
+                    ap = nla_nest_start(skb, j + 1);
+                    if (!ap)
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+
+                    if (nla_put_u64(skb,
+                        QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_TIME_STAMP,
+                        pSirWifiScanResult->ts) )
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+                    if (nla_put(skb,
+                             QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_SSID,
+                             sizeof(pSirWifiScanResult->ssid),
+                            pSirWifiScanResult->ssid) )
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+                    if (nla_put(skb,
+                            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_BSSID,
+                            sizeof(pSirWifiScanResult->bssid),
+                            pSirWifiScanResult->bssid) )
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+                    if (nla_put_u32(skb,
+                           QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_CHANNEL,
+                            pSirWifiScanResult->channel) )
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+                    if (nla_put_s32(skb,
+                            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RSSI,
+                            pSirWifiScanResult->rssi) )
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+                    if (nla_put_u32(skb,
+                              QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT,
+                              pSirWifiScanResult->rtt) )
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+                    if (nla_put_u32(skb,
+                            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT_SD,
+                            pSirWifiScanResult->rtt_sd))
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+                    if (nla_put_u32(skb,
+                            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_BEACON_PERIOD,
+                            pSirWifiScanResult->beaconPeriod))
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+                    if (nla_put_u32(skb,
+                            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_CAPABILITY,
+                            pSirWifiScanResult->capability))
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+                    if (nla_put_u32(skb,
+                            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_IE_LENGTH,
+                            ieLength))
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                        goto fail;
+                    }
+
+                    if (ieLength)
+                        if (nla_put(skb,
+                            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_IE_DATA,
+                            ieLength, ie)) {
+                            hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+                            goto fail;
+                        }
+
+                    nla_nest_end(skb, ap);
+                }
+                nla_nest_end(skb, aps);
+                nla_nest_end(skb, nla_result);
+            }
+
+         nla_nest_end(skb, nla_results);
+
+         cfg80211_vendor_cmd_reply(skb);
+
+        } while (totalResults > 0);
+    }
+
+    if (!pData->moreData) {
+        spin_lock(&hdd_context_lock);
+        context->response_status = 0;
+        complete(&context->response_event);
+        spin_unlock(&hdd_context_lock);
+    }
 
     EXIT();
     return;
@@ -2763,14 +2871,16 @@
 static void wlan_hdd_cfg80211_extscan_hotlist_match_ind(void *ctx,
                                                       void *pMsg)
 {
-    tpSirWifiScanResultEvent pData = (tpSirWifiScanResultEvent) pMsg;
+    tpSirEXTScanHotlistMatch pData = (tpSirEXTScanHotlistMatch) pMsg;
     hdd_context_t *pHddCtx         = (hdd_context_t *)ctx;
     struct sk_buff *skb            = NULL;
-    tANI_U32 i;
+    tANI_U32 i, index;
 
     ENTER();
 
     if (wlan_hdd_validate_context(pHddCtx)) {
+        hddLog(LOGE,
+               FL("HDD context is not valid or response"));
         return;
     }
     if (!pMsg)
@@ -2779,25 +2889,30 @@
         return;
     }
 
+    if (pData->bss_found)
+        index = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_FOUND_INDEX;
+    else
+        index = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_LOST_INDEX;
+
     skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
                       NULL,
 #endif
                       EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-                      QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_FOUND_INDEX,
-                      GFP_KERNEL);
+                      index, GFP_KERNEL);
 
     if (!skb) {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                   FL("cfg80211_vendor_event_alloc failed"));
         return;
     }
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
-    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
-    hddLog(VOS_TRACE_LEVEL_INFO, "Num results (%u)", pData->numOfAps);
-    hddLog(VOS_TRACE_LEVEL_INFO, "More Data (%u)", pData->moreData);
 
-    for (i = 0; i < pData->numOfAps; i++) {
+    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
+    hddLog(VOS_TRACE_LEVEL_INFO, "Num results (%u)", pData->numHotlistBss);
+    hddLog(VOS_TRACE_LEVEL_INFO, "More Data (%u)", pData->moreData);
+    hddLog(VOS_TRACE_LEVEL_INFO, "ap_found %u", pData->bss_found);
+
+    for (i = 0; i < pData->numHotlistBss; i++) {
         hddLog(VOS_TRACE_LEVEL_INFO, "[index=%u] Timestamp(0x%lld) "
                               "Ssid (%s) "
                               "Bssid (" MAC_ADDRESS_STR ") "
@@ -2806,24 +2921,24 @@
                               "RTT (%u) "
                               "RTT_SD (%u) ",
                               i,
-                              pData->ap[i].ts,
-                              pData->ap[i].ssid,
-                              MAC_ADDR_ARRAY(pData->ap[i].bssid),
-                              pData->ap[i].channel,
-                              pData->ap[i].rssi,
-                              pData->ap[i].rtt,
-                              pData->ap[i].rtt_sd);
+                              pData->bssHotlist[i].ts,
+                              pData->bssHotlist[i].ssid,
+                              MAC_ADDR_ARRAY(pData->bssHotlist[i].bssid),
+                              pData->bssHotlist[i].channel,
+                              pData->bssHotlist[i].rssi,
+                              pData->bssHotlist[i].rtt,
+                              pData->bssHotlist[i].rtt_sd);
     }
 
     if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
                       pData->requestId) ||
         nla_put_u32(skb,
                     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE,
-                      pData->numOfAps)) {
+                      pData->numHotlistBss)) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
         goto fail;
     }
-    if (pData->numOfAps) {
+    if (pData->numHotlistBss) {
         struct nlattr *aps;
 
         aps = nla_nest_start(skb,
@@ -2831,7 +2946,7 @@
         if (!aps)
             goto fail;
 
-        for (i = 0; i < pData->numOfAps; i++) {
+        for (i = 0; i < pData->numHotlistBss; i++) {
             struct nlattr *ap;
 
             ap = nla_nest_start(skb, i + 1);
@@ -2840,27 +2955,27 @@
 
             if (nla_put_u64(skb,
                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_TIME_STAMP,
-                    pData->ap[i].ts) ||
+                    pData->bssHotlist[i].ts) ||
                 nla_put(skb,
                      QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_SSID,
-                     sizeof(pData->ap[i].ssid),
-                     pData->ap[i].ssid) ||
+                     sizeof(pData->bssHotlist[i].ssid),
+                     pData->bssHotlist[i].ssid) ||
                 nla_put(skb,
                      QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_BSSID,
-                     sizeof(pData->ap[i].bssid),
-                     pData->ap[i].bssid) ||
+                     sizeof(pData->bssHotlist[i].bssid),
+                     pData->bssHotlist[i].bssid) ||
                 nla_put_u32(skb,
                      QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_CHANNEL,
-                     pData->ap[i].channel) ||
+                     pData->bssHotlist[i].channel) ||
                 nla_put_s32(skb,
                      QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RSSI,
-                     pData->ap[i].rssi) ||
+                     pData->bssHotlist[i].rssi) ||
                 nla_put_u32(skb,
                      QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT,
-                     pData->ap[i].rtt) ||
+                     pData->bssHotlist[i].rtt) ||
                 nla_put_u32(skb,
                      QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT_SD,
-                     pData->ap[i].rtt_sd))
+                     pData->bssHotlist[i].rtt_sd))
                 goto fail;
 
               nla_nest_end(skb, ap);
@@ -2882,113 +2997,157 @@
     return;
 
 }
-static void wlan_hdd_cfg80211_extscan_signif_wifi_change_results_ind(void *ctx,
-                                                                   void *pMsg)
+
+/**
+ * wlan_hdd_cfg80211_extscan_hotlist_ssid_match_ind() -
+ *	Handle an SSID hotlist match event
+ * @ctx: HDD context registered with SME
+ * @event: The SSID hotlist match event
+ *
+ * This function will take an SSID match event that was generated by
+ * firmware and will convert it into a cfg80211 vendor event which is
+ * sent to userspace.
+ *
+ * Return: none
+ */
+static void
+wlan_hdd_cfg80211_extscan_hotlist_ssid_match_ind(void *ctx,
+                                                void *pMsg)
 {
-    hdd_context_t *pHddCtx  = (hdd_context_t *)ctx;
-    struct sk_buff *skb     = NULL;
-    tANI_U32 i, j;
-    tpSirWifiSignificantChangeEvent pData =
-                                     (tpSirWifiSignificantChangeEvent) pMsg;
+   hdd_context_t *hdd_ctx = ctx;
+   struct sk_buff *skb;
+   tANI_U32 i, index;
+   tpSirEXTScanSsidHotlistMatch pData = (tpSirEXTScanSsidHotlistMatch) pMsg;
 
-    ENTER();
+   ENTER();
 
-    if (wlan_hdd_validate_context(pHddCtx)) {
-        return;
-    }
-    if (!pMsg)
-    {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
-        return;
+   if (wlan_hdd_validate_context(hdd_ctx)) {
+       hddLog(LOGE,
+              FL("HDD context is not valid or response"));
+       return;
+   }
+   if (!pMsg)
+   {
+       hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
+       return;
+   }
+
+    if (pData->ssid_found) {
+        index = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND_INDEX;
+        hddLog(LOG1, "SSID hotlist found");
+    } else {
+        index = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST_INDEX;
+        hddLog(LOG1, "SSID hotlist lost");
     }
 
-    skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
+    skb = cfg80211_vendor_event_alloc(hdd_ctx->wiphy,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
                        NULL,
 #endif
-                    EXTSCAN_EVENT_BUF_SIZE,
-                    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SIGNIFICANT_CHANGE_INDEX,
-                    GFP_KERNEL);
+          EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
+          index, GFP_KERNEL);
 
     if (!skb) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                  FL("cfg80211_vendor_event_alloc failed"));
+        hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
         return;
     }
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
-    hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
-    hddLog(VOS_TRACE_LEVEL_INFO, "total List Size %u ", pData->numSigRssiBss);
-    hddLog(VOS_TRACE_LEVEL_INFO, " CUrrent List size  (%u)",
-            pData->numSigRssiBss);
-    hddLog(VOS_TRACE_LEVEL_INFO, "moreData (%u)", pData->moreData);
+    hddLog(LOG1, "Req Id %u, Num of SSIDs %u, More Data (%u)",
+           pData->requestId, pData->numHotlistSsid, pData->moreData);
 
-    for (i = 0; i < pData->numSigRssiBss; i++) {
-        hddLog(VOS_TRACE_LEVEL_INFO , "Rssi List [%d] BSSID: (%pM) Channel %u "
-                " num RSSI %u ",
-                i, pData->sigRssiResult[i].bssid,
-                pData->sigRssiResult[i].channel,
-                pData->sigRssiResult[i].numRssi);
+    for (i = 0; i < pData->numHotlistSsid; i++) {
+         hddLog(LOG1, "[i=%d] Timestamp %llu "
+               "Ssid: %s "
+               "Bssid (" MAC_ADDRESS_STR ") "
+               "Channel %u "
+               "Rssi %d "
+               "RTT %u "
+               "RTT_SD %u",
+               i,
+               pData->ssidHotlist[i].ts,
+               pData->ssidHotlist[i].ssid,
+               MAC_ADDR_ARRAY(pData->ssidHotlist[i].bssid),
+               pData->ssidHotlist[i].channel,
+               pData->ssidHotlist[i].rssi,
+               pData->ssidHotlist[i].rtt,
+               pData->ssidHotlist[i].rtt_sd);
+   }
 
-        for (j = 0; j < pData->sigRssiResult[i].numRssi; j++){
-
-            hddLog(VOS_TRACE_LEVEL_INFO,
-                    " [%d]",
-                    pData->sigRssiResult[i].rssi[j]);
-
-        }
-    }
-
-
-    if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-                pData->requestId) ||
-            nla_put_u32(skb,
-                QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE,
-                pData->numSigRssiBss)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("put fail"));
+    if (nla_put_u32(skb,
+            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
+            pData->requestId) ||
+        nla_put_u32(skb,
+            QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_NUM_RESULTS_AVAILABLE,
+            pData->numHotlistSsid)) {
+        hddLog(LOGE, FL("put fail"));
         goto fail;
     }
 
-    if (pData->numSigRssiBss) {
+    if (pData->numHotlistSsid) {
         struct nlattr *aps;
-        aps = nla_nest_start(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_LIST);
-        if (!aps)
+        aps = nla_nest_start(skb,
+                   QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_LIST);
+        if (!aps) {
+            hddLog(LOGE, FL("nest fail"));
             goto fail;
-        for (i = 0; i < pData->numSigRssiBss; i++) {
+        }
+
+        for (i = 0; i < pData->numHotlistSsid; i++) {
             struct nlattr *ap;
 
             ap = nla_nest_start(skb, i);
-            if (!ap)
+            if (!ap) {
+                hddLog(LOGE, FL("nest fail"));
                 goto fail;
-            if (nla_put(skb,
-                 QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SIGNIFICANT_CHANGE_RESULT_BSSID,
-                 sizeof(tSirMacAddr), pData->sigRssiResult[i].bssid) ||
-                nla_put_u32(skb,
-                 QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SIGNIFICANT_CHANGE_RESULT_CHANNEL,
-                 pData->sigRssiResult[i].channel) ||
-                nla_put_u32(skb,
-                 QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SIGNIFICANT_CHANGE_RESULT_NUM_RSSI,
-                 pData->sigRssiResult[i].numRssi) ||
+            }
+
+            if (nla_put_u64(skb,
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_TIME_STAMP,
+                    pData->ssidHotlist[i].ts) ||
                 nla_put(skb,
-                 QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SIGNIFICANT_CHANGE_RESULT_RSSI_LIST,
-                 sizeof(s32) * pData->sigRssiResult[i].numRssi,
-                 pData->sigRssiResult[i].rssi))
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_SSID,
+                    sizeof(pData->ssidHotlist[i].ssid),
+                    pData->ssidHotlist[i].ssid) ||
+                nla_put(skb,
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_BSSID,
+                    sizeof(pData->ssidHotlist[i].bssid),
+                    pData->ssidHotlist[i].bssid) ||
+                nla_put_u32(skb,
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_CHANNEL,
+                    pData->ssidHotlist[i].channel) ||
+                nla_put_s32(skb,
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RSSI,
+                    pData->ssidHotlist[i].rssi) ||
+                nla_put_u32(skb,
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT,
+                    pData->ssidHotlist[i].rtt) ||
+                nla_put_u32(skb,
+                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT_SD,
+                    pData->ssidHotlist[i].rtt_sd)) {
+                hddLog(LOGE, FL("put fail"));
                 goto fail;
+            }
             nla_nest_end(skb, ap);
         }
         nla_nest_end(skb, aps);
+
         if (nla_put_u8(skb,
-                    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_MORE_DATA,
-                    pData->moreData))
+                   QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_MORE_DATA,
+                   pData->moreData)) {
+            hddLog(LOGE, FL("put fail"));
             goto fail;
+        }
     }
+
     cfg80211_vendor_event(skb, GFP_KERNEL);
-    EXIT();
     return;
+
 fail:
     kfree_skb(skb);
     return;
+
 }
 
+
 static void wlan_hdd_cfg80211_extscan_full_scan_result_event(void *ctx,
                                                            void *pMsg)
 {
@@ -3000,6 +3159,8 @@
     ENTER();
 
     if (wlan_hdd_validate_context(pHddCtx)) {
+        hddLog(LOGE,
+               FL("HDD context is not valid or response"));
         return;
     }
     if (!pMsg)
@@ -3008,6 +3169,15 @@
         return;
     }
 
+    /*
+         * If the full scan result including IE data exceeds NL 4K size
+         * limitation, drop that beacon/probe rsp frame.
+         */
+    if ((sizeof(*pData) + pData->ieLength) >= EXTSCAN_EVENT_BUF_SIZE) {
+        hddLog(LOGE, FL("Frame exceeded NL size limilation, drop it!"));
+        return;
+    }
+
     skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
             NULL,
@@ -3022,7 +3192,6 @@
         return;
     }
 
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Req Id (%u)"), pData->requestId);
     hddLog(VOS_TRACE_LEVEL_INFO, FL("More Data (%u)"), pData->moreData);
     hddLog(VOS_TRACE_LEVEL_INFO, FL("AP Info: Timestamp(0x%llX) "
@@ -3031,14 +3200,19 @@
                 "Channel (%u)"
                 "Rssi (%d)"
                 "RTT (%u)"
-                "RTT_SD (%u)"),
+                "RTT_SD (%u)"
+                "Bcn Period %d"
+                "Capability 0x%X "),
             pData->ap.ts,
             pData->ap.ssid,
             MAC_ADDR_ARRAY(pData->ap.bssid),
             pData->ap.channel,
             pData->ap.rssi,
             pData->ap.rtt,
-            pData->ap.rtt_sd);
+            pData->ap.rtt_sd,
+            pData->ap.beaconPeriod,
+            pData->ap.capability);
+
     hddLog(VOS_TRACE_LEVEL_INFO, "IE Length (%u)", pData->ieLength);
     if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
                 pData->requestId) ||
@@ -3069,17 +3243,23 @@
             pData->ap.capability) ||
         nla_put_u32(skb,
                 QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_IE_LENGTH,
-            pData->ieLength))
+            pData->ieLength) ||
+        nla_put_u8(skb,
+                QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_MORE_DATA,
+            pData->moreData))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
         goto nla_put_failure;
     }
-    if (nla_put(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_IE_DATA,
-                pData->ieLength,
-                pData->ie))
-    {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
-        goto nla_put_failure;
+
+    if (pData->ieLength) {
+        if (nla_put(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_IE_DATA,
+                    pData->ieLength,
+                    pData->ie))
+        {
+            hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla put fail"));
+            goto nla_put_failure;
+        }
     }
 
     cfg80211_vendor_event(skb, GFP_KERNEL);
@@ -3102,6 +3282,8 @@
     ENTER();
 
     if (wlan_hdd_validate_context(pHddCtx)){
+        hddLog(LOGE,
+               FL("HDD context is not valid or response"));
         return;
     }
     if (!pMsg)
@@ -3124,7 +3306,6 @@
         return;
     }
 
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
     hddLog(VOS_TRACE_LEVEL_INFO, "Req Id (%u)", pData->requestId);
     hddLog(VOS_TRACE_LEVEL_INFO, "Num results (%u)",
                                   pData->numResultsAvailable);
@@ -3156,6 +3337,8 @@
     ENTER();
 
     if (wlan_hdd_validate_context(pHddCtx)){
+        hddLog(LOGE,
+               FL("HDD context is not valid or response"));
         return;
     }
     if (!pMsg)
@@ -3177,7 +3360,7 @@
                   FL("cfg80211_vendor_event_alloc failed"));
         return;
     }
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Entering "));
+    hddLog(VOS_TRACE_LEVEL_INFO, FL("Request Id (%u) "), pData->requestId);
     hddLog(VOS_TRACE_LEVEL_INFO, "Scan event type (%u)",
             pData->extScanEventType);
     hddLog(VOS_TRACE_LEVEL_INFO, "Scan event status (%u)",
@@ -3240,15 +3423,16 @@
         wlan_hdd_cfg80211_extscan_reset_bss_hotlist_rsp(ctx, pMsg);
         break;
 
-    case SIR_HAL_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP:
-        wlan_hdd_cfg80211_extscan_set_signf_wifi_change_rsp(ctx, pMsg);
+    case SIR_HAL_EXTSCAN_SET_SSID_HOTLIST_RSP:
+        wlan_hdd_cfg80211_extscan_set_ssid_hotlist_rsp(ctx, pMsg);
         break;
 
-    case SIR_HAL_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP:
-        wlan_hdd_cfg80211_extscan_reset_signf_wifi_change_rsp(ctx, pMsg);
+    case SIR_HAL_EXTSCAN_RESET_SSID_HOTLIST_RSP:
+        wlan_hdd_cfg80211_extscan_reset_ssid_hotlist_rsp(ctx, pMsg);
         break;
+
     case SIR_HAL_EXTSCAN_GET_CAPABILITIES_RSP:
-        wlan_hdd_cfg80211_extscan_get_capabilities_ind(ctx, pMsg);
+        wlan_hdd_cfg80211_extscan_get_capabilities_rsp(ctx, pMsg);
         break;
     case SIR_HAL_EXTSCAN_PROGRESS_IND:
         wlan_hdd_cfg80211_extscan_scan_progress_event(ctx, pMsg);
@@ -3262,8 +3446,8 @@
     case SIR_HAL_EXTSCAN_HOTLIST_MATCH_IND:
         wlan_hdd_cfg80211_extscan_hotlist_match_ind(ctx, pMsg);
         break;
-    case SIR_HAL_EXTSCAN_SIGNF_WIFI_CHANGE_IND:
-        wlan_hdd_cfg80211_extscan_signif_wifi_change_results_ind(ctx, pMsg);
+    case SIR_HAL_EXTSCAN_SSID_HOTLIST_MATCH_IND:
+        wlan_hdd_cfg80211_extscan_hotlist_ssid_match_ind(ctx, pMsg);
         break;
     case SIR_HAL_EXTSCAN_FULL_SCAN_RESULT_IND:
         wlan_hdd_cfg80211_extscan_full_scan_result_event(ctx, pMsg);
@@ -3286,6 +3470,9 @@
     struct nlattr
         *tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
     eHalStatus status;
+    struct hdd_ext_scan_context *context;
+    unsigned long rc;
+    int ret;
 
     ENTER();
 
@@ -3296,7 +3483,8 @@
     }
     /* check the EXTScan Capability */
     if ( (TRUE != pHddCtx->cfg_ini->fEnableEXTScan) ||
-         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)))
+         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXT_SCAN_ENHANCED)))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("EXTScan not enabled/supported by Firmware"));
@@ -3316,7 +3504,6 @@
         return -EINVAL;
     }
 
-
     reqMsg.requestId = nla_get_u32(
               tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]);
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Req Id (%d)"), reqMsg.requestId);
@@ -3324,12 +3511,32 @@
     reqMsg.sessionId = pAdapter->sessionId;
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Session Id (%d)"), reqMsg.sessionId);
 
+    vos_spin_lock_acquire(&hdd_context_lock);
+    context = &pHddCtx->ext_scan_context;
+    context->request_id = reqMsg.requestId;
+    INIT_COMPLETION(context->response_event);
+    vos_spin_lock_release(&hdd_context_lock);
+
     status = sme_EXTScanGetCapabilities(pHddCtx->hHal, &reqMsg);
     if (!HAL_STATUS_SUCCESS(status)) {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("sme_EXTScanGetCapabilities failed(err=%d)"), status);
         return -EINVAL;
     }
+
+    rc = wait_for_completion_timeout(&context->response_event,
+             msecs_to_jiffies(WLAN_WAIT_TIME_EXTSCAN));
+    if (!rc) {
+        hddLog(LOGE, FL("Target response timed out"));
+        return -ETIMEDOUT;
+    }
+
+    ret = wlan_hdd_send_ext_scan_capability(pHddCtx);
+    if (ret)
+        hddLog(LOGE, FL("Failed to send ext scan capability to user space"));
+
+    return ret;
+
     EXIT();
     return 0;
 }
@@ -3358,9 +3565,17 @@
     struct nlattr
             *tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
     eHalStatus status;
+    struct hdd_ext_scan_context *context;
+    unsigned long rc;
+    int retval;
 
     ENTER();
 
+    if (VOS_FTM_MODE == hdd_get_conparam()) {
+        hddLog(LOGE, FL("Command not allowed in FTM mode"));
+        return -EINVAL;
+    }
+
     status = wlan_hdd_validate_context(pHddCtx);
     if (0 != status)
     {
@@ -3368,7 +3583,8 @@
     }
     /* check the EXTScan Capability */
     if ( (TRUE != pHddCtx->cfg_ini->fEnableEXTScan) ||
-         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)))
+         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXT_SCAN_ENHANCED)))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("EXTScan not enabled/supported by Firmware"));
@@ -3407,14 +3623,36 @@
 
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Flush (%d)"), reqMsg.flush);
 
+    spin_lock(&hdd_context_lock);
+    context = &pHddCtx->ext_scan_context;
+    context->request_id = reqMsg.requestId;
+    context->ignore_cached_results = false;
+    INIT_COMPLETION(context->response_event);
+    spin_unlock(&hdd_context_lock);
+
     status = sme_getCachedResults(pHddCtx->hHal, &reqMsg);
     if (!HAL_STATUS_SUCCESS(status)) {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("sme_getCachedResults failed(err=%d)"), status);
         return -EINVAL;
     }
+
+    rc = wait_for_completion_timeout(&context->response_event,
+            msecs_to_jiffies(WLAN_WAIT_TIME_EXTSCAN));
+    if (!rc) {
+        hddLog(LOGE, FL("Target response timed out"));
+        retval = -ETIMEDOUT;
+        spin_lock(&hdd_context_lock);
+        context->ignore_cached_results = true;
+        spin_unlock(&hdd_context_lock);
+    } else {
+        spin_lock(&hdd_context_lock);
+        retval = context->response_status;
+        spin_unlock(&hdd_context_lock);
+    }
+
     EXIT();
-    return 0;
+    return retval;
 
 failed:
     return -EINVAL;
@@ -3448,9 +3686,18 @@
     eHalStatus status;
     tANI_U8 i = 0;
     int rem;
+    struct hdd_ext_scan_context *context;
+    tANI_U32 request_id;
+    unsigned long rc;
+    int retval;
 
     ENTER();
 
+    if (VOS_FTM_MODE == hdd_get_conparam()) {
+        hddLog(LOGE, FL("Command not allowed in FTM mode"));
+        return -EINVAL;
+    }
+
     status = wlan_hdd_validate_context(pHddCtx);
     if (0 != status)
     {
@@ -3458,7 +3705,8 @@
     }
     /* check the EXTScan Capability */
     if ( (TRUE != pHddCtx->cfg_ini->fEnableEXTScan) ||
-         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)))
+         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXT_SCAN_ENHANCED)))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("EXTScan not enabled/supported by Firmware"));
@@ -3495,12 +3743,22 @@
         goto fail;
     }
 
+    /* Parse and fetch lost ap sample size */
+    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_LOST_AP_SAMPLE_SIZE]) {
+        hddLog(LOGE, FL("attr lost ap sample size failed"));
+        goto fail;
+    }
+
+    pReqMsg->lostBssidSampleSize = nla_get_u32(
+              tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_LOST_AP_SAMPLE_SIZE]);
+    hddLog(LOG1, FL("Lost ap sample size %d"), pReqMsg->lostBssidSampleSize);
+
     pReqMsg->sessionId = pAdapter->sessionId;
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Session Id (%d)"), pReqMsg->sessionId);
 
-    pReqMsg->numAp = nla_get_u32(
+    pReqMsg->numBssid = nla_get_u32(
               tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_NUM_AP]);
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Number of AP (%d)"), pReqMsg->numAp);
+    hddLog(VOS_TRACE_LEVEL_INFO, FL("Number of AP (%d)"), pReqMsg->numBssid);
 
     nla_for_each_nested(apTh,
                 tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM], rem) {
@@ -3539,18 +3797,15 @@
             tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_HIGH]);
         hddLog(VOS_TRACE_LEVEL_INFO, FL("RSSI High (%d)"),
                                          pReqMsg->ap[i].high);
-
-        /* Parse and fetch channel */
-        if (!tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_CHANNEL]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr channel failed"));
-            goto fail;
-        }
-        pReqMsg->ap[i].channel = nla_get_u32(
-              tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_CHANNEL]);
-        hddLog(VOS_TRACE_LEVEL_INFO,
-                FL("Channel (%u)"), pReqMsg->ap[i].channel);
         i++;
     }
+
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    INIT_COMPLETION(context->response_event);
+    context->request_id = request_id = pReqMsg->requestId;
+    spin_unlock(&hdd_context_lock);
+
     status = sme_SetBssHotlist(pHddCtx->hHal, pReqMsg);
     if (!HAL_STATUS_SUCCESS(status)) {
         hddLog(VOS_TRACE_LEVEL_ERROR,
@@ -3559,9 +3814,25 @@
         return -EINVAL;
     }
 
+    /* request was sent -- wait for the response */
+    rc = wait_for_completion_timeout(&context->response_event,
+                                     msecs_to_jiffies(WLAN_WAIT_TIME_EXTSCAN));
+
+    if (!rc) {
+       hddLog(LOGE, FL("sme_SetBssHotlist timed out"));
+       retval = -ETIMEDOUT;
+    } else {
+       spin_lock(&hdd_context_lock);
+       if (context->request_id == request_id)
+          retval = context->response_status;
+       else
+          retval = -EINVAL;
+       spin_unlock(&hdd_context_lock);
+    }
+
     vos_mem_free(pReqMsg);
     EXIT();
-    return 0;
+    return retval;
 
 fail:
     vos_mem_free(pReqMsg);
@@ -3582,182 +3853,352 @@
    return ret;
 }
 
-static int __wlan_hdd_cfg80211_extscan_set_significant_change(struct wiphy *wiphy,
-                                        struct wireless_dev *wdev,
-                                        const void *data, int dataLen)
+/*
+ * define short names for the global vendor params
+ * used by wlan_hdd_cfg80211_extscan_set_ssid_hotlist()
+ */
+#define PARAM_MAX \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX
+#define PARAM_REQUEST_ID \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID
+#define PARAMS_LOST_SSID_SAMPLE_SIZE \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_LOST_SSID_SAMPLE_SIZE
+#define PARAMS_NUM_SSID \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_NUM_SSID
+#define THRESHOLD_PARAM \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM
+#define PARAM_SSID \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_SSID
+#define PARAM_BAND \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_BAND
+#define PARAM_RSSI_LOW \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_LOW
+#define PARAM_RSSI_HIGH \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_HIGH
+
+/**
+ * __wlan_hdd_cfg80211_extscan_set_ssid_hotlist() - set ssid hot list
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Data length
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int
+__wlan_hdd_cfg80211_extscan_set_ssid_hotlist(struct wiphy *wiphy,
+                       struct wireless_dev *wdev,
+                       const void *data,
+                       int data_len)
 {
-    tpSirEXTScanSetSignificantChangeReqParams pReqMsg = NULL;
-    struct net_device *dev                  = wdev->netdev;
-    hdd_adapter_t *pAdapter                 = WLAN_HDD_GET_PRIV_PTR(dev);
-    hdd_context_t *pHddCtx                  = wiphy_priv(wiphy);
-    struct nlattr
-        *tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
-    struct nlattr
-        *tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
-    struct nlattr *apTh;
+    tSirEXTScanSetSsidHotListReqParams *request;
+    struct net_device *dev = wdev->netdev;
+    hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+    struct nlattr *tb[PARAM_MAX + 1];
+    struct nlattr *tb2[PARAM_MAX + 1];
+    struct nlattr *ssids;
+    struct hdd_ext_scan_context *context;
+    uint32_t request_id;
+    char ssid_string[SIR_MAC_MAX_SSID_LENGTH + 1] = {'\0'};
+    int ssid_len;
     eHalStatus status;
-    int i = 0;
-    int rem;
+    int i, rem, retval;
+    unsigned long rc;
 
     ENTER();
 
-    status = wlan_hdd_validate_context(pHddCtx);
-    if (0 != status)
-    {
+    if (VOS_FTM_MODE == hdd_get_conparam()) {
+        hddLog(LOGE, FL("Command not allowed in FTM mode"));
         return -EINVAL;
     }
+
+    retval = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != retval) {
+        hddLog(LOGE, FL("HDD context is not valid"));
+        return -EINVAL;
+    }
+
     /* check the EXTScan Capability */
-    if ( (TRUE != pHddCtx->cfg_ini->fEnableEXTScan) ||
-         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)))
+    if ( (TRUE != hdd_ctx->cfg_ini->fEnableEXTScan) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXT_SCAN_ENHANCED)))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("EXTScan not enabled/supported by Firmware"));
         return -EINVAL;
     }
 
+    if (nla_parse(tb, PARAM_MAX,
+        data, data_len,
+              wlan_hdd_extscan_config_policy)) {
+        hddLog(LOGE, FL("Invalid ATTR"));
+        return -EINVAL;
+    }
+
+    request = vos_mem_malloc(sizeof(*request));
+    if (!request) {
+        hddLog(LOGE, FL("vos_mem_malloc failed"));
+        return -ENOMEM;
+    }
+
+    /* Parse and fetch request Id */
+    if (!tb[PARAM_REQUEST_ID]) {
+        hddLog(LOGE, FL("attr request id failed"));
+        goto fail;
+    }
+
+    request->request_id = nla_get_u32(tb[PARAM_REQUEST_ID]);
+    hddLog(LOG1, FL("Request Id %d"), request->request_id);
+
+    /* Parse and fetch lost SSID sample size */
+    if (!tb[PARAMS_LOST_SSID_SAMPLE_SIZE]) {
+        hddLog(LOGE, FL("attr number of Ssid failed"));
+        goto fail;
+    }
+    request->lost_ssid_sample_size =
+        nla_get_u32(tb[PARAMS_LOST_SSID_SAMPLE_SIZE]);
+    hddLog(LOG1, FL("Lost SSID Sample Size %d"),
+           request->lost_ssid_sample_size);
+
+    /* Parse and fetch number of hotlist SSID */
+    if (!tb[PARAMS_NUM_SSID]) {
+        hddLog(LOGE, FL("attr number of Ssid failed"));
+        goto fail;
+    }
+    request->ssid_count = nla_get_u32(tb[PARAMS_NUM_SSID]);
+    hddLog(LOG1, FL("Number of SSID %d"), request->ssid_count);
+
+    request->session_id = adapter->sessionId;
+    hddLog(LOG1, FL("Session Id (%d)"), request->session_id);
+
+    i = 0;
+    nla_for_each_nested(ssids, tb[THRESHOLD_PARAM], rem) {
+        if (i >= WLAN_EXTSCAN_MAX_HOTLIST_SSIDS) {
+            hddLog(LOGE,
+                   FL("Too Many SSIDs, %d exceeds %d"),
+                   i, WLAN_EXTSCAN_MAX_HOTLIST_SSIDS);
+            break;
+        }
+        if (nla_parse(tb2, PARAM_MAX,
+                  nla_data(ssids), nla_len(ssids),
+                  wlan_hdd_extscan_config_policy)) {
+            hddLog(LOGE, FL("nla_parse failed"));
+            goto fail;
+        }
+
+        /* Parse and fetch SSID */
+        if (!tb2[PARAM_SSID]) {
+            hddLog(LOGE, FL("attr ssid failed"));
+            goto fail;
+        }
+        nla_memcpy(ssid_string,
+               tb2[PARAM_SSID],
+               sizeof(ssid_string));
+        hddLog(LOG1, FL("SSID %s"),
+               ssid_string);
+        ssid_len = strlen(ssid_string);
+        memcpy(request->ssid[i].ssid.ssId, ssid_string, ssid_len);
+        request->ssid[i].ssid.length = ssid_len;
+        request->ssid[i].ssid.ssId[ssid_len] = '\0';
+        hddLog(LOG1, FL("After copying SSID %s"),
+               request->ssid[i].ssid.ssId);
+        hddLog(LOG1, FL("After copying length: %d"),
+                        ssid_len);
+
+        /* Parse and fetch low RSSI */
+        if (!tb2[PARAM_BAND]) {
+            hddLog(LOGE, FL("attr band failed"));
+            goto fail;
+        }
+        request->ssid[i].band = nla_get_u8(tb2[PARAM_BAND]);
+        hddLog(LOG1, FL("band %d"), request->ssid[i].band);
+
+        /* Parse and fetch low RSSI */
+        if (!tb2[PARAM_RSSI_LOW]) {
+            hddLog(LOGE, FL("attr low RSSI failed"));
+            goto fail;
+        }
+        request->ssid[i].rssi_low = nla_get_s32(tb2[PARAM_RSSI_LOW]);
+        hddLog(LOG1, FL("RSSI low %d"), request->ssid[i].rssi_low);
+
+        /* Parse and fetch high RSSI */
+        if (!tb2[PARAM_RSSI_HIGH]) {
+            hddLog(LOGE, FL("attr high RSSI failed"));
+            goto fail;
+        }
+        request->ssid[i].rssi_high = nla_get_u32(tb2[PARAM_RSSI_HIGH]);
+        hddLog(LOG1, FL("RSSI high %d"), request->ssid[i].rssi_high);
+        i++;
+    }
+
+    context = &hdd_ctx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    INIT_COMPLETION(context->response_event);
+    context->request_id = request_id = request->request_id;
+    spin_unlock(&hdd_context_lock);
+
+    status = sme_set_ssid_hotlist(hdd_ctx->hHal, request);
+    if (!HAL_STATUS_SUCCESS(status)) {
+        hddLog(LOGE,
+               FL("sme_set_ssid_hotlist failed(err=%d)"), status);
+        goto fail;
+    }
+
+    vos_mem_free(request);
+
+    /* request was sent -- wait for the response */
+    rc = wait_for_completion_timeout(&context->response_event,
+                      msecs_to_jiffies
+                         (WLAN_WAIT_TIME_EXTSCAN));
+    if (!rc) {
+        hddLog(LOGE, FL("sme_set_ssid_hotlist timed out"));
+        retval = -ETIMEDOUT;
+    } else {
+        spin_lock(&hdd_context_lock);
+        if (context->request_id == request_id)
+            retval = context->response_status;
+        else
+            retval = -EINVAL;
+        spin_unlock(&hdd_context_lock);
+    }
+
+    return retval;
+
+fail:
+    vos_mem_free(request);
+    return -EINVAL;
+}
+
+/*
+ * done with short names for the global vendor params
+ * used by wlan_hdd_cfg80211_extscan_set_ssid_hotlist()
+ */
+#undef PARAM_MAX
+#undef PARAM_REQUEST_ID
+#undef PARAMS_NUM_SSID
+#undef THRESHOLD_PARAM
+#undef PARAM_SSID
+#undef PARAM_BAND
+#undef PARAM_RSSI_LOW
+#undef PARAM_RSSI_HIGH
+
+static int wlan_hdd_cfg80211_extscan_set_ssid_hotlist(struct wiphy *wiphy,
+                                        struct wireless_dev *wdev,
+                                        const void *data, int dataLen)
+{
+   int ret = 0;
+
+   vos_ssr_protect(__func__);
+   ret = __wlan_hdd_cfg80211_extscan_set_ssid_hotlist(wiphy, wdev, data,
+                                                       dataLen);
+   vos_ssr_unprotect(__func__);
+
+   return ret;
+}
+
+static int
+__wlan_hdd_cfg80211_extscan_reset_ssid_hotlist(struct wiphy *wiphy,
+                         struct wireless_dev *wdev,
+                         const void *data,
+                         int data_len)
+{
+    tSirEXTScanResetSsidHotlistReqParams request;
+    struct net_device *dev = wdev->netdev;
+    hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+    struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
+    struct hdd_ext_scan_context *context;
+    uint32_t request_id;
+    eHalStatus status;
+    int retval;
+    unsigned long rc;
+
+    ENTER();
+
+    if (VOS_FTM_MODE == hdd_get_conparam()) {
+        hddLog(LOGE, FL("Command not allowed in FTM mode"));
+        return -EINVAL;
+    }
+
+    retval = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != retval) {
+        hddLog(LOGE, FL("HDD context is not valid"));
+        return -EINVAL;
+    }
+
+    /* check the EXTScan Capability */
+    if ( (TRUE != hdd_ctx->cfg_ini->fEnableEXTScan) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXT_SCAN_ENHANCED)))
+    {
+        hddLog(LOGE,
+               FL("EXTScan not enabled/supported by Firmware"));
+        return -EINVAL;
+    }
+
     if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
-                    data, dataLen,
-                    wlan_hdd_extscan_config_policy)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("Invalid ATTR"));
+        data, data_len,
+               wlan_hdd_extscan_config_policy)) {
+        hddLog(LOGE, FL("Invalid ATTR"));
         return -EINVAL;
     }
 
     /* Parse and fetch request Id */
     if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr request id failed"));
+        hddLog(LOGE, FL("attr request id failed"));
         return -EINVAL;
     }
-    pReqMsg = (tpSirEXTScanSetSignificantChangeReqParams)
-                                     vos_mem_malloc(sizeof(*pReqMsg));
-    if (!pReqMsg) {
-       hddLog(VOS_TRACE_LEVEL_ERROR, FL("vos_mem_malloc failed"));
-       return -ENOMEM;
-    }
 
+    request.requestId = nla_get_u32(
+            tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]);
+    request.sessionId = adapter->sessionId;
+    hddLog(LOG1, FL("Request Id %d Session Id %d"), request.requestId,
+           request.sessionId);
 
+    context = &hdd_ctx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    INIT_COMPLETION(context->response_event);
+    context->request_id = request_id = request.requestId;
+    spin_unlock(&hdd_context_lock);
 
-    pReqMsg->requestId = nla_get_u32(
-              tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]);
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Req Id (%d)"), pReqMsg->requestId);
-
-    /* Parse and fetch RSSI sample size */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_RSSI_SAMPLE_SIZE])
-    {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr RSSI sample size failed"));
-        goto fail;
-    }
-    pReqMsg->rssiSampleSize = nla_get_u32(
-    tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_RSSI_SAMPLE_SIZE]);
-    hddLog(VOS_TRACE_LEVEL_INFO,
-               FL("RSSI sample size (%u)"), pReqMsg->rssiSampleSize);
-
-    /* Parse and fetch lost AP sample size */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_LOST_AP_SAMPLE_SIZE])
-    {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr lost AP sample size failed"));
-        goto fail;
-    }
-    pReqMsg->lostApSampleSize = nla_get_u32(
-    tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_LOST_AP_SAMPLE_SIZE]);
-    hddLog(VOS_TRACE_LEVEL_INFO,
-               FL("Lost AP sample size (%u)"), pReqMsg->lostApSampleSize);
-    /* Parse and fetch minimum Breaching */
-    if (!tb
-    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_MIN_BREACHING]) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr minBreaching failed"));
-        goto fail;
-    }
-    pReqMsg->minBreaching = nla_get_u32(
-      tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_MIN_BREACHING]);
-    hddLog(VOS_TRACE_LEVEL_INFO, FL(" Breaching (%d)"), pReqMsg->minBreaching);
-
-    /* Parse and fetch number of APs */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP]) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr number of AP failed"));
-        goto fail;
-    }
-    pReqMsg->numAp = nla_get_u32(
-            tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP]);
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Number of AP (%d)"), pReqMsg->numAp);
-
-    pReqMsg->sessionId = pAdapter->sessionId;
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Session Id (%d)"), pReqMsg->sessionId);
-
-    nla_for_each_nested(apTh,
-                tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM], rem) {
-        if(nla_parse(tb2,
-                QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
-                nla_data(apTh), nla_len(apTh),
-                NULL)) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla_parse failed"));
-            goto fail;
-        }
-
-        /* Parse and fetch MAC address */
-        if (!tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_BSSID]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr mac address failed"));
-            goto fail;
-        }
-        memcpy(pReqMsg->ap[i].bssid, nla_data(
-                tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_BSSID]),
-                sizeof(tSirMacAddr));
-
-        /* Parse and fetch low RSSI */
-        if (!tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_LOW]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr low RSSI failed"));
-            goto fail;
-        }
-        pReqMsg->ap[i].low = nla_get_s32(
-             tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_LOW]);
-        hddLog(VOS_TRACE_LEVEL_INFO, FL("RSSI low (%d)"), pReqMsg->ap[i].low);
-
-        /* Parse and fetch high RSSI */
-        if (!tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_HIGH]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr high RSSI failed"));
-            goto fail;
-        }
-        pReqMsg->ap[i].high = nla_get_s32(
-            tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_HIGH]);
-        hddLog(VOS_TRACE_LEVEL_INFO,
-                                    FL("RSSI High (%d)"), pReqMsg->ap[i].high);
-
-        /* Parse and fetch channel */
-        if (!tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_CHANNEL]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr channel failed"));
-            goto fail;
-        }
-        pReqMsg->ap[i].channel = nla_get_u32(
-              tb2[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_CHANNEL]);
-        hddLog(VOS_TRACE_LEVEL_INFO,
-                           FL("Channel (%u)"), pReqMsg->ap[i].channel);
-        i++;
-    }
-
-    status = sme_SetSignificantChange(pHddCtx->hHal, pReqMsg);
+    status = sme_reset_ssid_hotlist(hdd_ctx->hHal, &request);
     if (!HAL_STATUS_SUCCESS(status)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                  FL("sme_SetSignificantChange failed(err=%d)"), status);
-        vos_mem_free(pReqMsg);
+        hddLog(LOGE,
+               FL("sme_reset_ssid_hotlist failed(err=%d)"), status);
         return -EINVAL;
     }
-    vos_mem_free(pReqMsg);
-    EXIT();
-    return 0;
 
-fail:
-    vos_mem_free(pReqMsg);
-    return -EINVAL;
+    /* request was sent -- wait for the response */
+    rc = wait_for_completion_timeout(&context->response_event,
+                     msecs_to_jiffies
+                     (WLAN_WAIT_TIME_EXTSCAN));
+    if (!rc) {
+        hddLog(LOGE, FL("sme_reset_ssid_hotlist timed out"));
+        retval = -ETIMEDOUT;
+    } else {
+        spin_lock(&hdd_context_lock);
+        if (context->request_id == request_id)
+            retval = context->response_status;
+        else
+            retval = -EINVAL;
+        spin_unlock(&hdd_context_lock);
+    }
+
+    return retval;
 }
 
-static int wlan_hdd_cfg80211_extscan_set_significant_change(struct wiphy *wiphy,
-                                        struct wireless_dev *wdev,
-                                        const void *data, int dataLen)
+static int
+wlan_hdd_cfg80211_extscan_reset_ssid_hotlist(struct wiphy *wiphy,
+                     struct wireless_dev *wdev,
+                     const void *data,
+                     int data_len)
 {
-    int ret = 0;
+    int ret;
 
     vos_ssr_protect(__func__);
-    ret = __wlan_hdd_cfg80211_extscan_set_significant_change(wiphy, wdev, data,
-                                                             dataLen);
+    ret = __wlan_hdd_cfg80211_extscan_reset_ssid_hotlist(wiphy, wdev,
+                            data, data_len);
     vos_ssr_unprotect(__func__);
 
     return ret;
@@ -3771,7 +4212,7 @@
     tANI_U32 ChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
     tANI_U8 numChannels                                  = 0;
     struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
-    tANI_U32 requestId;
+    tANI_U32 requestId, maxChannels;
     tWifiBand wifiBand;
     eHalStatus status;
     struct sk_buff *replySkb;
@@ -3812,6 +4253,16 @@
      tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_WIFI_BAND]);
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Wifi band (%d)"), wifiBand);
 
+    /* Parse and fetch max channels */
+    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_MAX_CHANNELS])
+    {
+        hddLog(LOGE, FL("attr max channels failed"));
+        return -EINVAL;
+    }
+    maxChannels = nla_get_u32(
+     tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_MAX_CHANNELS]);
+    hddLog(VOS_TRACE_LEVEL_INFO, FL("Max channels %d"), maxChannels);
+
     status = sme_GetValidChannelsByBand((tHalHandle)(pHddCtx->hHal),
                                         wifiBand, ChannelList,
                                         &numChannels);
@@ -3820,7 +4271,10 @@
            FL("sme_GetValidChannelsByBand failed (err=%d)"), status);
         return -EINVAL;
     }
+
+    numChannels = VOS_MIN(numChannels, maxChannels);
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Number of channels (%d)"), numChannels);
+
     for (i = 0; i < numChannels; i++)
         hddLog(VOS_TRACE_LEVEL_INFO, "Channel: %u ", ChannelList[i]);
 
@@ -3864,26 +4318,281 @@
     return ret;
 }
 
+static int hdd_extscan_start_fill_bucket_channel_spec(
+            hdd_context_t *pHddCtx,
+            tpSirEXTScanStartReqParams pReqMsg,
+            struct nlattr **tb)
+{
+    struct nlattr *bucket[
+        QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
+    struct nlattr *channel[
+        QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
+    struct nlattr *buckets;
+    struct nlattr *channels;
+    int rem1, rem2;
+    eHalStatus status;
+    tANI_U8 bktIndex, j, numChannels;
+    tANI_U32 chanList[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+    tANI_U32 passive_max_chn_time, active_max_chn_time;
+
+    bktIndex = 0;
+
+    nla_for_each_nested(buckets,
+            tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC], rem1) {
+        if (nla_parse(bucket,
+            QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
+            nla_data(buckets), nla_len(buckets), NULL)) {
+            hddLog(LOGE, FL("nla_parse failed"));
+            return -EINVAL;
+        }
+
+        /* Parse and fetch bucket spec */
+        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_INDEX]) {
+            hddLog(LOGE, FL("attr bucket index failed"));
+            return -EINVAL;
+        }
+        pReqMsg->buckets[bktIndex].bucket = nla_get_u8(
+            bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_INDEX]);
+        hddLog(LOG1, FL("Bucket spec Index %d"),
+               pReqMsg->buckets[bktIndex].bucket);
+
+        /* Parse and fetch wifi band */
+        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_BAND]) {
+            hddLog(LOGE, FL("attr wifi band failed"));
+            return -EINVAL;
+        }
+        pReqMsg->buckets[bktIndex].band = nla_get_u8(
+            bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_BAND]);
+        hddLog(LOG1, FL("Wifi band %d"),
+               pReqMsg->buckets[bktIndex].band);
+
+        /* Parse and fetch period */
+        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_PERIOD]) {
+            hddLog(LOGE, FL("attr period failed"));
+            return -EINVAL;
+        }
+        pReqMsg->buckets[bktIndex].period = nla_get_u32(
+        bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_PERIOD]);
+        hddLog(LOG1, FL("period %d"),
+           pReqMsg->buckets[bktIndex].period);
+
+        /* Parse and fetch report events */
+        if (!bucket[
+            QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_REPORT_EVENTS]) {
+            hddLog(LOGE, FL("attr report events failed"));
+            return -EINVAL;
+        }
+        pReqMsg->buckets[bktIndex].reportEvents = nla_get_u8(
+            bucket[
+            QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_REPORT_EVENTS]);
+        hddLog(LOG1, FL("report events %d"),
+            pReqMsg->buckets[bktIndex].reportEvents);
+
+        /* Parse and fetch max period */
+        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_MAX_PERIOD]) {
+            hddLog(LOGE, FL("attr max period failed"));
+            return -EINVAL;
+        }
+        pReqMsg->buckets[bktIndex].max_period = nla_get_u32(
+            bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_MAX_PERIOD]);
+        hddLog(LOG1, FL("max period %u"),
+            pReqMsg->buckets[bktIndex].max_period);
+
+        /* Parse and fetch exponent */
+        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_EXPONENT]) {
+            hddLog(LOGE, FL("attr exponent failed"));
+            return -EINVAL;
+        }
+        pReqMsg->buckets[bktIndex].exponent = nla_get_u32(
+            bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_EXPONENT]);
+        hddLog(LOG1, FL("exponent %u"),
+            pReqMsg->buckets[bktIndex].exponent);
+
+        /* Parse and fetch step count */
+        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_STEP_COUNT]) {
+            hddLog(LOGE, FL("attr step count failed"));
+            return -EINVAL;
+        }
+        pReqMsg->buckets[bktIndex].step_count = nla_get_u32(
+            bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_STEP_COUNT]);
+        hddLog(LOG1, FL("Step count %u"),
+            pReqMsg->buckets[bktIndex].step_count);
+
+        ccmCfgGetInt(pHddCtx->hHal, WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME, &passive_max_chn_time);
+        ccmCfgGetInt(pHddCtx->hHal, WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME, &active_max_chn_time);
+
+        /* Framework shall pass the channel list if the input WiFi band is
+               * WIFI_BAND_UNSPECIFIED.
+               * If the input WiFi band is specified (any value other than
+               * WIFI_BAND_UNSPECIFIED) then driver populates the channel list
+               */
+        if (pReqMsg->buckets[bktIndex].band != WIFI_BAND_UNSPECIFIED) {
+            numChannels = 0;
+            hddLog(LOG1, "WiFi band is specified, driver to fill channel list");
+            status = sme_GetValidChannelsByBand(pHddCtx->hHal,
+                        pReqMsg->buckets[bktIndex].band,
+                        chanList, &numChannels);
+            if (!HAL_STATUS_SUCCESS(status)) {
+                hddLog(LOGE,
+                       FL("sme_GetValidChannelsByBand failed (err=%d)"),
+                       status);
+                return -EINVAL;
+            }
+
+            pReqMsg->buckets[bktIndex].numChannels =
+               VOS_MIN(numChannels, WLAN_EXTSCAN_MAX_CHANNELS);
+            hddLog(LOG1, FL("Num channels %d"),
+                   pReqMsg->buckets[bktIndex].numChannels);
+
+            for (j = 0; j < pReqMsg->buckets[bktIndex].numChannels;
+                 j++) {
+                pReqMsg->buckets[bktIndex].channels[j].channel =
+                            chanList[j];
+                pReqMsg->buckets[bktIndex].channels[j].
+                            chnlClass = 0;
+                if (CSR_IS_CHANNEL_DFS(
+                    vos_freq_to_chan(chanList[j]))) {
+                    pReqMsg->buckets[bktIndex].channels[j].
+                                passive = 1;
+                    pReqMsg->buckets[bktIndex].channels[j].
+                                dwellTimeMs = passive_max_chn_time;
+                } else {
+                    pReqMsg->buckets[bktIndex].channels[j].
+                        passive = 0;
+                    pReqMsg->buckets[bktIndex].channels[j].
+                        dwellTimeMs = active_max_chn_time;
+                }
+
+                hddLog(LOG1,
+                    "Channel %u Passive %u Dwell time %u ms",
+                    pReqMsg->buckets[bktIndex].channels[j].channel,
+                    pReqMsg->buckets[bktIndex].channels[j].passive,
+                    pReqMsg->buckets[bktIndex].channels[j].dwellTimeMs);
+            }
+
+            bktIndex++;
+            continue;
+        }
+
+        /* Parse and fetch number of channels */
+        if (!bucket[
+            QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS]) {
+            hddLog(LOGE, FL("attr num channels failed"));
+            return -EINVAL;
+        }
+
+        pReqMsg->buckets[bktIndex].numChannels =
+        nla_get_u32(bucket[
+        QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS]);
+        hddLog(LOG1, FL("num channels %d"),
+               pReqMsg->buckets[bktIndex].numChannels);
+
+        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC]) {
+            hddLog(LOGE, FL("attr channel spec failed"));
+            return -EINVAL;
+        }
+
+        j = 0;
+        nla_for_each_nested(channels,
+            bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC], rem2) {
+            if (nla_parse(channel,
+                QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
+                nla_data(channels), nla_len(channels),
+                wlan_hdd_extscan_config_policy)) {
+                hddLog(LOGE, FL("nla_parse failed"));
+                return -EINVAL;
+           }
+
+            /* Parse and fetch channel */
+            if (!channel[
+                QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_CHANNEL]) {
+                hddLog(LOGE, FL("attr channel failed"));
+                return -EINVAL;
+            }
+            pReqMsg->buckets[bktIndex].channels[j].channel =
+                nla_get_u32(channel[
+                QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_CHANNEL]);
+            hddLog(LOG1, FL("channel %u"),
+                   pReqMsg->buckets[bktIndex].channels[j].channel);
+
+            /* Parse and fetch dwell time */
+            if (!channel[
+                QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_DWELL_TIME]) {
+                hddLog(LOGE, FL("attr dwelltime failed"));
+                return -EINVAL;
+            }
+            pReqMsg->buckets[bktIndex].channels[j].dwellTimeMs =
+                nla_get_u32(channel[
+                QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_DWELL_TIME]);
+
+            hddLog(LOG1, FL("Dwell time (%u ms)"),
+                pReqMsg->buckets[bktIndex].channels[j].dwellTimeMs);
+
+
+            /* Parse and fetch channel spec passive */
+            if (!channel[
+                QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_PASSIVE]) {
+                hddLog(LOGE,
+                       FL("attr channel spec passive failed"));
+                return -EINVAL;
+            }
+            pReqMsg->buckets[bktIndex].channels[j].passive =
+                nla_get_u8(channel[
+                QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_PASSIVE]);
+            hddLog(LOG1, FL("Chnl spec passive %u"),
+                pReqMsg->buckets[bktIndex].channels[j].passive);
+
+            j++;
+       }
+
+       bktIndex++;
+    }
+
+    return 0;
+}
+
+
+/*
+ * define short names for the global vendor params
+ * used by wlan_hdd_cfg80211_extscan_start()
+ */
+#define PARAM_MAX \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX
+#define PARAM_REQUEST_ID \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID
+#define PARAM_BASE_PERIOD \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_BASE_PERIOD
+#define PARAM_MAX_AP_PER_SCAN \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_MAX_AP_PER_SCAN
+#define PARAM_RPT_THRHLD_PERCENT \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_PERCENT
+#define PARAM_RPT_THRHLD_NUM_SCANS \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD_NUM_SCANS
+#define PARAM_NUM_BUCKETS \
+QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS
+
 static int __wlan_hdd_cfg80211_extscan_start(struct wiphy *wiphy,
                                         struct wireless_dev *wdev,
                                         const void *data, int dataLen)
 {
     tpSirEXTScanStartReqParams pReqMsg = NULL;
-    struct net_device *dev                  = wdev->netdev;
-    hdd_adapter_t *pAdapter                 = WLAN_HDD_GET_PRIV_PTR(dev);
-    hdd_context_t *pHddCtx                  = wiphy_priv(wiphy);
-    struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
-    struct nlattr *bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
-    struct nlattr *channel[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
-    struct nlattr *buckets;
-    struct nlattr *channels;
-    int rem1;
-    int rem2;
+    struct net_device *dev             = wdev->netdev;
+    hdd_adapter_t *pAdapter            = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_context_t *pHddCtx             = wiphy_priv(wiphy);
+    struct nlattr *tb[PARAM_MAX + 1];
+    int retval;
     eHalStatus status;
-    tANI_U32 j = 0, index = 0;
+    tANI_U32 request_id;
+    struct hdd_ext_scan_context *context;
+    unsigned long rc;
 
     ENTER();
 
+    if (VOS_FTM_MODE == hdd_get_conparam()) {
+        hddLog(LOGE, FL("Command not allowed in FTM mode"));
+        return -EINVAL;
+    }
+
     status = wlan_hdd_validate_context(pHddCtx);
     if (0 != status)
     {
@@ -3891,14 +4600,15 @@
     }
     /* check the EXTScan Capability */
     if ( (TRUE != pHddCtx->cfg_ini->fEnableEXTScan) ||
-         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)))
+         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXT_SCAN_ENHANCED)))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("EXTScan not enabled/supported by Firmware"));
         return -EINVAL;
     }
 
-    if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
+    if (nla_parse(tb, PARAM_MAX,
                     data, dataLen,
                     wlan_hdd_extscan_config_policy)) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("Invalid ATTR"));
@@ -3906,7 +4616,7 @@
     }
 
     /* Parse and fetch request Id */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]) {
+    if (!tb[PARAM_REQUEST_ID]) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr request id failed"));
         return -EINVAL;
     }
@@ -3919,49 +4629,59 @@
     }
 
     pReqMsg->requestId = nla_get_u32(
-              tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]);
+              tb[PARAM_REQUEST_ID]);
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Req Id (%d)"), pReqMsg->requestId);
 
     pReqMsg->sessionId = pAdapter->sessionId;
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Session Id (%d)"), pReqMsg->sessionId);
 
     /* Parse and fetch base period */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_BASE_PERIOD]) {
+    if (!tb[PARAM_BASE_PERIOD]) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr base period failed"));
         goto fail;
     }
     pReqMsg->basePeriod = nla_get_u32(
-              tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_BASE_PERIOD]);
+              tb[PARAM_BASE_PERIOD]);
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Base Period (%d)"),
                                          pReqMsg->basePeriod);
 
     /* Parse and fetch max AP per scan */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_MAX_AP_PER_SCAN]) {
+    if (!tb[PARAM_MAX_AP_PER_SCAN]) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr max_ap_per_scan failed"));
         goto fail;
     }
     pReqMsg->maxAPperScan = nla_get_u32(
-             tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_MAX_AP_PER_SCAN]);
+             tb[PARAM_MAX_AP_PER_SCAN]);
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Max AP per Scan (%d)"),
                                          pReqMsg->maxAPperScan);
 
     /* Parse and fetch report threshold */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD]) {
+    if (!tb[PARAM_RPT_THRHLD_PERCENT]) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr report_threshold failed"));
         goto fail;
     }
-    pReqMsg->reportThreshold = nla_get_u8(
-            tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_REPORT_THRESHOLD]);
+    pReqMsg->reportThresholdPercent = nla_get_u8(
+            tb[PARAM_RPT_THRHLD_PERCENT]);
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Report Threshold (%d)"),
-                                         pReqMsg->reportThreshold);
+                                     pReqMsg->reportThresholdPercent);
+
+    /* Parse and fetch report threshold num scans */
+    if (!tb[PARAM_RPT_THRHLD_NUM_SCANS]) {
+        hddLog(LOGE, FL("attr report_threshold num scans failed"));
+        goto fail;
+    }
+    pReqMsg->reportThresholdNumScans = nla_get_u8(
+        tb[PARAM_RPT_THRHLD_NUM_SCANS]);
+    hddLog(LOG1, FL("Report Threshold num scans %d"),
+                     pReqMsg->reportThresholdNumScans);
 
     /* Parse and fetch number of buckets */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS]) {
+    if (!tb[PARAM_NUM_BUCKETS]) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr number of buckets failed"));
         goto fail;
     }
     pReqMsg->numBuckets = nla_get_u8(
-                 tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SCAN_CMD_PARAMS_NUM_BUCKETS]);
+                 tb[PARAM_NUM_BUCKETS]);
     if (pReqMsg->numBuckets > WLAN_EXTSCAN_MAX_BUCKETS) {
         hddLog(VOS_TRACE_LEVEL_WARN, FL("Exceeded MAX number of buckets "
           "Setting numBuckets to %u"), WLAN_EXTSCAN_MAX_BUCKETS);
@@ -3969,140 +4689,69 @@
     }
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Number of Buckets (%d)"),
                                          pReqMsg->numBuckets);
+
     if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC]) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr bucket spec failed"));
         goto fail;
     }
 
-    nla_for_each_nested(buckets,
-                tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC], rem1) {
-        if(nla_parse(bucket,
-            QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
-            nla_data(buckets), nla_len(buckets), NULL)) { //policy
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla_parse failed"));
-            goto fail;
-        }
+    pReqMsg->homeAwayTime = pHddCtx->cfg_ini->nRestTimeConc;
 
-        /* Parse and fetch bucket spec */
-        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_INDEX]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr bucket index failed"));
-            goto fail;
-        }
+    if (hdd_extscan_start_fill_bucket_channel_spec(pHddCtx, pReqMsg, tb))
+        goto fail;
 
-        pReqMsg->buckets[index].bucket = nla_get_u8(
-                bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_INDEX]);
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    INIT_COMPLETION(context->response_event);
+    context->request_id = request_id = pReqMsg->requestId;
+    spin_unlock(&hdd_context_lock);
 
-        hddLog(VOS_TRACE_LEVEL_INFO, FL("Bucket spec Index (%d)"),
-                pReqMsg->buckets[index].bucket);
-
-        /* Parse and fetch wifi band */
-        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_BAND]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr wifi band failed"));
-            goto fail;
-        }
-        pReqMsg->buckets[index].band = nla_get_u8(
-                         bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_BAND]);
-        hddLog(VOS_TRACE_LEVEL_INFO, FL("Wifi band (%d)"),
-                           pReqMsg->buckets[index].band);
-
-        /* Parse and fetch period */
-        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_PERIOD]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr period failed"));
-            goto fail;
-        }
-        pReqMsg->buckets[index].period = nla_get_u32(
-                       bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_PERIOD]);
-        hddLog(VOS_TRACE_LEVEL_INFO, FL("period (%d)"),
-                           pReqMsg->buckets[index].period);
-
-        /* Parse and fetch report events */
-        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_REPORT_EVENTS]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr report events failed"));
-            goto fail;
-        }
-        pReqMsg->buckets[index].reportEvents = nla_get_u8(
-                bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_REPORT_EVENTS]);
-        hddLog(VOS_TRACE_LEVEL_INFO, FL("report events (%d)"),
-                           pReqMsg->buckets[index].reportEvents);
-
-        /* Parse and fetch number of channels */
-        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS])
-        {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr num channels failed"));
-            goto fail;
-        }
-        pReqMsg->buckets[index].numChannels = nla_get_u32(
-            bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS]);
-        hddLog(VOS_TRACE_LEVEL_INFO, FL("num channels (%d)"),
-                           pReqMsg->buckets[index].numChannels);
-
-        if (!bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC]) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr channel spec failed"));
-            goto fail;
-        }
-
-        j = 0;
-        nla_for_each_nested(channels,
-                      bucket[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC], rem2) {
-            if(nla_parse(channel,
-                QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
-                nla_data(channels), nla_len(channels),
-                NULL)) { //wlan_hdd_extscan_config_policy here
-                hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla_parse failed"));
-                goto fail;
-            }
-
-            /* Parse and fetch channel */
-            if (!channel[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_CHANNEL]) {
-                hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr channel failed"));
-                goto fail;
-            }
-            pReqMsg->buckets[index].channels[j].channel = nla_get_u32(
-                   channel[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_CHANNEL]);
-            hddLog(VOS_TRACE_LEVEL_INFO, FL("channel (%u)"),
-                         pReqMsg->buckets[index].channels[j].channel);
-
-            /* Parse and fetch dwell time */
-            if (!channel[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_DWELL_TIME]) {
-                hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr dwelltime failed"));
-                goto fail;
-            }
-            pReqMsg->buckets[index].channels[j].dwellTimeMs = nla_get_u32(
-                 channel[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_DWELL_TIME]);
-            hddLog(VOS_TRACE_LEVEL_INFO, FL("Dwell time (%u ms)"),
-                     pReqMsg->buckets[index].channels[j].dwellTimeMs);
-
-            /* Parse and fetch channel spec passive */
-            if (!channel[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_PASSIVE]) {
-                hddLog(VOS_TRACE_LEVEL_ERROR,
-                                     FL("attr channel spec passive failed"));
-                goto fail;
-            }
-            pReqMsg->buckets[index].channels[j].passive = nla_get_u8(
-                   channel[QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_PASSIVE]);
-            hddLog(VOS_TRACE_LEVEL_INFO, FL("Chnl spec passive (%u)"),
-                     pReqMsg->buckets[index].channels[j].passive);
-            j++;
-        }
-        index++;
-    }
     status = sme_EXTScanStart(pHddCtx->hHal, pReqMsg);
     if (!HAL_STATUS_SUCCESS(status)) {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                      FL("sme_EXTScanStart failed(err=%d)"), status);
-        vos_mem_free(pReqMsg);
-        return -EINVAL;
+        goto fail;
+    }
+
+    pHddCtx->extscan_start_time_since_boot = vos_get_monotonic_boottime();
+
+    /* request was sent -- wait for the response */
+    rc = wait_for_completion_timeout(&context->response_event,
+                msecs_to_jiffies(WLAN_WAIT_TIME_EXTSCAN));
+
+    if (!rc) {
+        hddLog(LOGE, FL("sme_ExtScanStart timed out"));
+        retval = -ETIMEDOUT;
+    } else {
+        spin_lock(&hdd_context_lock);
+        if (context->request_id == request_id)
+            retval = context->response_status;
+        else
+            retval = -EINVAL;
+        spin_unlock(&hdd_context_lock);
     }
 
     vos_mem_free(pReqMsg);
     EXIT();
-    return 0;
+    return retval;
 
 fail:
     vos_mem_free(pReqMsg);
     return -EINVAL;
 }
 
+/*
+ * done with short names for the global vendor params
+ * used by wlan_hdd_cfg80211_extscan_start()
+ */
+#undef PARAM_MAX
+#undef PARAM_REQUEST_ID
+#undef PARAM_BASE_PERIOD
+#undef PARAMS_MAX_AP_PER_SCAN
+#undef PARAMS_RPT_THRHLD_PERCENT
+#undef PARAMS_RPT_THRHLD_NUM_SCANS
+#undef PARAMS_NUM_BUCKETS
+
 static int wlan_hdd_cfg80211_extscan_start(struct wiphy *wiphy,
                                         struct wireless_dev *wdev,
                                         const void *data, int dataLen)
@@ -4126,9 +4775,18 @@
     hdd_context_t *pHddCtx                  = wiphy_priv(wiphy);
     struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
     eHalStatus status;
+    int retval;
+    unsigned long rc;
+    struct hdd_ext_scan_context *context;
+    tANI_U32 request_id;
 
     ENTER();
 
+    if (VOS_FTM_MODE == hdd_get_conparam()) {
+        hddLog(LOGE, FL("Command not allowed in FTM mode"));
+        return -EINVAL;
+    }
+
     status = wlan_hdd_validate_context(pHddCtx);
     if (0 != status)
     {
@@ -4136,7 +4794,8 @@
     }
     /* check the EXTScan Capability */
     if ( (TRUE != pHddCtx->cfg_ini->fEnableEXTScan) ||
-         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)))
+         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXT_SCAN_ENHANCED)))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("EXTScan not enabled/supported by Firmware"));
@@ -4163,6 +4822,12 @@
     reqMsg.sessionId = pAdapter->sessionId;
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Session Id (%d)"), reqMsg.sessionId);
 
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    INIT_COMPLETION(context->response_event);
+    context->request_id = request_id = reqMsg.requestId;
+    spin_unlock(&hdd_context_lock);
+
     status = sme_EXTScanStop(pHddCtx->hHal, &reqMsg);
     if (!HAL_STATUS_SUCCESS(status)) {
         hddLog(VOS_TRACE_LEVEL_ERROR,
@@ -4170,6 +4835,24 @@
         return -EINVAL;
     }
 
+    /* request was sent -- wait for the response */
+    rc = wait_for_completion_timeout(&context->response_event,
+                 msecs_to_jiffies(WLAN_WAIT_TIME_EXTSCAN));
+
+    if (!rc) {
+        hddLog(LOGE, FL("sme_ExtScanStop timed out"));
+        retval = -ETIMEDOUT;
+    } else {
+        spin_lock(&hdd_context_lock);
+        if (context->request_id == request_id)
+            retval = context->response_status;
+        else
+            retval = -EINVAL;
+        spin_unlock(&hdd_context_lock);
+    }
+
+    return retval;
+
     EXIT();
     return 0;
 }
@@ -4197,17 +4880,28 @@
     hdd_context_t *pHddCtx                       = wiphy_priv(wiphy);
     struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
     eHalStatus status;
+    struct hdd_ext_scan_context *context;
+    tANI_U32 request_id;
+    unsigned long rc;
+    int retval;
 
     ENTER();
 
+    if (VOS_FTM_MODE == hdd_get_conparam()) {
+        hddLog(LOGE, FL("Command not allowed in FTM mode"));
+        return -EINVAL;
+    }
+
     status = wlan_hdd_validate_context(pHddCtx);
     if (0 != status)
     {
+        hddLog(LOGE, FL("HDD context is not valid"));
         return -EINVAL;
     }
     /* check the EXTScan Capability */
     if ( (TRUE != pHddCtx->cfg_ini->fEnableEXTScan) ||
-         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)))
+         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) ||
+         (TRUE != sme_IsFeatureSupportedByFW(EXT_SCAN_ENHANCED)))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("EXTScan not enabled/supported by Firmware"));
@@ -4234,14 +4928,36 @@
     reqMsg.sessionId = pAdapter->sessionId;
     hddLog(VOS_TRACE_LEVEL_INFO, FL("Session Id (%d)"), reqMsg.sessionId);
 
+    context = &pHddCtx->ext_scan_context;
+    spin_lock(&hdd_context_lock);
+    INIT_COMPLETION(context->response_event);
+    context->request_id = request_id = reqMsg.requestId;
+    spin_unlock(&hdd_context_lock);
+
     status = sme_ResetBssHotlist(pHddCtx->hHal, &reqMsg);
     if (!HAL_STATUS_SUCCESS(status)) {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                           FL("sme_ResetBssHotlist failed(err=%d)"), status);
         return -EINVAL;
     }
+
+    /* request was sent -- wait for the response */
+    rc = wait_for_completion_timeout(&context->response_event,
+                                     msecs_to_jiffies(WLAN_WAIT_TIME_EXTSCAN));
+    if (!rc) {
+       hddLog(LOGE, FL("sme_ResetBssHotlist timed out"));
+       retval = -ETIMEDOUT;
+    } else {
+       spin_lock(&hdd_context_lock);
+       if (context->request_id == request_id)
+          retval = context->response_status;
+       else
+          retval = -EINVAL;
+       spin_unlock(&hdd_context_lock);
+    }
+
     EXIT();
-    return 0;
+    return retval;
 }
 
 static int wlan_hdd_cfg80211_extscan_reset_bssid_hotlist(struct wiphy *wiphy,
@@ -4256,82 +4972,6 @@
 
    return ret;
 }
-
-static int __wlan_hdd_cfg80211_extscan_reset_significant_change(
-                                        struct wiphy *wiphy,
-                                        struct wireless_dev *wdev,
-                                        const void *data, int dataLen)
-{
-    tSirEXTScanResetSignificantChangeReqParams reqMsg;
-    struct net_device *dev                       = wdev->netdev;
-    hdd_adapter_t *pAdapter                      = WLAN_HDD_GET_PRIV_PTR(dev);
-    hdd_context_t *pHddCtx                       = wiphy_priv(wiphy);
-    struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
-    eHalStatus status;
-
-    ENTER();
-
-    status = wlan_hdd_validate_context(pHddCtx);
-    if (0 != status)
-    {
-        return -EINVAL;
-    }
-    /* check the EXTScan Capability */
-    if ( (TRUE != pHddCtx->cfg_ini->fEnableEXTScan) ||
-         (TRUE != sme_IsFeatureSupportedByFW(EXTENDED_SCAN)))
-    {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-               FL("EXTScan not enabled/supported by Firmware"));
-        return -EINVAL;
-    }
-
-    if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
-                    data, dataLen,
-                    wlan_hdd_extscan_config_policy)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("Invalid ATTR"));
-        return -EINVAL;
-    }
-
-    /* Parse and fetch request Id */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("attr request id failed"));
-        return -EINVAL;
-    }
-
-
-    reqMsg.requestId = nla_get_u32(
-              tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]);
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Req Id (%d)"), reqMsg.requestId);
-
-    reqMsg.sessionId = pAdapter->sessionId;
-    hddLog(VOS_TRACE_LEVEL_INFO, FL("Session Id (%d)"), reqMsg.sessionId);
-
-    status = sme_ResetSignificantChange(pHddCtx->hHal, &reqMsg);
-    if (!HAL_STATUS_SUCCESS(status)) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                   FL("sme_ResetSignificantChange failed(err=%d)"), status);
-        return -EINVAL;
-    }
-
-    EXIT();
-    return 0;
-}
-
-static int wlan_hdd_cfg80211_extscan_reset_significant_change(
-                                        struct wiphy *wiphy,
-                                        struct wireless_dev *wdev,
-                                        const void *data, int dataLen)
-{
-   int ret = 0;
-
-   vos_ssr_protect(__func__);
-   ret = __wlan_hdd_cfg80211_extscan_reset_significant_change(wiphy,
-                                                              wdev, data,
-                                                              dataLen);
-   vos_ssr_unprotect(__func__);
-
-   return ret;
-}
 #endif /* WLAN_FEATURE_EXTSCAN */
 
 /*EXT TDLS*/
@@ -4440,10 +5080,8 @@
             pHddCtx->spoofMacAddr.isEnabled = FALSE;
     }
 
-    if (VOS_STATUS_SUCCESS != hdd_processSpoofMacAddrRequest(pHddCtx))
-    {
-        hddLog(LOGE, FL("Failed to send Spoof Mac Addr to FW"));
-    }
+    schedule_delayed_work(&pHddCtx->spoof_mac_addr_work,
+                          msecs_to_jiffies(MAC_ADDR_SPOOFING_DEFER_INTERVAL));
 
     EXIT();
     return 0;
@@ -4890,8 +5528,9 @@
 
 #ifdef WLAN_FEATURE_EXTSCAN
     if ((TRUE == pHddCtx->cfg_ini->fEnableEXTScan) &&
-            sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) {
-        hddLog(LOG1, FL("EXTScan is supported by firmware"));
+            sme_IsFeatureSupportedByFW(EXTENDED_SCAN) &&
+            sme_IsFeatureSupportedByFW(EXT_SCAN_ENHANCED)) {
+        hddLog(LOG1, FL("Enhanced EXTScan is supported by firmware"));
         fset |= WIFI_FEATURE_EXTSCAN;
     }
 #endif
@@ -4907,6 +5546,11 @@
         fset |= WIFI_FEATURE_D2AP_RTT;
     }
 
+   if (sme_IsFeatureSupportedByFW(RTT3)) {
+        hddLog(LOG1, FL("RTT3 is supported by firmware"));
+        fset |= WIFI_FEATURE_RTT3;
+    }
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
     if (fset & WIFI_FEATURE_EXTSCAN) {
         hddLog(LOG1, FL("Batch scan is supported as extscan is supported"));
@@ -4985,6 +5629,88 @@
     return ret;
 }
 
+
+static const struct
+nla_policy
+qca_wlan_vendor_wifi_logger_get_ring_data_policy
+[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_MAX + 1] = {
+    [QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_ID]
+        = {.type = NLA_U32 },
+};
+
+static int
+    __wlan_hdd_cfg80211_wifi_logger_get_ring_data(struct wiphy *wiphy,
+                                                      struct wireless_dev *wdev,
+                                                      const void *data,
+                                                      int data_len)
+{
+    int ret;
+    VOS_STATUS status;
+    uint32_t ring_id;
+    hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+    struct nlattr *tb
+        [QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_MAX + 1];
+
+    ENTER();
+
+    ret = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != ret) {
+        return ret;
+    }
+
+    if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_MAX,
+            data, data_len,
+            qca_wlan_vendor_wifi_logger_get_ring_data_policy)) {
+        hddLog(LOGE, FL("Invalid attribute"));
+        return -EINVAL;
+    }
+
+    /* Parse and fetch ring id */
+    if (!tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_ID]) {
+        hddLog(LOGE, FL("attr ATTR failed"));
+        return -EINVAL;
+    }
+
+    ring_id = nla_get_u32(
+            tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_ID]);
+
+    hddLog(LOG1, FL("Bug report triggered by framework"));
+
+    status = vos_fatal_event_logs_req(WLAN_LOG_TYPE_NON_FATAL,
+                WLAN_LOG_INDICATOR_FRAMEWORK,
+                WLAN_LOG_REASON_CODE_FRAMEWORK,
+                TRUE, TRUE
+                );
+    if (VOS_STATUS_SUCCESS != status) {
+        hddLog(LOGE, FL("Failed to trigger bug report"));
+
+        return -EINVAL;
+    }
+
+    return 0;
+
+
+}
+
+
+static int
+    wlan_hdd_cfg80211_wifi_logger_get_ring_data(struct wiphy *wiphy,
+                                                      struct wireless_dev *wdev,
+                                                      const void *data,
+                                                      int data_len)
+{
+    int ret = 0;
+
+    vos_ssr_protect(__func__);
+    ret = __wlan_hdd_cfg80211_wifi_logger_get_ring_data(wiphy,
+            wdev, data, data_len);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
+
+}
+
+
 static int
 __wlan_hdd_cfg80211_get_concurrency_matrix(struct wiphy *wiphy,
                                          struct wireless_dev *wdev,
@@ -5083,6 +5809,188 @@
     return ret;
 }
 
+
+static int
+__wlan_hdd_cfg80211_get_fw_mem_dump(struct wiphy *wiphy,
+                                    struct wireless_dev *wdev,
+                                    const void *data, int data_len)
+{
+    hdd_context_t *pHddCtx = wiphy_priv(wiphy);
+    int ret;
+    ENTER();
+
+    ret = wlan_hdd_validate_context(pHddCtx);
+    if (0 != ret)
+    {
+        return ret;
+    }
+
+    if( !pHddCtx->cfg_ini->enableFwrMemDump ||
+       (FALSE == sme_IsFeatureSupportedByFW(MEMORY_DUMP_SUPPORTED)))
+    {
+       hddLog(VOS_TRACE_LEVEL_INFO, FL("FW dump Logging not supported"));
+       return -EINVAL;
+    }
+    /*call common API for FW mem dump req*/
+    ret = wlan_hdd_fw_mem_dump_req(pHddCtx);
+
+    if (!ret)
+    {
+        /*indicate to userspace the status of fw mem dump */
+        wlan_indicate_mem_dump_complete(true);
+    }
+    else
+    {
+        /*else send failure to userspace */
+        wlan_indicate_mem_dump_complete(false);
+    }
+    EXIT();
+    return ret;
+}
+
+/**
+ * wlan_hdd_cfg80211_get_fw_mem_dump() - Get FW memory dump
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ * @data:    Pointer to the NL data.
+ * @data_len:Length of @data
+ *
+ * This is called when wlan driver needs to get the firmware memory dump
+ * via vendor specific command.
+ *
+ * Return:   0 on success, error number otherwise.
+ */
+
+static int
+wlan_hdd_cfg80211_get_fw_mem_dump(struct wiphy *wiphy,
+                                              struct wireless_dev *wdev,
+                                         const void *data, int data_len)
+{
+    int ret = 0;
+    vos_ssr_protect(__func__);
+    ret = __wlan_hdd_cfg80211_get_fw_mem_dump(wiphy, wdev, data,
+                                        data_len);
+    vos_ssr_unprotect(__func__);
+    return ret;
+}
+
+static const struct
+nla_policy
+qca_wlan_vendor_wifi_logger_start_policy
+[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_MAX + 1] = {
+   [QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_RING_ID]
+     = {.type = NLA_U32 },
+     [QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_VERBOSE_LEVEL]
+        = {.type = NLA_U32 },
+     [QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_FLAGS]
+          = {.type = NLA_U32 },
+};
+
+/**
+ * __wlan_hdd_cfg80211_wifi_logger_start() - This function is used to enable
+ * or disable the collection of packet statistics from the firmware
+ * @wiphy:    WIPHY structure pointer
+ * @wdev:     Wireless device structure pointer
+ * @data:     Pointer to the data received
+ * @data_len: Length of the data received
+ *
+ * This function is used to enable or disable the collection of packet
+ * statistics from the firmware
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int __wlan_hdd_cfg80211_wifi_logger_start(struct wiphy *wiphy,
+                       struct wireless_dev *wdev,
+                        const void *data,
+                                int data_len)
+{
+    eHalStatus status;
+    hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+    struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_MAX + 1];
+    tAniWifiStartLog start_log;
+
+    status = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != status) {
+        return -EINVAL;
+    }
+
+     if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_MAX,
+             data, data_len,
+            qca_wlan_vendor_wifi_logger_start_policy)) {
+        hddLog(LOGE, FL("Invalid attribute"));
+        return -EINVAL;
+    }
+
+    /* Parse and fetch ring id */
+    if (!tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_RING_ID]) {
+        hddLog(LOGE, FL("attr ATTR failed"));
+        return -EINVAL;
+    }
+    start_log.ringId = nla_get_u32(
+           tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_RING_ID]);
+    hddLog(LOG1, FL("Ring ID=%d"), start_log.ringId);
+
+    /* Parse and fetch verbose level */
+    if (!tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_VERBOSE_LEVEL]) {
+        hddLog(LOGE, FL("attr verbose_level failed"));
+        return -EINVAL;
+    }
+    start_log.verboseLevel = nla_get_u32(
+         tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_VERBOSE_LEVEL]);
+    hddLog(LOG1, FL("verbose_level=%d"), start_log.verboseLevel);
+
+    /* Parse and fetch flag */
+    if (!tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_FLAGS]) {
+        hddLog(LOGE, FL("attr flag failed"));
+        return -EINVAL;
+    }
+    start_log.flag = nla_get_u32(
+        tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_FLAGS]);
+    hddLog(LOG1, FL("flag=%d"), start_log.flag);
+
+    if ((RING_ID_PER_PACKET_STATS == start_log.ringId) &&
+                 (!hdd_ctx->cfg_ini->wlanPerPktStatsLogEnable ||
+        !vos_isPktStatsEnabled()))
+
+    {
+       hddLog(LOGE, FL("per pkt stats not enabled"));
+       return -EINVAL;
+    }
+
+    vos_set_ring_log_level(start_log.ringId, start_log.verboseLevel);
+    return 0;
+}
+
+/**
+ * wlan_hdd_cfg80211_wifi_logger_start() - Wrapper function used to enable
+ * or disable the collection of packet statistics from the firmware
+ * @wiphy:    WIPHY structure pointer
+ * @wdev:     Wireless device structure pointer
+ * @data:     Pointer to the data received
+ * @data_len: Length of the data received
+ *
+ * This function is used to enable or disable the collection of packet
+ * statistics from the firmware
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int wlan_hdd_cfg80211_wifi_logger_start(struct wiphy *wiphy,
+                        struct wireless_dev *wdev,
+                        const void *data,
+                        int data_len)
+{
+    int ret = 0;
+
+    vos_ssr_protect(__func__);
+
+    ret = __wlan_hdd_cfg80211_wifi_logger_start(wiphy,
+          wdev, data, data_len);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
+}
+
+
 static const struct nla_policy
 wlan_hdd_set_no_dfs_flag_config_policy[QCA_WLAN_VENDOR_ATTR_SET_NO_DFS_FLAG_MAX
  +1] =
@@ -5208,8 +6116,13 @@
 
     //Update roaming
     status = sme_ConfigFwrRoaming((tHalHandle)(pHddCtx->hHal), isFwrRoamEnabled);
+    if (!HAL_STATUS_SUCCESS(status)) {
+        hddLog(LOGE,
+           FL("sme_ConfigFwrRoaming failed (err=%d)"), status);
+        return -EINVAL;
+    }
     EXIT();
-    return status;
+    return 0;
 }
 
 static int wlan_hdd_cfg80211_firmware_roaming(struct wiphy *wiphy,
@@ -5224,6 +6137,418 @@
     return ret;
 }
 
+static const struct
+nla_policy
+qca_wlan_vendor_get_wifi_info_policy[
+         QCA_WLAN_VENDOR_ATTR_WIFI_INFO_GET_MAX +1] = {
+    [QCA_WLAN_VENDOR_ATTR_WIFI_INFO_DRIVER_VERSION] = {.type = NLA_U8 },
+    [QCA_WLAN_VENDOR_ATTR_WIFI_INFO_FIRMWARE_VERSION] = {.type = NLA_U8 },
+};
+
+
+/**
+ * __wlan_hdd_cfg80211_get_wifi_info() - Get the wifi driver related info
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ * @data:    Pointer to the data to be passed via vendor interface
+ * @data_len:Length of the data to be passed
+ *
+ * This is called when wlan driver needs to send wifi driver related info
+ * (driver/fw version) to the user space application upon request.
+ *
+ * Return:   Return the Success or Failure code.
+ */
+static int __wlan_hdd_cfg80211_get_wifi_info(struct wiphy *wiphy,
+                                  struct wireless_dev *wdev,
+                              const void *data, int data_len)
+{
+    hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+    struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_WIFI_INFO_GET_MAX + 1];
+    tSirVersionString version;
+    uint32 version_len;
+    uint8 attr;
+    int status;
+    struct sk_buff *reply_skb = NULL;
+
+    if (VOS_FTM_MODE == hdd_get_conparam()) {
+        hddLog(LOGE, FL("Command not allowed in FTM mode"));
+        return -EINVAL;
+    }
+
+    status = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != status) {
+        hddLog(LOGE, FL("HDD context is not valid"));
+        return -EINVAL;
+    }
+
+    if (nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_WIFI_INFO_GET_MAX, data,
+        data_len, qca_wlan_vendor_get_wifi_info_policy)) {
+        hddLog(LOGE, FL("WIFI_INFO_GET NL CMD parsing failed"));
+        return -EINVAL;
+    }
+
+    if (tb_vendor[QCA_WLAN_VENDOR_ATTR_WIFI_INFO_DRIVER_VERSION]) {
+        hddLog(LOG1, FL("Rcvd req for Driver version Driver version is %s"),
+                                                          QWLAN_VERSIONSTR);
+        strlcpy(version, QWLAN_VERSIONSTR, sizeof(version));
+        attr = QCA_WLAN_VENDOR_ATTR_WIFI_INFO_DRIVER_VERSION;
+    } else if (tb_vendor[QCA_WLAN_VENDOR_ATTR_WIFI_INFO_FIRMWARE_VERSION]) {
+        hddLog(LOG1, FL("Rcvd req for FW version FW version is %s"),
+                                               hdd_ctx->fw_Version);
+        strlcpy(version, hdd_ctx->fw_Version, sizeof(version));
+        attr = QCA_WLAN_VENDOR_ATTR_WIFI_INFO_FIRMWARE_VERSION;
+    } else {
+        hddLog(LOGE, FL("Invalid attribute in get wifi info request"));
+        return -EINVAL;
+    }
+
+    version_len = strlen(version);
+    reply_skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy,
+    version_len + NLA_HDRLEN + NLMSG_HDRLEN);
+    if (!reply_skb) {
+        hddLog(LOGE, FL("cfg80211_vendor_cmd_alloc_reply_skb failed"));
+        return -ENOMEM;
+    }
+
+    if (nla_put(reply_skb, attr, version_len, version)) {
+        hddLog(LOGE, FL("nla put fail"));
+        kfree_skb(reply_skb);
+        return -EINVAL;
+    }
+
+    return cfg80211_vendor_cmd_reply(reply_skb);
+}
+
+/**
+ * __wlan_hdd_cfg80211_get_wifi_info() - Get the wifi driver related info
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ * @data:    Pointer to the data to be passed via vendor interface
+ * @data_len:Length of the data to be passed
+ * @data_len: Length of the data received
+ *
+ * This function is used to enable or disable the collection of packet
+ * statistics from the firmware
+ *
+ * Return: 0 on success and errno on failure
+ */
+
+static int
+wlan_hdd_cfg80211_get_wifi_info(struct wiphy *wiphy,
+                                  struct wireless_dev *wdev,
+                              const void *data, int data_len)
+
+
+{
+    int ret = 0;
+
+    vos_ssr_protect(__func__);
+    ret = __wlan_hdd_cfg80211_get_wifi_info(wiphy,
+          wdev, data, data_len);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
+}
+
+
+/*
+ * define short names for the global vendor params
+ * used by __wlan_hdd_cfg80211_monitor_rssi()
+ */
+#define PARAM_MAX QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_MAX
+#define PARAM_REQUEST_ID QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_REQUEST_ID
+#define PARAM_CONTROL QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_CONTROL
+#define PARAM_MIN_RSSI QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_MIN_RSSI
+#define PARAM_MAX_RSSI QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_MAX_RSSI
+
+/**---------------------------------------------------------------------------
+
+  \brief hdd_rssi_monitor_start_done - callback to be executed when rssi
+                                       monitor start is completed successfully.
+
+  \return -  None
+
+  --------------------------------------------------------------------------*/
+void hdd_rssi_monitor_start_done(void *fwRssiMonitorCbContext, VOS_STATUS status)
+{
+   hdd_context_t* pHddCtx = (hdd_context_t*)fwRssiMonitorCbContext;
+
+   if (NULL == pHddCtx)
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR,
+                 "%s: HDD context is NULL",__func__);
+      return;
+   }
+
+   if (VOS_STATUS_SUCCESS == status)
+   {
+      hddLog(VOS_TRACE_LEVEL_INFO, FL("Rssi Monitor start successful"));
+   }
+   else
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR, FL("Rssi Monitor start not successful"));
+   }
+
+   return;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief hdd_rssi_monitor_stop_done - callback to be executed when rssi monitor
+                                      stop is completed successfully.
+
+  \return -  None
+
+  --------------------------------------------------------------------------*/
+void hdd_rssi_monitor_stop_done(void *fwRssiMonitorCbContext, VOS_STATUS status)
+{
+   hdd_context_t* pHddCtx = (hdd_context_t*)fwRssiMonitorCbContext;
+
+   if (NULL == pHddCtx)
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR,
+                 "%s: HDD context is NULL",__func__);
+      return;
+   }
+
+   if (VOS_STATUS_SUCCESS == status)
+   {
+      hddLog(VOS_TRACE_LEVEL_INFO, FL("Rssi Monitor stop successful"));
+   }
+   else
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR, FL("Rssi Monitor stop not successful"));
+   }
+
+   return;
+}
+
+/**
+ * __wlan_hdd_cfg80211_monitor_rssi() - monitor rssi
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Data length
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+
+static int
+__wlan_hdd_cfg80211_monitor_rssi(struct wiphy *wiphy,
+                                 struct wireless_dev *wdev,
+                                 const void *data,
+                                 int data_len)
+{
+        struct net_device *dev = wdev->netdev;
+        hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
+        hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+        hdd_station_ctx_t *pHddStaCtx;
+        struct nlattr *tb[PARAM_MAX + 1];
+        tpSirRssiMonitorReq pReq;
+        eHalStatus status;
+        int ret;
+        uint32_t control;
+        static const struct nla_policy policy[PARAM_MAX + 1] = {
+                        [PARAM_REQUEST_ID] = { .type = NLA_U32 },
+                        [PARAM_CONTROL] = { .type = NLA_U32 },
+                        [PARAM_MIN_RSSI] = { .type = NLA_S8 },
+                        [PARAM_MAX_RSSI] = { .type = NLA_S8 },
+        };
+
+        ENTER();
+
+        ret = wlan_hdd_validate_context(hdd_ctx);
+        if (0 != ret) {
+                return -EINVAL;
+        }
+
+        if (!hdd_connIsConnected(WLAN_HDD_GET_STATION_CTX_PTR(pAdapter))) {
+                hddLog(LOGE, FL("Not in Connected state!"));
+                return -ENOTSUPP;
+        }
+
+        if (nla_parse(tb, PARAM_MAX, data, data_len, policy)) {
+                hddLog(LOGE, FL("Invalid ATTR"));
+                return -EINVAL;
+        }
+
+        if (!tb[PARAM_REQUEST_ID]) {
+                hddLog(LOGE, FL("attr request id failed"));
+                return -EINVAL;
+        }
+
+        if (!tb[PARAM_CONTROL]) {
+                hddLog(LOGE, FL("attr control failed"));
+                return -EINVAL;
+        }
+
+        pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+
+        pReq = vos_mem_malloc(sizeof(tSirRssiMonitorReq));
+        if(NULL == pReq)
+        {
+            hddLog(LOGE,
+                 FL("vos_mem_alloc failed "));
+            return eHAL_STATUS_FAILED_ALLOC;
+        }
+        vos_mem_set(pReq, sizeof(tSirRssiMonitorReq), 0);
+
+        pReq->requestId = nla_get_u32(tb[PARAM_REQUEST_ID]);
+        pReq->sessionId = pAdapter->sessionId;
+        pReq->rssiMonitorCbContext = hdd_ctx;
+        control = nla_get_u32(tb[PARAM_CONTROL]);
+        vos_mem_copy( &pReq->currentBssId, pHddStaCtx->conn_info.bssId, WNI_CFG_BSSID_LEN);
+
+        hddLog(LOG1, FL("Request Id: %u Session_id: %d Control: %d"),
+                        pReq->requestId, pReq->sessionId, control);
+
+        if (control == QCA_WLAN_RSSI_MONITORING_START) {
+                if (!tb[PARAM_MIN_RSSI]) {
+                        hddLog(LOGE, FL("attr min rssi failed"));
+                        goto fail;
+                }
+
+                if (!tb[PARAM_MAX_RSSI]) {
+                        hddLog(LOGE, FL("attr max rssi failed"));
+                        goto fail;
+                }
+
+                pReq->minRssi = nla_get_s8(tb[PARAM_MIN_RSSI]);
+                pReq->maxRssi = nla_get_s8(tb[PARAM_MAX_RSSI]);
+                pReq->rssiMonitorCallback = hdd_rssi_monitor_start_done;
+
+                if (!(pReq->minRssi < pReq->maxRssi)) {
+                        hddLog(LOGW, FL("min_rssi: %d must be less than max_rssi: %d"),
+                                        pReq->minRssi, pReq->maxRssi);
+                        goto fail;
+                }
+                hddLog(LOG1, FL("Min_rssi: %d Max_rssi: %d"),
+                       pReq->minRssi, pReq->maxRssi);
+                status = sme_StartRssiMonitoring(hdd_ctx->hHal, pReq);
+
+        }
+        else if (control == QCA_WLAN_RSSI_MONITORING_STOP) {
+                pReq->rssiMonitorCallback = hdd_rssi_monitor_stop_done;
+                status = sme_StopRssiMonitoring(hdd_ctx->hHal, pReq);
+        }
+        else {
+                hddLog(LOGE, FL("Invalid control cmd: %d"), control);
+                goto fail;
+        }
+
+        if (!HAL_STATUS_SUCCESS(status)) {
+                hddLog(LOGE,
+                        FL("sme_set_rssi_monitoring failed(err=%d)"), status);
+                goto fail;
+        }
+
+        return 0;
+fail:
+        vos_mem_free(pReq);
+        return -EINVAL;
+}
+
+/*
+ * done with short names for the global vendor params
+ * used by __wlan_hdd_cfg80211_monitor_rssi()
+ */
+#undef PARAM_MAX
+#undef PARAM_CONTROL
+#undef PARAM_REQUEST_ID
+#undef PARAM_MAX_RSSI
+#undef PARAM_MIN_RSSI
+
+/**
+ * wlan_hdd_cfg80211_monitor_rssi() - SSR wrapper to rssi monitoring
+ * @wiphy:    wiphy structure pointer
+ * @wdev:     Wireless device structure pointer
+ * @data:     Pointer to the data received
+ * @data_len: Length of @data
+ *
+ * Return: 0 on success; errno on failure
+ */
+static int
+wlan_hdd_cfg80211_monitor_rssi(struct wiphy *wiphy, struct wireless_dev *wdev,
+                               const void *data, int data_len)
+{
+        int ret;
+
+        vos_ssr_protect(__func__);
+        ret = __wlan_hdd_cfg80211_monitor_rssi(wiphy, wdev, data, data_len);
+        vos_ssr_unprotect(__func__);
+
+        return ret;
+}
+
+/**
+ * hdd_rssi_threshold_breached_cb() - rssi breached NL event
+ * @hddctx: HDD context
+ * @data: rssi breached event data
+ *
+ * This function reads the rssi breached event %data and fill in the skb with
+ * NL attributes and send up the NL event.
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
+ *
+ * Return: none
+ */
+void hdd_rssi_threshold_breached_cb(void *hddctx,
+                                 struct rssi_breach_event *data)
+{
+        hdd_context_t *pHddCtx  = (hdd_context_t *)hddctx;
+        int status;
+        struct sk_buff *skb;
+
+        ENTER();
+        status = wlan_hdd_validate_context(pHddCtx);
+
+        if (0 != status) {
+                return;
+        }
+
+        if (!data) {
+                hddLog(LOGE, FL("data is null"));
+                return;
+        }
+
+        skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+                                  NULL,
+#endif
+                                  EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
+                                  QCA_NL80211_VENDOR_SUBCMD_MONITOR_RSSI_INDEX,
+                                  GFP_KERNEL);
+
+        if (!skb) {
+                hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
+                return;
+        }
+
+        hddLog(LOG1, "Req Id: %u Current rssi: %d",
+                        data->request_id, data->curr_rssi);
+        hddLog(LOG1, "Current BSSID: "MAC_ADDRESS_STR,
+                        MAC_ADDR_ARRAY(data->curr_bssid.bytes));
+
+        if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_REQUEST_ID,
+                data->request_id) ||
+            nla_put(skb, QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_CUR_BSSID,
+                sizeof(data->curr_bssid), data->curr_bssid.bytes) ||
+            nla_put_s8(skb, QCA_WLAN_VENDOR_ATTR_RSSI_MONITORING_CUR_RSSI,
+                data->curr_rssi)) {
+                hddLog(LOGE, FL("nla put fail"));
+                goto fail;
+        }
+
+        cfg80211_vendor_event(skb, GFP_KERNEL);
+        return;
+
+fail:
+        kfree_skb(skb);
+        return;
+}
+
+
+
 /**
  * __wlan_hdd_cfg80211_setband() - set band
  * @wiphy: Pointer to wireless phy
@@ -5298,6 +6623,796 @@
     return ret;
 }
 
+#ifdef WLAN_FEATURE_OFFLOAD_PACKETS
+/**
+ * hdd_map_req_id_to_pattern_id() - map request id to pattern id
+ * @hdd_ctx: HDD context
+ * @request_id: [input] request id
+ * @pattern_id: [output] pattern id
+ *
+ * This function loops through request id to pattern id array
+ * if the slot is available, store the request id and return pattern id
+ * if entry exists, return the pattern id
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int hdd_map_req_id_to_pattern_id(hdd_context_t *hdd_ctx,
+        uint32_t request_id,
+        uint8_t *pattern_id)
+{
+    uint32_t i;
+
+    mutex_lock(&hdd_ctx->op_ctx.op_lock);
+    for (i = 0; i < MAXNUM_PERIODIC_TX_PTRNS; i++)
+    {
+        if (hdd_ctx->op_ctx.op_table[i].request_id == 0)
+        {
+            hdd_ctx->op_ctx.op_table[i].request_id = request_id;
+            *pattern_id = hdd_ctx->op_ctx.op_table[i].pattern_id;
+            mutex_unlock(&hdd_ctx->op_ctx.op_lock);
+            return 0;
+        } else if (hdd_ctx->op_ctx.op_table[i].request_id ==
+                request_id) {
+            *pattern_id = hdd_ctx->op_ctx.op_table[i].pattern_id;
+            mutex_unlock(&hdd_ctx->op_ctx.op_lock);
+            return 0;
+        }
+    }
+    mutex_unlock(&hdd_ctx->op_ctx.op_lock);
+    return -EINVAL;
+}
+
+/**
+ * hdd_unmap_req_id_to_pattern_id() - unmap request id to pattern id
+ * @hdd_ctx: HDD context
+ * @request_id: [input] request id
+ * @pattern_id: [output] pattern id
+ *
+ * This function loops through request id to pattern id array
+ * reset request id to 0 (slot available again) and
+ * return pattern id
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int hdd_unmap_req_id_to_pattern_id(hdd_context_t *hdd_ctx,
+        uint32_t request_id,
+        uint8_t *pattern_id)
+{
+    uint32_t i;
+
+    mutex_lock(&hdd_ctx->op_ctx.op_lock);
+    for (i = 0; i < MAXNUM_PERIODIC_TX_PTRNS; i++)
+    {
+        if (hdd_ctx->op_ctx.op_table[i].request_id == request_id)
+        {
+            hdd_ctx->op_ctx.op_table[i].request_id = 0;
+            *pattern_id = hdd_ctx->op_ctx.op_table[i].pattern_id;
+            mutex_unlock(&hdd_ctx->op_ctx.op_lock);
+            return 0;
+        }
+    }
+    mutex_unlock(&hdd_ctx->op_ctx.op_lock);
+    return -EINVAL;
+}
+
+
+/*
+ * define short names for the global vendor params
+ * used by __wlan_hdd_cfg80211_offloaded_packets()
+ */
+#define PARAM_MAX QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_MAX
+#define PARAM_REQUEST_ID \
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_REQUEST_ID
+#define PARAM_CONTROL \
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_SENDING_CONTROL
+#define PARAM_IP_PACKET \
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_IP_PACKET_DATA
+#define PARAM_SRC_MAC_ADDR \
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_SRC_MAC_ADDR
+#define PARAM_DST_MAC_ADDR \
+    QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_DST_MAC_ADDR
+#define PARAM_PERIOD QCA_WLAN_VENDOR_ATTR_OFFLOADED_PACKETS_PERIOD
+
+/**
+ * wlan_hdd_add_tx_ptrn() - add tx pattern
+ * @adapter: adapter pointer
+ * @hdd_ctx: hdd context
+ * @tb: nl attributes
+ *
+ * This function reads the NL attributes and forms a AddTxPtrn message
+ * posts it to SME.
+ *
+ */
+static int
+wlan_hdd_add_tx_ptrn(hdd_adapter_t *adapter, hdd_context_t *hdd_ctx,
+        struct nlattr **tb)
+{
+    struct sSirAddPeriodicTxPtrn *add_req;
+    eHalStatus status;
+    uint32_t request_id, ret, len;
+    uint8_t pattern_id = 0;
+    v_MACADDR_t dst_addr;
+    uint16_t eth_type = htons(ETH_P_IP);
+
+    if (!hdd_connIsConnected(WLAN_HDD_GET_STATION_CTX_PTR(adapter)))
+    {
+        hddLog(LOGE, FL("Not in Connected state!"));
+        return -ENOTSUPP;
+    }
+
+    add_req = vos_mem_malloc(sizeof(*add_req));
+    if (!add_req)
+    {
+        hddLog(LOGE, FL("memory allocation failed"));
+        return -ENOMEM;
+    }
+
+    /* Parse and fetch request Id */
+    if (!tb[PARAM_REQUEST_ID])
+    {
+        hddLog(LOGE, FL("attr request id failed"));
+        goto fail;
+    }
+
+    request_id = nla_get_u32(tb[PARAM_REQUEST_ID]);
+    hddLog(LOG1, FL("Request Id: %u"), request_id);
+    if (request_id == 0)
+    {
+        hddLog(LOGE, FL("request_id cannot be zero"));
+        goto fail;
+    }
+
+    if (!tb[PARAM_PERIOD])
+    {
+        hddLog(LOGE, FL("attr period failed"));
+        goto fail;
+    }
+    add_req->usPtrnIntervalMs = nla_get_u32(tb[PARAM_PERIOD]);
+    hddLog(LOG1, FL("Period: %u ms"), add_req->usPtrnIntervalMs);
+    if (add_req->usPtrnIntervalMs == 0)
+    {
+        hddLog(LOGE, FL("Invalid interval zero, return failure"));
+        goto fail;
+    }
+
+    if (!tb[PARAM_SRC_MAC_ADDR])
+    {
+        hddLog(LOGE, FL("attr source mac address failed"));
+        goto fail;
+    }
+    nla_memcpy(add_req->macAddress, tb[PARAM_SRC_MAC_ADDR],
+            VOS_MAC_ADDR_SIZE);
+    hddLog(LOG1, "input src mac address: "MAC_ADDRESS_STR,
+            MAC_ADDR_ARRAY(add_req->macAddress));
+
+    if (memcmp(add_req->macAddress, adapter->macAddressCurrent.bytes,
+                VOS_MAC_ADDR_SIZE))
+    {
+        hddLog(LOGE,
+            FL("input src mac address and connected ap bssid are different"));
+        goto fail;
+    }
+
+    if (!tb[PARAM_DST_MAC_ADDR])
+    {
+        hddLog(LOGE, FL("attr dst mac address failed"));
+        goto fail;
+    }
+    nla_memcpy(dst_addr.bytes, tb[PARAM_DST_MAC_ADDR], VOS_MAC_ADDR_SIZE);
+    hddLog(LOG1, "input dst mac address: "MAC_ADDRESS_STR,
+            MAC_ADDR_ARRAY(dst_addr.bytes));
+
+    if (!tb[PARAM_IP_PACKET])
+    {
+        hddLog(LOGE, FL("attr ip packet failed"));
+        goto fail;
+    }
+    add_req->ucPtrnSize = nla_len(tb[PARAM_IP_PACKET]);
+    hddLog(LOG1, FL("IP packet len: %u"), add_req->ucPtrnSize);
+
+    if (add_req->ucPtrnSize < 0 ||
+            add_req->ucPtrnSize > (PERIODIC_TX_PTRN_MAX_SIZE -
+                HDD_ETH_HEADER_LEN))
+    {
+        hddLog(LOGE, FL("Invalid IP packet len: %d"),
+                add_req->ucPtrnSize);
+        goto fail;
+    }
+
+    len = 0;
+    vos_mem_copy(&add_req->ucPattern[0], dst_addr.bytes, VOS_MAC_ADDR_SIZE);
+    len += VOS_MAC_ADDR_SIZE;
+    vos_mem_copy(&add_req->ucPattern[len], add_req->macAddress,
+            VOS_MAC_ADDR_SIZE);
+    len += VOS_MAC_ADDR_SIZE;
+    vos_mem_copy(&add_req->ucPattern[len], &eth_type, 2);
+    len += 2;
+
+    /*
+     * This is the IP packet, add 14 bytes Ethernet (802.3) header
+     * ------------------------------------------------------------
+     * | 14 bytes Ethernet (802.3) header | IP header and payload |
+     * ------------------------------------------------------------
+     */
+    vos_mem_copy(&add_req->ucPattern[len],
+            nla_data(tb[PARAM_IP_PACKET]),
+            add_req->ucPtrnSize);
+    add_req->ucPtrnSize += len;
+
+    VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+            add_req->ucPattern, add_req->ucPtrnSize);
+
+    ret = hdd_map_req_id_to_pattern_id(hdd_ctx, request_id, &pattern_id);
+    if (ret)
+    {
+        hddLog(LOGW, FL("req id to pattern id failed (ret=%d)"), ret);
+        goto fail;
+    }
+    add_req->ucPtrnId = pattern_id;
+    hddLog(LOG1, FL("pattern id: %d"), add_req->ucPtrnId);
+
+    status = sme_AddPeriodicTxPtrn(hdd_ctx->hHal, add_req);
+    if (!HAL_STATUS_SUCCESS(status))
+    {
+        hddLog(LOGE,
+                FL("sme_AddPeriodicTxPtrn failed (err=%d)"), status);
+        goto fail;
+    }
+
+    EXIT();
+    vos_mem_free(add_req);
+    return 0;
+
+fail:
+    vos_mem_free(add_req);
+    return -EINVAL;
+}
+
+/**
+ * wlan_hdd_del_tx_ptrn() - delete tx pattern
+ * @adapter: adapter pointer
+ * @hdd_ctx: hdd context
+ * @tb: nl attributes
+ *
+ * This function reads the NL attributes and forms a DelTxPtrn message
+ * posts it to SME.
+ *
+ */
+static int
+wlan_hdd_del_tx_ptrn(hdd_adapter_t *adapter, hdd_context_t *hdd_ctx,
+        struct nlattr **tb)
+{
+    struct sSirDelPeriodicTxPtrn *del_req;
+    eHalStatus status;
+    uint32_t request_id, ret;
+    uint8_t pattern_id = 0;
+
+    /* Parse and fetch request Id */
+    if (!tb[PARAM_REQUEST_ID])
+    {
+        hddLog(LOGE, FL("attr request id failed"));
+        return -EINVAL;
+    }
+    request_id = nla_get_u32(tb[PARAM_REQUEST_ID]);
+    if (request_id == 0)
+    {
+        hddLog(LOGE, FL("request_id cannot be zero"));
+        return -EINVAL;
+    }
+
+    ret = hdd_unmap_req_id_to_pattern_id(hdd_ctx, request_id, &pattern_id);
+    if (ret)
+    {
+        hddLog(LOGW, FL("req id to pattern id failed (ret=%d)"), ret);
+        return -EINVAL;
+    }
+
+    del_req = vos_mem_malloc(sizeof(*del_req));
+    if (!del_req)
+    {
+        hddLog(LOGE, FL("memory allocation failed"));
+        return -ENOMEM;
+    }
+
+    vos_mem_set(del_req, sizeof(*del_req), 0);
+    vos_mem_copy(del_req->macAddress, adapter->macAddressCurrent.bytes,
+            VOS_MAC_ADDR_SIZE);
+    hddLog(LOG1, MAC_ADDRESS_STR, MAC_ADDR_ARRAY(del_req->macAddress));
+    del_req->ucPatternIdBitmap |= (0x1 << pattern_id);
+    hddLog(LOG1, FL("Request Id: %u Pattern id: %d, bitmap %04x"),
+         request_id, pattern_id, del_req->ucPatternIdBitmap);
+
+    status = sme_DelPeriodicTxPtrn(hdd_ctx->hHal, del_req);
+    if (!HAL_STATUS_SUCCESS(status))
+    {
+        hddLog(LOGE,
+                FL("sme_DelPeriodicTxPtrn failed (err=%d)"), status);
+        goto fail;
+    }
+
+    EXIT();
+    vos_mem_free(del_req);
+    return 0;
+
+fail:
+    vos_mem_free(del_req);
+    return -EINVAL;
+}
+
+
+/**
+ * __wlan_hdd_cfg80211_offloaded_packets() - send offloaded packets
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Data length
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int
+__wlan_hdd_cfg80211_offloaded_packets(struct wiphy *wiphy,
+        struct wireless_dev *wdev,
+        const void *data,
+        int data_len)
+{
+    struct net_device *dev = wdev->netdev;
+    hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+    struct nlattr *tb[PARAM_MAX + 1];
+    uint8_t control;
+    int ret;
+    static const struct nla_policy policy[PARAM_MAX + 1] =
+    {
+        [PARAM_REQUEST_ID] = { .type = NLA_U32 },
+        [PARAM_CONTROL] = { .type = NLA_U32 },
+        [PARAM_SRC_MAC_ADDR] = { .type = NLA_BINARY,
+            .len = VOS_MAC_ADDR_SIZE },
+        [PARAM_DST_MAC_ADDR] = { .type = NLA_BINARY,
+            .len = VOS_MAC_ADDR_SIZE },
+        [PARAM_PERIOD] = { .type = NLA_U32 },
+    };
+
+    ENTER();
+
+    ret = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != ret)
+    {
+        hddLog(LOGE, FL("HDD context is not valid"));
+        return ret;
+    }
+
+    if (!sme_IsFeatureSupportedByFW(WLAN_PERIODIC_TX_PTRN))
+    {
+        hddLog(LOGE,
+            FL("Periodic Tx Pattern Offload feature is not supported in FW!"));
+        return -ENOTSUPP;
+    }
+
+    if (nla_parse(tb, PARAM_MAX, data, data_len, policy))
+    {
+        hddLog(LOGE, FL("Invalid ATTR"));
+        return -EINVAL;
+    }
+
+    if (!tb[PARAM_CONTROL])
+    {
+        hddLog(LOGE, FL("attr control failed"));
+        return -EINVAL;
+    }
+    control = nla_get_u32(tb[PARAM_CONTROL]);
+    hddLog(LOG1, FL("Control: %d"), control);
+
+    if (control == WLAN_START_OFFLOADED_PACKETS)
+        return wlan_hdd_add_tx_ptrn(adapter, hdd_ctx, tb);
+    else if (control == WLAN_STOP_OFFLOADED_PACKETS)
+        return wlan_hdd_del_tx_ptrn(adapter, hdd_ctx, tb);
+    else
+    {
+        hddLog(LOGE, FL("Invalid control: %d"), control);
+        return -EINVAL;
+    }
+}
+
+/*
+ * done with short names for the global vendor params
+ * used by __wlan_hdd_cfg80211_offloaded_packets()
+ */
+#undef PARAM_MAX
+#undef PARAM_REQUEST_ID
+#undef PARAM_CONTROL
+#undef PARAM_IP_PACKET
+#undef PARAM_SRC_MAC_ADDR
+#undef PARAM_DST_MAC_ADDR
+#undef PARAM_PERIOD
+
+/**
+ * wlan_hdd_cfg80211_offloaded_packets() - Wrapper to offload packets
+ * @wiphy:    wiphy structure pointer
+ * @wdev:     Wireless device structure pointer
+ * @data:     Pointer to the data received
+ * @data_len: Length of @data
+ *
+ * Return: 0 on success; errno on failure
+ */
+static int wlan_hdd_cfg80211_offloaded_packets(struct wiphy *wiphy,
+        struct wireless_dev *wdev,
+        const void *data,
+        int data_len)
+{
+    int ret = 0;
+
+    vos_ssr_protect(__func__);
+    ret = __wlan_hdd_cfg80211_offloaded_packets(wiphy,
+            wdev, data, data_len);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
+}
+#endif
+
+static const struct
+nla_policy
+qca_wlan_vendor_attr_policy[QCA_WLAN_VENDOR_ATTR_MAX+1] = {
+    [QCA_WLAN_VENDOR_ATTR_MAC_ADDR] = { .type = NLA_UNSPEC },
+};
+
+/**
+ * wlan_hdd_cfg80211_get_link_properties() - This function is used to
+ * get link properties like nss, rate flags and operating frequency for
+ * the connection with the given peer.
+ * @wiphy:    WIPHY structure pointer
+ * @wdev:     Wireless device structure pointer
+ * @data:     Pointer to the data received
+ * @data_len: Length of the data received
+ *
+ * This function return the above link properties on success.
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int wlan_hdd_cfg80211_get_link_properties(struct wiphy *wiphy,
+        struct wireless_dev *wdev,
+        const void *data,
+        int data_len)
+{
+    hdd_context_t       *hdd_ctx = wiphy_priv(wiphy);
+    struct net_device   *dev = wdev->netdev;
+    hdd_adapter_t       *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_station_ctx_t   *hdd_sta_ctx;
+    struct nlattr       *tb[QCA_WLAN_VENDOR_ATTR_MAX+1];
+    uint8_t             peer_mac[VOS_MAC_ADDR_SIZE];
+    uint32_t            sta_id;
+    struct sk_buff      *reply_skb;
+    uint32_t            rate_flags = 0;
+    uint8_t             nss;
+    uint8_t             final_rate_flags = 0;
+    uint32_t            freq;
+    v_CONTEXT_t pVosContext = NULL;
+    ptSapContext pSapCtx = NULL;
+
+    if (0 != wlan_hdd_validate_context(hdd_ctx)) {
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("HDD context is not valid"));
+        return -EINVAL;
+    }
+
+    if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_MAX, data, data_len,
+                qca_wlan_vendor_attr_policy)) {
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("Invalid attribute"));
+        return -EINVAL;
+    }
+
+    if (!tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]) {
+        hddLog(VOS_TRACE_LEVEL_ERROR,
+                FL("Attribute peerMac not provided for mode=%d"),
+                adapter->device_mode);
+        return -EINVAL;
+    }
+
+    memcpy(peer_mac, nla_data(tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]),
+            sizeof(peer_mac));
+    hddLog(VOS_TRACE_LEVEL_INFO,
+            FL("peerMac="MAC_ADDRESS_STR" for device_mode:%d"),
+            MAC_ADDR_ARRAY(peer_mac), adapter->device_mode);
+
+    if (adapter->device_mode == WLAN_HDD_INFRA_STATION ||
+            adapter->device_mode == WLAN_HDD_P2P_CLIENT) {
+        hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+        if ((hdd_sta_ctx->conn_info.connState !=
+                    eConnectionState_Associated) ||
+                !vos_mem_compare(hdd_sta_ctx->conn_info.bssId, peer_mac,
+                    VOS_MAC_ADDRESS_LEN)) {
+            hddLog(VOS_TRACE_LEVEL_ERROR,
+                    FL("Not Associated to mac "MAC_ADDRESS_STR),
+                    MAC_ADDR_ARRAY(peer_mac));
+            return -EINVAL;
+        }
+
+        nss  = 1; //pronto supports only one spatial stream
+        freq = vos_chan_to_freq(
+                hdd_sta_ctx->conn_info.operationChannel);
+        rate_flags = hdd_sta_ctx->conn_info.rate_flags;
+
+    } else if (adapter->device_mode == WLAN_HDD_P2P_GO ||
+            adapter->device_mode == WLAN_HDD_SOFTAP) {
+
+          pVosContext = ( WLAN_HDD_GET_CTX(adapter))->pvosContext;
+          pSapCtx = VOS_GET_SAP_CB(pVosContext);
+          if(pSapCtx == NULL){
+                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                   FL("psapCtx is NULL"));
+                     return -ENOENT;
+          }
+
+
+        for (sta_id = 0; sta_id < WLAN_MAX_STA_COUNT; sta_id++) {
+            if (pSapCtx->aStaInfo[sta_id].isUsed &&
+                    !vos_is_macaddr_broadcast(
+                        &pSapCtx->aStaInfo[sta_id].macAddrSTA) &&
+                    vos_mem_compare(
+                        &pSapCtx->aStaInfo[sta_id].macAddrSTA,
+                        peer_mac, VOS_MAC_ADDRESS_LEN))
+                break;
+        }
+
+        if (WLAN_MAX_STA_COUNT == sta_id) {
+            hddLog(VOS_TRACE_LEVEL_ERROR,
+                    FL("No active peer with mac="MAC_ADDRESS_STR),
+                    MAC_ADDR_ARRAY(peer_mac));
+            return -EINVAL;
+        }
+
+        nss  = 1; //pronto supports only one spatial stream
+        freq = vos_chan_to_freq(
+                (WLAN_HDD_GET_AP_CTX_PTR(adapter))->operatingChannel);
+        rate_flags = pSapCtx->aStaInfo[sta_id].rate_flags;
+    } else {
+        hddLog(VOS_TRACE_LEVEL_ERROR,
+                FL("Not Associated! with mac"MAC_ADDRESS_STR),
+                MAC_ADDR_ARRAY(peer_mac));
+        return -EINVAL;
+    }
+
+    if (!(rate_flags & eHAL_TX_RATE_LEGACY)) {
+        if (rate_flags & eHAL_TX_RATE_VHT80) {
+            final_rate_flags |= RATE_INFO_FLAGS_VHT_MCS;
+            final_rate_flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
+        } else if (rate_flags & eHAL_TX_RATE_VHT40) {
+            final_rate_flags |= RATE_INFO_FLAGS_VHT_MCS;
+            final_rate_flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+        } else if (rate_flags & eHAL_TX_RATE_VHT20) {
+            final_rate_flags |= RATE_INFO_FLAGS_VHT_MCS;
+        } else if (rate_flags & (eHAL_TX_RATE_HT20 | eHAL_TX_RATE_HT40)) {
+            final_rate_flags |= RATE_INFO_FLAGS_MCS;
+            if (rate_flags & eHAL_TX_RATE_HT40)
+                final_rate_flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+        }
+
+        if (rate_flags & eHAL_TX_RATE_SGI) {
+            if (!(final_rate_flags & RATE_INFO_FLAGS_VHT_MCS))
+                final_rate_flags |= RATE_INFO_FLAGS_MCS;
+            final_rate_flags |= RATE_INFO_FLAGS_SHORT_GI;
+        }
+    }
+
+    reply_skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy,
+            sizeof(u8) + sizeof(u8) + sizeof(u32) + NLMSG_HDRLEN);
+
+    if (NULL == reply_skb) {
+        hddLog(VOS_TRACE_LEVEL_ERROR,
+                FL("getLinkProperties: skb alloc failed"));
+        return -EINVAL;
+    }
+
+    if (nla_put_u8(reply_skb,
+                QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_NSS,
+                nss) ||
+            nla_put_u8(reply_skb,
+                QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_RATE_FLAGS,
+                final_rate_flags) ||
+            nla_put_u32(reply_skb,
+                QCA_WLAN_VENDOR_ATTR_LINK_PROPERTIES_FREQ,
+                freq)) {
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("nla_put failed"));
+        kfree_skb(reply_skb);
+        return -EINVAL;
+    }
+
+    return cfg80211_vendor_cmd_reply(reply_skb);
+}
+
+#define PARAM_WIFICONFIG_MAX QCA_WLAN_VENDOR_ATTR_CONFIG_MAX
+#define PARAM_MODULATED_DTIM QCA_WLAN_VENDOR_ATTR_CONFIG_MODULATED_DTIM
+#define PARAM_STATS_AVG_FACTOR QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR
+#define PARAM_GUARD_TIME QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME
+#define PARAM_BCNMISS_PENALTY_PARAM_COUNT \
+        QCA_WLAN_VENDOR_ATTR_CONFIG_PENALIZE_AFTER_NCONS_BEACON_MISS
+
+/**
+ * __wlan_hdd_cfg80211_wifi_configuration_set() - Wifi configuration
+ * vendor command
+ *
+ * @wiphy: wiphy device pointer
+ * @wdev: wireless device pointer
+ * @data: Vendor command data buffer
+ * @data_len: Buffer length
+ *
+ * Handles QCA_WLAN_VENDOR_ATTR_CONFIG_MAX.
+ *
+ * Return: EOK or other error codes.
+ */
+
+static int __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
+                            struct wireless_dev *wdev,
+                            const void *data,
+                            int data_len)
+{
+    struct net_device *dev = wdev->netdev;
+    hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_context_t *pHddCtx  = wiphy_priv(wiphy);
+    hdd_station_ctx_t *pHddStaCtx;
+    struct nlattr *tb[PARAM_WIFICONFIG_MAX + 1];
+    tpSetWifiConfigParams pReq;
+    tModifyRoamParamsReqParams modifyRoamParamsReq;
+    eHalStatus status;
+    int ret_val;
+    static const struct nla_policy policy[PARAM_WIFICONFIG_MAX + 1] = {
+                        [PARAM_STATS_AVG_FACTOR] = { .type = NLA_U16 },
+                        [PARAM_MODULATED_DTIM] = { .type = NLA_U32 },
+                        [PARAM_GUARD_TIME] = { .type = NLA_U32},
+                        [PARAM_BCNMISS_PENALTY_PARAM_COUNT] =
+                                             { .type = NLA_U32},
+    };
+
+    ENTER();
+
+    if (VOS_FTM_MODE == hdd_get_conparam()) {
+        hddLog(LOGE, FL("Command not allowed in FTM mode"));
+        return -EINVAL;
+    }
+
+    ret_val = wlan_hdd_validate_context(pHddCtx);
+    if (ret_val) {
+        return ret_val;
+    }
+
+    pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+
+    if (nla_parse(tb, PARAM_WIFICONFIG_MAX, data, data_len, policy)) {
+               hddLog(LOGE, FL("Invalid ATTR"));
+               return -EINVAL;
+    }
+
+    /* check the Wifi Capability */
+    if ( (TRUE != pHddCtx->cfg_ini->fEnableWifiConfig) &&
+         (TRUE != sme_IsFeatureSupportedByFW(WIFI_CONFIG)))
+    {
+        hddLog(VOS_TRACE_LEVEL_ERROR,
+               FL("WIFICONFIG not supported by Firmware"));
+        return -EINVAL;
+    }
+
+    if (tb[PARAM_BCNMISS_PENALTY_PARAM_COUNT]) {
+        modifyRoamParamsReq.param = WIFI_CONFIG_SET_BCNMISS_PENALTY_COUNT;
+        modifyRoamParamsReq.value =
+        nla_get_u32(tb[PARAM_BCNMISS_PENALTY_PARAM_COUNT]);
+
+        if (eHAL_STATUS_SUCCESS !=
+                sme_setBcnMissPenaltyCount(pHddCtx->hHal,&modifyRoamParamsReq))
+        {
+            hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Failed", __func__);
+            ret_val = -EINVAL;
+        }
+        return ret_val;
+    }
+
+    /* Moved this down in order to provide provision to set beacon
+     * miss penalty count irrespective of connection state.
+     */
+    if (!hdd_connIsConnected(WLAN_HDD_GET_STATION_CTX_PTR(pAdapter))) {
+                hddLog(LOGE, FL("Not in Connected state!"));
+                return -ENOTSUPP;
+    }
+
+    pReq = vos_mem_malloc(sizeof(tSetWifiConfigParams));
+
+    if (!pReq) {
+      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+             "%s: Not able to allocate memory for tSetWifiConfigParams",
+             __func__);
+       return eHAL_STATUS_E_MALLOC_FAILED;
+   }
+
+   vos_mem_set(pReq, sizeof(tSetWifiConfigParams), 0);
+
+   pReq->sessionId = pAdapter->sessionId;
+   vos_mem_copy( &pReq->bssId, pHddStaCtx->conn_info.bssId, WNI_CFG_BSSID_LEN);
+
+    if (tb[PARAM_MODULATED_DTIM]) {
+       pReq->paramValue = nla_get_u32(
+            tb[PARAM_MODULATED_DTIM]);
+       hddLog(LOG1, FL("Modulated DTIM: pReq->paramValue:%d "),
+                                        pReq->paramValue);
+       pHddCtx->cfg_ini->enableDynamicDTIM = pReq->paramValue;
+       hdd_set_pwrparams(pHddCtx);
+    if (BMPS == pmcGetPmcState(pHddCtx->hHal)) {
+       hddLog( LOG1, FL("WifiConfig: Requesting FullPower!"));
+
+       sme_RequestFullPower(WLAN_HDD_GET_HAL_CTX(pAdapter),
+                            iw_full_power_cbfn, pAdapter,
+                            eSME_FULL_PWR_NEEDED_BY_HDD);
+       }
+       else
+       {
+            hddLog( LOG1, FL("WifiConfig Not in BMPS state"));
+       }
+    }
+
+    if (tb[PARAM_STATS_AVG_FACTOR]) {
+        pReq->paramType = WIFI_CONFIG_SET_AVG_STATS_FACTOR;
+        pReq->paramValue = nla_get_u16(
+            tb[PARAM_STATS_AVG_FACTOR]);
+        hddLog(LOG1, FL("AVG_STATS_FACTOR pReq->paramType:%d,pReq->paramValue:%d "),
+                                        pReq->paramType, pReq->paramValue);
+        status = sme_set_wificonfig_params(pHddCtx->hHal, pReq);
+
+        if (eHAL_STATUS_SUCCESS != status)
+        {
+            vos_mem_free(pReq);
+            pReq = NULL;
+            ret_val = -EPERM;
+            return ret_val;
+        }
+    }
+
+
+    if (tb[PARAM_GUARD_TIME]) {
+        pReq->paramType = WIFI_CONFIG_SET_GUARD_TIME;
+        pReq->paramValue = nla_get_u32(
+            tb[PARAM_GUARD_TIME]);
+       hddLog(LOG1, FL("GUARD_TIME pReq->paramType:%d,pReq->paramValue:%d "),
+                                        pReq->paramType, pReq->paramValue);
+        status = sme_set_wificonfig_params(pHddCtx->hHal, pReq);
+
+        if (eHAL_STATUS_SUCCESS != status)
+        {
+            vos_mem_free(pReq);
+            pReq = NULL;
+            ret_val = -EPERM;
+            return ret_val;
+        }
+
+    }
+
+    EXIT();
+    return ret_val;
+}
+
+/**
+ * wlan_hdd_cfg80211_wifi_configuration_set() - Wifi configuration
+ * vendor command
+ *
+ * @wiphy: wiphy device pointer
+ * @wdev: wireless device pointer
+ * @data: Vendor command data buffer
+ * @data_len: Buffer length
+ *
+ * Handles QCA_WLAN_VENDOR_ATTR_CONFIG_MAX.
+ *
+ * Return: EOK or other error codes.
+ */
+static int wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
+                            struct wireless_dev *wdev,
+                            const void *data,
+                            int data_len)
+{
+    int ret;
+
+    vos_ssr_protect(__func__);
+    ret = __wlan_hdd_cfg80211_wifi_configuration_set(wiphy, wdev,
+                             data, data_len);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
+}
 const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] =
 {
     {
@@ -5404,19 +7519,19 @@
     },
     {
         .info.vendor_id = QCA_NL80211_VENDOR_ID,
-        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SIGNIFICANT_CHANGE,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST,
         .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
                  WIPHY_VENDOR_CMD_NEED_NETDEV |
                  WIPHY_VENDOR_CMD_NEED_RUNNING,
-        .doit = wlan_hdd_cfg80211_extscan_set_significant_change
+        .doit = wlan_hdd_cfg80211_extscan_set_ssid_hotlist
     },
     {
         .info.vendor_id = QCA_NL80211_VENDOR_ID,
-        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SIGNIFICANT_CHANGE,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SSID_HOTLIST,
         .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
                  WIPHY_VENDOR_CMD_NEED_NETDEV |
                  WIPHY_VENDOR_CMD_NEED_RUNNING,
-        .doit = wlan_hdd_cfg80211_extscan_reset_significant_change
+        .doit = wlan_hdd_cfg80211_extscan_reset_ssid_hotlist
     },
 #endif /* WLAN_FEATURE_EXTSCAN */
 /*EXT TDLS*/
@@ -5473,11 +7588,76 @@
     },
     {
         .info.vendor_id = QCA_NL80211_VENDOR_ID,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP,
+        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+                 WIPHY_VENDOR_CMD_NEED_NETDEV |
+                 WIPHY_VENDOR_CMD_NEED_RUNNING,
+        .doit = wlan_hdd_cfg80211_get_fw_mem_dump
+    },
+    {
+        .info.vendor_id = QCA_NL80211_VENDOR_ID,
         .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_SETBAND,
         .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
             WIPHY_VENDOR_CMD_NEED_NETDEV |
             WIPHY_VENDOR_CMD_NEED_RUNNING,
         .doit = wlan_hdd_cfg80211_setband
+    },
+    {
+         .info.vendor_id = QCA_NL80211_VENDOR_ID,
+         .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_START,
+         .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+                  WIPHY_VENDOR_CMD_NEED_NETDEV,
+         .doit = wlan_hdd_cfg80211_wifi_logger_start
+    },
+    {
+        .info.vendor_id = QCA_NL80211_VENDOR_ID,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_GET_WIFI_INFO,
+        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+                 WIPHY_VENDOR_CMD_NEED_NETDEV|
+                  WIPHY_VENDOR_CMD_NEED_RUNNING,
+        .doit = wlan_hdd_cfg80211_get_wifi_info
+    },
+    {
+        .info.vendor_id = QCA_NL80211_VENDOR_ID,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_GET_RING_DATA,
+        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+                 WIPHY_VENDOR_CMD_NEED_NETDEV |
+                 WIPHY_VENDOR_CMD_NEED_RUNNING,
+        .doit = wlan_hdd_cfg80211_wifi_logger_get_ring_data
+    },
+    {
+        .info.vendor_id = QCA_NL80211_VENDOR_ID,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_MONITOR_RSSI,
+        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+                 WIPHY_VENDOR_CMD_NEED_NETDEV |
+                 WIPHY_VENDOR_CMD_NEED_RUNNING,
+        .doit = wlan_hdd_cfg80211_monitor_rssi
+    },
+#ifdef WLAN_FEATURE_OFFLOAD_PACKETS
+    {
+        .info.vendor_id = QCA_NL80211_VENDOR_ID,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_OFFLOADED_PACKETS,
+        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+            WIPHY_VENDOR_CMD_NEED_NETDEV |
+            WIPHY_VENDOR_CMD_NEED_RUNNING,
+        .doit = wlan_hdd_cfg80211_offloaded_packets
+    },
+#endif
+    {
+        .info.vendor_id = QCA_NL80211_VENDOR_ID,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_LINK_PROPERTIES,
+        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+            WIPHY_VENDOR_CMD_NEED_NETDEV |
+            WIPHY_VENDOR_CMD_NEED_RUNNING,
+        .doit = wlan_hdd_cfg80211_get_link_properties
+    },
+    {
+        .info.vendor_id = QCA_NL80211_VENDOR_ID,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION,
+        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+                 WIPHY_VENDOR_CMD_NEED_NETDEV |
+                 WIPHY_VENDOR_CMD_NEED_RUNNING,
+        .doit = wlan_hdd_cfg80211_wifi_configuration_set
     }
 };
 
@@ -5566,15 +7746,19 @@
     },
     {
         .vendor_id = QCA_NL80211_VENDOR_ID,
-        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SIGNIFICANT_CHANGE
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST
     },
     {
         .vendor_id = QCA_NL80211_VENDOR_ID,
-        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SIGNIFICANT_CHANGE
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SSID_HOTLIST
     },
-    {
+    [QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND_INDEX] = {
         .vendor_id = QCA_NL80211_VENDOR_ID,
-        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SIGNIFICANT_CHANGE
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND
+    },
+    [QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST_INDEX] = {
+        .vendor_id = QCA_NL80211_VENDOR_ID,
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST
     },
 #endif /* WLAN_FEATURE_EXTSCAN */
 /*EXT TDLS*/
@@ -5582,12 +7766,30 @@
         .vendor_id = QCA_NL80211_VENDOR_ID,
         .subcmd = QCA_NL80211_VENDOR_SUBCMD_TDLS_STATE
     },
+    [QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP_INDEX] = {
+        .vendor_id = QCA_NL80211_VENDOR_ID,
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP
+    },
+
 
     {
         .vendor_id = QCA_NL80211_VENDOR_ID,
         .subcmd = QCA_NL80211_VENDOR_SUBCMD_NAN
     },
 
+    {
+        .vendor_id = QCA_NL80211_VENDOR_ID,
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_GET_WIFI_INFO,
+    },
+    [QCA_NL80211_VENDOR_SUBCMD_MONITOR_RSSI_INDEX] = {
+        .vendor_id = QCA_NL80211_VENDOR_ID,
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_MONITOR_RSSI
+    },
+    [QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_LOST_INDEX] = {
+        .vendor_id = QCA_NL80211_VENDOR_ID,
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_LOST
+    },
+
 };
 
 /*
@@ -5807,7 +8009,6 @@
     {
         wlan_hdd_band_2_4_GHZ.ht_cap.cap     &= ~IEEE80211_HT_CAP_SGI_20;
         wlan_hdd_band_5_GHZ.ht_cap.cap       &= ~IEEE80211_HT_CAP_SGI_20;
-        wlan_hdd_band_p2p_2_4_GHZ.ht_cap.cap &= ~IEEE80211_HT_CAP_SGI_20;
     }
 
     if( !pCfg->ShortGI40MhzEnable )
@@ -8689,12 +10890,25 @@
     ret = wait_for_completion_interruptible_timeout(&pAdapter->tdls_add_station_comp,
            msecs_to_jiffies(WAIT_TIME_TDLS_ADD_STA));
 
+    mutex_lock(&pHddCtx->tdls_lock);
+    pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, mac, FALSE);
+
+    if ((pTdlsPeer != NULL) &&
+         (pTdlsPeer->link_status == eTDLS_LINK_TEARING))
+    {
+         hddLog(VOS_TRACE_LEVEL_ERROR,
+                FL("peer link status %u"), pTdlsPeer->link_status);
+         mutex_unlock(&pHddCtx->tdls_lock);
+         goto error;
+    }
+    mutex_unlock(&pHddCtx->tdls_lock);
+
     if (ret <= 0)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                 "%s: timeout waiting for tdls add station indication %ld",
                 __func__, ret);
-        return -EPERM;
+        goto error;
     }
 
     if ( eHAL_STATUS_SUCCESS != pAdapter->tdlsAddStaStatus)
@@ -8735,6 +10949,7 @@
     tCsrStaParams StaParams = {0};
     tANI_U8 isBufSta = 0;
     tANI_U8 isOffChannelSupported = 0;
+    tANI_U8 isQosWmmSta = FALSE;
 #endif
 
     ENTER();
@@ -8872,9 +11087,22 @@
                     isOffChannelSupported = 1;
                 }
             }
+
+            if (pHddCtx->cfg_ini->fEnableTDLSWmmMode &&
+                   (params->sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
+
+                /* TDLS Peer is WME/QoS capable */
+                isQosWmmSta = TRUE;
+            }
+
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                      "%s: TDLS Peer is QOS capable isQosWmmSta= %d HTcapPresent= %d",
+                      __func__, isQosWmmSta, StaParams.htcap_present);
+
             status = wlan_hdd_tdls_set_peer_caps( pAdapter, mac,
                                                   &StaParams, isBufSta,
-                                                  isOffChannelSupported);
+                                                  isOffChannelSupported,
+                                                  isQosWmmSta);
 
             if (VOS_STATUS_SUCCESS != status) {
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
@@ -9838,6 +12066,40 @@
                 rssi, GFP_KERNEL );
 }
 
+/*
+ * wlan_hdd_cfg80211_update_bss_list :to inform nl80211
+ * interface that BSS might have been lost.
+ * @pAdapter: adaptor
+ * @bssid: bssid which might have been lost
+ *
+ * Return: bss which is unlinked from kernel cache
+ */
+struct cfg80211_bss* wlan_hdd_cfg80211_update_bss_list(
+   hdd_adapter_t *pAdapter, tSirMacAddr bssid)
+{
+    struct net_device *dev = pAdapter->dev;
+    struct wireless_dev *wdev = dev->ieee80211_ptr;
+    struct wiphy *wiphy = wdev->wiphy;
+    struct cfg80211_bss *bss = NULL;
+
+    bss = cfg80211_get_bss(wiphy, NULL, bssid,
+                           NULL,
+                           0,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 1, 0)) && !defined(WITH_BACKPORTS) \
+     && !defined(IEEE80211_PRIVACY)
+                           WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+#else
+                           IEEE80211_BSS_TYPE_ESS, IEEE80211_PRIVACY_ANY);
+#endif
+    if (bss == NULL) {
+        hddLog(LOGE, FL("BSS not present"));
+    } else {
+        hddLog(LOG1, FL("cfg80211_unlink_bss called for BSSID "
+               MAC_ADDRESS_STR), MAC_ADDR_ARRAY(bssid));
+        cfg80211_unlink_bss(wiphy, bss);
+    }
+    return bss;
+}
 
 
 /*
@@ -9927,7 +12189,7 @@
     qie_age->oui_2      = QCOM_OUI2;
     qie_age->oui_3      = QCOM_OUI3;
     qie_age->type       = QCOM_VENDOR_IE_AGE_TYPE;
-    qie_age->age        = vos_timer_get_system_ticks() - bss_desc->nReceivedTime;
+    qie_age->age        = vos_timer_get_system_time() - bss_desc->nReceivedTime;
 #endif
 
     memcpy(mgmt->u.probe_resp.variable, ie, ie_length);
@@ -9979,7 +12241,9 @@
      */
     if(chan == NULL)
     {
-       hddLog(VOS_TRACE_LEVEL_ERROR, "%s chan pointer is NULL", __func__);
+       hddLog(VOS_TRACE_LEVEL_ERROR,
+           FL("chan pointer is NULL, chan_no: %d freq: %d"),
+           chan_no, freq);
        kfree(mgmt);
        return NULL;
     }
@@ -10059,6 +12323,7 @@
     tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
     tCsrScanResultInfo *pScanResult;
     eHalStatus status = 0;
+    int ret;
     tScanResultHandle pResult;
     struct cfg80211_bss *bss_status = NULL;
     hdd_context_t *pHddCtx;
@@ -10070,21 +12335,10 @@
                        NO_SESSION, pAdapter->sessionId));
 
     pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-
-    if (pHddCtx->isLogpInProgress)
+    ret = wlan_hdd_validate_context(pHddCtx);
+    if (0 != ret)
     {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
-                   "%s:LOGP in Progress. Ignore!!!",__func__);
-        return -EAGAIN;
-    }
-
-
-    /*bss_update is not allowed during wlan driver loading or unloading*/
-    if (WLAN_HDD_IS_LOAD_UNLOAD_IN_PROGRESS(pHddCtx))
-    {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                   "%s:Loading_unloading in Progress. Ignore!!!",__func__);
-        return VOS_STATUS_E_PERM;
+        return ret;
     }
 
     if (pAdapter->request != NULL)
@@ -10353,6 +12607,9 @@
     struct cfg80211_scan_request *req = NULL;
     int ret = 0;
     bool aborted = false;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+    bool iface_down = false;
+#endif
     long waitRet = 0;
     tANI_U8 i;
     hdd_context_t *pHddCtx;
@@ -10362,9 +12619,16 @@
     pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     if (NULL == pHddCtx) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("HDD context is Null"));
-        goto allow_suspend;
+        return 0;
     }
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+    if (!(pAdapter->dev->flags & IFF_UP))
+    {
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("Interface is down"));
+        iface_down = true;
+    }
+#endif
     pScanInfo = &pHddCtx->scan_info;
 
     hddLog(VOS_TRACE_LEVEL_INFO,
@@ -10401,12 +12665,15 @@
                 (int) scanId);
     }
 
-    ret = wlan_hdd_cfg80211_update_bss((WLAN_HDD_GET_CTX(pAdapter))->wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+    if (!iface_down)
+#endif
+    {
+        ret = wlan_hdd_cfg80211_update_bss((WLAN_HDD_GET_CTX(pAdapter))->wiphy,
                                         pAdapter);
-
-    if (0 > ret)
-        hddLog(VOS_TRACE_LEVEL_INFO, "%s: NO SCAN result", __func__);
-
+        if (0 > ret)
+            hddLog(VOS_TRACE_LEVEL_INFO, "%s: NO SCAN result", __func__);
+    }
 
     /* If any client wait scan result through WEXT
      * send scan done event to client */
@@ -10436,18 +12703,18 @@
 
     /* Get the Scan Req */
     req = pAdapter->request;
-
-    if (!req)
-    {
-        hddLog(VOS_TRACE_LEVEL_ERROR, "request is became NULL");
-        pScanInfo->mScanPending = VOS_FALSE;
-        goto allow_suspend;
-    }
-
     pAdapter->request = NULL;
+
     /* Scan is no longer pending */
     pScanInfo->mScanPending = VOS_FALSE;
 
+    if (!req || req->wiphy == NULL)
+    {
+        hddLog(VOS_TRACE_LEVEL_ERROR, "request is became NULL");
+        complete(&pScanInfo->abortscan_event_var);
+        goto allow_suspend;
+    }
+
     /* last_scan_timestamp is used to decide if new scan
      * is needed or not on station interface. If last station
      *  scan time and new station scan time is less then
@@ -10477,18 +12744,25 @@
     {
          aborted = true;
     }
-    cfg80211_scan_done(req, aborted);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+    if (!iface_down)
+#endif
+        cfg80211_scan_done(req, aborted);
+
     complete(&pScanInfo->abortscan_event_var);
 
+allow_suspend:
     if ((pHddCtx->cfg_ini->enableMacSpoofing == MAC_ADDR_SPOOFING_FW_HOST_ENABLE
        ) && (pHddCtx->spoofMacAddr.isEnabled
          ||  pHddCtx->spoofMacAddr.isReqDeferred)) {
         /* Generate new random mac addr for next scan */
         hddLog(VOS_TRACE_LEVEL_INFO, "scan completed - generate new spoof mac addr");
-        hdd_processSpoofMacAddrRequest(pHddCtx);
+
+        schedule_delayed_work(&pHddCtx->spoof_mac_addr_work,
+                           msecs_to_jiffies(MAC_ADDR_SPOOFING_DEFER_INTERVAL));
     }
 
-allow_suspend:
     /* release the wake lock at the end of the scan*/
     hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_SCAN);
 
@@ -10498,8 +12772,11 @@
      * to process the connect request to AP */
     hdd_prevent_suspend_timeout(1000, WIFI_POWER_EVENT_WAKELOCK_SCAN);
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+    if (!iface_down)
+#endif
 #ifdef FEATURE_WLAN_TDLS
-    wlan_hdd_tdls_scan_done_callback(pAdapter);
+        wlan_hdd_tdls_scan_done_callback(pAdapter);
 #endif
 
     EXIT();
@@ -10607,6 +12884,27 @@
     return VOS_FALSE;
 }
 
+/**
+ * csr_scan_request_assign_bssid() - Set the BSSID received from Supplicant
+ *                                   to the Scan request
+ * @scanRequest: Pointer to the csr scan request
+ * @request: Pointer to the scan request from supplicant
+ *
+ * Return: None
+ */
+#ifdef CFG80211_SCAN_BSSID
+static inline void csr_scan_request_assign_bssid(tCsrScanRequest *scanRequest,
+					struct cfg80211_scan_request *request)
+{
+	vos_mem_copy(scanRequest->bssid, request->bssid, VOS_MAC_ADDR_SIZE);
+}
+#else
+static inline void csr_scan_request_assign_bssid(tCsrScanRequest *scanRequest,
+					struct cfg80211_scan_request *request)
+{
+}
+#endif
+
 /*
  * FUNCTION: __wlan_hdd_cfg80211_scan
  * this scan respond to scan trigger and update cfg80211 scan database
@@ -10631,8 +12929,6 @@
     int ret = 0;
     v_U8_t *pWpsIe=NULL;
     bool is_p2p_scan = false;
-    v_S7_t rssi=0;
-    hdd_station_ctx_t *pHddStaCtx=NULL;
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
     struct net_device *dev = NULL;
@@ -10670,13 +12966,6 @@
     cfg_param = pHddCtx->cfg_ini;
     pScanInfo = &pHddCtx->scan_info;
 
-    pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-    if ( (pHddStaCtx != NULL) && (TRUE == hdd_connIsConnected(pHddStaCtx)))
-    {
-        wlan_hdd_get_roam_rssi(pAdapter, &rssi);
-        hddLog(VOS_TRACE_LEVEL_INFO, FL("rssi: %d"), rssi);
-    }
-
 #ifdef WLAN_BTAMP_FEATURE
     //Scan not supported when AMP traffic is on.
     if (VOS_TRUE == WLANBAP_AmpSessionOn())
@@ -10804,6 +13093,8 @@
     scanRequest.minChnTime = cfg_param->nActiveMinChnTime;
     scanRequest.maxChnTime = cfg_param->nActiveMaxChnTime;
 
+    csr_scan_request_assign_bssid(&scanRequest, request);
+
     /* set BSSType to default type */
     scanRequest.BSSType = eCSR_BSS_TYPE_ANY;
 
@@ -11018,16 +13309,16 @@
                                           dev,
 #endif
                                           request);
-    if(status <= 0)
+    if (status <= 0)
     {
-       if(!status)
+       if (!status)
            hddLog(VOS_TRACE_LEVEL_ERROR, "%s: TDLS in progress."
                   "scan rejected  %d", __func__, status);
        else
            hddLog(VOS_TRACE_LEVEL_ERROR, "%s: TDLS teardown is ongoing %d",
                                           __func__, status);
-
-       return status;
+       hdd_wlan_block_scan_by_tdls();
+       goto free_mem;
     }
 #endif
 
@@ -11888,13 +14179,14 @@
                 pWextState->roamProfile.nRSNReqIELength = eLen + 2; //ie_len;
                 break;
 
-                /* Appending Extended Capabilities with Interworking bit set
-                 * in Assoc Req.
+                /* Appending extended capabilities with Interworking or
+                 * bsstransition bit set in Assoc Req.
                  *
                  * In assoc req this EXT Cap will only be taken into account if
-                 * interworkingService bit is set to 1. Currently
-                 * driver is only interested in interworkingService capability
-                 * from supplicant. If in future any other EXT Cap info is
+                 * interworkingService or bsstransition bit is set to 1.
+                 * Driver is only interested in interworkingService and
+                 * bsstransition capability from supplicant.
+                 * If in future any other EXT Cap info is
                  * required from supplicat, it needs to be handled while
                  * sending Assoc Req in LIM.
                  */
@@ -12162,49 +14454,110 @@
 static int wlan_hdd_try_disconnect( hdd_adapter_t *pAdapter )
 {
     long ret = 0;
+    int status, result = 0;
     hdd_station_ctx_t *pHddStaCtx;
     eMib_dot11DesiredBssType connectedBssType;
+    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
 
+    ret = wlan_hdd_validate_context(pHddCtx);
+    if (0 != ret)
+    {
+        return ret;
+    }
     pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
 
     hdd_connGetConnectedBssType(pHddStaCtx,&connectedBssType );
 
     if((eMib_dot11DesiredBssType_independent == connectedBssType) ||
       (eConnectionState_Associated == pHddStaCtx->conn_info.connState) ||
+      (eConnectionState_Connecting == pHddStaCtx->conn_info.connState) ||
       (eConnectionState_IbssConnected == pHddStaCtx->conn_info.connState))
     {
+        spin_lock_bh(&pAdapter->lock_for_active_session);
+        if (eConnectionState_Associated ==  pHddStaCtx->conn_info.connState)
+        {
+            wlan_hdd_decr_active_session(pHddCtx, pAdapter->device_mode);
+        }
+        spin_unlock_bh(&pAdapter->lock_for_active_session);
+        hdd_connSetConnectionState(pHddStaCtx,
+                     eConnectionState_Disconnecting);
         /* Issue disconnect to CSR */
         INIT_COMPLETION(pAdapter->disconnect_comp_var);
-        if( eHAL_STATUS_SUCCESS ==
-              sme_RoamDisconnect( WLAN_HDD_GET_HAL_CTX(pAdapter),
+        status = sme_RoamDisconnect(WLAN_HDD_GET_HAL_CTX(pAdapter),
                         pAdapter->sessionId,
-                        eCSR_DISCONNECT_REASON_UNSPECIFIED ) )
-        {
-            ret = wait_for_completion_interruptible_timeout(
+                        eCSR_DISCONNECT_REASON_UNSPECIFIED);
+        if(eHAL_STATUS_CMD_NOT_QUEUED == status) {
+            hddLog(LOG1,
+             FL("Already disconnected or connect was in sme/roam pending list and removed by disconnect"));
+        } else if ( 0 != status ) {
+            hddLog(LOGE,
+               FL("csrRoamDisconnect failure, returned %d"),
+               (int)status );
+            result = -EINVAL;
+            goto disconnected;
+        }
+        ret = wait_for_completion_timeout(
                          &pAdapter->disconnect_comp_var,
                          msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
-            if (0 >=  ret)
-            {
-                hddLog(LOGE, FL("Failed to receive disconnect event"));
-                return -EALREADY;
-            }
+        if (!ret && ( eHAL_STATUS_CMD_NOT_QUEUED != status)) {
+            hddLog(LOGE,
+              "%s: Failed to disconnect, timed out", __func__);
+            result = -ETIMEDOUT;
         }
     }
     else if(eConnectionState_Disconnecting == pHddStaCtx->conn_info.connState)
     {
-        ret = wait_for_completion_interruptible_timeout(
+        ret = wait_for_completion_timeout(
                      &pAdapter->disconnect_comp_var,
                      msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
-        if (0 >= ret)
+        if (!ret)
         {
             hddLog(LOGE, FL("Failed to receive disconnect event"));
-            return -EALREADY;
+            result = -ETIMEDOUT;
         }
     }
-
-    return 0;
+disconnected:
+    hddLog(LOG1,
+          FL("Set HDD connState to eConnectionState_NotConnected"));
+    pHddStaCtx->conn_info.connState = eConnectionState_NotConnected;
+    return result;
 }
 
+/**
+ * wlan_hdd_reassoc_bssid_hint() - Start reassociation if bssid is present
+ * @adapter: Pointer to the HDD adapter
+ * @req: Pointer to the structure cfg_connect_params receieved from user space
+ *
+ * This function will start reassociation if bssid hint, channel hint and
+ * previous bssid parameters are present in the connect request
+ *
+ * Return: success if reassociation is happening
+ *         Error code if reassociation is not permitted or not happening
+ */
+#ifdef CFG80211_CONNECT_PREV_BSSID
+static int wlan_hdd_reassoc_bssid_hint(hdd_adapter_t *adapter,
+				struct cfg80211_connect_params *req)
+{
+	int status = -EPERM;
+	if (req->bssid_hint && req->channel_hint && req->prev_bssid) {
+		hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("REASSOC Attempt on channel %d to "MAC_ADDRESS_STR),
+			req->channel_hint->hw_value,
+			MAC_ADDR_ARRAY(req->bssid_hint));
+		status  = hdd_reassoc(adapter, req->bssid_hint,
+					req->channel_hint->hw_value,
+					CONNECT_CMD_USERSPACE);
+	}
+	return status;
+}
+#else
+static int wlan_hdd_reassoc_bssid_hint(hdd_adapter_t *adapter,
+				struct cfg80211_connect_params *req)
+{
+	return -EPERM;
+}
+#endif
+
 /*
  * FUNCTION: __wlan_hdd_cfg80211_connect
  * This function is used to start the association process
@@ -12215,6 +14568,13 @@
                                       )
 {
     int status;
+    u16 channel;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)) || \
+             defined(CFG80211_BSSID_HINT_BACKPORT)
+    const u8 *bssid_hint = req->bssid_hint;
+#else
+    const u8 *bssid_hint = NULL;
+#endif
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR( ndev );
     VOS_STATUS exitbmpsStatus = VOS_STATUS_E_INVAL;
     hdd_context_t *pHddCtx = NULL;
@@ -12243,10 +14603,10 @@
         return status;
     }
 
-    if (vos_max_concurrent_connections_reached()) {
-        hddLog(VOS_TRACE_LEVEL_INFO, FL("Reached max concurrent connections"));
-        return -ECONNREFUSED;
-    }
+    status = wlan_hdd_reassoc_bssid_hint(pAdapter, req);
+    if (0 == status)
+        return status;
+
 
 #ifdef WLAN_BTAMP_FEATURE
     //Infra connect not supported when AMP traffic is on.
@@ -12274,6 +14634,11 @@
                 " connection"));
         return -EALREADY;
     }
+    /* Check for max concurrent connections after doing disconnect if any*/
+    if (vos_max_concurrent_connections_reached()) {
+        hddLog(VOS_TRACE_LEVEL_INFO, FL("Reached max concurrent connections"));
+        return -ECONNREFUSED;
+    }
 
     /*initialise security parameters*/
     status = wlan_hdd_cfg80211_set_privacy(pAdapter, req);
@@ -12299,19 +14664,13 @@
             return -ECONNREFUSED;
     }
 
-    if ( req->channel )
-    {
-        status = wlan_hdd_cfg80211_connect_start(pAdapter, req->ssid,
-                                                  req->ssid_len, req->bssid,
-                                                  req->bssid_hint,
-                                                  req->channel->hw_value);
-    }
+    if (req->channel)
+        channel = req->channel->hw_value;
     else
-    {
-        status = wlan_hdd_cfg80211_connect_start(pAdapter, req->ssid,
-                                                  req->ssid_len, req->bssid,
-                                                   req->bssid_hint, 0);
-    }
+        channel = 0;
+    status = wlan_hdd_cfg80211_connect_start(pAdapter, req->ssid,
+                                             req->ssid_len, req->bssid,
+                                             bssid_hint, channel);
 
     if (0 != status)
     {
@@ -12402,40 +14761,41 @@
     /*issue disconnect*/
     status = sme_RoamDisconnect( WLAN_HDD_GET_HAL_CTX(pAdapter),
                                  pAdapter->sessionId, reason);
-     if(eHAL_STATUS_CMD_NOT_QUEUED == status)
-     {
-        hddLog(VOS_TRACE_LEVEL_INFO,
-             FL("status = %d, already disconnected"),
-                     (int)status );
-
+    if(eHAL_STATUS_CMD_NOT_QUEUED == status)
+    {
+        hddLog(LOG1,
+            FL("Already disconnected or connect was in sme/roam pending list and removed by disconnect"));
     }
     else if ( 0 != status )
     {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-               "%s csrRoamDisconnect failure, returned %d",
-               __func__, (int)status );
+        hddLog(LOGE,
+               FL("csrRoamDisconnect failure, returned %d"),
+               (int)status);
         result = -EINVAL;
         goto disconnected;
     }
-    ret = wait_for_completion_interruptible_timeout(
+    ret = wait_for_completion_timeout(
                 &pAdapter->disconnect_comp_var,
                 msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
-    if (!ret && ( eHAL_STATUS_CMD_NOT_QUEUED != status ))
+    if (!ret && (eHAL_STATUS_CMD_NOT_QUEUED != status))
     {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
+        hddLog(LOGE,
               "%s: Failed to disconnect, timed out", __func__);
         result = -ETIMEDOUT;
     }
-    else if (ret == -ERESTARTSYS)
-    {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-               "%s: Failed to disconnect, wait interrupted", __func__);
-        result = -ERESTARTSYS;
-    }
 disconnected:
-    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+     hddLog(LOG1,
               FL("Set HDD connState to eConnectionState_NotConnected"));
     pHddStaCtx->conn_info.connState = eConnectionState_NotConnected;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,11,0)
+    /* Sending disconnect event to userspace for kernel version < 3.11
+     * is handled by __cfg80211_disconnect call to __cfg80211_disconnected
+     */
+    hddLog(LOG1, FL("Send disconnected event to userspace"));
+
+    wlan_hdd_cfg80211_indicate_disconnect(pAdapter->dev, true,
+                                          WLAN_REASON_UNSPECIFIED);
+#endif
 
     EXIT();
     return result;
@@ -12871,6 +15231,9 @@
     tCsrRoamProfile *pRoamProfile;
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     int status;
+#ifdef WLAN_FEATURE_RMC
+    tANI_U8 addIE[WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA_LEN] = {0};
+#endif
 
     ENTER();
 
@@ -12903,6 +15266,41 @@
         return -EINVAL;
     }
 
+#ifdef WLAN_FEATURE_RMC
+    /* Clearing add IE of beacon */
+    if (ccmCfgSetStr(pHddCtx->hHal,
+        WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA, &addIE[0],
+        WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA_LEN,
+        NULL, eANI_BOOLEAN_FALSE) != eHAL_STATUS_SUCCESS)
+    {
+        hddLog (VOS_TRACE_LEVEL_ERROR,
+                "%s: unable to clear PROBE_RSP_BCN_ADDNIE_DATA", __func__);
+        return -EINVAL;
+    }
+    if (ccmCfgSetInt(pHddCtx->hHal,
+        WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG, 0, NULL,
+        eANI_BOOLEAN_FALSE) != eHAL_STATUS_SUCCESS)
+    {
+        hddLog (VOS_TRACE_LEVEL_ERROR,
+                "%s: unable to clear WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG",
+                __func__);
+        return -EINVAL;
+    }
+
+    // Reset WNI_CFG_PROBE_RSP Flags
+    wlan_hdd_reset_prob_rspies(pAdapter);
+
+    if (ccmCfgSetInt(WLAN_HDD_GET_HAL_CTX(pAdapter),
+                     WNI_CFG_PROBE_RSP_ADDNIE_FLAG, 0,NULL,
+                     eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE)
+    {
+        hddLog (VOS_TRACE_LEVEL_ERROR,
+                "%s: unable to clear WNI_CFG_PROBE_RSP_ADDNIE_FLAG",
+                __func__);
+        return -EINVAL;
+    }
+#endif
+
     /* Issue Disconnect request */
     INIT_COMPLETION(pAdapter->disconnect_comp_var);
     sme_RoamDisconnect( WLAN_HDD_GET_HAL_CTX(pAdapter), pAdapter->sessionId,
@@ -13679,6 +16077,19 @@
        STATION_INFO_TX_RETRIES |
        STATION_INFO_TX_FAILED;
 
+    sinfo->rx_packets = pAdapter->hdd_stats.summary_stat.rx_frm_cnt;
+    sinfo->filled |= STATION_INFO_RX_PACKETS;
+
+    if (rate_flags & eHAL_TX_RATE_LEGACY)
+        hddLog(LOG1, FL("Reporting RSSI:%d legacy rate %d pkt cnt tx %d rx %d"),
+               sinfo->signal, sinfo->txrate.legacy, sinfo->tx_packets,
+               sinfo->rx_packets);
+    else
+        hddLog(LOG1,
+               FL("Reporting RSSI:%d MCS rate %d flags 0x%x pkt cnt tx %d rx %d"),
+               sinfo->signal, sinfo->txrate.mcs, sinfo->txrate.flags,
+               sinfo->tx_packets, sinfo->rx_packets);
+
     MTRACE(vos_trace(VOS_MODULE_ID_HDD,
                      TRACE_CODE_HDD_CFG80211_GET_STA,
                       pAdapter->sessionId, maxRate));
@@ -13774,6 +16185,7 @@
 
     return ret;
 }
+
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38))
 static int __wlan_hdd_set_default_mgmt_key(struct wiphy *wiphy,
                                            struct net_device *netdev,
@@ -14977,6 +17389,7 @@
     int responder;
     long rc;
     int ret;
+    hddTdlsPeer_t *pTdlsPeer;
 #if !(TDLS_MGMT_VERSION2) && (LINUX_VERSION_CODE < KERNEL_VERSION(3,15,0))
     u32 peer_capability = 0;
 #endif
@@ -15121,7 +17534,6 @@
         }
         else
         {
-            hddTdlsPeer_t *pTdlsPeer;
             mutex_lock(&pHddCtx->tdls_lock);
             pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, FALSE);
             if (pTdlsPeer && TDLS_IS_CONNECTED(pTdlsPeer))
@@ -15146,8 +17558,6 @@
     if (SIR_MAC_TDLS_TEARDOWN == action_code)
     {
 
-       hddTdlsPeer_t *pTdlsPeer;
-
        mutex_lock(&pHddCtx->tdls_lock);
        pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, FALSE);
 
@@ -15165,9 +17575,28 @@
        mutex_unlock(&pHddCtx->tdls_lock);
     }
 
+    /* Discard TDLS setup if peer is removed by user app */
+    if ((pHddCtx->cfg_ini->fTDLSExternalControl) &&
+        ((SIR_MAC_TDLS_SETUP_REQ == action_code) ||
+        (SIR_MAC_TDLS_SETUP_CNF == action_code) ||
+        (SIR_MAC_TDLS_DIS_REQ == action_code))) {
+
+        mutex_lock(&pHddCtx->tdls_lock);
+        pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, FALSE);
+        if (pTdlsPeer && (FALSE == pTdlsPeer->isForcedPeer)) {
+            mutex_unlock(&pHddCtx->tdls_lock);
+            hddLog(LOGE, FL("TDLS External Control enabled, but peer "
+                   MAC_ADDRESS_STR " is not forced, so reject the action code %d"),
+                   MAC_ADDR_ARRAY(peer), action_code);
+            return -EINVAL;
+        }
+        mutex_unlock(&pHddCtx->tdls_lock);
+    }
+
     /* For explicit trigger of DIS_REQ come out of BMPS for
        successfully receiving DIS_RSP from peer. */
     if ((SIR_MAC_TDLS_SETUP_RSP == action_code) ||
+        (SIR_MAC_TDLS_SETUP_CNF== action_code) ||
         (SIR_MAC_TDLS_DIS_RSP == action_code) ||
         (SIR_MAC_TDLS_DIS_REQ == action_code))
     {
@@ -15214,17 +17643,6 @@
         goto tx_failed;
     }
 
-    if ((SIR_MAC_TDLS_DIS_REQ == action_code) ||
-        (SIR_MAC_TDLS_DIS_RSP == action_code))
-    {
-        /* for DIS_REQ/DIS_RSP, supplicant don't consider the return status.
-         * So we no need to wait for tdls_mgmt_comp for sending ack status.
-         */
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                "%s: tx done for frm %u", __func__, action_code);
-        return 0;
-    }
-
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
             "%s: Wait for tdls_mgmt_comp. Timeout %u ms", __func__,
             WAIT_TIME_TDLS_MGMT);
@@ -15245,6 +17663,11 @@
                       "%s: LOGP in Progress. Ignore!!!", __func__);
             return -EAGAIN;
         }
+        if (rc <= 0)
+            vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_HDD_TIME_OUT,
+                 TRUE, TRUE);
 
         ret = -EINVAL;
         goto tx_failed;
@@ -15477,6 +17900,7 @@
 
     hddTdlsPeer_t *pTdlsPeer;
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
               " %s : NL80211_TDLS_TEARDOWN for " MAC_ADDRESS_STR,
               __func__, MAC_ADDR_ARRAY(peer));
@@ -15509,6 +17933,8 @@
     else {
         wlan_hdd_tdls_indicate_teardown(pAdapter, pTdlsPeer,
                            eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
+        hdd_send_wlan_tdls_teardown_event(eTDLS_TEARDOWN_EXT_CTRL,
+                                                 pTdlsPeer->peerMac);
         /* if channel switch is configured, reset
            the channel for this peer */
         if (TRUE == pTdlsPeer->isOffChannelConfigured)
@@ -15591,19 +18017,25 @@
             {
                 VOS_STATUS status;
                 long ret;
-                tCsrTdlsLinkEstablishParams tdlsLinkEstablishParams;
+                tCsrTdlsLinkEstablishParams tdlsLinkEstablishParams = { {0}, 0,
+                                                0, 0, 0, 0, 0, 0, {0}, 0, {0} };
                 WLAN_STADescType         staDesc;
                 tANI_U16 numCurrTdlsPeers = 0;
                 hddTdlsPeer_t *connPeer = NULL;
                 tANI_U8 suppChannelLen = 0;
+                tSirMacAddr peerMac;
+                int channel;
+                tTDLSLinkStatus peer_status = eTDLS_LINK_IDLE;
 
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                         " %s : NL80211_TDLS_ENABLE_LINK for " MAC_ADDRESS_STR,
                                 __func__, MAC_ADDR_ARRAY(peer));
 
-                pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, TRUE);
+                mutex_lock(&pHddCtx->tdls_lock);
+                pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, FALSE);
                 memset(&staDesc, 0, sizeof(staDesc));
                 if ( NULL == pTdlsPeer ) {
+                    mutex_unlock(&pHddCtx->tdls_lock);
                     hddLog(VOS_TRACE_LEVEL_ERROR, "%s: " MAC_ADDRESS_STR
                            " (oper %d) not exsting. ignored",
                            __func__, MAC_ADDR_ARRAY(peer), (int)oper);
@@ -15620,17 +18052,23 @@
                     hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Invalid Staion Index %u "
                            MAC_ADDRESS_STR " failed",
                            __func__, pTdlsPeer->staId, MAC_ADDR_ARRAY(peer));
+                    mutex_unlock(&pHddCtx->tdls_lock);
                     return -EINVAL;
                 }
 
                 /* before starting tdls connection, set tdls
                  * off channel established status to default value */
                 pTdlsPeer->isOffChannelEstablished = FALSE;
+
+                mutex_unlock(&pHddCtx->tdls_lock);
+
+                wlan_hdd_tdls_set_cap(pAdapter, peer, eTDLS_CAP_SUPPORTED);
                 /* TDLS Off Channel, Disable tdls channel switch,
                    when there are more than one tdls link */
                 numCurrTdlsPeers = wlan_hdd_tdlsConnectedPeers(pAdapter);
                 if (numCurrTdlsPeers == 2)
                 {
+                    mutex_lock(&pHddCtx->tdls_lock);
                     /* get connected peer and send disable tdls off chan */
                     connPeer = wlan_hdd_tdls_get_connected_peer(pAdapter);
                     if ((connPeer) &&
@@ -15642,12 +18080,16 @@
                                   "TDLS channel switch", __func__);
 
                         connPeer->isOffChannelEstablished = FALSE;
+                        vos_mem_copy(peerMac, connPeer->peerMac, sizeof (tSirMacAddr));
+                        channel = connPeer->peerParams.channel;
+
+                        mutex_unlock(&pHddCtx->tdls_lock);
 
                         ret = sme_SendTdlsChanSwitchReq(
                                            WLAN_HDD_GET_HAL_CTX(pAdapter),
                                            pAdapter->sessionId,
-                                           connPeer->peerMac,
-                                           connPeer->peerParams.channel,
+                                           peerMac,
+                                           channel,
                                            TDLS_OFF_CHANNEL_BW_OFFSET,
                                            TDLS_CHANNEL_SWITCH_DISABLE);
                         if (ret != VOS_STATUS_SUCCESS) {
@@ -15666,10 +18108,24 @@
                                     : -1),
                                   (connPeer ? (connPeer->isOffChannelConfigured)
                                     : -1));
+                        mutex_unlock(&pHddCtx->tdls_lock);
                     }
                 }
 
-                if (eTDLS_LINK_CONNECTED != pTdlsPeer->link_status)
+                mutex_lock(&pHddCtx->tdls_lock);
+                pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, FALSE);
+                if ( NULL == pTdlsPeer ) {
+                    mutex_unlock(&pHddCtx->tdls_lock);
+                    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                              "%s: " MAC_ADDRESS_STR
+                              " (oper %d) peer got freed in other context. ignored",
+                              __func__, MAC_ADDR_ARRAY(peer), (int)oper);
+                    return -EINVAL;
+                }
+                peer_status = pTdlsPeer->link_status;
+                mutex_unlock(&pHddCtx->tdls_lock);
+
+                if (eTDLS_LINK_CONNECTED != peer_status)
                 {
                     if (IS_ADVANCE_TDLS_ENABLE) {
 
@@ -15694,7 +18150,22 @@
                         ret = wait_for_completion_interruptible_timeout(
                                 &pAdapter->tdls_link_establish_req_comp,
                                 msecs_to_jiffies(WAIT_TIME_TDLS_LINK_ESTABLISH_REQ));
-                        if (ret <= 0)
+
+                        mutex_lock(&pHddCtx->tdls_lock);
+                        pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, FALSE);
+                        if ( NULL == pTdlsPeer ) {
+                            mutex_unlock(&pHddCtx->tdls_lock);
+                            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                                      "%s %d: " MAC_ADDRESS_STR
+                                      " (oper %d) peer got freed in other context. ignored",
+                                      __func__, __LINE__, MAC_ADDR_ARRAY(peer),
+                                      (int)oper);
+                            return -EINVAL;
+                        }
+                        peer_status = pTdlsPeer->link_status;
+                        mutex_unlock(&pHddCtx->tdls_lock);
+
+                        if (ret <= 0 || (peer_status == eTDLS_LINK_TEARING))
                         {
                             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                                       FL("Link Establish Request Failed Status %ld"),
@@ -15703,11 +18174,44 @@
                         }
                     }
 
+                    mutex_lock(&pHddCtx->tdls_lock);
+                    pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, FALSE);
+                    if ( NULL == pTdlsPeer ) {
+                        mutex_unlock(&pHddCtx->tdls_lock);
+                        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                                  "%s: " MAC_ADDRESS_STR
+                                  " (oper %d) peer got freed in other context. ignored",
+                                  __func__, MAC_ADDR_ARRAY(peer), (int)oper);
+                        return -EINVAL;
+                    }
+
                     wlan_hdd_tdls_set_peer_link_status(pTdlsPeer,
                                                        eTDLS_LINK_CONNECTED,
                                                        eTDLS_LINK_SUCCESS);
                     staDesc.ucSTAId = pTdlsPeer->staId;
                     staDesc.ucQosEnabled = tdlsLinkEstablishParams.qos;
+
+                    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                              "%s: tdlsLinkEstablishParams of peer "
+                              MAC_ADDRESS_STR "uapsdQueues: %d"
+                              "qos: %d maxSp: %d isBufSta: %d isOffChannelSupported: %d"
+                              "isResponder: %d  peerstaId: %d",
+                              __func__,
+                              MAC_ADDR_ARRAY(tdlsLinkEstablishParams.peerMac),
+                              tdlsLinkEstablishParams.uapsdQueues,
+                              tdlsLinkEstablishParams.qos,
+                              tdlsLinkEstablishParams.maxSp,
+                              tdlsLinkEstablishParams.isBufSta,
+                              tdlsLinkEstablishParams.isOffChannelSupported,
+                              tdlsLinkEstablishParams.isResponder,
+                              pTdlsPeer->staId);
+
+                    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                              "%s: StaDesc ucSTAId: %d ucQosEnabled: %d",
+                              __func__,
+                              staDesc.ucSTAId,
+                              staDesc.ucQosEnabled);
+
                     ret = WLANTL_UpdateTdlsSTAClient(
                                                 pHddCtx->pvosContext,
                                                 &staDesc);
@@ -15728,13 +18232,16 @@
 
                             tdlsInfo = wlan_hdd_get_conn_info(pHddCtx, staId);
 
-                            /* Initialize initiator wait callback */
-                            vos_timer_init(
+                            if (!vos_timer_is_initialized(
+                                 &pTdlsPeer->initiatorWaitTimeoutTimer))
+                            {
+                                /* Initialize initiator wait callback */
+                                vos_timer_init(
                                     &pTdlsPeer->initiatorWaitTimeoutTimer,
                                     VOS_TIMER_TYPE_SW,
                                     wlan_hdd_tdls_initiator_wait_cb,
                                     tdlsInfo);
-
+                            }
                             wlan_hdd_tdls_timer_restart(pAdapter,
                                                         &pTdlsPeer->initiatorWaitTimeoutTimer,
                                                        WAIT_TIME_TDLS_INITIATOR);
@@ -15799,10 +18306,15 @@
                                   __func__, pTdlsPeer->peerParams.channel);
 
                             pTdlsPeer->isOffChannelEstablished = TRUE;
+                            vos_mem_copy(peerMac, pTdlsPeer->peerMac, sizeof (tSirMacAddr));
+                            channel = pTdlsPeer->peerParams.channel;
+
+                            mutex_unlock(&pHddCtx->tdls_lock);
+
                             ret = sme_SendTdlsChanSwitchReq(WLAN_HDD_GET_HAL_CTX(pAdapter),
                                                            pAdapter->sessionId,
-                                                           pTdlsPeer->peerMac,
-                                                           pTdlsPeer->peerParams.channel,
+                                                           peerMac,
+                                                           channel,
                                                            TDLS_OFF_CHANNEL_BW_OFFSET,
                                                            TDLS_CHANNEL_SWITCH_ENABLE);
                             if (ret != VOS_STATUS_SUCCESS) {
@@ -15819,9 +18331,13 @@
                                       __func__, numCurrTdlsPeers,
                                       pTdlsPeer->isOffChannelSupported,
                                       pTdlsPeer->isOffChannelConfigured);
+                            mutex_unlock(&pHddCtx->tdls_lock);
                         }
 
                     }
+                    else
+                        mutex_unlock(&pHddCtx->tdls_lock);
+
                     wlan_hdd_tdls_check_bmps(pAdapter);
 
                     /* Update TL about the UAPSD masks , to route the packets to firmware */
@@ -15846,6 +18362,14 @@
                         }
                     }
                 }
+
+                /* stop TCP delack timer if TDLS is enable  */
+                set_bit(WLAN_TDLS_MODE, &pHddCtx->mode);
+                hdd_manage_delack_timer(pHddCtx);
+                hdd_wlan_tdls_enable_link_event(peer,
+                           pTdlsPeer->isOffChannelSupported,
+                           pTdlsPeer->isOffChannelConfigured,
+                           pTdlsPeer->isOffChannelEstablished);
             }
             break;
         case NL80211_TDLS_DISABLE_LINK:
@@ -15987,6 +18511,11 @@
                     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                               "%s: TDLS Peer Station doesn't exist.", __func__);
                 }
+                if (numCurrTdlsPeers == 0) {
+                   /* start TCP delack timer if TDLS is disable  */
+                    clear_bit(WLAN_TDLS_MODE, &pHddCtx->mode);
+                    hdd_manage_delack_timer(pHddCtx);
+                }
             }
             break;
         case NL80211_TDLS_TEARDOWN:
@@ -16055,7 +18584,6 @@
     hddLog(VOS_TRACE_LEVEL_INFO,
            "tdls send discover req: "MAC_ADDRESS_STR,
            MAC_ADDR_ARRAY(peer));
-
 #if TDLS_MGMT_VERSION2
     return wlan_hdd_cfg80211_tdls_mgmt(wiphy, dev, peer,
                             WLAN_TDLS_DISCOVERY_REQUEST, 1, 0, 0, NULL, 0);
@@ -16835,6 +19363,109 @@
 
     return ret;
 }
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+static void wlan_hdd_cfg80211_oem_data_rsp_ind_new(void *ctx,
+                                   void *pMsg, tANI_U32 evLen)
+{
+    hdd_context_t *pHddCtx         = (hdd_context_t *)ctx;
+
+    ENTER();
+
+    if (wlan_hdd_validate_context(pHddCtx)) {
+        return;
+    }
+    if (!pMsg)
+    {
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("pMsg is null"));
+        return;
+    }
+
+    send_oem_data_rsp_msg(evLen, pMsg);
+
+    EXIT();
+    return;
+
+}
+
+void wlan_hdd_cfg80211_oemdata_callback(void *ctx, const tANI_U16 evType,
+                                      void *pMsg,  tANI_U32 evLen)
+{
+    hdd_context_t *pHddCtx = (hdd_context_t *)ctx;
+
+    ENTER();
+
+    if (wlan_hdd_validate_context(pHddCtx)) {
+        return;
+    }
+
+    hddLog(VOS_TRACE_LEVEL_INFO, FL("Rcvd Event (%d) evLen %d"), evType, evLen);
+
+    switch(evType) {
+    case SIR_HAL_START_OEM_DATA_RSP_IND_NEW:
+        wlan_hdd_cfg80211_oem_data_rsp_ind_new(ctx, pMsg, evLen);
+        break;
+    default:
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("invalid event type %d "), evType);
+        break;
+    }
+    EXIT();
+}
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,5,0)) || \
+    defined(CFG80211_ABORT_SCAN)
+/**
+ * __wlan_hdd_cfg80211_abort_scan() - cfg80211 abort scan api
+ * @wiphy: Pointer to wiphy
+ * @wdev: Pointer to wireless device structure
+ *
+ * This function is used to abort an ongoing scan
+ *
+ * Return: None
+ */
+static void __wlan_hdd_cfg80211_abort_scan(struct wiphy *wiphy,
+                                           struct wireless_dev *wdev)
+{
+    struct net_device *dev = wdev->netdev;
+    hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+    int ret;
+
+    ENTER();
+
+    if (NULL == adapter) {
+        hddLog(VOS_TRACE_LEVEL_FATAL, FL("HDD adapter is NULL"));
+        return;
+    }
+
+    ret = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != ret)
+        return;
+
+    wlan_hdd_scan_abort(adapter);
+
+    return;
+}
+
+/**
+ * wlan_hdd_cfg80211_abort_scan - cfg80211 abort scan api
+ * @wiphy: Pointer to wiphy
+ * @wdev: Pointer to wireless device structure
+ *
+ * Return: None
+ */
+void wlan_hdd_cfg80211_abort_scan(struct wiphy *wiphy,
+                                  struct wireless_dev *wdev)
+{
+    vos_ssr_protect(__func__);
+    __wlan_hdd_cfg80211_abort_scan(wiphy, wdev);
+    vos_ssr_unprotect(__func__);
+
+    return;
+}
+#endif
+
 /* cfg80211_ops */
 static struct cfg80211_ops wlan_hdd_cfg80211_ops =
 {
@@ -16905,5 +19536,9 @@
      .testmode_cmd = wlan_hdd_cfg80211_testmode,
 #endif
      .dump_survey = wlan_hdd_cfg80211_dump_survey,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,5,0)) || \
+    defined(CFG80211_ABORT_SCAN)
+     .abort_scan = wlan_hdd_cfg80211_abort_scan,
+#endif
 };
 
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_dev_pwr.c b/wlan/prima/CORE/HDD/src/wlan_hdd_dev_pwr.c
index c0c99e7..17d0647 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_dev_pwr.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_dev_pwr.c
@@ -94,6 +94,31 @@
 #endif
 
 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/**
+ * hdd_wlan_suspend_resume_event()- send suspend/resume state
+ *
+ * @state: suspend/resume state
+ *
+ * This Function send send suspend resume state diag event
+ *
+ * Return: void.
+ */
+void hdd_wlan_suspend_resume_event(uint8_t state)
+{
+   WLAN_VOS_DIAG_EVENT_DEF(suspend_state,
+                     struct vos_event_suspend);
+   vos_mem_zero( &suspend_state,
+                        sizeof(suspend_state));
+
+   suspend_state.state= state;
+   WLAN_VOS_DIAG_EVENT_REPORT(&suspend_state,
+                      EVENT_WLAN_SUSPEND_RESUME);
+
+}
+#endif
+
+
 /*----------------------------------------------------------------------------
 
    @brief Function to suspend the wlan driver.
@@ -118,13 +143,33 @@
       VOS_TRACE(VOS_MODULE_ID_HDD,VOS_TRACE_LEVEL_FATAL,"%s: Global VOS_SCHED context is Null",__func__);
       return 0;
    }
-   if(!vos_is_apps_power_collapse_allowed(pHddCtx))
+
+   if (!pHddCtx->last_suspend_success)
+     pHddCtx->last_suspend_success = vos_timer_get_system_time();
+
+   if (!vos_is_apps_power_collapse_allowed(pHddCtx))
    {
        /* Fail this suspend */
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, "%s: Fail wlan suspend: not in IMPS/BMPS", __func__);
+       pHddCtx->continuous_suspend_fail_cnt++;
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+        FL("Fail wlan suspend: not in IMPS/BMPS, continuous Failcnt %d"),
+        pHddCtx->continuous_suspend_fail_cnt);
+
+       /* call fatal event if power collapse fails for
+        * WLAN_POWER_COLLAPSE_FAIL_THRESHOLD time.
+        */
+       if ((vos_timer_get_system_time() - pHddCtx->last_suspend_success) >=
+                                         WLAN_POWER_COLLAPSE_FAIL_THRESHOLD)
+       {
+          pHddCtx->last_suspend_success = 0;
+          vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                      WLAN_LOG_INDICATOR_HOST_DRIVER,
+                      WLAN_LOG_REASON_POWER_COLLAPSE_FAIL,
+                      FALSE, TRUE);
+       }
        return -EPERM;
    }
-
+   pHddCtx->continuous_suspend_fail_cnt = 0;
    /*
      Suspending MC Thread, Rx Thread and Tx Thread as the platform driver is going to Suspend.     
    */
@@ -158,7 +203,18 @@
                    "%s: TX Thread: will still suspend", __func__);
          goto tx_suspend;
       }
-
+      /* call fatal event if suspend for
+       * WLAN_POWER_COLLAPSE_FAIL_THRESHOLD time.
+       */
+      if ((vos_timer_get_system_time() - pHddCtx->last_suspend_success) >=
+                                         WLAN_POWER_COLLAPSE_FAIL_THRESHOLD)
+      {
+          pHddCtx->last_suspend_success = 0;
+          vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                      WLAN_LOG_INDICATOR_HOST_DRIVER,
+                      WLAN_LOG_REASON_POWER_COLLAPSE_FAIL,
+                      FALSE, TRUE);
+      }
       return -ETIME;
    }
 
@@ -199,6 +255,18 @@
 
        /* Set the Tx Thread as Resumed */
        pHddCtx->isTxThreadSuspended = FALSE;
+      /* call fatal event if suspend for
+       * WLAN_POWER_COLLAPSE_FAIL_THRESHOLD time.
+       */
+      if ((vos_timer_get_system_time() - pHddCtx->last_suspend_success) >=
+                                         WLAN_POWER_COLLAPSE_FAIL_THRESHOLD)
+      {
+          pHddCtx->last_suspend_success = 0;
+          vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                      WLAN_LOG_INDICATOR_HOST_DRIVER,
+                      WLAN_LOG_REASON_POWER_COLLAPSE_FAIL,
+                      FALSE, TRUE);
+      }
 
        return -ETIME;
    }
@@ -249,6 +317,19 @@
        /* Set the Tx Thread as Resumed */
        pHddCtx->isTxThreadSuspended = FALSE;
 
+      /* call fatal event if suspend for
+       * WLAN_POWER_COLLAPSE_FAIL_THRESHOLD time.
+       */
+      if ((vos_timer_get_system_time() - pHddCtx->last_suspend_success) >=
+                                         WLAN_POWER_COLLAPSE_FAIL_THRESHOLD)
+      {
+          pHddCtx->last_suspend_success = 0;
+          vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                      WLAN_LOG_INDICATOR_HOST_DRIVER,
+                      WLAN_LOG_REASON_POWER_COLLAPSE_FAIL,
+                      FALSE, TRUE);
+      }
+
        return -ETIME;
    }
 
@@ -258,7 +339,8 @@
    
    /* Set the Station state as Suspended */
    pHddCtx->isWlanSuspended = TRUE;
-
+   pHddCtx->last_suspend_success = 0;
+   hdd_wlan_suspend_resume_event(HDD_WLAN_SUSPEND);
    return 0;
 }
 
@@ -310,6 +392,7 @@
 
    /* Set the Station state as Suspended */
    pHddCtx->isWlanSuspended = FALSE;
+   hdd_wlan_suspend_resume_event(HDD_WLAN_RESUME);
 }
 
 /*----------------------------------------------------------------------------
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_early_suspend.c b/wlan/prima/CORE/HDD/src/wlan_hdd_early_suspend.c
index e2aec64..85cdeae 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_early_suspend.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_early_suspend.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -106,6 +106,32 @@
 static struct timer_list ssr_timer;
 static bool ssr_timer_started;
 
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/**
+ * hdd_wlan_offload_event()- send offloads event
+ *
+ * @type: offload type
+ * @state: enabled or disabled
+ *
+ * This Function send offloads enable/disable diag event
+ *
+ * Return: void.
+ */
+
+void hdd_wlan_offload_event(uint8_t type, uint8_t state)
+{
+   WLAN_VOS_DIAG_EVENT_DEF(host_offload,
+                    struct vos_event_offload_req);
+   vos_mem_zero(&host_offload, sizeof(host_offload));
+
+   host_offload.offload_type = type;
+   host_offload.state = state;
+
+   WLAN_VOS_DIAG_EVENT_REPORT(&host_offload, EVENT_OFFLOAD_REQ);
+}
+#endif /* FEATURE_WLAN_DIAG_SUPPORT */
+
 //Callback invoked by PMC to report status of standby request
 void hdd_suspend_standby_cbk (void *callbackContext, eHalStatus status)
 {
@@ -373,7 +399,8 @@
        hddLog(VOS_TRACE_LEVEL_ERROR, "%s: vos_stop return failed %d",
                 __func__, vosStatus);
        VOS_ASSERT(0);
-       VOS_BUG(0);
+       if (isSsrPanicOnFailure())
+           VOS_BUG(0);
    }
 
    pHddCtx->hdd_ps_state = eHDD_SUSPEND_DEEP_SLEEP;
@@ -413,7 +440,8 @@
    {
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
          "%s: Failed in vos_start",__func__);
-      VOS_BUG(0);
+      if (isSsrPanicOnFailure())
+          VOS_BUG(0);
       goto err_deep_sleep;
    }
 
@@ -539,6 +567,12 @@
              (pAdapterNode->pAdapter->device_mode == WLAN_HDD_INFRA_STATION ||
               pAdapterNode->pAdapter->device_mode == WLAN_HDD_P2P_CLIENT))
         {
+
+            if (eConnectionState_Associated ==
+               WLAN_HDD_GET_STATION_CTX_PTR
+               (pAdapterNode->pAdapter)->conn_info.connState)
+                 sme_dhcp_done_ind(pHddCtx->hHal,
+                       pAdapterNode->pAdapter->sessionId);
             if (pHddCtx->cfg_ini->nEnableSuspend ==
                   WLAN_MAP_SUSPEND_TO_MCAST_BCAST_FILTER)
             {
@@ -860,6 +894,8 @@
                                                           SIR_IPV6_ADDR_VALID;
                     offLoadRequest.offloadType =  SIR_IPV6_NS_OFFLOAD;
                     offLoadRequest.enableOrDisable = SIR_OFFLOAD_ENABLE;
+                    hdd_wlan_offload_event(SIR_IPV6_NS_OFFLOAD,
+                                                     SIR_OFFLOAD_ENABLE);
 
                     hddLog (VOS_TRACE_LEVEL_INFO,
                        FL("configuredMcastBcastFilter: %d"
@@ -881,7 +917,9 @@
                                 FL("Set offLoadRequest with %d"),
                                    offLoadRequest.enableOrDisable);
                     }
-
+                    hdd_wlan_offload_event(
+                                  SIR_OFFLOAD_NS_AND_MCAST_FILTER_ENABLE,
+                                  SIR_OFFLOAD_ENABLE);
                     vos_mem_copy(&offLoadRequest.params.hostIpv6Addr,
                                 &offLoadRequest.nsOffloadInfo.targetIPv6Addr[0],
                                 sizeof(tANI_U8)*SIR_MAC_IPV6_ADDR_LEN);
@@ -918,6 +956,8 @@
         vos_mem_zero((void *)&offLoadRequest, sizeof(tSirHostOffloadReq));
         offLoadRequest.enableOrDisable = SIR_OFFLOAD_DISABLE;
         offLoadRequest.offloadType =  SIR_IPV6_NS_OFFLOAD;
+        hdd_wlan_offload_event(SIR_IPV6_NS_OFFLOAD,
+                                           SIR_OFFLOAD_DISABLE);
 
         for (i = 0; i < slot_index; i++)
         {
@@ -1026,6 +1066,12 @@
              (pAdapterNode->pAdapter->device_mode == WLAN_HDD_INFRA_STATION ||
               pAdapterNode->pAdapter->device_mode == WLAN_HDD_P2P_CLIENT))
         {
+
+            if (eConnectionState_Associated ==
+               WLAN_HDD_GET_STATION_CTX_PTR
+               (pAdapterNode->pAdapter)->conn_info.connState)
+                 sme_dhcp_done_ind(pHddCtx->hHal,
+                       pAdapterNode->pAdapter->sessionId);
             if ((pHddCtx->cfg_ini->nEnableSuspend !=
                   WLAN_MAP_SUSPEND_TO_MCAST_BCAST_FILTER)
                || (!pHddCtx->cfg_ini->fhostArpOffload))
@@ -1116,6 +1162,8 @@
        {
            offLoadRequest.offloadType =  SIR_IPV4_ARP_REPLY_OFFLOAD;
            offLoadRequest.enableOrDisable = SIR_OFFLOAD_ENABLE;
+           hdd_wlan_offload_event(SIR_IPV4_ARP_REPLY_OFFLOAD,
+                                           SIR_OFFLOAD_ENABLE);
 
            hddLog(VOS_TRACE_LEVEL_INFO, "%s: Enabled", __func__);
 
@@ -1130,6 +1178,8 @@
                hddLog(VOS_TRACE_LEVEL_INFO,
                       "offload: inside arp offload conditional check");
            }
+           hdd_wlan_offload_event(SIR_OFFLOAD_ARP_AND_BCAST_FILTER_ENABLE,
+                                           SIR_OFFLOAD_ENABLE);
 
            hddLog(VOS_TRACE_LEVEL_INFO, "offload: arp filter programmed = %d",
                   offLoadRequest.enableOrDisable);
@@ -1168,7 +1218,8 @@
        vos_mem_zero((void *)&offLoadRequest, sizeof(tSirHostOffloadReq));
        offLoadRequest.enableOrDisable = SIR_OFFLOAD_DISABLE;
        offLoadRequest.offloadType =  SIR_IPV4_ARP_REPLY_OFFLOAD;
-
+       hdd_wlan_offload_event(SIR_IPV4_ARP_REPLY_OFFLOAD,
+                                           SIR_OFFLOAD_DISABLE);
        if (eHAL_STATUS_SUCCESS !=
                  sme_SetHostOffload(WLAN_HDD_GET_HAL_CTX(pAdapter),
                  pAdapter->sessionId, &offLoadRequest))
@@ -1434,6 +1485,7 @@
    }
 
    pHddCtx->hdd_wlan_suspended = TRUE;
+   hdd_wlan_suspend_resume_event(HDD_WLAN_EARLY_SUSPEND);
    hdd_set_pwrparams(pHddCtx);
    status =  hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
    while ( NULL != pAdapterNode && VOS_STATUS_SUCCESS == status )
@@ -1508,7 +1560,8 @@
    /* if the driver was not in BMPS during early suspend,
     * the dynamic DTIM is now updated at Riva */
    if ((newState == BMPS) && pHddCtx->hdd_wlan_suspended
-           && pHddCtx->cfg_ini->enableDynamicDTIM
+           && (pHddCtx->cfg_ini->enableDynamicDTIM ||
+               pHddCtx->cfg_ini->enableModulatedDTIM)
            && (pHddCtx->hdd_ignore_dtim_enabled == FALSE))
    {
        pHddCtx->hdd_ignore_dtim_enabled = TRUE;
@@ -1735,6 +1788,7 @@
    }
 
    pHddCtx->hdd_wlan_suspended = FALSE;
+   hdd_wlan_suspend_resume_event(HDD_WLAN_EARLY_RESUME);
    /*loop through all adapters. Concurrency */
    status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
 
@@ -1913,13 +1967,18 @@
    }
 
    //Stop the traffic monitor timer
-   if ( VOS_TIMER_STATE_RUNNING ==
-                        vos_timer_getCurrentState(&pHddCtx->tx_rx_trafficTmr))
+   if ((pHddCtx->cfg_ini->dynSplitscan)&& (VOS_TIMER_STATE_RUNNING ==
+                        vos_timer_getCurrentState(&pHddCtx->tx_rx_trafficTmr)))
    {
         vos_timer_stop(&pHddCtx->tx_rx_trafficTmr);
    }
 
+   vos_flush_delayed_work(&pHddCtx->spoof_mac_addr_work);
    hdd_reset_all_adapters(pHddCtx);
+
+   /* set default value of Tcp delack and stop timer */
+   hdd_set_default_stop_delack_timer(pHddCtx);
+
    /* DeRegister with platform driver as client for Suspend/Resume */
    vosStatus = hddDeregisterPmOps(pHddCtx);
    if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
@@ -2040,6 +2099,9 @@
    vos_sched_flush_rx_mqs(vosSchedContext);
 #ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
    wlan_logging_flush_pkt_queue();
+   /*Free fw dump mem in case of SSR/Shutdown */
+   wlan_set_fwr_mem_dump_state(FW_MEM_DUMP_IDLE);
+   wlan_free_fwr_mem_dump_buffer();
 #endif
 
    /* Deinit all the TX and MC queues */
@@ -2188,7 +2250,8 @@
    if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
    {
       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: vos_start failed",__func__);
-      VOS_BUG(0);
+      if (isSsrPanicOnFailure())
+          VOS_BUG(0);
       goto err_vosclose;
    }
 
@@ -2273,6 +2336,7 @@
                                         __func__);
       goto err_unregister_pmops;
    }
+   sme_set_rssi_threshold_breached_cb(pHddCtx->hHal, hdd_rssi_threshold_breached_cb);
    vos_set_reinit_in_progress(VOS_MODULE_ID_VOSS, FALSE);
 
    sme_register_mgmt_frame_ind_callback(pHddCtx->hHal,hdd_indicate_mgmt_frame);
@@ -2282,6 +2346,13 @@
             wlan_hdd_cfg80211_extscan_callback,
                            pHddCtx);
 #endif /* WLAN_FEATURE_EXTSCAN */
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+    sme_OemDataRegisterCallback(pHddCtx->hHal,
+             wlan_hdd_cfg80211_oemdata_callback,
+                          pHddCtx);
+#endif /* FEATURE_OEM_DATA_SUPPORT */
+
    goto success;
 
 err_unregister_pmops:
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_ftm.c b/wlan/prima/CORE/HDD/src/wlan_hdd_ftm.c
index cbe31d0..7bf993d 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_ftm.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_ftm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -76,6 +76,7 @@
 #include "pttMsgApi.h"
 #include "wlan_qct_pal_device.h"
 #include "linux/wcnss_wlan.h"
+#include "qc_sap_ioctl.h"
 
 #define RXMODE_DISABLE_ALL 0
 #define RXMODE_ENABLE_ALL  1
@@ -474,6 +475,7 @@
     v_U16_t rxmode;
     v_U16_t chainSelect;
     ePhyChanBondState cbmode;
+    ePowerTempIndexSource powerIndex;
 
 } FTM_STATUS ;
 static FTM_STATUS ftm_status;
@@ -507,6 +509,7 @@
     ftm_status.rxmode = RXMODE_ENABLE_ALL; /* macStart() enables all receive pkt types */
     ftm_status.chainSelect = FTM_CHAIN_SEL_R0_T0_ON;
     ftm_status.cbmode = 0 ; //none channel bonding
+    ftm_status.powerIndex = FIXED_POWER_DBM;
 
     return;
 }
@@ -1581,6 +1584,7 @@
 #else
 nl_srv_exit();
 #endif /* WLAN_KD_READY_NOTIFIER */
+ptt_sock_deactivate_svc(pHddCtx);
 err_ftm_register_wext_close:
 hdd_UnregisterWext(pAdapter->dev);
 
@@ -1625,17 +1629,17 @@
                   "%s: Ftm has been started. stopping ftm", __func__);
         wlan_ftm_stop(pHddCtx);
     }
-
 #ifdef WLAN_KD_READY_NOTIFIER
     nl_srv_exit(pHddCtx->ptt_pid);
 #else
     nl_srv_exit();
 #endif /* WLAN_KD_READY_NOTIFIER */
+    ptt_sock_deactivate_svc(pHddCtx);
+
     //TODO----------
     //Deregister the device with the kernel
     hdd_UnregisterWext(pAdapter->dev);
 
-    hdd_close_all_adapters( pHddCtx );
 #if 0
     if(test_bit(NET_DEVICE_REGISTERED, &pAdapter->event_flags))
     {
@@ -1654,8 +1658,7 @@
 
     //Close VOSS
     wlan_ftm_vos_close(vosContext);
-
-
+    hdd_close_all_adapters( pHddCtx );
     vosStatus = vos_event_destroy(&pHddCtx->ftm.ftm_vos_event);
     if (!VOS_IS_STATUS_SUCCESS(vosStatus))
     {
@@ -3653,6 +3656,75 @@
     return status;
 }
 
+static VOS_STATUS wlan_ftm_priv_set_dump(hdd_adapter_t *pAdapter, int *value)
+{
+    uPttMsgs *pMsgBody;
+    VOS_STATUS status;
+    long ret;
+    hdd_context_t *pHddCtx = (hdd_context_t *)pAdapter->pHddCtx;
+
+    if (pHddCtx->ftm.ftm_state != WLAN_FTM_STARTED)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+                   "%s:Ftm has not started. Please start the ftm. ", __func__);
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    if (NULL == pMsgBuf)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+                   "%s:pMsgBuf is NULL", __func__);
+        return VOS_STATUS_E_NOMEM;
+    }
+
+    vos_mem_set(pMsgBuf, sizeof(*pMsgBuf), 0);
+    init_completion(&pHddCtx->ftm.ftm_comp_var);
+    pMsgBuf->msgId = PTT_MSG_PRIMA_GENERIC_CMD;
+    pMsgBuf->msgBodyLength = sizeof(tMsgPttPrimaGenericCmd) + PTT_HEADER_LENGTH;
+
+    pMsgBody = &pMsgBuf->msgBody;
+
+    pMsgBody->PrimaGenericCmd.cmdIdx = value[0];
+    pMsgBody->PrimaGenericCmd.param1 = value[1];
+    pMsgBody->PrimaGenericCmd.param2 = value[2];
+    pMsgBody->PrimaGenericCmd.param3 = value[3];
+    pMsgBody->PrimaGenericCmd.param4 = value[4];
+
+    status = wlan_ftm_postmsg((v_U8_t*)pMsgBuf,pMsgBuf->msgBodyLength);
+
+    if (status != VOS_STATUS_SUCCESS)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+                   "%s:wlan_ftm_postmsg failed", __func__);
+        status = VOS_STATUS_E_FAILURE;
+        goto done;
+    }
+
+    ret = wait_for_completion_interruptible_timeout(&pHddCtx->ftm.ftm_comp_var,
+                                msecs_to_jiffies(WLAN_FTM_COMMAND_TIME_OUT));
+    if (0 >= ret )
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                   FL("wait on ftm_comp_var failed %ld"), ret);
+    }
+
+    if (pMsgBuf->msgResponse != PTT_STATUS_SUCCESS)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+                   "%s:Ptt response status failed", __func__);
+    }
+
+    if (pMsgBuf->msgResponse != PTT_STATUS_SUCCESS)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+                   "%s:Ptt response status failed", __func__);
+        status = VOS_STATUS_E_FAILURE;
+        goto done;
+    }
+
+done:
+    return status;
+}
 
 /**---------------------------------------------------------------------------
 
@@ -3926,7 +3998,7 @@
     if (pwr_source > 3)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
-                   "%s:invalid power index source. valid mode is 0 , 1, 2. ",
+                   "%s:invalid power index source. valid mode is 0, 1, 2, 3. ",
                    __func__);
         return VOS_STATUS_E_FAILURE;
     }
@@ -3959,6 +4031,7 @@
         goto done;
     }
 
+    ftm_status.powerIndex = pwr_source;
 done:
 
    return status;
@@ -4048,7 +4121,8 @@
 
         if (ftm_status.powerCtlMode == 2) //only for CLPC mode
         {
-           status = wlan_ftm_priv_set_power_index(pAdapter, FIXED_POWER_DBM) != VOS_STATUS_SUCCESS; //power index source set to Fixed
+           status = wlan_ftm_priv_set_power_index(pAdapter,
+                                                  ftm_status.powerIndex);
            if(status != VOS_STATUS_SUCCESS)
            {
               goto done;
@@ -5162,6 +5236,18 @@
            break;
         }
 
+        case WE_SET_POWER_INDEX:
+        {
+            status = wlan_ftm_priv_set_power_index(pAdapter, set_value);
+            if (status != VOS_STATUS_SUCCESS)
+            {
+                hddLog(VOS_TRACE_LEVEL_ERROR, "set power index failed = %d",
+                    status);
+                ret = -EINVAL;
+            }
+            break;
+        }
+
         default:
         {
             hddLog(LOGE, "Invalid IOCTL setvalue command %d value %d",
@@ -5488,14 +5574,16 @@
     int sub_cmd = wrqu->data.flags;
     int *value = (int*)wrqu->data.pointer;
     int ret = 0;
+    VOS_STATUS status;
 
     ENTER();
 
-    if(wrqu->data.length != 2)
+    if(wrqu->data.length < 2)
     {
         hddLog(LOGE, "Invalid number of Arguments  %d ",  wrqu->data.length);
         return -EINVAL;
     }
+
     pAdapter = (netdev_priv(dev));
     if (NULL == pAdapter)
     {
@@ -5503,19 +5591,20 @@
                   "%s: Adapter is NULL",__func__);
         return -EINVAL;
     }
+
     pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     ret = wlan_hdd_validate_context(pHddCtx);
     if (0 != ret)
     {
         return ret;
     }
+
     switch (sub_cmd)
     {
         case WE_SET_TX_WF_GAIN:
         {
             v_S15_t dGain = 0;
             v_U16_t rfGain = 0;
-            VOS_STATUS status;
 
             dGain = *(v_S15_t*) value++;
             rfGain = *(v_U16_t*) value;
@@ -5530,6 +5619,23 @@
         }
         break;
 
+        case WE_SET_DUMP:
+            if (*value == 1)
+            {
+                 status = wlan_ftm_priv_set_dump(pAdapter, value);
+                 if(status != VOS_STATUS_SUCCESS)
+                 {
+                     hddLog(LOGE, "wlan_ftm_priv_set_dump Failed =%d\n",
+                            status);
+                     ret = -EINVAL;
+                 }
+            }else
+            {
+                 hddLog(LOGE, "%s arg[0]: %d expecting arg[0]: 1\n",
+                        __func__, *value);
+            }
+            break;
+
         default:
         {
             hddLog(LOGE, "Invalid IOCTL command %d ", sub_cmd );
@@ -5546,19 +5652,50 @@
         union iwreq_data *wrqu, char *extra)
 {
    int ret;
+   union iwreq_data u_priv_wrqu;
+   int apps_args[MAX_VAR_ARGS] = {0};
+   int num_args;
 
-   if (!capable(CAP_NET_ADMIN))
-   {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-           FL("permission check failed"));
-        return -EPERM;
-   }
+    if (!capable(CAP_NET_ADMIN))
+    {
+         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+            FL("permission check failed"));
+         return -EPERM;
+    }
 
-   vos_ssr_protect(__func__);
-   ret = __iw_ftm_set_var_ints_getnone(dev, info, wrqu, extra);
-   vos_ssr_unprotect(__func__);
+    /* helper function to get iwreq_data with compat handling. */
+    if (hdd_priv_get_data(&u_priv_wrqu.data, wrqu))
+    {
+       return -EINVAL;
+    }
 
-   return ret;
+    if (NULL == u_priv_wrqu.data.pointer)
+    {
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "%s: NULL data pointer", __func__);
+       return -EINVAL;
+    }
+
+    num_args = u_priv_wrqu.data.length;
+    if (num_args > MAX_VAR_ARGS)
+    {
+       num_args = MAX_VAR_ARGS;
+    }
+
+    if (copy_from_user(apps_args, u_priv_wrqu.data.pointer,
+                       (sizeof(int)) * num_args))
+    {
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "%s: failed to copy data from user buffer", __func__);
+       return -EFAULT;
+    }
+
+    vos_ssr_protect(__func__);
+    ret = __iw_ftm_set_var_ints_getnone(dev, info, &u_priv_wrqu,
+                                       (char *)&apps_args);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
 }
 
 static const iw_handler we_ftm_private[] = {
@@ -5654,6 +5791,11 @@
         0,
         "set_cb" },
 
+    {   WE_SET_POWER_INDEX,
+        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+        0,
+        "set_power_index" },
+
     /* handlers for main ioctl */
     {   WLAN_FTM_PRIV_SET_NONE_GET_INT,
         0,
@@ -5733,6 +5875,11 @@
         0,
         "set_nv_defaults" },
 
+    {   WE_SET_DUMP,
+        IW_PRIV_TYPE_INT | MAX_FTM_VAR_ARGS,
+        0,
+        "dump" },
+
 };
 
 const struct iw_handler_def we_ftm_handler_def = {
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_hostapd.c b/wlan/prima/CORE/HDD/src/wlan_hdd_hostapd.c
index f877c13..752a34c 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1036,6 +1036,15 @@
                                      vos_status, MAC_ADDR_ARRAY(wrqu.addr.sa_data));
             }
 
+            staId =
+                pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staId;
+            if (VOS_IS_STATUS_SUCCESS(vos_status))
+            {
+
+                pSapCtx->aStaInfo[staId].rate_flags =
+                pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.rate_flags;
+            }
+
             // Stop AP inactivity timer
             if (pHddApCtx->hdd_ap_inactivity_timer.state == VOS_TIMER_STATE_RUNNING)
             {
@@ -1078,6 +1087,8 @@
                 }
              }
 #endif
+            hdd_manage_delack_timer(pHddCtx);
+
             pScanInfo =  &pHddCtx->scan_info;
             // Lets do abort scan to ensure smooth authentication for client
             if ((pScanInfo != NULL) && pScanInfo->mScanPending)
@@ -1142,6 +1153,7 @@
                 hddLog(LOGE, "%s: failed to update Beacon interval %d",
                         __func__, vos_status);
             }
+            hdd_manage_delack_timer(pHddCtx);
             break;
         case eSAP_WPS_PBC_PROBE_REQ_EVENT:
         {
@@ -1404,35 +1416,6 @@
 }
 
 #ifdef FEATURE_WLAN_CH_AVOID
-/**---------------------------------------------------------------------------
-
-  \brief hdd_hostapd_freq_to_chn() -
-
-  Input frequency translated into channel number
-
-  \param  - freq input frequency with order of kHz
-
-  \return - corresponding channel number.
-            incannot find correct channel number, return 0
-
-  --------------------------------------------------------------------------*/
-v_U16_t hdd_hostapd_freq_to_chn
-(
-   v_U16_t   freq
-)
-{
-   int   loop;
-
-   for (loop = 0; loop < NUM_20MHZ_RF_CHANNELS; loop++)
-   {
-      if (rfChannels[loop].targetFreq == freq)
-      {
-         return rfChannels[loop].channelNum;
-      }
-   }
-
-   return (0);
-}
 
 /*==========================================================================
   FUNCTION    sapUpdateUnsafeChannelList
@@ -1564,9 +1547,13 @@
                 NUM_20MHZ_RF_CHANNELS * sizeof(v_U16_t));
    for (rangeLoop = 0; rangeLoop < chAvoidInd->avoidRangeCount; rangeLoop++)
    {
-      startChannel = hdd_hostapd_freq_to_chn(
+      if (unsafeChannelCount >= NUM_20MHZ_RF_CHANNELS) {
+         hddLog(LOGW, FL("LTE Coex unsafe channel list full"));
+         break;
+      }
+      startChannel = ieee80211_frequency_to_channel(
                       chAvoidInd->avoidFreqRange[rangeLoop].startFreq);
-      endChannel   = hdd_hostapd_freq_to_chn(
+      endChannel   = ieee80211_frequency_to_channel(
                       chAvoidInd->avoidFreqRange[rangeLoop].endFreq);
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                 "%s : start %d : %d, end %d : %d",
@@ -1604,6 +1591,10 @@
                            "%s : unsafe channel %d, count %d",
                            __func__,
                            channelLoop, unsafeChannelCount);
+                     if (unsafeChannelCount >= NUM_20MHZ_RF_CHANNELS) {
+                        hddLog(LOGW, FL("LTE Coex unsafe channel list full"));
+                        break;
+                     }
                  }
              }
          }
@@ -1965,7 +1956,11 @@
                 }
                 break;
             }
-
+        case QCSAP_PARAM_SET_PROXIMITY:
+            {
+                ret = wlan_hdd_set_proximity(set_value);
+                break;
+            }
         default:
             hddLog(LOGE, FL("Invalid setparam command %d value %d"),
                     sub_cmd, set_value);
@@ -2794,6 +2789,163 @@
     EXIT();
     return 0;
 }
+int
+static __iw_softap_ap_get_stats(struct net_device *dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *wrqu, char *extra)
+{
+    hdd_adapter_t *pAdapter;
+    hdd_tx_rx_stats_t *pStats;
+
+    ENTER();
+    pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    if (NULL == pAdapter)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Adapter is NULL",__func__);
+        return -EINVAL;
+    }
+
+    pStats = &pAdapter->hdd_stats.hddTxRxStats;
+    snprintf(extra, QCSAP_MAX_STR_LEN,
+                     "\nTransmit"
+                     "\ncalled %u, dropped %u, backpressured %u, queued %u"
+                     "\n      dropped BK %u, BE %u, VI %u, VO %u"
+                     "\n   classified BK %u, BE %u, VI %u, VO %u"
+                     "\nbackpressured BK %u, BE %u, VI %u, VO %u"
+                     "\n       queued BK %u, BE %u, VI %u, VO %u"
+                     "\nfetched %u, empty %u, lowres %u, deqerr %u"
+                     "\ndequeued %u, depressured %u, deque-depressured %u,\
+                        completed %u, flushed %u"
+                     "\n      fetched BK %u, BE %u, VI %u, VO %u"
+                     "\n     dequeued BK %u, BE %u, VI %u, VO %u"
+                     "\n  depressured BK %u, BE %u, VI %u, VO %u"
+                     "\nDeque depressured BK %u, BE %u, VI %u, VO %u"
+                     "\n      flushed BK %u, BE %u, VI %u, VO %u"
+                     "\n\nReceive"
+                     "\nchains %u, packets %u, dropped %u, delivered %u, refused %u"
+                     "\n\nResetsStats"
+                     "\n",
+                     pStats->txXmitCalled,
+                     pStats->txXmitDropped,
+                     pStats->txXmitBackPressured,
+                     pStats->txXmitQueued,
+
+                     pStats->txXmitDroppedAC[WLANTL_AC_BK],
+                     pStats->txXmitDroppedAC[WLANTL_AC_BE],
+                     pStats->txXmitDroppedAC[WLANTL_AC_VI],
+                     pStats->txXmitDroppedAC[WLANTL_AC_VO],
+
+                     pStats->txXmitClassifiedAC[WLANTL_AC_BK],
+                     pStats->txXmitClassifiedAC[WLANTL_AC_BE],
+                     pStats->txXmitClassifiedAC[WLANTL_AC_VI],
+                     pStats->txXmitClassifiedAC[WLANTL_AC_VO],
+
+                     pStats->txXmitBackPressuredAC[WLANTL_AC_BK],
+                     pStats->txXmitBackPressuredAC[WLANTL_AC_BE],
+                     pStats->txXmitBackPressuredAC[WLANTL_AC_VI],
+                     pStats->txXmitBackPressuredAC[WLANTL_AC_VO],
+
+                     pStats->txXmitQueuedAC[WLANTL_AC_BK],
+                     pStats->txXmitQueuedAC[WLANTL_AC_BE],
+                     pStats->txXmitQueuedAC[WLANTL_AC_VI],
+                     pStats->txXmitQueuedAC[WLANTL_AC_VO],
+
+                     pStats->txFetched,
+                     pStats->txFetchEmpty,
+                     pStats->txFetchLowResources,
+                     pStats->txFetchDequeueError,
+
+                     pStats->txFetchDequeued,
+                     pStats->txFetchDePressured,
+                     pStats->txDequeDePressured,
+                     pStats->txCompleted,
+                     pStats->txFlushed,
+
+                     pStats->txFetchedAC[WLANTL_AC_BK],
+                     pStats->txFetchedAC[WLANTL_AC_BE],
+                     pStats->txFetchedAC[WLANTL_AC_VI],
+                     pStats->txFetchedAC[WLANTL_AC_VO],
+
+                     pStats->txFetchDequeuedAC[WLANTL_AC_BK],
+                     pStats->txFetchDequeuedAC[WLANTL_AC_BE],
+                     pStats->txFetchDequeuedAC[WLANTL_AC_VI],
+                     pStats->txFetchDequeuedAC[WLANTL_AC_VO],
+
+                     pStats->txFetchDePressuredAC[WLANTL_AC_BK],
+                     pStats->txFetchDePressuredAC[WLANTL_AC_BE],
+                     pStats->txFetchDePressuredAC[WLANTL_AC_VI],
+                     pStats->txFetchDePressuredAC[WLANTL_AC_VO],
+
+                     pStats->txDequeDePressuredAC[WLANTL_AC_BK],
+                     pStats->txDequeDePressuredAC[WLANTL_AC_BE],
+                     pStats->txDequeDePressuredAC[WLANTL_AC_VI],
+                     pStats->txDequeDePressuredAC[WLANTL_AC_VO],
+
+                     pStats->txFlushedAC[WLANTL_AC_BK],
+                     pStats->txFlushedAC[WLANTL_AC_BE],
+                     pStats->txFlushedAC[WLANTL_AC_VI],
+                     pStats->txFlushedAC[WLANTL_AC_VO],
+
+                     pStats->rxChains,
+                     pStats->rxPackets,
+                     pStats->rxDropped,
+                     pStats->rxDelivered,
+                     pStats->rxRefused
+                     );
+
+    wrqu->data.length = strlen(extra) + 1;
+
+   return 0;
+}
+
+int
+static __iw_softap_ap_clear_stats(struct net_device *dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *wrqu, char *extra)
+{
+    hdd_adapter_t *pAdapter;
+
+    ENTER();
+
+    pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    if (NULL == pAdapter)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Adapter is NULL",__func__);
+        return -EINVAL;
+    }
+
+    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,"%s: clearing", __func__);
+    memset(&pAdapter->stats, 0, sizeof(pAdapter->stats));
+    memset(&pAdapter->hdd_stats, 0, sizeof(pAdapter->hdd_stats));
+    return 0;
+}
+
+
+int
+static iw_softap_get_stats(struct net_device *dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *wrqu, char *extra)
+{
+   int ret;
+   vos_ssr_protect(__func__);
+   ret = __iw_softap_ap_get_stats(dev, info, wrqu, extra);
+   vos_ssr_unprotect(__func__);
+   return ret;
+}
+
+int
+static iw_softap_clear_stats(struct net_device *dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *wrqu, char *extra)
+{
+   int ret;
+   vos_ssr_protect(__func__);
+   ret = __iw_softap_ap_clear_stats(dev, info, wrqu, extra);
+   vos_ssr_unprotect(__func__);
+   return ret;
+}
 
 int
 static iw_softap_ap_stats(struct net_device *dev,
@@ -2982,11 +3134,6 @@
 
     hddLog(LOG1,FL(" number of channels %d"), num_channels);
 
-    if (num_channels > IW_MAX_FREQUENCIES)
-    {
-        num_channels = IW_MAX_FREQUENCIES;
-    }
-
     channel_list->num_channels = num_channels;
     EXIT();
 
@@ -3715,417 +3862,6 @@
     return ret;
 }
 
-static int __iw_softap_setwpsie(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu,
-                              char *extra)
-{
-   hdd_adapter_t *pHostapdAdapter;
-   hdd_context_t *pHddCtx;
-   v_CONTEXT_t pVosContext;
-   hdd_hostapd_state_t *pHostapdState;
-   eHalStatus halStatus= eHAL_STATUS_SUCCESS;
-   u_int8_t *wps_genie;
-   u_int8_t *fwps_genie;
-   u_int8_t *pos;
-   tpSap_WPSIE pSap_WPSIe;
-   u_int8_t WPSIeType;
-   u_int16_t length;
-   struct iw_point s_priv_data;
-   int ret = 0;
-
-   ENTER();
-
-   if (!capable(CAP_NET_ADMIN))
-   {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 FL("permission check failed"));
-       return -EPERM;
-   }
-
-   pHostapdAdapter = (netdev_priv(dev));
-   if (NULL == pHostapdAdapter)
-   {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 "%s: Adapter is NULL",__func__);
-       return -EINVAL;
-   }
-   pHddCtx = WLAN_HDD_GET_CTX(pHostapdAdapter);
-   ret = wlan_hdd_validate_context(pHddCtx);
-   if (0 != ret)
-   {
-       return ret;
-   }
-   pVosContext = pHddCtx->pvosContext;
-   if (NULL == pVosContext)
-   {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 "%s: HDD context is not valid ",__func__);
-       return -EINVAL;
-   }
-   /* helper function to get iwreq_data with compat handling. */
-   if (hdd_priv_get_data(&s_priv_data, wrqu))
-   {
-      return -EINVAL;
-   }
-
-   if ((NULL == s_priv_data.pointer) || (s_priv_data.length < QCSAP_MAX_WSC_IE))
-   {
-      return -EINVAL;
-   }
-
-   wps_genie = mem_alloc_copy_from_user_helper(s_priv_data.pointer,
-                                               s_priv_data.length);
-
-   if(NULL == wps_genie)
-   {
-       hddLog(LOG1, "%s: failed to alloc memory "
-                    "and copy data from user buffer", __func__);
-       return -EFAULT;
-   }
-
-   fwps_genie = wps_genie;
-
-   pSap_WPSIe = vos_mem_malloc(sizeof(tSap_WPSIE));
-   if (NULL == pSap_WPSIe) 
-   {
-      hddLog(LOGE, "VOS unable to allocate memory");
-      kfree(fwps_genie);
-      return -ENOMEM;
-   }
-   vos_mem_zero(pSap_WPSIe, sizeof(tSap_WPSIE));
- 
-   hddLog(LOG1,"%s WPS IE type[0x%X] IE[0x%X], LEN[%d]", __func__, wps_genie[0], wps_genie[1], wps_genie[2]);
-   WPSIeType = wps_genie[0];
-   if ( wps_genie[0] == eQC_WPS_BEACON_IE)
-   {
-      pSap_WPSIe->sapWPSIECode = eSAP_WPS_BEACON_IE; 
-      wps_genie = wps_genie + 1;
-      switch ( wps_genie[0] ) 
-      {
-         case DOT11F_EID_WPA: 
-            if (wps_genie[1] < 2 + 4)
-            {
-               ret = -EINVAL;
-               goto exit;
-            }
-            else if (memcmp(&wps_genie[2], "\x00\x50\xf2\x04", 4) == 0) 
-            {
-             hddLog (LOG1, "%s Set WPS BEACON IE(len %d)",__func__, wps_genie[1]+2);
-             pos = &wps_genie[6];
-             while (((size_t)pos - (size_t)&wps_genie[6])  < (wps_genie[1] - 4) )
-             {
-                switch((u_int16_t)(*pos<<8) | *(pos+1))
-                {
-                   case HDD_WPS_ELEM_VERSION:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.Version = *pos;   
-                      hddLog(LOG1, "WPS version %d", pSap_WPSIe->sapwpsie.sapWPSBeaconIE.Version);
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_VER_PRESENT;   
-                      pos += 1;
-                      break;
-                   
-                   case HDD_WPS_ELEM_WPS_STATE:
-                      pos +=4;
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.wpsState = *pos;
-                      hddLog(LOG1, "WPS State %d", pSap_WPSIe->sapwpsie.sapWPSBeaconIE.wpsState);
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_STATE_PRESENT;
-                      pos += 1;
-                      break;
-                   case HDD_WPS_ELEM_APSETUPLOCK:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.APSetupLocked = *pos;
-                      hddLog(LOG1, "AP setup lock %d", pSap_WPSIe->sapwpsie.sapWPSBeaconIE.APSetupLocked);
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_APSETUPLOCK_PRESENT;
-                      pos += 1;
-                      break;
-                   case HDD_WPS_ELEM_SELECTEDREGISTRA:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.SelectedRegistra = *pos;
-                      hddLog(LOG1, "Selected Registra %d", pSap_WPSIe->sapwpsie.sapWPSBeaconIE.SelectedRegistra);
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_SELECTEDREGISTRA_PRESENT;
-                      pos += 1;
-                      break;
-                   case HDD_WPS_ELEM_DEVICE_PASSWORD_ID:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.DevicePasswordID = (*pos<<8) | *(pos+1);
-                      hddLog(LOG1, "Password ID: %x", pSap_WPSIe->sapwpsie.sapWPSBeaconIE.DevicePasswordID);
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_DEVICEPASSWORDID_PRESENT;
-                      pos += 2; 
-                      break;
-                   case HDD_WPS_ELEM_REGISTRA_CONF_METHODS:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.SelectedRegistraCfgMethod = (*pos<<8) | *(pos+1);
-                      hddLog(LOG1, "Select Registra Config Methods: %x", pSap_WPSIe->sapwpsie.sapWPSBeaconIE.SelectedRegistraCfgMethod);
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_SELECTEDREGISTRACFGMETHOD_PRESENT;
-                      pos += 2; 
-                      break;
-                
-                   case HDD_WPS_ELEM_UUID_E:
-                      pos += 2; 
-                      length = *pos<<8 | *(pos+1);
-                      pos += 2;
-                      if (length > sizeof(pSap_WPSIe->sapwpsie.sapWPSBeaconIE.UUID_E))
-                      {
-                          ret = -EINVAL;
-                          goto exit;
-                      }
-                      vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSBeaconIE.UUID_E, pos, length);
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_UUIDE_PRESENT; 
-                      pos += length;
-                      break;
-                   case HDD_WPS_ELEM_RF_BANDS:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.RFBand = *pos;
-                      hddLog(LOG1, "RF band: %d", pSap_WPSIe->sapwpsie.sapWPSBeaconIE.RFBand);
-                      pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_RF_BANDS_PRESENT;
-                      pos += 1;
-                      break;
-                   
-                   default:
-                      hddLog (LOGW, "UNKNOWN TLV in WPS IE(%x)", (*pos<<8 | *(pos+1)));
-                      ret = -EINVAL;
-                      goto exit;
-                }
-              }  
-            }
-            else { 
-                 hddLog (LOGE, "%s WPS IE Mismatch %X",
-                         __func__, wps_genie[0]);
-            }     
-            break;
-                 
-         default:
-            hddLog (LOGE, "%s Set UNKNOWN IE %X",__func__, wps_genie[0]);
-            ret = -EINVAL;
-            goto exit;
-      }
-    } 
-    else if( wps_genie[0] == eQC_WPS_PROBE_RSP_IE)
-    {
-      pSap_WPSIe->sapWPSIECode = eSAP_WPS_PROBE_RSP_IE; 
-      wps_genie = wps_genie + 1;
-      switch ( wps_genie[0] ) 
-      {
-         case DOT11F_EID_WPA: 
-            if (wps_genie[1] < 2 + 4)
-            {
-                ret = -EINVAL;
-                goto exit;
-            }
-            else if (memcmp(&wps_genie[2], "\x00\x50\xf2\x04", 4) == 0) 
-            {
-             hddLog (LOG1, "%s Set WPS PROBE RSP IE(len %d)",__func__, wps_genie[1]+2);
-             pos = &wps_genie[6];
-             while (((size_t)pos - (size_t)&wps_genie[6])  < (wps_genie[1] - 4) )
-             {
-              switch((u_int16_t)(*pos<<8) | *(pos+1))
-              {
-                   case HDD_WPS_ELEM_VERSION:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Version = *pos;   
-                      hddLog(LOG1, "WPS version %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Version);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_VER_PRESENT;   
-                      pos += 1;
-                      break;
-                   
-                   case HDD_WPS_ELEM_WPS_STATE:
-                      pos +=4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.wpsState = *pos;
-                      hddLog(LOG1, "WPS State %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.wpsState);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_STATE_PRESENT;
-                      pos += 1;
-                      break;
-                   case HDD_WPS_ELEM_APSETUPLOCK:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.APSetupLocked = *pos;
-                      hddLog(LOG1, "AP setup lock %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.APSetupLocked);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_APSETUPLOCK_PRESENT;
-                      pos += 1;
-                      break;
-                   case HDD_WPS_ELEM_SELECTEDREGISTRA:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SelectedRegistra = *pos;
-                      hddLog(LOG1, "Selected Registra %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SelectedRegistra);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_SELECTEDREGISTRA_PRESENT;                      
-                      pos += 1;
-                      break;
-                   case HDD_WPS_ELEM_DEVICE_PASSWORD_ID:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DevicePasswordID = (*pos<<8) | *(pos+1);
-                      hddLog(LOG1, "Password ID: %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DevicePasswordID);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_DEVICEPASSWORDID_PRESENT;
-                      pos += 2; 
-                      break;
-                   case HDD_WPS_ELEM_REGISTRA_CONF_METHODS:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SelectedRegistraCfgMethod = (*pos<<8) | *(pos+1);
-                      hddLog(LOG1, "Select Registra Config Methods: %x", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SelectedRegistraCfgMethod);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_SELECTEDREGISTRACFGMETHOD_PRESENT;
-                      pos += 2; 
-                      break;
-                  case HDD_WPS_ELEM_RSP_TYPE:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ResponseType = *pos;
-                      hddLog(LOG1, "Config Methods: %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ResponseType);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_RESPONSETYPE_PRESENT;
-                      pos += 1;
-                      break;
-                   case HDD_WPS_ELEM_UUID_E:
-                      pos += 2; 
-                      length = *pos<<8 | *(pos+1);
-                      pos += 2;
-                      if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.UUID_E)))
-                      {
-                          ret = -EINVAL;
-                          goto exit;
-                      }
-                      vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.UUID_E, pos, length);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_UUIDE_PRESENT;
-                      pos += length;
-                      break;
-                   
-                   case HDD_WPS_ELEM_MANUFACTURER:
-                      pos += 2;
-                      length = *pos<<8 | *(pos+1);
-                      pos += 2;
-                      if (length >  (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Manufacture.name)))
-                      {
-                          ret = -EINVAL;
-                          goto exit;
-                      }
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Manufacture.num_name = length;
-                      vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Manufacture.name, pos, length);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_MANUFACTURE_PRESENT;
-                      pos += length;
-                      break;
- 
-                   case HDD_WPS_ELEM_MODEL_NAME:
-                      pos += 2;
-                      length = *pos<<8 | *(pos+1);
-                      pos += 2;
-                      if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelName.text)))
-                      {
-                          ret = -EINVAL;
-                          goto exit;
-                      }
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelName.num_text = length;
-                      vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelName.text, pos, length);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_MODELNAME_PRESENT;
-                      pos += length;
-                      break;
-                   case HDD_WPS_ELEM_MODEL_NUM:
-                      pos += 2;
-                      length = *pos<<8 | *(pos+1);
-                      pos += 2;
-                      if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelNumber.text)))
-                      {
-                          ret = -EINVAL;
-                          goto exit;
-                      }
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelNumber.num_text = length;
-                      vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelNumber.text, pos, length);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_MODELNUMBER_PRESENT;
-                      pos += length;
-                      break;
-                   case HDD_WPS_ELEM_SERIAL_NUM:
-                      pos += 2;
-                      length = *pos<<8 | *(pos+1);
-                      pos += 2;
-                      if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SerialNumber.text)))
-                      {
-                          ret = -EINVAL;
-                          goto exit;
-                      }
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SerialNumber.num_text = length;
-                      vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SerialNumber.text, pos, length);
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_SERIALNUMBER_PRESENT;
-                      pos += length;
-                      break;
-                   case HDD_WPS_ELEM_PRIMARY_DEVICE_TYPE:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.PrimaryDeviceCategory = (*pos<<8 | *(pos+1));
-                      hddLog(LOG1, "primary dev category: %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.PrimaryDeviceCategory);
-                      pos += 2;
-                      
-                      vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.PrimaryDeviceOUI, pos, HDD_WPS_DEVICE_OUI_LEN);
-                      hddLog(LOG1, "primary dev oui: %02x, %02x, %02x, %02x", pos[0], pos[1], pos[2], pos[3]);
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceSubCategory = (*pos<<8 | *(pos+1));
-                      hddLog(LOG1, "primary dev sub category: %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceSubCategory);
-                      pos += 2;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_PRIMARYDEVICETYPE_PRESENT;                      
-                      break;
-                   case HDD_WPS_ELEM_DEVICE_NAME:
-                      pos += 2;
-                      length = *pos<<8 | *(pos+1);
-                      pos += 2;
-                      if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceName.text)))
-                      {
-                          ret = -EINVAL;
-                          goto exit;
-                      }
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceName.num_text = length;
-                      vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceName.text, pos, length);
-                      pos += length;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_DEVICENAME_PRESENT;
-                      break;
-                   case HDD_WPS_ELEM_CONFIG_METHODS:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ConfigMethod = (*pos<<8) | *(pos+1);
-                      hddLog(LOG1, "Config Methods: %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SelectedRegistraCfgMethod);
-                      pos += 2; 
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_CONFIGMETHODS_PRESENT;
-                      break;
- 
-                   case HDD_WPS_ELEM_RF_BANDS:
-                      pos += 4;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.RFBand = *pos;
-                      hddLog(LOG1, "RF band: %d", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.RFBand);
-                      pos += 1;
-                      pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_RF_BANDS_PRESENT;
-                      break;
-              }  // switch
-            }
-         } 
-         else
-         {
-            hddLog (LOGE, "%s WPS IE Mismatch %X",__func__, wps_genie[0]);
-         }
-         
-      } // switch
-    }
-    halStatus = WLANSAP_Set_WpsIe(pVosContext, pSap_WPSIe);
-    if (halStatus != eHAL_STATUS_SUCCESS)
-        ret = -EINVAL;
-    pHostapdState = WLAN_HDD_GET_HOSTAP_STATE_PTR(pHostapdAdapter);
-    if( pHostapdState->bCommit && WPSIeType == eQC_WPS_PROBE_RSP_IE)
-    {
-        //hdd_adapter_t *pHostapdAdapter = (netdev_priv(dev));
-        //v_CONTEXT_t pVosContext = pHostapdAdapter->pvosContext;
-        WLANSAP_Update_WpsIe ( pVosContext );
-    }
- 
-exit:
-    vos_mem_free(pSap_WPSIe);   
-    kfree(fwps_genie);
-    EXIT();
-    return ret;
-}
-
-static int iw_softap_setwpsie(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu,
-                              char *extra)
-{
-    int ret;
-
-    vos_ssr_protect(__func__);
-    ret = __iw_softap_setwpsie(dev, info, wrqu, extra);
-    vos_ssr_unprotect(__func__);
-
-    return ret;
-}
 
 static int __iw_softap_stopbss(struct net_device *dev,
                              struct iw_request_info *info,
@@ -4228,7 +3964,7 @@
     return ret;
 }
 
-VOS_STATUS hdd_softap_get_sta_info(hdd_adapter_t *pAdapter, v_U8_t *pBuf, int buf_len)
+int hdd_softap_get_sta_info(hdd_adapter_t *pAdapter, v_U8_t *pBuf, int buf_len)
 {
     v_U8_t i;
     int len = 0;
@@ -4265,7 +4001,11 @@
         return VOS_STATUS_E_FAULT;
     }
 
-    len = scnprintf(pBuf, buf_len, sta_info_header);
+    len = snprintf(pBuf, buf_len, sta_info_header);
+    if (len >= buf_len) {
+        hddLog(LOGE, FL("Insufficient buffer:%d, %d"), buf_len, len);
+        return -E2BIG;
+    }
     pBuf += len;
     buf_len -= len;
 
@@ -4281,6 +4021,10 @@
                                        pSapCtx->aStaInfo[i].macAddrSTA.bytes[3],
                                        pSapCtx->aStaInfo[i].macAddrSTA.bytes[4],
                                        pSapCtx->aStaInfo[i].macAddrSTA.bytes[5]);
+            if (len >= buf_len) {
+                hddLog(LOGE, FL("Insufficient buffer:%d, %d"), buf_len, len);
+                return -E2BIG;
+            }
             pBuf += len;
             buf_len -= len;
         }
@@ -4290,7 +4034,7 @@
         }
     }
     EXIT();
-    return VOS_STATUS_SUCCESS;
+    return 0;
 }
 
 static int __iw_softap_get_sta_info(struct net_device *dev,
@@ -4299,12 +4043,12 @@
                                     char *extra)
 {
     hdd_adapter_t *pHostapdAdapter = (netdev_priv(dev));
-    VOS_STATUS status;
+    int ret;
     ENTER();
-    status = hdd_softap_get_sta_info(pHostapdAdapter, extra, WE_SAP_MAX_STA_INFO);
-    if ( !VOS_IS_STATUS_SUCCESS( status ) ) {
+    ret = hdd_softap_get_sta_info(pHostapdAdapter, extra, WE_SAP_MAX_STA_INFO);
+    if (ret) {
        hddLog(VOS_TRACE_LEVEL_ERROR, "%s Failed!!!",__func__);
-       return -EINVAL;
+       return ret;
     }
     wrqu->data.length = strlen(extra);
     EXIT();
@@ -4507,7 +4251,7 @@
            kfree(pmacAddress);
            return -EFAULT;
        }
-       pmacAddress[MAC_ADDRESS_STR_LEN] = '\0';
+       pmacAddress[MAC_ADDRESS_STR_LEN-1] = '\0';
 
        status = hdd_string_to_hex (pmacAddress, MAC_ADDRESS_STR_LEN, macAddress );
        kfree(pmacAddress);
@@ -4669,6 +4413,8 @@
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,  "hideSSID" },
    { QCSAP_PARAM_SET_MC_RATE,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,  "setMcRate" },
+  { QCSAP_PARAM_SET_PROXIMITY,
+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,  "setProximity" },
   { QCSAP_IOCTL_GETPARAM,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "getparam" },
@@ -4688,8 +4434,6 @@
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setAclMode" },
   { QCSAP_IOCTL_GET_STAWPAIE,
       IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "get_staWPAIE" },
-  { QCSAP_IOCTL_SETWPAIE,
-      IW_PRIV_TYPE_BYTE | QCSAP_MAX_WSC_IE | IW_PRIV_SIZE_FIXED, 0, "setwpaie" },
   { QCSAP_IOCTL_STOPBSS,
       IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED, 0, "stopbss" },
   { QCSAP_IOCTL_VERSION, 0,
@@ -4704,6 +4448,9 @@
         IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 6 , 0, "disassoc_sta" },
   { QCSAP_IOCTL_AP_STATS, 0,
         IW_PRIV_TYPE_CHAR | QCSAP_MAX_WSC_IE, "ap_stats" },
+  { QCSAP_IOCTL_GET_STATS, 0,
+        IW_PRIV_TYPE_CHAR | QCSAP_MAX_STR_LEN, "getStats"},
+  { QCSAP_IOCTL_CLR_STATS, 0, 0, "clearStats" },
   { QCSAP_IOCTL_PRIV_GET_SOFTAP_LINK_SPEED,
         IW_PRIV_TYPE_CHAR | 18,
         IW_PRIV_TYPE_CHAR | 5, "getLinkSpeed" },
@@ -4785,7 +4532,6 @@
    [QCSAP_IOCTL_SETPARAM - SIOCIWFIRSTPRIV] = iw_softap_setparam,  //set priv ioctl
    [QCSAP_IOCTL_GETPARAM - SIOCIWFIRSTPRIV] = iw_softap_getparam,  //get priv ioctl   
    [QCSAP_IOCTL_GET_STAWPAIE - SIOCIWFIRSTPRIV] = iw_get_genie, //get station genIE
-   [QCSAP_IOCTL_SETWPAIE - SIOCIWFIRSTPRIV] = iw_softap_setwpsie,
    [QCSAP_IOCTL_STOPBSS - SIOCIWFIRSTPRIV] = iw_softap_stopbss,       // stop bss
    [QCSAP_IOCTL_VERSION - SIOCIWFIRSTPRIV] = iw_softap_version,       // get driver version
    [QCSAP_IOCTL_GET_WPS_PBC_PROBE_REQ_IES - SIOCIWFIRSTPRIV] = iw_get_WPSPBCProbeReqIEs,
@@ -4804,6 +4550,8 @@
    [QCSAP_IOCTL_SET_MAX_TX_POWER - SIOCIWFIRSTPRIV]   = iw_softap_set_max_tx_power,
    [QCSAP_IOCTL_DATAPATH_SNAP_SHOT - SIOCIWFIRSTPRIV]  =   iw_display_data_path_snapshot,
    [QCSAP_IOCTL_SET_TRAFFIC_MONITOR - SIOCIWFIRSTPRIV]  =  iw_softap_set_trafficmonitor,
+   [QCSAP_IOCTL_GET_STATS - SIOCIWFIRSTPRIV]  =  iw_softap_get_stats,
+   [QCSAP_IOCTL_CLR_STATS - SIOCIWFIRSTPRIV]  =  iw_softap_clear_stats,
 };
 const struct iw_handler_def hostapd_handler_def = {
    .num_standard     = sizeof(hostapd_handler) / sizeof(hostapd_handler[0]),
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_main.c b/wlan/prima/CORE/HDD/src/wlan_hdd_main.c
old mode 100755
new mode 100644
index 5362a5f..802452b
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_main.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -176,6 +176,15 @@
 #define SIZE_OF_SETROAMMODE             11    /* size of SETROAMMODE */
 #define SIZE_OF_GETROAMMODE             11    /* size of GETROAMMODE */
 
+#ifdef WLAN_FEATURE_RMC
+/*
+ * Ibss prop IE from command will be of size:
+ * size  = sizeof(oui) + sizeof(oui_data) + 1(Element ID) + 1(EID Length)
+ * OUI_DATA should be at least 3 bytes long
+ */
+#define WLAN_HDD_IBSS_MIN_OUI_DATA_LENGTH (3)
+#endif
+
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 #define TID_MIN_VALUE 0
 #define TID_MAX_VALUE 15
@@ -191,9 +200,27 @@
 #define WLAN_MAX_BUF_SIZE 1024
 #define WLAN_PRIV_DATA_MAX_LEN    8192
 
+/*
+ * When ever we need to print IBSSPEERINFOALL for morethan 16 STA
+ * we will split the printing.
+ */
+#define NUM_OF_STA_DATA_TO_PRINT 16
+
+#ifdef WLAN_FEATURE_RMC
+#define WLAN_NLINK_CESIUM 30
+#endif
+
 //wait time for beacon miss rate.
 #define BCN_MISS_RATE_TIME 500
 
+/*
+ * Android DRIVER command structures
+ */
+struct android_wifi_reassoc_params {
+	unsigned char bssid[18];
+	int channel;
+};
+
 static vos_wake_lock_t wlan_wake_lock;
 
 /* set when SSR is needed after unload */
@@ -203,6 +230,22 @@
 static VOS_STATUS wlan_hdd_framework_restart(hdd_context_t *pHddCtx);
 static void wlan_hdd_restart_init(hdd_context_t *pHddCtx);
 static void wlan_hdd_restart_deinit(hdd_context_t *pHddCtx);
+
+#ifdef WLAN_FEATURE_RMC
+static void hdd_tx_fail_ind_callback(v_U8_t *MacAddr, v_U8_t seqNo);
+
+static int hdd_open_cesium_nl_sock(void);
+static void hdd_close_cesium_nl_sock(void);
+static struct sock *cesium_nl_srv_sock;
+static v_U16_t cesium_pid;
+
+static int hdd_ParseIBSSTXFailEventParams(tANI_U8 *pValue,
+                                          tANI_U8 *tx_fail_count,
+                                          tANI_U16 *pid);
+
+static int hdd_ParseUserParams(tANI_U8 *pValue, tANI_U8 **ppArg);
+
+#endif /* WLAN_FEATURE_RMC */
 void wlan_hdd_restart_timer_cb(v_PVOID_t usrDataForCallback);
 void hdd_set_wlan_suspend_mode(bool suspend);
 
@@ -228,9 +271,8 @@
 static VOS_STATUS hdd_parse_send_action_frame_data(tANI_U8 *pValue, tANI_U8 *pTargetApBssid,
                               tANI_U8 *pChannel, tANI_U8 *pDwellTime,
                               tANI_U8 **pBuf, tANI_U8 *pBufLen);
-static VOS_STATUS hdd_parse_reassoc_command_data(tANI_U8 *pValue,
-                                                 tANI_U8 *pTargetApBssid,
-                                                 tANI_U8 *pChannel);
+static int hdd_parse_reassoc_command_v1_data(const tANI_U8 *pValue,
+				tANI_U8 *pTargetApBssid, tANI_U8 *pChannel);
 #endif
 
 /* Store WLAN driver info in a global variable such that crash debugger
@@ -393,6 +435,30 @@
 static int curr_con_mode;
 #endif
 
+#ifdef WLAN_FEATURE_OFFLOAD_PACKETS
+/**
+ * hdd_init_offloaded_packets_ctx() - Initialize offload packets context
+ * @hdd_ctx: hdd global context
+ *
+ * Return: none
+ */
+static void hdd_init_offloaded_packets_ctx(hdd_context_t *hdd_ctx)
+{
+    uint8_t i;
+
+    mutex_init(&hdd_ctx->op_ctx.op_lock);
+    for (i = 0; i < MAXNUM_PERIODIC_TX_PTRNS; i++)
+    {
+        hdd_ctx->op_ctx.op_table[i].request_id = 0;
+        hdd_ctx->op_ctx.op_table[i].pattern_id = i;
+    }
+}
+#else
+static void hdd_init_offloaded_packets_ctx(hdd_context_t *hdd_ctx)
+{
+}
+#endif
+
 /**---------------------------------------------------------------------------
 
   \brief hdd_vos_trace_enable() - Configure initial VOS Trace enable
@@ -700,6 +766,486 @@
 
 }
 
+#ifdef WLAN_FEATURE_RMC
+static int hdd_parse_setrmcenable_command(tANI_U8 *pValue, tANI_U8 *pRmcEnable)
+{
+    tANI_U8 *inPtr = pValue;
+    int tempInt;
+    int v = 0;
+    char buf[32];
+    *pRmcEnable = 0;
+
+    inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE);
+    /*no argument after the command*/
+    if (NULL == inPtr)
+    {
+        return 0;
+    }
+
+    /*no space after the command*/
+    else if (SPACE_ASCII_VALUE != *inPtr)
+    {
+        return 0;
+    }
+
+    /*removing empty spaces*/
+    while ((SPACE_ASCII_VALUE  == *inPtr) && ('\0' !=  *inPtr)) inPtr++;
+
+    /*no argument followed by spaces*/
+    if ('\0' == *inPtr)
+    {
+        return 0;
+    }
+
+    /* getting the first argument which enables or disables RMC
+         * for input IP v4 address*/
+    sscanf(inPtr, "%32s ", buf);
+    v = kstrtos32(buf, 10, &tempInt);
+    if ( v < 0)
+    {
+       return -EINVAL;
+    }
+
+    *pRmcEnable = tempInt;
+
+    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+       "ucRmcEnable: %d", *pRmcEnable);
+
+    return 0;
+}
+
+/* Function header left blank Intentionally */
+static int hdd_parse_setrmcactionperiod_command(tANI_U8 *pValue,
+           tANI_U32 *pActionPeriod)
+{
+    tANI_U8 *inPtr = pValue;
+    int tempInt;
+    int v = 0;
+    char buf[32];
+    *pActionPeriod = 0;
+
+    inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE);
+    /*no argument after the command*/
+    if (NULL == inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*no space after the command*/
+    else if (SPACE_ASCII_VALUE != *inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*removing empty spaces*/
+    while ((SPACE_ASCII_VALUE  == *inPtr) && ('\0' !=  *inPtr)) inPtr++;
+
+    /*no argument followed by spaces*/
+    if ('\0' == *inPtr)
+    {
+        return 0;
+    }
+
+    /* getting the first argument which enables or disables RMC
+         * for input IP v4 address*/
+    sscanf(inPtr, "%32s ", buf);
+    v = kstrtos32(buf, 10, &tempInt);
+    if ( v < 0)
+    {
+       return -EINVAL;
+    }
+
+    /* Range checking for passed paramter */
+    if (tempInt < WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMIN ||
+        tempInt > WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMAX)
+    {
+       return -EINVAL;
+    }
+
+    *pActionPeriod = tempInt;
+
+    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+       "uActionPeriod: %d", *pActionPeriod);
+
+    return 0;
+}
+
+/* Function header left blank Intentionally */
+static int hdd_parse_setrmcrate_command(tANI_U8 *pValue,
+           tANI_U32 *pRate, tTxrateinfoflags *pTxFlags)
+{
+    tANI_U8 *inPtr = pValue;
+    int tempInt;
+    int v = 0;
+    char buf[32];
+    *pRate = 0;
+    *pTxFlags = 0;
+
+    inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE);
+    /*no argument after the command*/
+    if (NULL == inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*no space after the command*/
+    else if (SPACE_ASCII_VALUE != *inPtr)
+    {
+        return -EINVAL;
+    }
+
+    /*removing empty spaces*/
+    while ((SPACE_ASCII_VALUE  == *inPtr) && ('\0' !=  *inPtr)) inPtr++;
+
+    /*no argument followed by spaces*/
+    if ('\0' == *inPtr)
+    {
+        return 0;
+    }
+
+    /*
+     * getting the first argument which sets multicast rate.
+     */
+    sscanf(inPtr, "%32s ", buf);
+    v = kstrtos32(buf, 10, &tempInt);
+    if ( v < 0)
+        {
+       return -EINVAL;
+        }
+
+    /*
+     * Validate the multicast rate.
+     */
+    switch (tempInt)
+        {
+        default:
+            VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
+            "Unsupported rate: %d", tempInt);
+            return -EINVAL;
+        case 0:
+        case 6:
+        case 9:
+        case 12:
+        case 18:
+        case 24:
+        case 36:
+        case 48:
+        case 54:
+            *pTxFlags = eHAL_TX_RATE_LEGACY;
+            *pRate = tempInt * 10;
+            break;
+        case 65:
+            *pTxFlags = eHAL_TX_RATE_HT20;
+            *pRate = tempInt * 10;
+            break;
+        case 72:
+            *pTxFlags = eHAL_TX_RATE_HT20 | eHAL_TX_RATE_SGI;
+            *pRate = 722; /* fractional rate 72.2 Mbps */
+            break;
+    }
+
+    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+       "Rate: %d", *pRate);
+
+    return 0;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief hdd_cfg80211_get_ibss_peer_info_cb() - Callback function for IBSS
+  Peer Info request
+
+  This is an asynchronous callback function from SME when the peer info
+  is received
+
+  \pUserData -> Adapter private data
+  \pPeerInfoRsp -> Peer info response
+
+  \return - 0 for success non-zero for failure
+  --------------------------------------------------------------------------*/
+static void
+hdd_cfg80211_get_ibss_peer_info_cb(v_VOID_t *pUserData, v_VOID_t *pPeerInfoRsp)
+{
+   hdd_adapter_t *pAdapter = (hdd_adapter_t *)pUserData;
+   tSirPeerInfoRspParams *pPeerInfo = (tSirPeerInfoRspParams *)pPeerInfoRsp;
+   hdd_station_ctx_t *pStaCtx;
+   v_U8_t   i;
+
+   /*Sanity check*/
+   if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic))
+        {
+      hddLog(LOGE,
+         FL("invalid adapter or adapter has invalid magic"));
+      return;
+   }
+
+   pStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+   if (NULL != pStaCtx && NULL != pPeerInfo &&
+       eHAL_STATUS_SUCCESS == pPeerInfo->status)
+   {
+      pStaCtx->ibss_peer_info.status = pPeerInfo->status;
+      pStaCtx->ibss_peer_info.numIBSSPeers = pPeerInfo->numPeers;
+
+      /* Paranoia check */
+      if (pPeerInfo->numPeers < HDD_MAX_NUM_IBSS_STA)
+      {
+         for (i = 0; i < pPeerInfo->numPeers; i++)
+         {
+            memcpy(&pStaCtx->ibss_peer_info.ibssPeerList[i],
+                   &pPeerInfo->peerInfoParams[i],
+                   sizeof(hdd_ibss_peer_info_params_t));
+         }
+         hddLog(LOG1,
+            FL("Peer Info copied in HDD"));
+      }
+      else
+      {
+         hddLog(LOGE,
+               FL(" Number of peers %d returned is more than limit %d"),
+               pPeerInfo->numPeers, HDD_MAX_NUM_IBSS_STA);
+      }
+   }
+   else
+   {
+      hddLog(LOG1,
+           FL("peerInfo returned is NULL"));
+   }
+
+   complete(&pAdapter->ibss_peer_info_comp);
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief hdd_cfg80211_get_ibss_peer_info_all() -
+
+  Request function to get IBSS peer info from lower layers
+
+  \pAdapter -> Adapter context
+
+  \return - 0 for success non-zero for failure
+  --------------------------------------------------------------------------*/
+static
+VOS_STATUS hdd_cfg80211_get_ibss_peer_info_all(hdd_adapter_t *pAdapter)
+{
+   tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
+   long status;
+   VOS_STATUS retStatus = VOS_STATUS_E_FAILURE;
+
+   INIT_COMPLETION(pAdapter->ibss_peer_info_comp);
+
+   retStatus = sme_RequestIBSSPeerInfo(hHal, pAdapter,
+                                    hdd_cfg80211_get_ibss_peer_info_cb,
+                                    VOS_TRUE, 0xFF);
+
+   if (VOS_STATUS_SUCCESS == retStatus)
+   {
+      status = wait_for_completion_interruptible_timeout
+               (&pAdapter->ibss_peer_info_comp,
+                msecs_to_jiffies(IBSS_PEER_INFO_REQ_TIMOEUT));
+
+      /* status will be 0 if timed out */
+      if (status <= 0)
+      {
+         hddLog(VOS_TRACE_LEVEL_WARN, "%s: Warning: IBSS_PEER_INFO_TIMEOUT %ld",
+                __func__, status);
+         retStatus = VOS_STATUS_E_FAILURE;
+         return retStatus;
+      }
+   }
+   else
+   {
+      hddLog(VOS_TRACE_LEVEL_WARN,
+             "%s: Warning: sme_RequestIBSSPeerInfo Request failed", __func__);
+   }
+
+   return retStatus;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief hdd_cfg80211_get_ibss_peer_info() -
+
+  Request function to get IBSS peer info from lower layers
+
+  \pAdapter -> Adapter context
+  \staIdx -> Sta index for which the peer info is requested
+
+  \return - 0 for success non-zero for failure
+  --------------------------------------------------------------------------*/
+static VOS_STATUS
+hdd_cfg80211_get_ibss_peer_info(hdd_adapter_t *pAdapter, v_U8_t staIdx)
+{
+    long status;
+    tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
+    VOS_STATUS retStatus = VOS_STATUS_E_FAILURE;
+
+    INIT_COMPLETION(pAdapter->ibss_peer_info_comp);
+
+    retStatus = sme_RequestIBSSPeerInfo(hHal, pAdapter,
+                                     hdd_cfg80211_get_ibss_peer_info_cb,
+                                     VOS_FALSE, staIdx);
+
+    if (VOS_STATUS_SUCCESS == retStatus)
+    {
+       status = wait_for_completion_interruptible_timeout
+                (&pAdapter->ibss_peer_info_comp,
+                msecs_to_jiffies(IBSS_PEER_INFO_REQ_TIMOEUT));
+
+       /* status = 0 on timeout */
+       if (status <= 0)
+       {
+          hddLog(VOS_TRACE_LEVEL_WARN, "%s: Warning: IBSS_PEER_INFO_TIMEOUT %ld",
+                  __func__, status);
+          retStatus = VOS_STATUS_E_FAILURE;
+          return retStatus;
+       }
+    }
+    else
+    {
+       hddLog(VOS_TRACE_LEVEL_WARN,
+              "%s: Warning: sme_RequestIBSSPeerInfo Request failed", __func__);
+    }
+
+    return retStatus;
+}
+
+/* Function header left blank Intentionally */
+VOS_STATUS
+hdd_parse_get_ibss_peer_info(tANI_U8 *pValue, v_MACADDR_t *pPeerMacAddr)
+{
+    tANI_U8 *inPtr = pValue;
+    inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE);
+
+    /*no argument after the command*/
+    if (NULL == inPtr)
+    {
+        return VOS_STATUS_E_FAILURE;;
+    }
+
+    /*no space after the command*/
+    else if (SPACE_ASCII_VALUE != *inPtr)
+    {
+        return VOS_STATUS_E_FAILURE;;
+    }
+
+    /*removing empty spaces*/
+    while ((SPACE_ASCII_VALUE  == *inPtr) && ('\0' !=  *inPtr) ) inPtr++;
+
+    /*no argument followed by spaces*/
+    if ('\0' == *inPtr)
+    {
+        return VOS_STATUS_E_FAILURE;;
+    }
+
+    /*getting the first argument ie the peer mac address */
+    if (inPtr[2] != ':' || inPtr[5] != ':' || inPtr[8] != ':' ||
+        inPtr[11] != ':' || inPtr[14] != ':')
+    {
+       return VOS_STATUS_E_FAILURE;;
+    }
+    sscanf(inPtr, "%2x:%2x:%2x:%2x:%2x:%2x",
+                  (unsigned int *)&pPeerMacAddr->bytes[0],
+                  (unsigned int *)&pPeerMacAddr->bytes[1],
+                  (unsigned int *)&pPeerMacAddr->bytes[2],
+                  (unsigned int *)&pPeerMacAddr->bytes[3],
+                  (unsigned int *)&pPeerMacAddr->bytes[4],
+                  (unsigned int *)&pPeerMacAddr->bytes[5]);
+
+    /* The command buffer seems to be fine */
+    return VOS_STATUS_SUCCESS;
+}
+
+/* Function header left blank Intentionally */
+static int hdd_parse_set_ibss_oui_data_command(tANI_U8 *command, tANI_U8 *ie,
+                                               tANI_U32 limit)
+{
+   tANI_U8 len;
+   tANI_U8 data;
+
+   /* skip white space */
+   while ((SPACE_ASCII_VALUE == *command) && ('\0' != *command))
+   {
+      command++;
+      limit--;
+   }
+
+   /* skip element id  and element length */
+   len = 2;
+
+   /* extract oui */
+   while ((SPACE_ASCII_VALUE != *command) && ('\0' != *command) &&
+          (limit > 1))
+   {
+      /* Convert ASCII to decimal */
+      data = ((*command -'0') << 4) | (*(command + 1) - '0');
+      ie[len++] = data;
+      command += 2;
+      limit -= 2;
+   }
+
+   /* skip white space */
+   while ((SPACE_ASCII_VALUE == *command) && ('\0' != *command))
+   {
+      command++;
+      limit--;
+   }
+
+   /* extract data */
+   while ((SPACE_ASCII_VALUE != *command) && ('\0' != *command) &&
+         (limit > 1))
+   {
+      /* Convert ASCII to decimal */
+      data = ((*command -'0') << 4) | (*(command + 1) - '0');
+      ie[len++] = data;
+      command += 2;
+      limit -= 2;
+   }
+
+   /* fill element id and element length */
+   ie[0] = IE_EID_VENDOR;
+   ie[1] = len - 2;
+
+   return len;
+}
+
+static tANI_U32 hdd_find_ibss_wpa_ie_pos(tANI_U8 *addIePtr, tANI_U32 addIeLen)
+{
+   tANI_U32 ieLenPresent = 0;
+   int left = addIeLen;
+   v_U8_t *ptr = addIePtr;
+   v_U8_t elem_id,elem_len;
+
+   while(left >= 2)
+   {
+      elem_id  =  ptr[0];
+      elem_len =  ptr[1];
+      left -= 2;
+      if(elem_len > left)
+      {
+         hddLog(LOGE,
+             FL("****Invalid elem_len=%d left=%d*****"),
+                                           elem_len,left);
+         return 0;
+      }
+      if ((elem_id == IE_EID_VENDOR) &&
+               (left >= WPA_OUI_TYPE_SIZE))
+      {
+         if (!memcmp(&ptr[2], WPA_OUI_TYPE,
+                          WPA_OUI_TYPE_SIZE))
+         {
+             ieLenPresent += elem_len + 2;
+             return ieLenPresent;
+         }
+      }
+      ieLenPresent += (elem_len + 2);
+      left -= elem_len;
+      ptr += (elem_len + 2);
+    }
+    return 0;
+}
+
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
 
 /**---------------------------------------------------------------------------
@@ -864,19 +1410,13 @@
     tANI_U8 *inPtr = pValue;
     tANI_U8 val = 0;
     tANI_U8 lastArg = 0;
-    tANI_U32 nScanFreq;
+    tANI_U32 nScanFreq = HDD_SET_BATCH_SCAN_DEFAULT_FREQ;
     tANI_U32 nMscan;
-    tANI_U32 nBestN;
-    tANI_U8  ucRfBand;
-    tANI_U32 nRtt;
+    tANI_U32 nBestN = HDD_SET_BATCH_SCAN_BEST_NETWORK;
+    tANI_U8  ucRfBand = HDD_SET_BATCH_SCAN_DEFAULT_BAND;
+    tANI_U32 nRtt = 0;
     tANI_U32 temp;
 
-    /*initialize default values*/
-    nScanFreq = HDD_SET_BATCH_SCAN_DEFAULT_FREQ;
-    ucRfBand = HDD_SET_BATCH_SCAN_DEFAULT_BAND;
-    nRtt = 0;
-    nBestN = HDD_SET_BATCH_SCAN_BEST_NETWORK;
-
     /*go to space after WLS_BATCHING_SET command*/
     inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE);
     /*no argument after the command*/
@@ -1606,11 +2146,11 @@
                 rc = wait_for_completion_timeout(
                      &pAdapter->hdd_get_batch_scan_req_var,
                      msecs_to_jiffies(HDD_GET_BATCH_SCAN_RSP_TIME_OUT));
-                if (0 == rc)
+                if (0 >= rc)
                 {
                     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                    "%s: Timeout waiting to fetch batch scan rsp from fw",
-                    __func__);
+                           "%s: wait on hdd_get_batch_scan_req_var failed %ld",
+                             __func__, rc);
                     return -EFAULT;
                 }
             }
@@ -1677,7 +2217,6 @@
    return 0;
 } /*End of hdd_return_batch_scan_rsp_to_user*/
 
-
 /**---------------------------------------------------------------------------
 
   \brief hdd_handle_batch_scan_ioctl () - This function handles WLS_BATCHING
@@ -1940,6 +2479,184 @@
 
 #endif/*End of FEATURE_WLAN_BATCH_SCAN*/
 
+#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
+/**
+ * hdd_assign_handoff_src_reassoc - Set handoff source as REASSOC
+ *                                  to Handoff request
+ * @handoffInfo: Pointer to Handoff request
+ * @src: enum of handoff_src
+ * Return: None
+ */
+#ifndef QCA_WIFI_ISOC
+static inline void hdd_assign_handoff_src_reassoc(tCsrHandoffRequest
+					*handoffInfo, handoff_src src)
+{
+	handoffInfo->src = src;
+}
+#else
+static inline void hdd_assign_handoff_src_reassoc(tCsrHandoffRequest
+					*handoffInfo, handoff_src src)
+{
+}
+#endif
+
+/**
+ * hdd_reassoc() - perform a user space-directed reassoc
+ *
+ * @pAdapter: Adapter upon which the command was received
+ * @bssid: BSSID with which to reassociate
+ * @channel: channel upon which to reassociate
+ * @src:      The source for the trigger of this action
+ *
+ * Return: 0 for success non-zero for failure
+ */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+int hdd_reassoc(hdd_adapter_t *pAdapter, const tANI_U8 *bssid,
+			const tANI_U8 channel, const handoff_src src)
+{
+	hdd_station_ctx_t *pHddStaCtx;
+	tCsrHandoffRequest handoffInfo;
+	hdd_context_t *pHddCtx = NULL;
+	pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+
+	pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+
+	/* if not associated, no need to proceed with reassoc */
+	if (eConnectionState_Associated != pHddStaCtx->conn_info.connState) {
+		hddLog(LOG1, FL("Not associated"));
+		return -EINVAL;
+	}
+
+	/* if the target bssid is same as currently associated AP,
+	   then no need to proceed with reassoc */
+	if (!memcmp(bssid, pHddStaCtx->conn_info.bssId, sizeof(tSirMacAddr))) {
+		hddLog(LOG1, FL("Reassoc BSSID is same as currently associated AP bssid"));
+		return -EINVAL;
+	}
+
+	/* Check channel number is a valid channel number */
+	if (VOS_STATUS_SUCCESS !=
+		wlan_hdd_validate_operation_channel(pAdapter, channel)) {
+		hddLog(LOGE, FL("Invalid Channel %d"), channel);
+		return -EINVAL;
+	}
+
+	/* Proceed with reassoc */
+	handoffInfo.channel = channel;
+	hdd_assign_handoff_src_reassoc(&handoffInfo, src);
+	memcpy(handoffInfo.bssid, bssid, sizeof(tSirMacAddr));
+	sme_HandoffRequest(pHddCtx->hHal, &handoffInfo);
+	return 0;
+}
+#else
+int hdd_reassoc(hdd_adapter_t *pAdapter, const tANI_U8 *bssid,
+			const tANI_U8 channel, const handoff_src src)
+{
+	return -EPERM;
+}
+#endif
+
+/**
+ * hdd_parse_reassoc_v1() - parse version 1 of the REASSOC command
+ *     This function parses the v1 REASSOC command with the format
+ *     REASSOC xx:xx:xx:xx:xx:xx CH where "xx:xx:xx:xx:xx:xx" is the
+ *     Hex-ASCII representation of the BSSID and CH is the ASCII
+ *     representation of the channel. For example
+ *     REASSOC 00:0a:0b:11:22:33 48
+ *
+ * @pAdapter: Adapter upon which the command was received
+ * @command: ASCII text command that was received
+ *
+ * Return: 0 for success non-zero for failure
+ */
+static int
+hdd_parse_reassoc_v1(hdd_adapter_t *pAdapter, const char *command)
+{
+	tANI_U8 channel = 0;
+	tSirMacAddr bssid;
+	int ret;
+
+	ret = hdd_parse_reassoc_command_v1_data(command, bssid, &channel);
+	if (ret)
+		hddLog(LOGE, FL("Failed to parse reassoc command data"));
+	else
+		ret = hdd_reassoc(pAdapter, bssid, channel, REASSOC);
+
+	return ret;
+}
+
+/**
+ * hdd_parse_reassoc_v2() - parse version 2 of the REASSOC command
+ *     This function parses the v2 REASSOC command with the format
+ *     REASSOC <android_wifi_reassoc_params>
+ *
+ * @pAdapter: Adapter upon which the command was received
+ * @command: command that was received, ASCII command followed
+ *                    by binary data
+ *
+ * Return: 0 for success non-zero for failure
+ */
+static int
+hdd_parse_reassoc_v2(hdd_adapter_t *pAdapter, const char *command)
+{
+	struct android_wifi_reassoc_params params;
+	tSirMacAddr bssid;
+	int ret;
+
+	/* The params are located after "REASSOC " */
+	memcpy(&params, command + 8, sizeof(params));
+
+	if (!mac_pton(params.bssid, (u8 *)&bssid)) {
+		hddLog(LOGE, FL("MAC address parsing failed"));
+		ret = -EINVAL;
+	} else {
+		ret = hdd_reassoc(pAdapter, bssid, params.channel, REASSOC);
+	}
+	return ret;
+}
+
+/**
+ * hdd_parse_reassoc() - parse the REASSOC command
+ *    There are two different versions of the REASSOC command.Version 1
+ *    of the command contains a parameter list that is ASCII characters
+ *    whereas version 2 contains a combination of ASCII and binary
+ *    payload.  Determine if a version 1 or a version 2 command is being
+ *    parsed by examining the parameters, and then dispatch the parser
+ *    that is appropriate for the command.
+ *
+ *  @pAdapter: Adapter upon which the command was received
+ *  @command: command that was received
+ *
+ *  Return: 0 for success non-zero for failure
+ */
+static int
+hdd_parse_reassoc(hdd_adapter_t *pAdapter, const char *command)
+{
+	int ret;
+
+	/*
+	 * both versions start with "REASSOC"
+	 * v1 has a bssid and channel # as an ASCII string
+	 *    REASSOC xx:xx:xx:xx:xx:xx CH
+	 * v2 has a C struct
+	 *    REASSOC <binary c struct>
+	 *
+	 * The first field in the v2 struct is also the bssid in ASCII.
+	 * But in the case of a v2 message the BSSID is NUL-terminated.
+	 * Hence we can peek at that offset to see if this is V1 or V2
+	 * REASSOC xx:xx:xx:xx:xx:xx*
+	 *           1111111111222222
+	 * 01234567890123456789012345
+	 */
+	if (command[25])
+		ret = hdd_parse_reassoc_v1(pAdapter, command);
+	else
+		ret = hdd_parse_reassoc_v2(pAdapter, command);
+
+	return ret;
+}
+#endif  /* WLAN_FEATURE_VOWIFI_11R || FEATURE_WLAN_ESE FEATURE_WLAN_LFR */
+
 static void getBcnMissRateCB(VOS_STATUS status, int bcnMissRate, void *data)
 {
     bcnMissRateContext_t *pCBCtx;
@@ -2220,7 +2937,8 @@
         return -EINVAL;
     }
 
-    status = sme_handleSetFccChannel(pHddCtx->hHal, fcc_constraint);
+    status = sme_handleSetFccChannel(pHddCtx->hHal, fcc_constraint,
+                                     pHddCtx->scan_info.mScanPending);
     if (status != eHAL_STATUS_SUCCESS)
         ret = -EPERM;
 
@@ -2275,6 +2993,126 @@
    return ret;
 }
 
+/**
+ * wlan_hdd_fastreassoc_handoff_request() - Post Handoff request to SME
+ * @pHddCtx: Pointer to the HDD context
+ * @channel: channel to reassociate
+ * @targetApBssid: Target AP/BSSID to reassociate
+ *
+ * Return: None
+ */
+#if defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD) && !defined(QCA_WIFI_ISOC)
+static void wlan_hdd_fastreassoc_handoff_request(hdd_context_t *pHddCtx,
+				uint8_t channel, tSirMacAddr targetApBssid)
+{
+	tCsrHandoffRequest handoffInfo;
+	handoffInfo.channel = channel;
+	handoffInfo.src = FASTREASSOC;
+	vos_mem_copy(handoffInfo.bssid, targetApBssid, sizeof(tSirMacAddr));
+	sme_HandoffRequest(pHddCtx->hHal, &handoffInfo);
+}
+#else
+static void wlan_hdd_fastreassoc_handoff_request(hdd_context_t *pHddCtx,
+				uint8_t channel, tSirMacAddr targetApBssid)
+{
+}
+#endif
+
+/**
+ * csr_fastroam_neighbor_ap_event() - Function to trigger scan/roam
+ * @pAdapter: Pointer to HDD adapter
+ * @channel: Channel to scan/roam
+ * @targetApBssid: BSSID to roam
+ *
+ * Return: None
+ */
+#ifdef QCA_WIFI_ISOC
+static void csr_fastroam_neighbor_ap_event(hdd_adapter_t *pAdapter,
+				uint8_t channel, tSirMacAddr targetApBssid)
+{
+	smeIssueFastRoamNeighborAPEvent(WLAN_HDD_GET_HAL_CTX(pAdapter),
+			&targetApBssid[0], eSME_ROAM_TRIGGER_SCAN, channel);
+}
+#else
+static void csr_fastroam_neighbor_ap_event(hdd_adapter_t *pAdapter,
+				uint8_t channel, tSirMacAddr targetApBssid)
+{
+}
+#endif
+
+/**
+ * wlan_hdd_handle_fastreassoc() - Handle fastreassoc command
+ * @pAdapter: pointer to hdd adapter
+ * @command: pointer to the command received
+ *
+ * Return: VOS_STATUS enum
+ */
+static VOS_STATUS wlan_hdd_handle_fastreassoc(hdd_adapter_t *pAdapter,
+						uint8_t *command)
+{
+	tANI_U8 *value = command;
+	tANI_U8 channel = 0;
+	tSirMacAddr targetApBssid;
+	hdd_station_ctx_t *pHddStaCtx = NULL;
+	hdd_context_t *pHddCtx = NULL;
+	int ret;
+	pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+	pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+
+	/* if not associated, no need to proceed with reassoc */
+	if (eConnectionState_Associated != pHddStaCtx->conn_info.connState) {
+		hddLog(LOG1, FL("Not associated!"));
+		return eHAL_STATUS_FAILURE;
+	}
+
+	ret = hdd_parse_reassoc_command_v1_data(value, targetApBssid, &channel);
+	if (ret) {
+		hddLog(LOGE, FL("Failed to parse reassoc command data"));
+		return eHAL_STATUS_FAILURE;
+	}
+
+	/* if the target bssid is same as currently associated AP,
+	   then no need to proceed with reassoc */
+	if (vos_mem_compare(targetApBssid,
+				pHddStaCtx->conn_info.bssId,
+				sizeof(tSirMacAddr))) {
+		hddLog(LOG1, FL("Reassoc BSSID is same as currently associated AP bssid"));
+		return eHAL_STATUS_FAILURE;
+	}
+
+	/* Check channel number is a valid channel number */
+	if (VOS_STATUS_SUCCESS !=
+		wlan_hdd_validate_operation_channel(pAdapter, channel)) {
+		hddLog(LOGE, FL("Invalid Channel [%d]"), channel);
+		return eHAL_STATUS_FAILURE;
+	}
+
+	/* Proceed with reassoc */
+	wlan_hdd_fastreassoc_handoff_request(pHddCtx, channel, targetApBssid);
+
+	/* Proceed with scan/roam */
+	csr_fastroam_neighbor_ap_event(pAdapter, channel, targetApBssid);
+
+	return eHAL_STATUS_SUCCESS;
+}
+
+/**
+ * hdd_assign_reassoc_handoff - Set handoff source as REASSOC
+ * @handoffInfo: Pointer to the csr Handoff Request.
+ *
+ * Return: None
+ */
+#ifndef QCA_WIFI_ISOC
+static inline void hdd_assign_reassoc_handoff(tCsrHandoffRequest *handoffInfo)
+{
+	handoffInfo->src = REASSOC;
+}
+#else
+static inline void hdd_assign_reassoc_handoff(tCsrHandoffRequest *handoffInfo)
+{
+}
+#endif
+
 static int hdd_driver_command(hdd_adapter_t *pAdapter,
                               hdd_priv_data_t *ppriv_data)
 {
@@ -2872,7 +3710,7 @@
            [Number of roam scan channels][Channel1][Channel2]... */
            /* copy the number of channels in the 0th index */
            len = scnprintf(extra, sizeof(extra), "%s %d", command, numChannels);
-           for (j = 0; (j < numChannels); j++)
+           for (j = 0; (j < numChannels) && len <= sizeof(extra); j++)
            {
                len += scnprintf(extra + len, sizeof(extra) - len, " %d",
                        ChannelList[j]);
@@ -3448,58 +4286,9 @@
        }
        else if (strncmp(command, "REASSOC", 7) == 0)
        {
-           tANI_U8 *value = command;
-           tANI_U8 channel = 0;
-           tSirMacAddr targetApBssid;
-           eHalStatus status = eHAL_STATUS_SUCCESS;
-#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-           tCsrHandoffRequest handoffInfo;
-#endif
-           hdd_station_ctx_t *pHddStaCtx = NULL;
-           pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-
-           /* if not associated, no need to proceed with reassoc */
-           if (eConnectionState_Associated != pHddStaCtx->conn_info.connState)
-           {
-               VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "%s:Not associated!",__func__);
-               ret = -EINVAL;
+           ret = hdd_parse_reassoc(pAdapter, command);
+           if (!ret)
                goto exit;
-           }
-
-           status = hdd_parse_reassoc_command_data(value, targetApBssid, &channel);
-           if (eHAL_STATUS_SUCCESS != status)
-           {
-               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  "%s: Failed to parse reassoc command data", __func__);
-               ret = -EINVAL;
-               goto exit;
-           }
-
-           /* if the target bssid is same as currently associated AP,
-              then no need to proceed with reassoc */
-           if (VOS_TRUE == vos_mem_compare(targetApBssid,
-                                           pHddStaCtx->conn_info.bssId, sizeof(tSirMacAddr)))
-           {
-               VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "%s:Reassoc BSSID is same as currently associated AP bssid",__func__);
-               ret = -EINVAL;
-               goto exit;
-           }
-
-           /* Check channel number is a valid channel number */
-           if(VOS_STATUS_SUCCESS !=
-                         wlan_hdd_validate_operation_channel(pAdapter, channel))
-           {
-               hddLog(VOS_TRACE_LEVEL_ERROR,
-                      "%s: Invalid Channel [%d]", __func__, channel);
-               return -EINVAL;
-           }
-
-           /* Proceed with reassoc */
-#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-           handoffInfo.channel = channel;
-           vos_mem_copy(handoffInfo.bssid, targetApBssid, sizeof(tSirMacAddr));
-           sme_HandoffRequest(pHddCtx->hHal, &handoffInfo);
-#endif
        }
        else if (strncmp(command, "SETWESMODE", 10) == 0)
        {
@@ -3693,66 +4482,9 @@
        }
        else if (strncmp(command, "FASTREASSOC", 11) == 0)
        {
-           tANI_U8 *value = command;
-           tANI_U8 channel = 0;
-           tSirMacAddr targetApBssid;
-           tANI_U8 trigger = 0;
-           eHalStatus status = eHAL_STATUS_SUCCESS;
-           tHalHandle hHal;
-           v_U32_t roamId = 0;
-           tCsrRoamModifyProfileFields modProfileFields;
-           hdd_station_ctx_t *pHddStaCtx = NULL;
-           pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-           hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
-
-           /* if not associated, no need to proceed with reassoc */
-           if (eConnectionState_Associated != pHddStaCtx->conn_info.connState)
-           {
-               VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "%s:Not associated!",__func__);
-               ret = -EINVAL;
+           ret = wlan_hdd_handle_fastreassoc(pAdapter, command);
+           if (!ret)
                goto exit;
-           }
-
-           status = hdd_parse_reassoc_command_data(value, targetApBssid, &channel);
-           if (eHAL_STATUS_SUCCESS != status)
-           {
-               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  "%s: Failed to parse reassoc command data", __func__);
-               ret = -EINVAL;
-               goto exit;
-           }
-
-           /* if the target bssid is same as currently associated AP,
-              issue reassoc to same AP */
-           if (VOS_TRUE == vos_mem_compare(targetApBssid,
-                                           pHddStaCtx->conn_info.bssId, sizeof(tSirMacAddr)))
-           {
-               VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                         "%s:11r Reassoc BSSID is same as currently associated AP bssid",
-                         __func__);
-               sme_GetModifyProfileFields(hHal, pAdapter->sessionId,
-                                       &modProfileFields);
-               sme_RoamReassoc(hHal, pAdapter->sessionId,
-                            NULL, modProfileFields, &roamId, 1);
-               return 0;
-           }
-
-           /* Check channel number is a valid channel number */
-           if(VOS_STATUS_SUCCESS !=
-                         wlan_hdd_validate_operation_channel(pAdapter, channel))
-           {
-               hddLog(VOS_TRACE_LEVEL_ERROR,
-                      "%s: Invalid Channel  [%d]", __func__, channel);
-               return -EINVAL;
-           }
-
-           trigger = eSME_ROAM_TRIGGER_SCAN;
-
-           /* Proceed with scan/roam */
-           smeIssueFastRoamNeighborAPEvent(WLAN_HDD_GET_HAL_CTX(pAdapter),
-                                           &targetApBssid[0],
-                                           (tSmeFastRoamTrigger)(trigger),
-                                           channel);
        }
 #endif
 #ifdef FEATURE_WLAN_ESE
@@ -3977,14 +4709,14 @@
        }
        else if (strncmp(command, "SCAN-ACTIVE", 11) == 0)
        {
-           VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                              FL("making default scan to ACTIVE"));
+           hddLog(LOG1,
+                FL("making default scan to ACTIVE"));
            pHddCtx->scan_info.scan_mode = eSIR_ACTIVE_SCAN;
        }
        else if (strncmp(command, "SCAN-PASSIVE", 12) == 0)
        {
-           VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                              FL("making default scan to PASSIVE"));
+           hddLog(LOG1,
+                FL("making default scan to PASSIVE"));
            pHddCtx->scan_info.scan_mode = eSIR_PASSIVE_SCAN;
        }
        else if (strncmp(command, "GETDWELLTIME", 12) == 0)
@@ -3996,8 +4728,7 @@
            memset(extra, 0, sizeof(extra));
            ret = hdd_get_dwell_time(pCfg, command, extra, sizeof(extra), &len);
            len = VOS_MIN(priv_data.total_len, len + 1);
-           if (ret != 0 || copy_to_user(priv_data.buf, &extra, len + 1))
-           {
+           if (ret != 0 || copy_to_user(priv_data.buf, &extra, len)) {
                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "%s: failed to copy data to user buffer", __func__);
                ret = -EFAULT;
@@ -4107,6 +4838,703 @@
            ret = hdd_handle_batch_scan_ioctl(pAdapter, &priv_data, command);
        }
 #endif
+#ifdef WLAN_FEATURE_RMC
+       else if ((strncasecmp(command, "SETIBSSBEACONOUIDATA", 20) == 0) &&
+                (WLAN_HDD_IBSS == pAdapter->device_mode))
+       {
+           int i = 0;
+           tANI_U8 *ibss_ie;
+           tANI_U32 command_len;
+           tANI_U8 *value = command;
+           tHalHandle hHal = pHddCtx->hHal;
+           tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+           tANI_U32 ibss_ie_length;
+           tANI_U32 len, present;
+           tANI_U8 *addIE;
+           tANI_U8 *addIEData;
+
+           hddLog(LOG1,
+                     FL(" received command %s"),((char *) value));
+           /* validate argument of command */
+           if (strlen(value) <= 21)
+           {
+               hddLog(LOGE,
+                   FL("No arguements in command length %zu"), strlen(value));
+              ret = -EFAULT;
+              goto exit;
+           }
+
+           /* moving to arguments of commands */
+           value = value + 21;
+           command_len = strlen(value);
+
+           /* oui_data can't be less than 3 bytes */
+           if (command_len <= (2 * WLAN_HDD_IBSS_MIN_OUI_DATA_LENGTH))
+           {
+               hddLog(LOGE,
+                     FL("Invalid SETIBSSBEACONOUIDATA command length %d"),
+                     command_len);
+              ret = -EFAULT;
+              goto exit;
+           }
+           ibss_ie = vos_mem_malloc(command_len);
+           if (!ibss_ie) {
+               hddLog(LOGE,
+                     FL("Could not allocate memory for command length %d"),
+                     command_len);
+              ret = -ENOMEM;
+              goto exit;
+           }
+           vos_mem_zero(ibss_ie, command_len);
+
+           ibss_ie_length = hdd_parse_set_ibss_oui_data_command(value, ibss_ie,
+                                                                  command_len);
+           if (ibss_ie_length < (2 * WLAN_HDD_IBSS_MIN_OUI_DATA_LENGTH)) {
+               hddLog(LOGE, FL("Could not parse command %s return length %d"),
+                     value, ibss_ie_length);
+                 ret = -EFAULT;
+              vos_mem_free(ibss_ie);
+                 goto exit;
+              }
+
+           hddLog(LOG1, FL("ibss_ie length %d ibss_ie:"), ibss_ie_length);
+           while (i < ibss_ie_length)
+              hddLog(LOG1, FL("0x%x"), ibss_ie[i++]);
+
+           /* Populate Vendor IE in Beacon */
+           if ((ccmCfgGetInt(hHal,
+                             WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG,
+                             &present)) != eHAL_STATUS_SUCCESS)
+           {
+              hddLog(LOGE,
+                FL("unable to ftch WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG"));
+              ret = -EFAULT;
+              vos_mem_free(ibss_ie);
+              goto exit;
+           }
+
+           addIE = vos_mem_malloc(WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA_LEN);
+           if (!addIE) {
+              hddLog(LOGE,
+                     FL("Could not allocate memory for command length %d"),
+                     command_len);
+              vos_mem_free(ibss_ie);
+              ret = -ENOMEM;
+              goto exit;
+           }
+           vos_mem_zero(addIE, WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA_LEN);
+
+           if (present)
+           {
+              if ((wlan_cfgGetStrLen(pMac,
+                      WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA, &len)) != eSIR_SUCCESS)
+              {
+                 hddLog(LOGE,
+                   FL("unable to fetch WNI_CFG_PROBE_RSP_BCN_ADDNIE_LEN"));
+                 ret = -EFAULT;
+                 vos_mem_free(ibss_ie);
+                 vos_mem_free(addIE);
+                 goto exit;
+              }
+
+              if (len <= WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA_LEN && len &&
+                ((len + ibss_ie_length) <=
+                                    WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA_LEN))
+              {
+                 if ((ccmCfgGetStr(hHal,
+                        WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA, addIE, &len))
+                        != eHAL_STATUS_SUCCESS)
+                 {
+                    hddLog(LOGE,
+                      FL("unable to fetch WNI_PROBE_RSP_BCN_ADDNIE_DATA"));
+                    ret = -EFAULT;
+                    vos_mem_free(ibss_ie);
+                    vos_mem_free(addIE);
+                    goto exit;
+                 }
+                 else
+                 {
+                    /* Curruntly only WPA IE is added before Vendor IE
+                     * so we can blindly place the Vendor IE after WPA
+                     * IE. If no WPA IE found replace all with Vendor IE.
+                     */
+                    len = hdd_find_ibss_wpa_ie_pos(addIE, len);
+                 }
+              }
+              else
+              {
+                 hddLog(LOGE,
+                    FL("IE len exceed limit len %d,ibss_ie_length %d "),
+                    len, ibss_ie_length);
+                 ret = -EFAULT;
+                 vos_mem_free(addIE);
+                 vos_mem_free(ibss_ie);
+                 goto exit;
+              }
+           }
+           else {
+              len = 0;
+           }
+
+           vos_mem_copy (addIE + len , ibss_ie, ibss_ie_length);
+           len += ibss_ie_length;
+
+           if (ccmCfgSetStr(hHal,
+               WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA, addIE, len, NULL,
+               eANI_BOOLEAN_FALSE) != eHAL_STATUS_SUCCESS)
+           {
+              hddLog(LOGE,
+                  FL("unable to set WNI_CFG_PRBE_RSP_BCN_ADDNIE_DATA"));
+              ret = -EFAULT;
+              vos_mem_free(ibss_ie);
+              vos_mem_free(addIE);
+              goto exit;
+           }
+           vos_mem_free(addIE);
+           if (ccmCfgSetInt(hHal,
+               WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG, 1,NULL,
+               eANI_BOOLEAN_FALSE) != eHAL_STATUS_SUCCESS)
+           {
+              hddLog(LOGE,
+                 FL("unble to set WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG"));
+              ret = -EFAULT;
+              vos_mem_free(ibss_ie);
+              goto exit;
+           }
+
+           /* Populate Vendor IE in probe resp */
+           if ((ccmCfgGetInt(hHal,
+                             WNI_CFG_PROBE_RSP_ADDNIE_FLAG,
+                             &present)) != eHAL_STATUS_SUCCESS)
+           {
+               hddLog(LOGE,
+                   FL("unable to fetch WNI_CFG_PROBE_RSP_ADDNIE_FLAG"));
+               ret = -EFAULT;
+               vos_mem_free(ibss_ie);
+               goto exit;
+           }
+
+           addIEData = vos_mem_malloc(WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN);
+           if (!addIEData) {
+              hddLog(LOGE,
+                     FL("Could not allocate memory for command length %d"),
+                     command_len);
+              vos_mem_free(ibss_ie);
+              ret = -ENOMEM;
+              goto exit;
+           }
+           vos_mem_zero(addIEData, WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN);
+
+           if (present) {
+              if (eSIR_SUCCESS != wlan_cfgGetStrLen(pMac,
+                                      WNI_CFG_PROBE_RSP_ADDNIE_DATA1, &len)) {
+                 hddLog(LOGE,
+                     FL("unable to fetch WNI_CFG_PROBE_RSP_ADDNIE_DATA1"));
+                 ret = -EFAULT;
+                 vos_mem_free(ibss_ie);
+                 vos_mem_free(addIEData);
+                 goto exit;
+              }
+              if (len < WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN && len &&
+                 (ibss_ie_length + len) <=
+                                   WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN) {
+
+                 if ((ccmCfgGetStr(hHal,
+                         WNI_CFG_PROBE_RSP_ADDNIE_DATA1, addIEData, &len))
+                         != eHAL_STATUS_SUCCESS) {
+                    hddLog(LOGE,
+                     FL("unable fetch WNI_CFG_PROBE_RSP_ADDNIE_DATA1"));
+                    ret = -EFAULT;
+                    vos_mem_free(ibss_ie);
+                    vos_mem_free(addIEData);
+                    goto exit;
+                 }
+                 else {
+                    /* Curruntly only WPA IE is added before Vendor IE
+                     * so we can blindly place the Vendor IE after WPA
+                     * IE. If no WPA IE found replace all with Vendor IE.
+                     */
+                    len = hdd_find_ibss_wpa_ie_pos(addIEData, len);
+                 }
+              }
+              else
+              {
+                 hddLog(LOGE,
+                    FL("IE len exceed limit len %d,ibss_ie_length %d "),
+                    len, ibss_ie_length);
+                 ret = -EFAULT;
+                 vos_mem_free(addIEData);
+                 vos_mem_free(ibss_ie);
+                 goto exit;
+              }
+           } /* probe rsp ADD IE present */
+           else {
+              /* probe rsp add IE is not present */
+              len = 0;
+           }
+
+           vos_mem_copy(addIEData +len , ibss_ie, ibss_ie_length);
+           len += ibss_ie_length;
+
+           vos_mem_free(ibss_ie);
+
+           if (ccmCfgSetStr(hHal,
+                               WNI_CFG_PROBE_RSP_ADDNIE_DATA1,
+                               (tANI_U8*)(addIEData),
+                               len, NULL,
+                               eANI_BOOLEAN_FALSE)
+                               == eHAL_STATUS_FAILURE) {
+              hddLog(LOGE,
+                  FL("unable to copy to WNI_CFG_PROBE_RSP_ADDNIE_DATA1"));
+              ret = -EFAULT;
+              vos_mem_free(addIEData);
+              goto exit;
+           }
+           vos_mem_free(addIEData);
+           if (ccmCfgSetInt(WLAN_HDD_GET_HAL_CTX(pAdapter),
+                            WNI_CFG_PROBE_RSP_ADDNIE_FLAG, 1,NULL,
+                           eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE)
+           {
+              hddLog(LOGE,
+                  FL("unable to copy WNI_CFG_PROBE_RSP_ADDNIE_FLAG"));
+              ret = -EFAULT;
+              goto exit;
+           }
+        }
+       else if (strncasecmp(command, "SETRMCENABLE", 12) == 0)
+       {
+          tANI_U8 *value = command;
+          tANI_U8 ucRmcEnable = 0;
+          int  status;
+
+          if ((WLAN_HDD_IBSS != pAdapter->device_mode) &&
+              (WLAN_HDD_SOFTAP != pAdapter->device_mode))
+          {
+             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "Received SETRMCENABLE command in invalid mode %d "
+                "SETRMCENABLE command is only allowed in IBSS or SOFTAP mode",
+                pAdapter->device_mode);
+             ret = -EINVAL;
+             goto exit;
+          }
+
+          status = hdd_parse_setrmcenable_command(value, &ucRmcEnable);
+          if (status)
+          {
+             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "Invalid SETRMCENABLE command ");
+             ret = -EINVAL;
+             goto exit;
+          }
+
+          VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+               "%s: ucRmcEnable %d ", __func__, ucRmcEnable);
+
+          if (TRUE == ucRmcEnable)
+          {
+              status = sme_EnableRMC( (tHalHandle)(pHddCtx->hHal),
+                         pAdapter->sessionId );
+          }
+          else if(FALSE == ucRmcEnable)
+          {
+              status = sme_DisableRMC( (tHalHandle)(pHddCtx->hHal),
+                         pAdapter->sessionId );
+          }
+          else
+          {
+             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "Invalid SETRMCENABLE command %d", ucRmcEnable);
+             ret = -EINVAL;
+             goto exit;
+          }
+
+          if (VOS_STATUS_SUCCESS != status)
+          {
+              VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "%s: SETRMC %d failed status %d", __func__, ucRmcEnable,
+                 status);
+              ret = -EINVAL;
+              goto exit;
+          }
+       }
+       else if (strncasecmp(command, "SETRMCACTIONPERIOD", 18) == 0)
+       {
+          tANI_U8 *value = command;
+          tANI_U32 uActionPeriod = 0;
+          int  status;
+
+          if ((WLAN_HDD_IBSS != pAdapter->device_mode) &&
+              (WLAN_HDD_SOFTAP != pAdapter->device_mode))
+          {
+             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "Received SETRMC command in invalid mode %d "
+                "SETRMC command is only allowed in IBSS or SOFTAP mode",
+                pAdapter->device_mode);
+             ret = -EINVAL;
+             goto exit;
+          }
+
+          status = hdd_parse_setrmcactionperiod_command(value, &uActionPeriod);
+          if (status)
+          {
+             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "Invalid SETRMCACTIONPERIOD command ");
+             ret = -EINVAL;
+             goto exit;
+          }
+
+          VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+               "%s: uActionPeriod %d ", __func__, uActionPeriod);
+
+          if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY,
+                 uActionPeriod, NULL, eANI_BOOLEAN_FALSE))
+          {
+              VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "%s: Could not set SETRMCACTIONPERIOD %d", __func__, uActionPeriod);
+              ret = -EINVAL;
+              goto exit;
+          }
+
+      }
+      else if (strncasecmp(command, "GETIBSSPEERINFOALL", 18) == 0)
+      {
+         /* Peer Info All Command */
+         int status = eHAL_STATUS_SUCCESS;
+         hdd_station_ctx_t *pHddStaCtx = NULL;
+         char *extra = NULL;
+         int idx = 0, length = 0;
+         v_MACADDR_t *macAddr;
+         v_U32_t txRateMbps = 0, numOfBytestoPrint = 0;
+
+         if (WLAN_HDD_IBSS == pAdapter->device_mode)
+         {
+            pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+         }
+         else
+         {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                      "%s: pAdapter is not valid for this device mode",
+                      __func__);
+            ret = -EINVAL;
+            goto exit;
+         }
+
+         VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                 "%s: Received GETIBSSPEERINFOALL Command", __func__);
+
+
+         /* Handle the command */
+         status = hdd_cfg80211_get_ibss_peer_info_all(pAdapter);
+         if (VOS_STATUS_SUCCESS == status)
+         {
+            /* The variable extra needed to be allocated on the heap since
+             * amount of memory required to copy the data for 32 devices
+             * exceeds the size of 1024 bytes of default stack size. On
+             * 64 bit devices, the default max stack size of 2048 bytes
+             */
+            extra = kmalloc(WLAN_MAX_BUF_SIZE, GFP_KERNEL);
+
+            if (NULL == extra)
+            {
+               VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                         "%s:kmalloc failed", __func__);
+               ret = -EINVAL;
+               goto exit;
+            }
+
+            /* Copy number of stations */
+            length = scnprintf( extra, WLAN_MAX_BUF_SIZE, "%d ",
+                             pHddStaCtx->ibss_peer_info.numIBSSPeers);
+            numOfBytestoPrint = length;
+            for (idx = 0; idx < pHddStaCtx->ibss_peer_info.numIBSSPeers; idx++)
+            {
+               macAddr =
+                       hdd_wlan_get_ibss_mac_addr_from_staid(pAdapter,
+                                         pHddStaCtx->ibss_peer_info.ibssPeerList[idx].staIdx);
+               if (NULL != macAddr)
+               {
+                  txRateMbps =
+                     ((pHddStaCtx->ibss_peer_info.ibssPeerList[idx].txRate)*500*1000)/1000000;
+
+                  length += scnprintf( (extra + length), WLAN_MAX_BUF_SIZE - length,
+                                  "%02x:%02x:%02x:%02x:%02x:%02x %d %d ",
+                                  macAddr->bytes[0], macAddr->bytes[1], macAddr->bytes[2],
+                                  macAddr->bytes[3], macAddr->bytes[4], macAddr->bytes[5],
+                                  (int)txRateMbps,
+                                  (int)pHddStaCtx->ibss_peer_info.ibssPeerList[idx].rssi);
+               }
+               else
+               {
+                  VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                             "%s: MAC ADDR is NULL for staIdx: %d", __func__,
+                             pHddStaCtx->ibss_peer_info.ibssPeerList[idx].staIdx);
+               }
+
+               /*
+                * VOS_TRACE() macro has limitation of 512 bytes for the print
+                * buffer. Hence printing the data in two chunks. The first chunk
+                * will have the data for 16 devices and the second chunk will
+                * have the rest.
+                */
+               if (idx < NUM_OF_STA_DATA_TO_PRINT)
+               {
+                   numOfBytestoPrint = length;
+               }
+            }
+
+            /*
+             * Copy the data back into buffer, if the data to copy is
+             * morethan 512 bytes than we will split the data and do
+             * it in two shots
+             */
+            if (copy_to_user(priv_data.buf, extra, numOfBytestoPrint))
+            {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                          "%s: Copy into user data buffer failed ", __func__);
+               ret = -EFAULT;
+               kfree(extra);
+               goto exit;
+            }
+            priv_data.buf[numOfBytestoPrint] = '\0';
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_MED,
+                      "%s", priv_data.buf);
+
+            if (length > numOfBytestoPrint)
+            {
+                if (copy_to_user(priv_data.buf + numOfBytestoPrint,
+                                 extra + numOfBytestoPrint,
+                                 length - numOfBytestoPrint + 1))
+                {
+                    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                              "%s: Copy into user data buffer failed ", __func__);
+                    ret = -EFAULT;
+                    kfree(extra);
+                    goto exit;
+                }
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_MED,
+                          "%s", &priv_data.buf[numOfBytestoPrint]);
+            }
+
+            /* Free temporary buffer */
+            kfree(extra);
+         }
+
+         else
+         {
+            /* Command failed, log error */
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "%s: GETIBSSPEERINFOALL command failed with status code %d",
+                      __func__, status);
+            ret = -EINVAL;
+            goto exit;
+         }
+         ret = 0;
+      }
+      else if(strncasecmp(command, "GETIBSSPEERINFO", 15) == 0)
+      {
+         /* Peer Info <Peer Addr> command */
+         tANI_U8 *value = command;
+         VOS_STATUS status;
+         hdd_station_ctx_t *pHddStaCtx = NULL;
+         char extra[128] = { 0 };
+         v_U32_t length = 0;
+         v_U8_t staIdx = 0;
+         v_U32_t txRateMbps = 0;
+         v_MACADDR_t peerMacAddr;
+
+         if (WLAN_HDD_IBSS == pAdapter->device_mode)
+         {
+            pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+         }
+         else
+         {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                      "%s: pAdapter is not valid for this device mode",
+                      __func__);
+            ret = -EINVAL;
+            goto exit;
+         }
+
+         /* if there are no peers, no need to continue with the command */
+         VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                 "%s: Received GETIBSSPEERINFO Command", __func__);
+
+         if (eConnectionState_IbssConnected != pHddStaCtx->conn_info.connState)
+         {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                      "%s:No IBSS Peers coalesced", __func__);
+            ret = -EINVAL;
+            goto exit;
+         }
+
+         /* Parse the incoming command buffer */
+         status = hdd_parse_get_ibss_peer_info(value, &peerMacAddr);
+         if (VOS_STATUS_SUCCESS != status)
+         {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "%s: Invalid GETIBSSPEERINFO command", __func__);
+            ret = -EINVAL;
+            goto exit;
+         }
+
+         /* Get station index for the peer mac address */
+         hdd_Ibss_GetStaId(pHddStaCtx, &peerMacAddr, &staIdx);
+
+         if (staIdx > HDD_MAX_NUM_IBSS_STA)
+         {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "%s: Invalid StaIdx %d returned", __func__, staIdx);
+            ret = -EINVAL;
+            goto exit;
+         }
+
+         /* Handle the command */
+         status = hdd_cfg80211_get_ibss_peer_info(pAdapter, staIdx);
+         if (VOS_STATUS_SUCCESS == status)
+         {
+            v_U32_t txRate = pHddStaCtx->ibss_peer_info.ibssPeerList[0].txRate;
+            txRateMbps = (txRate * 500 * 1000)/1000000;
+
+            length = scnprintf( extra, sizeof(extra), "%d %d", (int)txRateMbps,
+                            (int)pHddStaCtx->ibss_peer_info.ibssPeerList[0].rssi);
+
+            /* Copy the data back into buffer */
+            if (copy_to_user(priv_data.buf, &extra, length+ 1))
+            {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: copy data to user buffer failed GETIBSSPEERINFO command",
+                  __func__);
+               ret = -EFAULT;
+               goto exit;
+            }
+         }
+         else
+         {
+            /* Command failed, log error */
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "%s: GETIBSSPEERINFO command failed with status code %d",
+                      __func__, status);
+            ret = -EINVAL;
+            goto exit;
+         }
+
+         /* Success ! */
+         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_MED,
+                   "%s", priv_data.buf);
+         ret = 0;
+       }
+       else if (strncasecmp(command, "SETRMCTXRATE", 12) == 0)
+       {
+          tANI_U8 *value = command;
+          tANI_U32 uRate = 0;
+          tTxrateinfoflags txFlags = 0;
+          tSirRateUpdateInd *rateUpdateParams;
+          int  status;
+
+          if ((WLAN_HDD_IBSS != pAdapter->device_mode) &&
+              (WLAN_HDD_SOFTAP != pAdapter->device_mode))
+           {
+              VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "Received SETRMCTXRATE command in invalid mode %d "
+                "SETRMC command is only allowed in IBSS or SOFTAP mode",
+                pAdapter->device_mode);
+              ret = -EINVAL;
+              goto exit;
+           }
+
+          status = hdd_parse_setrmcrate_command(value, &uRate, &txFlags);
+          if (status)
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "Invalid SETRMCTXRATE command ");
+               ret = -EINVAL;
+               goto exit;
+           }
+
+          rateUpdateParams = vos_mem_malloc(sizeof(tSirRateUpdateInd));
+          if (NULL == rateUpdateParams)
+           {
+             ret = -EINVAL;
+             goto exit;
+           }
+
+          VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+               "%s: uRate %d ", __func__, uRate);
+
+          vos_mem_zero(rateUpdateParams, sizeof(tSirRateUpdateInd ));
+
+          /* -1 implies ignore this param */
+          rateUpdateParams->ucastDataRate = -1;
+
+          /*
+           * Fill the user specifieed RMC rate param
+           * and the derived tx flags.
+           */
+          rateUpdateParams->rmcDataRate = uRate;
+          rateUpdateParams->rmcDataRateTxFlag = txFlags;
+
+          status = sme_SendRateUpdateInd((tHalHandle)(pHddCtx->hHal), rateUpdateParams);
+       }
+       else if (strncasecmp(command, "SETIBSSTXFAILEVENT", 18) == 0 )
+       {
+           char *value;
+           tANI_U8 tx_fail_count = 0;
+           tANI_U16 pid = 0;
+
+           value = command;
+
+           ret = hdd_ParseIBSSTXFailEventParams(value, &tx_fail_count, &pid);
+
+           if (0 != ret)
+           {
+              hddLog(VOS_TRACE_LEVEL_INFO,
+                     "%s: Failed to parse SETIBSSTXFAILEVENT arguments",
+                     __func__);
+              goto exit;
+           }
+
+           hddLog(VOS_TRACE_LEVEL_INFO, "%s: tx_fail_cnt=%hhu, pid=%hu",
+                   __func__, tx_fail_count, pid);
+
+           if (0 == tx_fail_count)
+           {
+               // Disable TX Fail Indication
+               if (eHAL_STATUS_SUCCESS  ==
+                   sme_TXFailMonitorStartStopInd(pHddCtx->hHal,
+                                                 tx_fail_count,
+                                                 NULL))
+               {
+                   cesium_pid = 0;
+           }
+               else
+               {
+                   VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                             "%s: failed to disable TX Fail Event ", __func__);
+                   ret = -EINVAL;
+       }
+           }
+           else
+       {
+               if (eHAL_STATUS_SUCCESS  ==
+                   sme_TXFailMonitorStartStopInd(pHddCtx->hHal,
+                                                 tx_fail_count,
+                                           (void*)hdd_tx_fail_ind_callback))
+               {
+                   cesium_pid = pid;
+                   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                             "%s: Registered Cesium pid %u", __func__,
+                             cesium_pid);
+       }
+               else
+               {
+                   VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                             "%s: Failed to enable TX Fail Monitoring", __func__);
+                   ret = -EINVAL;
+               }
+           }
+       }
+
+#endif /* WLAN_FEATURE_RMC */
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
        else if (strncmp(command, "SETCCXROAMSCANCHANNELS", 22) == 0)
        {
@@ -4707,7 +6135,8 @@
                                      tCsrEseBeaconReq *pEseBcnReq)
 {
     tANI_U8 *inPtr = pValue;
-    int tempInt = 0;
+    uint8_t input = 0;
+    uint32_t tempInt = 0;
     int j = 0, i = 0, v = 0;
     char buf[32];
 
@@ -4733,13 +6162,14 @@
     v = sscanf(inPtr, "%31s ", buf);
     if (1 != v) return -EINVAL;
 
-    v = kstrtos32(buf, 10, &tempInt);
+    v = kstrtos8(buf, 10, &input);
     if ( v < 0) return -EINVAL;
 
-    pEseBcnReq->numBcnReqIe = tempInt;
+    input = VOS_MIN(input, SIR_ESE_MAX_MEAS_IE_REQS);
+    pEseBcnReq->numBcnReqIe = input;
 
-    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
-               "Number of Bcn Req Ie fields(%d)", pEseBcnReq->numBcnReqIe);
+    hddLog(LOG1, "Number of Bcn Req Ie fields: %d", pEseBcnReq->numBcnReqIe);
+
 
     for (j = 0; j < (pEseBcnReq->numBcnReqIe); j++)
     {
@@ -4759,27 +6189,27 @@
             v = sscanf(inPtr, "%31s ", buf);
             if (1 != v) return -EINVAL;
 
-            v = kstrtos32(buf, 10, &tempInt);
+            v = kstrtou32(buf, 10, &tempInt);
             if (v < 0) return -EINVAL;
 
             switch (i)
             {
                 case 0:  /* Measurement token */
-                if (tempInt <= 0)
+                if (!tempInt)
                 {
                    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                             "Invalid Measurement Token(%d)", tempInt);
+                             "Invalid Measurement Token: %u", tempInt);
                    return -EINVAL;
                 }
                 pEseBcnReq->bcnReq[j].measurementToken = tempInt;
                 break;
 
                 case 1:  /* Channel number */
-                if ((tempInt <= 0) ||
+                if ((!tempInt) ||
                     (tempInt > WNI_CFG_CURRENT_CHANNEL_STAMAX))
                 {
                    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                             "Invalid Channel Number(%d)", tempInt);
+                             "Invalid Channel Number: %u", tempInt);
                    return -EINVAL;
                 }
                 pEseBcnReq->bcnReq[j].channel = tempInt;
@@ -4789,18 +6219,18 @@
                 if ((tempInt < eSIR_PASSIVE_SCAN) || (tempInt > eSIR_BEACON_TABLE))
                 {
                    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                             "Invalid Scan Mode(%d) Expected{0|1|2}", tempInt);
+                             "Invalid Scan Mode(%u) Expected{0|1|2}", tempInt);
                    return -EINVAL;
                 }
                 pEseBcnReq->bcnReq[j].scanMode= tempInt;
                 break;
 
                 case 3:  /* Measurement duration */
-                if (((tempInt <= 0) && (pEseBcnReq->bcnReq[j].scanMode != eSIR_BEACON_TABLE)) ||
-                    ((tempInt < 0) && (pEseBcnReq->bcnReq[j].scanMode == eSIR_BEACON_TABLE)))
+                if (((!tempInt) && (pEseBcnReq->bcnReq[j].scanMode != eSIR_BEACON_TABLE)) ||
+                    ((pEseBcnReq->bcnReq[j].scanMode == eSIR_BEACON_TABLE)))
                 {
                    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                             "Invalid Measurement Duration(%d)", tempInt);
+                             "Invalid Measurement Duration: %u", tempInt);
                    return -EINVAL;
                 }
                 pEseBcnReq->bcnReq[j].measurementDuration = tempInt;
@@ -5281,24 +6711,21 @@
 }
 
 
-/**---------------------------------------------------------------------------
-
-  \brief hdd_parse_reassoc_command_data() - HDD Parse reassoc command data
-
-  This function parses the reasoc command data passed in the format
-  REASSOC<space><bssid><space><channel>
-
-  \param  - pValue Pointer to input data (its a NUL terminated string)
-  \param  - pTargetApBssid Pointer to target Ap bssid
-  \param  - pChannel Pointer to the Target AP channel
-
-  \return - 0 for success non-zero for failure
-
-  --------------------------------------------------------------------------*/
-VOS_STATUS hdd_parse_reassoc_command_data(tANI_U8 *pValue,
-                            tANI_U8 *pTargetApBssid, tANI_U8 *pChannel)
+/**
+ * hdd_parse_reassoc_command_v1_data() - HDD Parse reassoc command data
+ *    This function parses the reasoc command data passed in the format
+ *    REASSOC<space><bssid><space><channel>
+ *
+ * @pValue: Pointer to input data (its a NUL terminated string)
+ * @pTargetApBssid: Pointer to target Ap bssid
+ * @pChannel: Pointer to the Target AP channel
+ *
+ * Return: 0 for success non-zero for failure
+ */
+static int hdd_parse_reassoc_command_v1_data(const tANI_U8 *pValue,
+				tANI_U8 *pTargetApBssid, tANI_U8 *pChannel)
 {
-    tANI_U8 *inPtr = pValue;
+    const tANI_U8 *inPtr = pValue;
     int tempInt;
     int v = 0;
     tANI_U8 tempBuf[32];
@@ -5830,6 +7257,7 @@
       /* after uninit our adapter structure will no longer be valid */
       pAdapter->dev = NULL;
       pAdapter->magic = 0;
+      pAdapter->pHddCtx = NULL;
    } while (0);
 
    EXIT();
@@ -5985,6 +7413,193 @@
    }
 }
 
+#ifdef WLAN_FEATURE_RMC
+static void hdd_tx_fail_ind_callback(v_U8_t *MacAddr, v_U8_t seqNo)
+{
+   int payload_len;
+   struct sk_buff *skb;
+   struct nlmsghdr *nlh;
+   v_U8_t *data;
+
+   payload_len = ETH_ALEN;
+
+   if (0 == cesium_pid)
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR, "%s: cesium process not registered",
+             __func__);
+      return;
+   }
+
+   if ((skb = nlmsg_new(payload_len,GFP_ATOMIC)) == NULL)
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR,
+             "%s: nlmsg_new() failed for msg size[%d]",
+             __func__, NLMSG_SPACE(payload_len));
+      return;
+   }
+
+   nlh = nlmsg_put(skb, cesium_pid, seqNo, 0, payload_len, NLM_F_REQUEST);
+
+   if (NULL == nlh)
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR,
+             "%s: nlmsg_put() failed for msg size[%d]",
+             __func__, NLMSG_SPACE(payload_len));
+
+      kfree_skb(skb);
+      return;
+   }
+
+   data = nlmsg_data(nlh);
+   memcpy(data, MacAddr, ETH_ALEN);
+
+   if (nlmsg_unicast(cesium_nl_srv_sock, skb, cesium_pid) < 0)
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR, "%s: nlmsg_unicast() failed for msg size[%d]",
+                                       __func__, NLMSG_SPACE(payload_len));
+   }
+
+   return;
+}
+
+/**---------------------------------------------------------------------------
+     \brief hdd_ParseuserParams - return a pointer to the next argument
+
+     \return - status
+
+--------------------------------------------------------------------------*/
+static int hdd_ParseUserParams(tANI_U8 *pValue, tANI_U8 **ppArg)
+{
+   tANI_U8 *pVal;
+
+   pVal = strchr(pValue, ' ');
+
+   if (NULL == pVal)
+   {
+      /* no argument remains */
+      return -EINVAL;
+   }
+   else if (SPACE_ASCII_VALUE != *pVal)
+   {
+      /* no space after the current argument */
+      return -EINVAL;
+   }
+
+   pVal++;
+
+   /* remove empty spaces */
+   while ((SPACE_ASCII_VALUE  == *pVal) && ('\0' !=  *pVal))
+   {
+      pVal++;
+   }
+
+   /* no argument followed by spaces */
+   if ('\0' == *pVal)
+   {
+      return -EINVAL;
+   }
+
+   *ppArg = pVal;
+
+   return 0;
+}
+
+/**----------------------------------------------------------------------------
+     \brief hdd_ParseIBSSTXFailEventParams - Parse params for SETIBSSTXFAILEVENT
+
+     \return - status
+
+------------------------------------------------------------------------------*/
+static int hdd_ParseIBSSTXFailEventParams(tANI_U8 *pValue,
+                                          tANI_U8 *tx_fail_count,
+                                          tANI_U16 *pid)
+{
+   tANI_U8 *param = NULL;
+   int ret;
+
+   ret = hdd_ParseUserParams(pValue, &param);
+
+   if (0 == ret && NULL != param)
+   {
+      if (1 != sscanf(param, "%hhu", tx_fail_count))
+      {
+         ret = -EINVAL;
+         goto done;
+      }
+   }
+   else
+   {
+      goto done;
+   }
+
+   if (0 == *tx_fail_count)
+   {
+      *pid = 0;
+      goto done;
+   }
+
+   pValue = param;
+   pValue++;
+
+   ret = hdd_ParseUserParams(pValue, &param);
+
+   if (0 == ret)
+   {
+      if (1 != sscanf(param, "%hu", pid))
+      {
+         ret = -EINVAL;
+         goto done;
+      }
+   }
+   else
+   {
+      goto done;
+   }
+
+done:
+   return ret;
+}
+
+static int hdd_open_cesium_nl_sock()
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+   struct netlink_kernel_cfg cfg = {
+          .groups = WLAN_NLINK_MCAST_GRP_ID,
+          .input = NULL
+          };
+#endif
+   int ret = 0;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+   cesium_nl_srv_sock = netlink_kernel_create(&init_net, WLAN_NLINK_CESIUM,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,7,0))
+                                              THIS_MODULE,
+#endif
+                                              &cfg);
+#else
+   cesium_nl_srv_sock = netlink_kernel_create(&init_net, WLAN_NLINK_CESIUM,
+                                        WLAN_NLINK_MCAST_GRP_ID, NULL, NULL, THIS_MODULE);
+#endif
+
+   if (cesium_nl_srv_sock == NULL)
+   {
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "NLINK:  cesium netlink_kernel_create failed");
+       ret = -ECONNREFUSED;
+   }
+
+   return ret;
+}
+
+static void hdd_close_cesium_nl_sock()
+{
+   if (NULL != cesium_nl_srv_sock)
+   {
+      netlink_kernel_release(cesium_nl_srv_sock);
+      cesium_nl_srv_sock = NULL;
+   }
+}
+#endif /* WLAN_FEATURE_RMC */
 /**---------------------------------------------------------------------------
 
     \brief hdd_req_bmps_cbk() - HDD Request BMPS callback function
@@ -6391,6 +8006,32 @@
 
    return eHAL_STATUS_SUCCESS;
 }
+/**
+ * hdd_close_tx_queues() - close tx queues
+ * @hdd_ctx: hdd global context
+ *
+ * Return: None
+ */
+static void hdd_close_tx_queues(hdd_context_t *hdd_ctx)
+{
+   VOS_STATUS status;
+   hdd_adapter_t *adapter;
+   hdd_adapter_list_node_t *adapter_node = NULL, *next_adapter = NULL;
+   /* Not validating hdd_ctx as it's already done by the caller */
+   ENTER();
+   status = hdd_get_front_adapter(hdd_ctx, &adapter_node);
+   while (NULL != adapter_node && VOS_STATUS_SUCCESS == status) {
+      adapter = adapter_node->pAdapter;
+      if (adapter && adapter->dev) {
+          netif_tx_disable (adapter->dev);
+          netif_carrier_off(adapter->dev);
+      }
+      status = hdd_get_next_adapter(hdd_ctx, adapter_node,
+                                    &next_adapter);
+      adapter_node = next_adapter;
+   }
+   EXIT();
+}
 
 VOS_STATUS hdd_init_station_mode( hdd_adapter_t *pAdapter )
 {
@@ -6491,7 +8132,7 @@
    {
       INIT_COMPLETION(pAdapter->session_close_comp_var);
       if (eHAL_STATUS_SUCCESS == sme_CloseSession(pHddCtx->hHal,
-                                    pAdapter->sessionId, VOS_TRUE,
+                                    pAdapter->sessionId, FALSE, VOS_TRUE,
                                     hdd_smeCloseSessionCallback, pAdapter))
       {
          unsigned long rc;
@@ -7068,6 +8709,7 @@
              INIT_DELAYED_WORK(&pAdapter->roc_work,
                      hdd_p2p_roc_work_queue);
          }
+
          break;
       }
       case WLAN_HDD_MONITOR:
@@ -7372,13 +9014,17 @@
                 halStatus = sme_RoamDisconnect(pHddCtx->hHal,
                                             pAdapter->sessionId, 
                                             eCSR_DISCONNECT_REASON_UNSPECIFIED);
-            //success implies disconnect command got queued up successfully
-            if(halStatus == eHAL_STATUS_SUCCESS)
+            /* Success implies disconnect command got queued up successfully
+             * Or cmd not queued as scan for SSID is in progress
+             */
+            if((eHAL_STATUS_SUCCESS == halStatus) ||
+               (eHAL_STATUS_CMD_NOT_QUEUED == halStatus))
             {
                ret = wait_for_completion_interruptible_timeout(
                           &pAdapter->disconnect_comp_var,
                            msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
-               if (ret <= 0)
+               if (ret <= 0 &&
+                   (eHAL_STATUS_CMD_NOT_QUEUED != halStatus))
                {
                    hddLog(VOS_TRACE_LEVEL_ERROR,
                           "%s: wait on disconnect_comp_var failed %ld",
@@ -7407,10 +9053,9 @@
                  FL("wait on disconnect_comp_var failed %ld"), ret);
              }
          }
-         else if(pScanInfo != NULL && pHddCtx->scan_info.mScanPending)
+         if(pScanInfo != NULL && pHddCtx->scan_info.mScanPending)
          {
-            hdd_abort_mac_scan(pHddCtx, pScanInfo->sessionId,
-                               eCSR_SCAN_ABORT_DEFAULT);
+            wlan_hdd_scan_abort(pAdapter);
          }
        if ((pAdapter->device_mode != WLAN_HDD_INFRA_STATION) &&
                    (pAdapter->device_mode != WLAN_HDD_IBSS))
@@ -7457,8 +9102,8 @@
          {
             INIT_COMPLETION(pAdapter->session_close_comp_var);
             if (eHAL_STATUS_SUCCESS ==
-                  sme_CloseSession(pHddCtx->hHal, pAdapter->sessionId, VOS_FALSE,
-                     hdd_smeCloseSessionCallback, pAdapter))
+                    sme_CloseSession(pHddCtx->hHal, pAdapter->sessionId, FALSE,
+                      VOS_FALSE, hdd_smeCloseSessionCallback, pAdapter))
             {
                unsigned long ret;
 
@@ -7728,7 +9373,6 @@
             connState = (WLAN_HDD_GET_STATION_CTX_PTR(pAdapter))->conn_info.connState;
 
             hdd_init_station_mode(pAdapter);
-
             /* Open the gates for HDD to receive Wext commands */
             pAdapter->isLinkUpSvcNeeded = FALSE; 
             pHddCtx->scan_info.mScanPending = FALSE;
@@ -7750,8 +9394,8 @@
                pAdapter->sessionCtx.station.hdd_ReassocScenario = VOS_FALSE;
 
                /* indicate disconnected event to nl80211 */
-               cfg80211_disconnected(pAdapter->dev, WLAN_REASON_UNSPECIFIED,
-                                     NULL, 0, GFP_KERNEL); 
+               wlan_hdd_cfg80211_indicate_disconnect(pAdapter->dev, false,
+                                                     WLAN_REASON_UNSPECIFIED);
             }
             else if (eConnectionState_Connecting == connState)
             {
@@ -7863,7 +9507,6 @@
    v_U8_t staChannel = 0, p2pChannel = 0, apChannel = 0;
    const char *p2pMode = "DEV";
    const char *ccMode = "Standalone";
-   int n;
 
    status =  hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
    while ( NULL != pAdapterNode && VOS_STATUS_SUCCESS == status )
@@ -7911,14 +9554,14 @@
    if (staChannel > 0 && (apChannel > 0 || p2pChannel > 0)) {
        ccMode = (p2pChannel==staChannel||apChannel==staChannel) ? "SCC" : "MCC";
    }
-   n = pr_info("wlan(%d) " MAC_ADDRESS_STR " %s",
+   hddLog(VOS_TRACE_LEVEL_ERROR, "wlan(%d) " MAC_ADDRESS_STR " %s",
                 staChannel, MAC_ADDR_ARRAY(staBssid), ccMode);
    if (p2pChannel > 0) {
-       n +=  pr_info("p2p-%s(%d) " MAC_ADDRESS_STR,
+       hddLog(VOS_TRACE_LEVEL_ERROR, "p2p-%s(%d) " MAC_ADDRESS_STR,
                      p2pMode, p2pChannel, MAC_ADDR_ARRAY(p2pBssid));
    }
    if (apChannel > 0) {
-       n += pr_info("AP(%d) " MAC_ADDRESS_STR,
+       hddLog(VOS_TRACE_LEVEL_ERROR, "AP(%d) " MAC_ADDRESS_STR,
                      apChannel, MAC_ADDR_ARRAY(apBssid));
    }
 
@@ -8265,6 +9908,14 @@
       }
    }
 
+   if (pHddCtx->hdd_wlan_suspended)
+   {
+       /*
+        * Configure the Mcast address list to FW
+        * If wlan is already in suspend mode
+        */
+       wlan_hdd_set_mc_addr_list(pAdapter, TRUE);
+   }
    EXIT();
    return;
 }
@@ -8368,27 +10019,6 @@
         vos_mem_free(scanReq.ChannelInfo.ChannelList);
 }
 
-void hdd_purge_cmd_list_all_adapters( hdd_context_t *pHddCtx )
-{
-   hdd_adapter_list_node_t *pAdapterNode = NULL, *pNext = NULL;
-   VOS_STATUS status;
-   hdd_adapter_t      *pAdapter;
-
-   ENTER();
-
-   status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
-
-   while ( NULL != pAdapterNode && VOS_STATUS_SUCCESS == status )
-   {
-      pAdapter = pAdapterNode->pAdapter;
-
-      status = sme_PurgeCmdList(pHddCtx->hHal, pAdapter->sessionId);
-      status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
-      pAdapterNode = pNext;
-   }
-
-   EXIT();
-}
 /**---------------------------------------------------------------------------
 
   \brief hdd_full_power_callback() - HDD full power callback function
@@ -8631,7 +10261,8 @@
        * to be disabled so that hdd_rx_packet_cbk won't call
        * wlan_hdd_tdls_find_peer.
        */
-      wlan_hdd_tdls_set_mode(pHddCtx, eTDLS_SUPPORT_DISABLED, FALSE);
+      wlan_hdd_tdls_set_mode(pHddCtx, eTDLS_SUPPORT_DISABLED, FALSE,
+                             HDD_SET_TDLS_MODE_SOURCE_USER);
 #endif
 
       vosStatus = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
@@ -8659,6 +10290,9 @@
 #ifdef FEATURE_WLAN_TDLS
             mutex_unlock(&pHddCtx->tdls_lock);
 #endif
+            vos_flush_delayed_work(&pHddCtx->scan_ctxt.scan_work);
+
+            wlan_hdd_init_deinit_defer_scan_context(&pHddCtx->scan_ctxt);
 
             if (WLAN_HDD_INFRA_STATION ==  pAdapter->device_mode ||
                 WLAN_HDD_P2P_CLIENT == pAdapter->device_mode)
@@ -8672,9 +10306,6 @@
          pAdapterNode = pNext;
       }
 
-       //Purge all sme cmd's for all interface
-       hdd_purge_cmd_list_all_adapters(pHddCtx);
-
       // Cancel any outstanding scan requests.  We are about to close all
       // of our adapters, but an adapter structure is what SME passes back
       // to our callback function. Hence if there are any outstanding scan
@@ -8737,20 +10368,39 @@
    }
 
    //Stop the traffic monitor timer
-   if ( VOS_TIMER_STATE_RUNNING ==
-                        vos_timer_getCurrentState(&pHddCtx->tx_rx_trafficTmr))
+   if ((pHddCtx->cfg_ini->dynSplitscan) && (VOS_TIMER_STATE_RUNNING ==
+        vos_timer_getCurrentState(&pHddCtx->tx_rx_trafficTmr)))
    {
         vos_timer_stop(&pHddCtx->tx_rx_trafficTmr);
    }
 
    // Destroy the traffic monitor timer
-   if (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy(
-                         &pHddCtx->tx_rx_trafficTmr)))
+   if ((pHddCtx->cfg_ini->dynSplitscan) &&
+       (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy(
+                         &pHddCtx->tx_rx_trafficTmr))))
    {
        hddLog(VOS_TRACE_LEVEL_ERROR,
            "%s: Cannot deallocate Traffic monitor timer", __func__);
    }
 
+   if (VOS_TIMER_STATE_RUNNING ==
+                      vos_timer_getCurrentState(&pHddCtx->delack_timer)) {
+       vos_timer_stop(&pHddCtx->delack_timer);
+   }
+
+   if (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy(
+                                   &pHddCtx->delack_timer))) {
+       hddLog(VOS_TRACE_LEVEL_ERROR,
+            "%s: Cannot deallocate Bus bandwidth timer", __func__);
+   }
+
+   if (VOS_TIMER_STATE_RUNNING ==
+                 vos_timer_getCurrentState(&pHddCtx->tdls_source_timer)) {
+       vos_timer_stop(&pHddCtx->tdls_source_timer);
+   }
+
+   vos_timer_destroy(&pHddCtx->tdls_source_timer);
+
    //Disable IMPS/BMPS as we do not want the device to enter any power
    //save mode during shutdown
    sme_DisablePowerSave(pHddCtx->hHal, ePMC_IDLE_MODE_POWER_SAVE);
@@ -8845,7 +10495,8 @@
       VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
          "%s: Failed to stop VOSS",__func__);
       VOS_ASSERT( VOS_IS_STATUS_SUCCESS( vosStatus ) );
-      VOS_BUG(0);
+      if (isSsrPanicOnFailure())
+          VOS_BUG(0);
    }
 
    //This requires pMac access, Call this before vos_close().
@@ -8888,6 +10539,10 @@
    //Clean up HDD Nlink Service
    send_btc_nlink_msg(WLAN_MODULE_DOWN_IND, 0);
 
+   hdd_close_tx_queues(pHddCtx);
+   wlan_free_fwr_mem_dump_buffer();
+   memdump_deinit();
+
 #ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
    if (pHddCtx->cfg_ini->wlanLoggingEnable)
    {
@@ -8901,9 +10556,14 @@
    nl_srv_exit();
 #endif /* WLAN_KD_READY_NOTIFIER */
 
+#ifdef WLAN_FEATURE_RMC
+   hdd_close_cesium_nl_sock();
+#endif /* WLAN_FEATURE_RMC */
 
    hdd_close_all_adapters( pHddCtx );
 
+   vos_flush_delayed_work(&pHddCtx->spoof_mac_addr_work);
+
 free_hdd_ctx:
    /* free the power on lock from platform driver */
    if (free_riva_power_on_lock("wlan"))
@@ -8919,9 +10579,10 @@
        pHddCtx->cfg_ini= NULL;
    }
 
-   /* FTM mode, WIPHY did not registered
+   /* FTM/MONITOR mode, WIPHY did not registered
       If un-register here, system crash will happen */
-   if (VOS_FTM_MODE != hdd_get_conparam())
+   if (!(VOS_FTM_MODE == hdd_get_conparam() ||
+            VOS_MONITOR_MODE == hdd_get_conparam()))
    {
       wiphy_unregister(wiphy) ;
       hdd_wlan_free_wiphy_channels(wiphy);
@@ -9165,6 +10826,7 @@
 
       pr_info("%s: WCNSS software version %s\n",
               WLAN_MODULE_NAME, versionString);
+      vos_mem_copy(pHddCtx->fw_Version, versionString, sizeof(versionString));
 
       vstatus = sme_GetWcnssHardwareVersion(pHddCtx->hHal,
                                             versionString,
@@ -9245,6 +10907,14 @@
                        nlh->nlmsg_len = NLMSG_LENGTH((sizeof(tAniMsgHdr)));
                        skb_put(skb, NLMSG_SPACE(sizeof(tAniMsgHdr)));
                        break;
+               case WLAN_SVC_WLAN_TP_IND:
+                        ani_hdr->length = len;
+                        nlh->nlmsg_len = NLMSG_LENGTH((sizeof(tAniMsgHdr)
+                                                                       + len));
+                        nl_data = (char *)ani_hdr + sizeof(tAniMsgHdr);
+                        memcpy(nl_data, data, len);
+                        skb_put(skb, NLMSG_SPACE(sizeof(tAniMsgHdr) + len));
+                        break;
                case WLAN_MSG_RPS_ENABLE_IND:
                         ani_hdr->length = len;
                         nlh->nlmsg_len = NLMSG_LENGTH((sizeof(tAniMsgHdr) + len));
@@ -9264,7 +10934,68 @@
     return;
 }
 
+/**
+ * hdd_request_tcp_delack() - Find the Delack value based on RX packet
+ * @pHddCtx: Valid Global HDD context pointer
+ * @rx_packets: Number of RX packet in perticular time
+ *
+ * Based on the RX packet this function calculate  next value of tcp delack.
+ * This function compare rx packet value to high and low threshold limit.
+ *
+ * Return: void
+ */
+void hdd_request_tcp_delack(hdd_context_t *pHddCtx, uint64_t rx_packets)
+{
+    /* average of rx_packets and prev_rx is taken so that
+       bus width doesnot fluctuate much */
+    uint64_t temp_rx = (rx_packets + pHddCtx->prev_rx)/2;
+    TP_IND_TYPE next_rx_level = pHddCtx->cur_rx_level;
 
+    pHddCtx->prev_rx = rx_packets;
+    if (temp_rx > pHddCtx->cfg_ini->tcpDelAckThresholdHigh)
+        next_rx_level = TP_IND_HIGH;
+    else if (temp_rx <= pHddCtx->cfg_ini->tcpDelAckThresholdLow)
+        next_rx_level = TP_IND_LOW;
+
+    hdd_set_delack_value(pHddCtx, next_rx_level);
+}
+
+#define HDD_BW_GET_DIFF(x, y) ((x) >= (y) ? (x) - (y) : (ULONG_MAX - (y) + (x)))
+
+/**
+ * hdd_tcp_delack_compute_function() - get link status
+ * @priv: Valid Global HDD context pointer
+ *
+ * This function find number of RX packet during timer life span.
+ * It request tcp delack with number of RX packet and re-configure delack timer
+ * for tcpDelAckComputeInterval timer interval.
+ *
+ * Return: void
+ */
+void hdd_tcp_delack_compute_function(void *priv)
+{
+    hdd_context_t *pHddCtx = (hdd_context_t *)priv;
+    hdd_adapter_t *pAdapter = NULL;
+    v_U32_t rx_packets = 0;
+    hdd_adapter_list_node_t *pAdapterNode = NULL;
+    VOS_STATUS status = 0;
+
+    for (status = hdd_get_front_adapter(pHddCtx, &pAdapterNode);
+          NULL != pAdapterNode && VOS_STATUS_SUCCESS == status;
+          status = hdd_get_next_adapter(pHddCtx, pAdapterNode, &pAdapterNode)) {
+        if ((pAdapter = pAdapterNode->pAdapter) == NULL)
+             continue;
+
+        rx_packets += HDD_BW_GET_DIFF(pAdapter->stats.rx_packets,
+                    pAdapter->prev_rx_packets);
+        pAdapter->prev_rx_packets = pAdapter->stats.rx_packets;
+    }
+
+    hdd_request_tcp_delack(pHddCtx, rx_packets);
+
+    vos_timer_start(&pHddCtx->delack_timer,
+            pHddCtx->cfg_ini->tcpDelAckComputeInterval);
+}
 
 /**---------------------------------------------------------------------------
 
@@ -9473,7 +11204,7 @@
   \return -  None
 
   --------------------------------------------------------------------------*/
-void hdd_init_frame_logging_done(void *fwlogInitCbContext, VOS_STATUS status)
+void hdd_init_frame_logging_done(void *fwlogInitCbContext, tAniLoggingInitRsp *pRsp)
 {
    hdd_context_t* pHddCtx = (hdd_context_t*)fwlogInitCbContext;
 
@@ -9484,7 +11215,7 @@
       return;
    }
 
-   if ((VOS_STATUS_SUCCESS == status) &&
+   if ((pRsp->status == VOS_STATUS_SUCCESS) &&
        (TRUE == pHddCtx->cfg_ini->enableMgmtLogging))
    {
       hddLog(VOS_TRACE_LEVEL_INFO, FL("Mgmt Frame Logging init successful"));
@@ -9494,9 +11225,21 @@
    {
       hddLog(VOS_TRACE_LEVEL_INFO, FL("Mgmt Frame Logging init not success"));
       pHddCtx->mgmt_frame_logging = FALSE;
+      return;
    }
 
-   return;
+   /*Check feature supported by FW*/
+   if(TRUE == sme_IsFeatureSupportedByFW(MEMORY_DUMP_SUPPORTED))
+   {
+      //Store fwr mem dump size given by firmware.
+      wlan_store_fwr_mem_dump_size(pRsp->fw_mem_dump_max_size);
+   }
+   else
+   {
+      wlan_store_fwr_mem_dump_size(0);
+   }
+
+
 }
 /**---------------------------------------------------------------------------
 
@@ -9511,7 +11254,7 @@
 void hdd_init_frame_logging(hdd_context_t* pHddCtx)
 {
    eHalStatus halStatus = eHAL_STATUS_FAILURE;
-   tpSirFWLoggingInitParam wlanFWLoggingInitParam;
+   tSirFWLoggingInitParam wlanFWLoggingInitParam = {0};
 
    if (TRUE != sme_IsFeatureSupportedByFW(MGMT_FRAME_LOGGING) &&
        TRUE != sme_IsFeatureSupportedByFW(LOGGING_ENHANCEMENT))
@@ -9520,55 +11263,57 @@
        return;
    }
 
-   wlanFWLoggingInitParam = vos_mem_malloc(sizeof(tSirFWLoggingInitParam));
-   if(NULL == wlanFWLoggingInitParam)
-   {
-       hddLog(VOS_TRACE_LEVEL_FATAL, "%s: vos_mem_alloc failed ", __func__);
-       return;
-   }
-
-   vos_mem_set(wlanFWLoggingInitParam, sizeof(tSirFWLoggingInitParam), 0);
-
-   hddLog(VOS_TRACE_LEVEL_INFO, "%s: Configuring %s %s %s Logging",__func__,
+   hddLog(VOS_TRACE_LEVEL_INFO, "%s: Configuring %s %s %s %s Logging",__func__,
                pHddCtx->cfg_ini->enableFWLogging?"FW Log,":"",
                pHddCtx->cfg_ini->enableContFWLogging ? "Cont FW log,":"",
-               pHddCtx->cfg_ini->enableMgmtLogging ? "Mgmt Pkt Log":"");
+               pHddCtx->cfg_ini->enableMgmtLogging ? "Mgmt Pkt Log":"",
+               pHddCtx->cfg_ini->enableFwrMemDump ? "Fw Mem dump":"");
 
    if (pHddCtx->cfg_ini->enableFWLogging ||
                  pHddCtx->cfg_ini->enableContFWLogging)
    {
-      wlanFWLoggingInitParam->enableFlag |= WLAN_QXDM_LOG_EN;
+      wlanFWLoggingInitParam.enableFlag |= WLAN_QXDM_LOG_EN;
    }
 
    if (pHddCtx->cfg_ini->enableMgmtLogging)
    {
-      wlanFWLoggingInitParam->enableFlag |= WLAN_FRAME_LOG_EN;
+      wlanFWLoggingInitParam.enableFlag |= WLAN_FRAME_LOG_EN;
    }
    if (pHddCtx->cfg_ini->enableBMUHWtracing)
    {
-      wlanFWLoggingInitParam->enableFlag |= WLAN_BMUHW_TRACE_LOG_EN;
+      wlanFWLoggingInitParam.enableFlag |= WLAN_BMUHW_TRACE_LOG_EN;
    }
-
-   wlanFWLoggingInitParam->frameType = WLAN_FRAME_LOGGING_FRAMETYPE_MGMT;
-   wlanFWLoggingInitParam->frameSize = WLAN_MGMT_LOGGING_FRAMESIZE_128BYTES;
-   wlanFWLoggingInitParam->bufferMode = WLAN_FRAME_LOGGING_BUFFERMODE_CIRCULAR;
-   wlanFWLoggingInitParam->continuousFrameLogging =
+   if(pHddCtx->cfg_ini->enableFwrMemDump &&
+      (TRUE == sme_IsFeatureSupportedByFW(MEMORY_DUMP_SUPPORTED)))
+   {
+      wlanFWLoggingInitParam.enableFlag |= WLAN_FW_MEM_DUMP_EN;
+   }
+   if( wlanFWLoggingInitParam.enableFlag == 0 )
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Logging not enabled", __func__);
+      return;
+   }
+   wlanFWLoggingInitParam.frameType = WLAN_FRAME_LOGGING_FRAMETYPE_MGMT;
+   wlanFWLoggingInitParam.frameSize = WLAN_MGMT_LOGGING_FRAMESIZE_128BYTES;
+   wlanFWLoggingInitParam.bufferMode = WLAN_FRAME_LOGGING_BUFFERMODE_CIRCULAR;
+   wlanFWLoggingInitParam.continuousFrameLogging =
                               pHddCtx->cfg_ini->enableContFWLogging;
 
-   wlanFWLoggingInitParam->enableFlag &= ~WLAN_DPU_TXP_LOG_EN;
+   wlanFWLoggingInitParam.enableFlag &= ~WLAN_DPU_TXP_LOG_EN;
 
-   wlanFWLoggingInitParam->minLogBufferSize =
+   wlanFWLoggingInitParam.minLogBufferSize =
                               pHddCtx->cfg_ini->minLoggingBufferSize;
-   wlanFWLoggingInitParam->maxLogBufferSize =
+   wlanFWLoggingInitParam.maxLogBufferSize =
                               pHddCtx->cfg_ini->maxLoggingBufferSize;
-   wlanFWLoggingInitParam->fwlogInitCallback = hdd_init_frame_logging_done;
-   wlanFWLoggingInitParam->fwlogInitCbContext= pHddCtx;
+   wlanFWLoggingInitParam.fwlogInitCallback = hdd_init_frame_logging_done;
+   wlanFWLoggingInitParam.fwlogInitCbContext= pHddCtx;
 
-   halStatus = sme_InitMgmtFrameLogging(pHddCtx->hHal, wlanFWLoggingInitParam);
+   halStatus = sme_InitMgmtFrameLogging(pHddCtx->hHal, &wlanFWLoggingInitParam);
 
    if (eHAL_STATUS_SUCCESS != halStatus)
    {
-       vos_mem_free(wlanFWLoggingInitParam);
+       hddLog(LOGE, FL("sme_InitMgmtFrameLogging failed, returned %d"),
+            halStatus);
    }
 
    return;
@@ -9614,6 +11359,89 @@
    }
 }
 
+void wlan_hdd_schedule_defer_scan(struct work_struct *work)
+{
+    scan_context_t *scan_ctx =
+          container_of(work, scan_context_t, scan_work.work);
+
+    if (NULL == scan_ctx)
+    {
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 FL("scan_ctx is NULL"));
+        return;
+    }
+
+    if (unlikely(TDLS_CTX_MAGIC != scan_ctx->magic))
+        return;
+
+    scan_ctx->attempt++;
+
+    wlan_hdd_cfg80211_scan(scan_ctx->wiphy,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+                           scan_ctx->dev,
+#endif
+                           scan_ctx->scan_request);
+}
+
+int wlan_hdd_copy_defer_scan_context(hdd_context_t *pHddCtx,
+                            struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+                            struct net_device *dev,
+#endif
+                            struct cfg80211_scan_request *request)
+{
+    scan_context_t *scan_ctx;
+
+    ENTER();
+    if (0 != (wlan_hdd_validate_context(pHddCtx)))
+    {
+        return -1;
+    }
+
+    scan_ctx = &pHddCtx->scan_ctxt;
+
+    scan_ctx->wiphy = wiphy;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+    scan_ctx->dev = dev;
+#endif
+
+    scan_ctx->scan_request = request;
+
+    EXIT();
+    return 0;
+}
+
+void wlan_hdd_defer_scan_init_work(hdd_context_t *pHddCtx,
+                                struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+                                struct net_device *dev,
+#endif
+                                struct cfg80211_scan_request *request,
+                                unsigned long delay)
+{
+    if (TDLS_CTX_MAGIC != pHddCtx->scan_ctxt.magic)
+    {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+        wlan_hdd_copy_defer_scan_context(pHddCtx, wiphy, dev, request);
+#else
+        wlan_hdd_copy_defer_scan_context(pHddCtx, wiphy, request);
+#endif
+        pHddCtx->scan_ctxt.attempt = 0;
+        pHddCtx->scan_ctxt.magic = TDLS_CTX_MAGIC;
+    }
+    schedule_delayed_work(&pHddCtx->scan_ctxt.scan_work, delay);
+}
+
+void wlan_hdd_init_deinit_defer_scan_context(scan_context_t *scan_ctx)
+{
+    scan_ctx->magic = 0;
+    scan_ctx->attempt = 0;
+    scan_ctx->reject = 0;
+    scan_ctx->scan_request = NULL;
+
+    return;
+}
+
 /**---------------------------------------------------------------------------
 
   \brief hdd_wlan_startup() - HDD init function
@@ -9711,10 +11539,17 @@
    init_completion(&pHddCtx->driver_crda_req);
 #endif
 
+#ifdef WLAN_FEATURE_EXTSCAN
+   init_completion(&pHddCtx->ext_scan_context.response_event);
+#endif /* WLAN_FEATURE_EXTSCAN */
+
    spin_lock_init(&pHddCtx->schedScan_lock);
 
    hdd_list_init( &pHddCtx->hddAdapters, MAX_NUMBER_OF_ADAPTERS );
 
+   vos_init_delayed_work(&pHddCtx->spoof_mac_addr_work,
+                                hdd_processSpoofMacAddrRequest);
+
 #ifdef FEATURE_WLAN_TDLS
    /* tdls_lock is initialized before an hdd_open_adapter ( which is
     * invoked by other instances also) to protect the concurrent
@@ -9725,6 +11560,7 @@
    mutex_init(&pHddCtx->spoofMacAddr.macSpoofingLock);
    mutex_init(&pHddCtx->wmmLock);
 
+   hdd_init_offloaded_packets_ctx(pHddCtx);
    /* By default Strict Regulatory For FCC should be false */
 
    pHddCtx->nEnableStrictRegulatoryForFCC = FALSE;
@@ -9902,12 +11738,23 @@
    }
 
 #endif
+   //Initialize the nlink service
+   if(nl_srv_init() != 0)
+   {
+      hddLog(VOS_TRACE_LEVEL_FATAL,"%s: nl_srv_init failed", __func__);
+      goto err_vos_nv_close;
+   }
+
+#ifdef WLAN_KD_READY_NOTIFIER
+   pHddCtx->kd_nl_init = 1;
+#endif /* WLAN_KD_READY_NOTIFIER */
+
    vos_set_roam_delay_stats_enabled(pHddCtx->cfg_ini->gEnableRoamDelayStats);
    status = vos_open( &pVosContext, pHddCtx->parent_dev);
    if ( !VOS_IS_STATUS_SUCCESS( status ))
    {
       hddLog(VOS_TRACE_LEVEL_FATAL, "%s: vos_open failed", __func__);
-      goto err_vos_nv_close;
+      goto err_nl_srv;
    }
 
    pHddCtx->hHal = (tHalHandle)vos_get_context( VOS_MODULE_ID_SME, pVosContext );
@@ -10049,7 +11896,8 @@
    if ( !VOS_IS_STATUS_SUCCESS( status ) )
    {
       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: vos_start failed",__func__);
-      VOS_BUG(0);
+      if (isSsrPanicOnFailure())
+          VOS_BUG(0);
       goto err_vosclose;
    }
 
@@ -10274,6 +12122,11 @@
 
    wlan_hdd_tdls_init(pHddCtx);
 
+   wlan_hdd_init_deinit_defer_scan_context(&pHddCtx->scan_ctxt);
+
+   vos_init_delayed_work(&pHddCtx->scan_ctxt.scan_work,
+                         wlan_hdd_schedule_defer_scan);
+
    sme_Register11dScanDoneCallback(pHddCtx->hHal, hdd_11d_scan_done);
 
    /* Register with platform driver as client for Suspend/Resume */
@@ -10312,30 +12165,37 @@
       goto err_unregister_pmops;
    }
 
-   //Initialize the nlink service
-   if(nl_srv_init() != 0)
-   {
-      hddLog(VOS_TRACE_LEVEL_FATAL,"%s: nl_srv_init failed", __func__);
-      goto err_reg_netdev;
-   }
-
-#ifdef WLAN_KD_READY_NOTIFIER
-   pHddCtx->kd_nl_init = 1;
-#endif /* WLAN_KD_READY_NOTIFIER */
-
    //Initialize the BTC service
    if(btc_activate_service(pHddCtx) != 0)
    {
       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: btc_activate_service failed",__func__);
-      goto err_nl_srv;
+      goto err_reg_netdev;
    }
 
+#ifdef FEATURE_OEM_DATA_SUPPORT
+   //Initialize the OEM service
+   if (oem_activate_service(pHddCtx) != 0)
+   {
+       hddLog(VOS_TRACE_LEVEL_FATAL,
+              "%s: oem_activate_service failed", __func__);
+       goto err_reg_netdev;
+   }
+#endif
+
 #ifdef PTT_SOCK_SVC_ENABLE
    //Initialize the PTT service
    if(ptt_sock_activate_svc(pHddCtx) != 0)
    {
       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: ptt_sock_activate_svc failed",__func__);
-      goto err_nl_srv;
+      goto err_reg_netdev;
+   }
+#endif
+
+#ifdef WLAN_FEATURE_RMC
+   if (hdd_open_cesium_nl_sock() < 0)
+   {
+      hddLog(VOS_TRACE_LEVEL_FATAL,"%s: hdd_open_cesium_nl_sock failed", __func__);
+      goto err_reg_netdev;
    }
 #endif
 
@@ -10344,11 +12204,13 @@
    {
        if(wlan_logging_sock_activate_svc(
                    pHddCtx->cfg_ini->wlanLoggingFEToConsole,
-                   pHddCtx->cfg_ini->wlanLoggingNumBuf))
+                   pHddCtx->cfg_ini->wlanLoggingNumBuf,
+                   pHddCtx->cfg_ini->wlanPerPktStatsLogEnable,
+                   pHddCtx->cfg_ini->wlanPerPktStatsNumBuf))
        {
            hddLog(VOS_TRACE_LEVEL_ERROR, "%s: wlan_logging_sock_activate_svc"
                    " failed", __func__);
-           goto err_nl_srv;
+           goto err_reg_netdev;
        }
        //TODO: To Remove enableDhcpDebug and use gEnableDebugLog for
        //EAPOL and DHCP
@@ -10361,7 +12223,9 @@
    if (pHddCtx->cfg_ini->wlanLoggingEnable &&
                (pHddCtx->cfg_ini->enableFWLogging ||
                 pHddCtx->cfg_ini->enableMgmtLogging ||
-                pHddCtx->cfg_ini->enableContFWLogging))
+                pHddCtx->cfg_ini->enableContFWLogging ||
+                pHddCtx->cfg_ini->enableFwrMemDump )
+                )
    {
        hdd_init_frame_logging(pHddCtx);
    }
@@ -10414,6 +12278,8 @@
    sme_UpdateChannelList(pHddCtx->hHal);
 
    /* Fwr capabilities received, Set the Dot11 mode */
+   sme_SetPhyMode(WLAN_HDD_GET_HAL_CTX(pAdapter),
+       hdd_cfg_xlate_to_csr_phy_mode(pHddCtx->cfg_ini->dot11Mode));
    sme_SetDefDot11Mode(pHddCtx->hHal);
 
 #ifndef CONFIG_ENABLE_LINUX_REG
@@ -10436,12 +12302,25 @@
    }
    wlan_hdd_cfg80211_nan_init(pHddCtx);
 
+   mutex_init(&pHddCtx->cur_rx_level_lock);
+   vos_timer_init(&pHddCtx->delack_timer, VOS_TIMER_TYPE_SW,
+                             hdd_tcp_delack_compute_function,(void *)pHddCtx);
+   vos_timer_init(&pHddCtx->tdls_source_timer, VOS_TIMER_TYPE_SW,
+                  wlan_hdd_change_tdls_mode, (void *)pHddCtx);
+
 #ifdef WLAN_FEATURE_EXTSCAN
     sme_EXTScanRegisterCallback(pHddCtx->hHal,
             wlan_hdd_cfg80211_extscan_callback,
                            pHddCtx);
 #endif /* WLAN_FEATURE_EXTSCAN */
 
+#ifdef FEATURE_OEM_DATA_SUPPORT
+    sme_OemDataRegisterCallback(pHddCtx->hHal,
+            wlan_hdd_cfg80211_oemdata_callback,
+                           pHddCtx);
+#endif /* FEATURE_OEM_DATA_SUPPORT */
+
+   sme_set_rssi_threshold_breached_cb(pHddCtx->hHal, hdd_rssi_threshold_breached_cb);
 #ifdef WLAN_NS_OFFLOAD
    // Register IPv6 notifier to notify if any change in IP
    // So that we can reconfigure the offload parameters
@@ -10469,16 +12348,12 @@
    {
       hddLog(VOS_TRACE_LEVEL_INFO, FL("Registered IPv4 notifier"));
    }
+   /*Fw mem dump procfs initialization*/
+   memdump_init();
    hdd_dp_util_send_rps_ind(pHddCtx);
 
    goto success;
 
-err_nl_srv:
-#ifdef WLAN_KD_READY_NOTIFIER
-   nl_srv_exit(pHddCtx->ptt_pid);
-#else
-   nl_srv_exit();
-#endif /* WLAN_KD_READY_NOTIFIER */
 err_reg_netdev:
    unregister_netdevice_notifier(&hdd_netdev_notifier);
 
@@ -10518,6 +12393,12 @@
    }
    vos_close(pVosContext );
 
+err_nl_srv:
+#ifdef WLAN_KD_READY_NOTIFIER
+   nl_srv_exit(pHddCtx->ptt_pid);
+#else
+   nl_srv_exit();
+#endif /* WLAN_KD_READY_NOTIFIER */
 err_vos_nv_close:
 
 #ifdef CONFIG_ENABLE_LINUX_REG
@@ -10651,6 +12532,8 @@
    }
 
    hddTraceInit();
+   hdd_register_debug_callback();
+
 #ifndef MODULE
       /* For statically linked driver, call hdd_set_conparam to update curr_con_mode
        */
@@ -11331,6 +13214,7 @@
  * --------------------------------------------------------------------------*/
 void wlan_hdd_decr_active_session(hdd_context_t *pHddCtx, tVOS_CON_MODE mode)
 {
+
    switch (mode) {
    case VOS_STA_MODE:
    case VOS_P2P_CLIENT_MODE:
@@ -11466,6 +13350,7 @@
           * the driver.
           *
           */
+
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
          cfg80211_rx_unprot_mlme_mgmt(pAdapterNode->pAdapter->dev, (u_int8_t*)mgmt, len);
 #else
@@ -11543,6 +13428,178 @@
    return status;
 }
 
+/**
+ * hdd_get_total_sessions() -  provide total number of active sessions
+ * @pHddCtx: Valid Global HDD context pointer
+ *
+ * This function iterates through pAdaptors and find the number of all active
+ * sessions. This active sessions includes connected sta, p2p client and number
+ * of client connected to sap/p2p go.
+ *
+ * Return:  Total number of active sessions.
+ */
+v_U8_t  hdd_get_total_sessions(hdd_context_t *pHddCtx)
+{
+    v_U8_t active_session = 0;
+    hdd_station_ctx_t *pHddStaCtx;
+    hdd_adapter_list_node_t *pAdapterNode, *pNext;
+    hdd_adapter_t *pAdapter;
+    VOS_STATUS status;
+
+    status = hdd_get_front_adapter(pHddCtx, &pAdapterNode);
+    while (NULL != pAdapterNode && VOS_STATUS_SUCCESS == status) {
+        pAdapter = pAdapterNode->pAdapter;
+        switch (pAdapter->device_mode) {
+        case VOS_STA_MODE:
+        case VOS_P2P_CLIENT_MODE:
+            pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+            if(eConnectionState_Associated == pHddStaCtx->conn_info.connState)
+               active_session += 1;
+            break;
+        case VOS_STA_SAP_MODE:
+        case VOS_P2P_GO_MODE:
+           active_session += hdd_softap_get_connected_sta(pAdapter);
+           break;
+        default:
+           break;
+        }
+
+        status = hdd_get_next_adapter(pHddCtx, pAdapterNode, &pNext);
+        pAdapterNode = pNext;
+    }
+
+    return active_session;
+}
+
+/**
+ * hdd_set_delack_value() - Set delack value
+ * @pHddCtx: Valid Global HDD context pointer
+ * @next_rx_level: Value to set for delack
+ *
+ * This function compare  present value and  next value of delack. If the both
+ * are diffrent then it sets next value .
+ *
+ * Return: void.
+ */
+void hdd_set_delack_value(hdd_context_t *pHddCtx, v_U32_t next_rx_level)
+{
+    if (pHddCtx->cur_rx_level != next_rx_level) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_DEBUG,
+               "%s: TCP DELACK trigger level %d",
+               __func__, next_rx_level);
+        mutex_lock(&pHddCtx->cur_rx_level_lock);
+        pHddCtx->cur_rx_level = next_rx_level;
+        mutex_unlock(&pHddCtx->cur_rx_level_lock);
+        wlan_hdd_send_svc_nlink_msg(WLAN_SVC_WLAN_TP_IND, &next_rx_level,
+                                                       sizeof(next_rx_level));
+    }
+}
+
+/**
+ * hdd_set_default_stop_delack_timer() - Start delack timer
+ * @pHddCtx: Valid Global HDD context pointer
+ *
+ * This function stop delack timer and set delack value to default..
+ *
+ * Return: void.
+ */
+
+void hdd_set_default_stop_delack_timer(hdd_context_t *pHddCtx)
+{
+    if (VOS_TIMER_STATE_RUNNING !=
+                            vos_timer_getCurrentState(&pHddCtx->delack_timer)) {
+         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_DEBUG,
+               "%s: Can not stop timer", __func__);
+        return;
+    }
+
+    vos_timer_stop(&pHddCtx->delack_timer);
+    hdd_set_delack_value(pHddCtx, TP_IND_LOW);
+}
+
+/**
+ * hdd_start_delack_timer() - Start delack timer
+ * @pHddCtx: Valid Global HDD context pointer
+ *
+ * This function starts the delack timer for tcpDelAckComputeInterval time
+ * interval.The default timer value is 2 second.
+ *
+ * Return: void.
+ */
+void hdd_start_delack_timer(hdd_context_t *pHddCtx)
+{
+    if (VOS_TIMER_STATE_RUNNING ==
+                            vos_timer_getCurrentState(&pHddCtx->delack_timer)) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_DEBUG,
+              "%s: Timer is already running", __func__);
+        return;
+    }
+
+    vos_timer_start(&pHddCtx->delack_timer,
+                                pHddCtx->cfg_ini->tcpDelAckComputeInterval);
+}
+
+/**
+ * hdd_update_prev_rx_packet_count() - Update previous rx packet count
+ * @pHddCtx: Valid Global HDD context pointer
+ *
+ * This function updates the prev_rx_packets count from the corresponding
+ * pAdapter states. This prev_rx_packets will diffed with the packet count
+ * at the end of delack timer. That can give number of RX packet is spacific
+ * time.
+ *
+ * Return: void.
+ */
+void hdd_update_prev_rx_packet_count(hdd_context_t *pHddCtx)
+{
+    hdd_adapter_list_node_t *pAdapterNode, *pNext;
+    hdd_adapter_t *pAdapter;
+    VOS_STATUS status;
+
+    status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
+    while (NULL != pAdapterNode && VOS_STATUS_SUCCESS == status) {
+        pAdapter = pAdapterNode->pAdapter;
+        pAdapter->prev_rx_packets = pAdapter->stats.rx_packets;
+        status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
+        pAdapterNode = pNext;
+    }
+}
+
+/**
+ * hdd_manage_delack_timer() - start\stop delack timer
+ * @pHddCtx: Valid Global HDD context pointer
+ *
+ * This function check the number of concerent session present, it starts the
+ * delack timer if only one session is present.
+ * In the case of BT_COEX and TDLS mode it blindly stop delack functionality.
+ *
+ * Return: void.
+ */
+void hdd_manage_delack_timer(hdd_context_t *pHddCtx)
+{
+    uint8_t sessions;
+
+    if (!pHddCtx->cfg_ini->enable_delack) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_DEBUG,
+               "%s: TCP DELACK is not enabled", __func__);
+        return;
+    }
+
+    /* Blindly stop timer of BTCOEX and TDLS Session is up */
+    if (pHddCtx->mode != 0) {
+        hdd_set_default_stop_delack_timer(pHddCtx);
+        return;
+    }
+
+    sessions = hdd_get_total_sessions(pHddCtx);
+    if (sessions == 1) {
+        hdd_update_prev_rx_packet_count(pHddCtx);
+        hdd_start_delack_timer(pHddCtx);
+    } else {
+        hdd_set_default_stop_delack_timer(pHddCtx);
+    }
+}
+
 /**---------------------------------------------------------------------------
  *
  *   \brief wlan_hdd_init_channels
@@ -12149,6 +14206,326 @@
     return sta_id;
 }
 
+/*FW memory dump feature*/
+/**
+ * This structure hold information about the /proc file
+ *
+ */
+static struct proc_dir_entry *proc_file, *proc_dir;
+
+/**
+ * memdump_read() - perform read operation in memory dump proc file
+ *
+ * @file  - handle for the proc file.
+ * @buf   - pointer to user space buffer.
+ * @count - number of bytes to be read.
+ * @pos   - offset in the from buffer.
+ *
+ * This function performs read operation for the memory dump proc file.
+ *
+ * Return: number of bytes read on success, error code otherwise.
+ */
+static ssize_t memdump_read(struct file *file, char __user *buf,
+                    size_t count, loff_t *pos)
+{
+    int status;
+    hdd_context_t *hdd_ctx = (hdd_context_t *)PDE_DATA(file_inode(file));
+    size_t ret_count;
+    loff_t bytes_left;
+    ENTER();
+
+    hddLog(LOG1, FL("Read req for size:%zu pos:%llu"), count, *pos);
+    status = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != status) {
+        return -EINVAL;
+    }
+
+    if (!wlan_fwr_mem_dump_test_and_set_read_allowed_bit()) {
+        hddLog(LOGE, FL("Current mem dump request timed out/failed"));
+        return -EINVAL;
+    }
+
+    /* run fs_read_handler in an atomic context*/
+    vos_ssr_protect(__func__);
+    ret_count = wlan_fwr_mem_dump_fsread_handler( buf, count, pos, &bytes_left);
+    if(bytes_left == 0)
+    {
+        /*Free the fwr mem dump buffer */
+        wlan_free_fwr_mem_dump_buffer();
+        wlan_set_fwr_mem_dump_state(FW_MEM_DUMP_IDLE);
+        ret_count=0;
+    }
+    /*if SSR/unload code is waiting for memdump_read to finish,signal it*/
+    vos_ssr_unprotect(__func__);
+    EXIT();
+    return ret_count;
+}
+
+/**
+ * struct memdump_fops - file operations for memory dump feature
+ * @read - read function for memory dump operation.
+ *
+ * This structure initialize the file operation handle for memory
+ * dump feature
+ */
+static const struct file_operations memdump_fops = {
+    read: memdump_read
+};
+
+/*
+* wlan_hdd_fw_mem_dump_cb : callback for Fw mem dump request
+* To be passed by HDD to WDA and called upon receiving of response
+* from firmware
+* @fwMemDumpReqContext : memory dump request context
+* @dump_rsp : dump response from HAL
+* Returns none
+*/
+void wlan_hdd_fw_mem_dump_cb(void *fwMemDumpReqContext,
+                         tAniFwrDumpRsp *dump_rsp)
+{
+    struct hdd_fw_mem_dump_req_ctx *pHddFwMemDumpCtx = (struct hdd_fw_mem_dump_req_ctx *)fwMemDumpReqContext;
+
+    ENTER();
+    spin_lock(&hdd_context_lock);
+    if(!pHddFwMemDumpCtx || (FW_MEM_DUMP_MAGIC != pHddFwMemDumpCtx->magic)) {
+       spin_unlock(&hdd_context_lock);
+       return;
+    }
+    /* report the status to requesting function and free mem.*/
+    if (dump_rsp->dump_status != eHAL_STATUS_SUCCESS) {
+       hddLog(LOGE, FL("fw dump request declined by fwr"));
+       //set the request completion variable
+       complete(&(pHddFwMemDumpCtx->req_completion));
+       //Free the allocated fwr dump
+       wlan_free_fwr_mem_dump_buffer();
+       wlan_set_fwr_mem_dump_state(FW_MEM_DUMP_IDLE);
+    }
+    else {
+       hddLog(LOG1, FL("fw dump request accepted by fwr"));
+       /* register the HDD callback which will be called by SVC */
+       wlan_set_svc_fw_mem_dump_req_cb((void*)wlan_hdd_fw_mem_dump_req_cb,(void*)pHddFwMemDumpCtx);
+    }
+    spin_unlock(&hdd_context_lock);
+    EXIT();
+
+}
+
+/**
+ * memdump_procfs_remove() - Remove file/dir under procfs for memory dump
+ *
+ * This function removes file/dir under proc file system that was
+ * processing firmware memory dump
+ *
+ * Return:  None
+ */
+static void memdump_procfs_remove(void)
+{
+    remove_proc_entry(PROCFS_MEMDUMP_NAME, proc_dir);
+    hddLog(LOG1 , FL("/proc/%s/%s removed\n"),
+           PROCFS_MEMDUMP_DIR, PROCFS_MEMDUMP_NAME);
+    remove_proc_entry(PROCFS_MEMDUMP_DIR, NULL);
+    hddLog(LOG1 , FL("/proc/%s removed\n"), PROCFS_MEMDUMP_DIR);
+}
+
+/**
+ * memdump_procfs_init() - Initialize procfs for memory dump
+ *
+ * @vos_ctx - Global vos context.
+ *
+ * This function create file under proc file system to be used later for
+ * processing firmware memory dump
+ *
+ * Return:   0 on success, error code otherwise.
+ */
+static int memdump_procfs_init(void *vos_ctx)
+{
+    hdd_context_t *hdd_ctx;
+
+    hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
+    if (!hdd_ctx) {
+        hddLog(LOGE , FL("Invalid HDD context"));
+        return -EINVAL;
+    }
+
+    proc_dir = proc_mkdir(PROCFS_MEMDUMP_DIR, NULL);
+    if (proc_dir == NULL) {
+        remove_proc_entry(PROCFS_MEMDUMP_DIR, NULL);
+        hddLog(LOGE , FL("Error: Could not initialize /proc/%s"),
+               PROCFS_MEMDUMP_DIR);
+        return -ENOMEM;
+    }
+
+    proc_file = proc_create_data(PROCFS_MEMDUMP_NAME,
+                                 S_IRUSR | S_IWUSR, proc_dir,
+                                 &memdump_fops, hdd_ctx);
+    if (proc_file == NULL) {
+        remove_proc_entry(PROCFS_MEMDUMP_NAME, proc_dir);
+        hddLog(LOGE , FL("Error: Could not initialize /proc/%s"),
+               PROCFS_MEMDUMP_NAME);
+        return -ENOMEM;
+    }
+
+    hddLog(LOG1 , FL("/proc/%s/%s created"),
+           PROCFS_MEMDUMP_DIR, PROCFS_MEMDUMP_NAME);
+
+    return 0;
+}
+
+/**
+ * memdump_init() - Initialization function for memory dump feature
+ *
+ * This function creates proc file for memdump feature and registers
+ * HDD callback function with SME.
+ *
+ * Return - 0 on success, error otherwise
+ */
+int memdump_init(void)
+{
+    hdd_context_t *hdd_ctx;
+    void *vos_ctx;
+    int status = 0;
+
+    vos_ctx = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+    if (!vos_ctx) {
+        hddLog(LOGE, FL("Invalid VOS context"));
+        return -EINVAL;
+    }
+
+    hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
+    if (!hdd_ctx) {
+        hddLog(LOGE , FL("Invalid HDD context"));
+        return -EINVAL;
+    }
+
+    status = memdump_procfs_init(vos_ctx);
+    if (status) {
+        hddLog(LOGE , FL("Failed to create proc file"));
+        return status;
+    }
+
+    return 0;
+}
+
+/**
+ * memdump_deinit() - De initialize memdump feature
+ *
+ * This function removes proc file created for memdump feature.
+ *
+ * Return: None
+ */
+int memdump_deinit(void)
+{
+    hdd_context_t *hdd_ctx;
+    void *vos_ctx;
+
+    vos_ctx = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+    if (!vos_ctx) {
+        hddLog(LOGE, FL("Invalid VOS context"));
+        return -EINVAL;
+    }
+
+    hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
+    if(!hdd_ctx) {
+        hddLog(LOGE , FL("Invalid HDD context"));
+        return -EINVAL;
+    }
+
+    memdump_procfs_remove();
+    return 0;
+}
+
+/**
+ * wlan_hdd_fw_mem_dump_req(pHddCtx) - common API(cfg80211/ioctl) for requesting fw mem dump to SME
+ * Return: HAL status
+ */
+
+int wlan_hdd_fw_mem_dump_req(hdd_context_t * pHddCtx)
+{
+   tAniFwrDumpReq fw_mem_dump_req={0};
+   struct hdd_fw_mem_dump_req_ctx fw_mem_dump_ctx;
+   eHalStatus status = eHAL_STATUS_FAILURE;
+   int ret=0, result;
+   ENTER();
+
+   /*Check whether a dump request is already going on
+    *Caution this function will free previously held memory if new dump request is allowed*/
+   if (!wlan_fwr_mem_dump_test_and_set_write_allowed_bit()) {
+       hddLog(LOGE, FL("Fw memdump already in progress"));
+       return -EBUSY;
+   }
+   //Allocate memory for fw mem dump buffer
+   ret = wlan_fwr_mem_dump_buffer_allocation();
+   if(ret == -EFAULT)
+   {
+      hddLog(LOGE, FL("Fwr mem dump not supported by FW"));
+      return ret;
+   }
+   if (0 != ret) {
+       hddLog(LOGE, FL("Fwr mem Allocation failed"));
+       return -ENOMEM;
+   }
+   init_completion(&fw_mem_dump_ctx.req_completion);
+   fw_mem_dump_ctx.magic = FW_MEM_DUMP_MAGIC;
+   fw_mem_dump_ctx.status = false;
+
+   fw_mem_dump_req.fwMemDumpReqCallback = wlan_hdd_fw_mem_dump_cb;
+   fw_mem_dump_req.fwMemDumpReqContext = &fw_mem_dump_ctx;
+   status = sme_FwMemDumpReq(pHddCtx->hHal, &fw_mem_dump_req);
+   if(eHAL_STATUS_SUCCESS != status)
+   {
+       hddLog(VOS_TRACE_LEVEL_ERROR,
+          "%s: fw_mem_dump_req failed ", __func__);
+       wlan_free_fwr_mem_dump_buffer();
+       ret = -EFAULT;
+       goto cleanup;
+   }
+   /*wait for fw mem dump completion to send event to userspace*/
+   result =
+     wait_for_completion_timeout(&fw_mem_dump_ctx.req_completion,
+                            msecs_to_jiffies(FW_MEM_DUMP_TIMEOUT_MS));
+   if (0 >= result )
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR,
+          "%s: fw_mem_dump_req timeout %d ", __func__,result);
+      ret = -ETIMEDOUT;
+   }
+cleanup:
+   spin_lock(&hdd_context_lock);
+   fw_mem_dump_ctx.magic = 0;
+   if(!ret && !fw_mem_dump_ctx.status)
+      ret = -EFAULT;
+   spin_unlock(&hdd_context_lock);
+
+   EXIT();
+   return ret;
+}
+
+/**
+ * HDD callback which will be called by SVC to indicate mem dump completion.
+ */
+void wlan_hdd_fw_mem_dump_req_cb(struct hdd_fw_mem_dump_req_ctx* pHddFwMemDumpCtx)
+{
+   if (!pHddFwMemDumpCtx) {
+       hddLog(VOS_TRACE_LEVEL_ERROR,
+          "%s: HDD context not valid ", __func__);
+       return;
+   }
+   spin_lock(&hdd_context_lock);
+   /* check the req magic and set status */
+   if (pHddFwMemDumpCtx->magic == FW_MEM_DUMP_MAGIC)
+   {
+       pHddFwMemDumpCtx->status = true;
+       //signal the completion
+       complete(&(pHddFwMemDumpCtx->req_completion));
+   }
+   else
+   {
+       hddLog(VOS_TRACE_LEVEL_ERROR,
+          "%s: fw mem dump request possible timeout ", __func__);
+   }
+   spin_unlock(&hdd_context_lock);
+}
+
 void hdd_initialize_adapter_common(hdd_adapter_t *pAdapter)
 {
         if (NULL == pAdapter)
@@ -12188,6 +14565,7 @@
         return;
 }
 
+
 //Register the module init/exit functions
 module_init(hdd_module_init);
 module_exit(hdd_module_exit);
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_oemdata.c b/wlan/prima/CORE/HDD/src/wlan_hdd_oemdata.c
index 146efdd..ca2c812 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_oemdata.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_oemdata.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -46,6 +46,10 @@
 #include <wlan_hdd_includes.h>
 #include <net/arp.h>
 #include <vos_sched.h>
+#include "qwlan_version.h"
+
+static struct hdd_context_s *pHddCtx;
+
 /*---------------------------------------------------------------------------------------------
 
   \brief hdd_OemDataReqCallback() - 
@@ -315,4 +319,678 @@
     return ret;
 }
 
+/**---------------------------------------------------------------------------
+
+  \brief iw_get_oem_data_cap()
+
+  This function gets the capability information for OEM Data Request
+  and Response.
+
+  \param - dev  - Pointer to the net device
+         - info - Pointer to the t_iw_oem_data_cap
+         - wrqu - Pointer to the iwreq data
+         - extra - Pointer to the data
+
+  \return - 0 for success, non zero for failure
+
+----------------------------------------------------------------------------*/
+int iw_get_oem_data_cap(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra)
+{
+    eHalStatus status;
+    t_iw_oem_data_cap oemDataCap;
+    t_iw_oem_data_cap *pHddOemDataCap;
+    hdd_adapter_t *pAdapter = netdev_priv(dev);
+    hdd_context_t *pHddContext;
+    hdd_config_t *pConfig;
+    tANI_U32 numChannels;
+    tANI_U8 chanList[OEM_CAP_MAX_NUM_CHANNELS];
+    tANI_U32 i;
+    int ret;
+
+    ENTER();
+
+    if (!pAdapter)
+    {
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "%s:Invalid context, pAdapter is null", __func__);
+       return -EINVAL;
+    }
+
+    pHddContext = WLAN_HDD_GET_CTX(pAdapter);
+    ret = wlan_hdd_validate_context(pHddContext);
+    if (0 != ret)
+      return ret;
+
+    pConfig = pHddContext->cfg_ini;
+
+    do
+    {
+       vos_mem_zero(&oemDataCap, sizeof(oemDataCap));
+       strlcpy(oemDataCap.oem_target_signature, OEM_TARGET_SIGNATURE,
+               OEM_TARGET_SIGNATURE_LEN);
+       oemDataCap.oem_target_type = TARGET_TYPE_PRONTO;
+       oemDataCap.oem_fw_version = 0;
+       oemDataCap.driver_version.major = QWLAN_VERSION_MAJOR;
+       oemDataCap.driver_version.minor = QWLAN_VERSION_MINOR;
+       oemDataCap.driver_version.patch = QWLAN_VERSION_PATCH;
+       oemDataCap.driver_version.build = QWLAN_VERSION_BUILD;
+       oemDataCap.allowed_dwell_time_min = pConfig->nNeighborScanMinChanTime;
+       oemDataCap.allowed_dwell_time_max = pConfig->nNeighborScanMaxChanTime;
+       oemDataCap.curr_dwell_time_min =
+               sme_getNeighborScanMinChanTime(pHddContext->hHal);
+       oemDataCap.curr_dwell_time_max =
+               sme_getNeighborScanMaxChanTime(pHddContext->hHal);
+       oemDataCap.supported_bands = pConfig->nBandCapability;
+
+       /* request for max num of channels */
+       numChannels = WNI_CFG_VALID_CHANNEL_LIST_LEN;
+       status = sme_GetCfgValidChannels(pHddContext->hHal,
+                                        &chanList[0],
+                                        &numChannels);
+       if (eHAL_STATUS_SUCCESS != status)
+       {
+         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                   "%s:failed to get valid channel list", __func__);
+         return -ENOENT;
+       }
+       else
+       {
+         /* make sure num channels is not more than chan list array */
+         if (numChannels > OEM_CAP_MAX_NUM_CHANNELS)
+         {
+           VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                     "%s:Num of channels(%d) more than length(%d) of chanlist",
+                     __func__, numChannels, OEM_CAP_MAX_NUM_CHANNELS);
+           return -ENOMEM;
+         }
+
+         oemDataCap.num_channels = numChannels;
+         for (i = 0; i < numChannels; i++)
+         {
+           oemDataCap.channel_list[i] = chanList[i];
+         }
+       }
+
+       pHddOemDataCap = (t_iw_oem_data_cap *)(extra);
+       vos_mem_copy(pHddOemDataCap, &oemDataCap, sizeof(*pHddOemDataCap));
+    } while (0);
+
+    EXIT();
+    return 0;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief send_oem_reg_rsp_nlink_msg() - send oem registration response
+
+  This function sends oem message to registered application process
+
+  \param -
+     - none
+
+  \return - none
+
+  --------------------------------------------------------------------------*/
+static void send_oem_reg_rsp_nlink_msg(void)
+{
+   struct sk_buff *skb;
+   struct nlmsghdr *nlh;
+   tAniMsgHdr *aniHdr;
+   tANI_U8 *buf;
+   tANI_U8 *numInterfaces;
+   tANI_U8 *deviceMode;
+   tANI_U8 *vdevId;
+   hdd_adapter_list_node_t *pAdapterNode = NULL;
+   hdd_adapter_list_node_t *pNext = NULL;
+   hdd_adapter_t *pAdapter = NULL;
+   VOS_STATUS status = 0;
+
+   /* OEM message is always to a specific process and cannot be a broadcast */
+   if (pHddCtx->oem_pid == 0)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: invalid dest pid", __func__);
+      return;
+   }
+
+   skb = alloc_skb(NLMSG_SPACE(WLAN_NL_MAX_PAYLOAD), GFP_KERNEL);
+   if (skb == NULL)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: alloc_skb failed", __func__);
+      return;
+   }
+
+   nlh = (struct nlmsghdr *)skb->data;
+   nlh->nlmsg_pid = 0;  /* from kernel */
+   nlh->nlmsg_flags = 0;
+   nlh->nlmsg_seq = 0;
+   nlh->nlmsg_type = WLAN_NL_MSG_OEM;
+   aniHdr = NLMSG_DATA(nlh);
+   aniHdr->type = ANI_MSG_APP_REG_RSP;
+
+   /* Fill message body:
+    *   First byte will be number of interfaces, followed by
+    *   two bytes for each interfaces
+    *     - one byte for device mode
+    *     - one byte for vdev id
+    */
+   buf = (char *) ((char *)aniHdr + sizeof(tAniMsgHdr));
+   numInterfaces = buf++;
+   *numInterfaces = 0;
+
+   /* Iterate through each of the adapters and fill device mode and vdev id */
+   status = hdd_get_front_adapter(pHddCtx, &pAdapterNode);
+   while ((VOS_STATUS_SUCCESS == status) && pAdapterNode)
+   {
+     pAdapter = pAdapterNode->pAdapter;
+     if (pAdapter)
+     {
+       deviceMode = buf++;
+       vdevId = buf++;
+       *deviceMode = pAdapter->device_mode;
+       *vdevId = pAdapter->sessionId;
+       (*numInterfaces)++;
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                 "%s: numInterfaces: %d, deviceMode: %d, vdevId: %d",
+                 __func__, *numInterfaces, *deviceMode, *vdevId);
+     }
+     status = hdd_get_next_adapter(pHddCtx, pAdapterNode, &pNext);
+     pAdapterNode = pNext;
+   }
+
+   aniHdr->length = sizeof(tANI_U8) + (*numInterfaces) * 2 * sizeof(tANI_U8);
+   nlh->nlmsg_len = NLMSG_LENGTH((sizeof(tAniMsgHdr) + aniHdr->length));
+
+   skb_put(skb, NLMSG_SPACE((sizeof(tAniMsgHdr) + aniHdr->length)));
+
+   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+             "%s: sending App Reg Response length (%d) to process pid (%d)",
+             __func__, aniHdr->length, pHddCtx->oem_pid);
+
+   (void)nl_srv_ucast(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
+
+   return;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief send_oem_err_rsp_nlink_msg() - send oem error response
+
+  This function sends error response to oem app
+
+  \param -
+     - app_pid - PID of oem application process
+
+  \return - none
+
+  --------------------------------------------------------------------------*/
+static void send_oem_err_rsp_nlink_msg(v_SINT_t app_pid, tANI_U8 error_code)
+{
+   struct sk_buff *skb;
+   struct nlmsghdr *nlh;
+   tAniMsgHdr *aniHdr;
+   tANI_U8 *buf;
+
+   skb = alloc_skb(NLMSG_SPACE(WLAN_NL_MAX_PAYLOAD), GFP_KERNEL);
+   if (skb == NULL)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: alloc_skb failed", __func__);
+      return;
+   }
+
+   nlh = (struct nlmsghdr *)skb->data;
+   nlh->nlmsg_pid = 0;  /* from kernel */
+   nlh->nlmsg_flags = 0;
+   nlh->nlmsg_seq = 0;
+   nlh->nlmsg_type = WLAN_NL_MSG_OEM;
+   aniHdr = NLMSG_DATA(nlh);
+   aniHdr->type = ANI_MSG_OEM_ERROR;
+   aniHdr->length = sizeof(tANI_U8);
+   nlh->nlmsg_len = NLMSG_LENGTH(sizeof(tAniMsgHdr) + aniHdr->length);
+
+   /* message body will contain one byte of error code */
+   buf = (char *) ((char *) aniHdr + sizeof(tAniMsgHdr));
+   *buf = error_code;
+
+   skb_put(skb, NLMSG_SPACE(sizeof(tAniMsgHdr) + aniHdr->length));
+
+   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+             "%s: sending oem error response to process pid (%d)",
+             __func__, app_pid);
+
+   (void)nl_srv_ucast(skb, app_pid, MSG_DONTWAIT);
+
+   return;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief send_oem_data_rsp_msg() - send oem data response
+
+  This function sends oem data rsp message to registered application process
+  over the netlink socket.
+
+  \param -
+     - oemDataRsp - Pointer to OEM Data Response struct
+
+  \return - 0 for success, non zero for failure
+
+  --------------------------------------------------------------------------*/
+void send_oem_data_rsp_msg(tANI_U32 length, tANI_U8 *oemDataRsp)
+{
+   struct sk_buff *skb;
+   struct nlmsghdr *nlh;
+   tAniMsgHdr *aniHdr;
+   tANI_U8 *oemData;
+
+   /* OEM message is always to a specific process and cannot be a broadcast */
+   if (pHddCtx->oem_pid == 0)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: invalid dest pid", __func__);
+      return;
+   }
+
+   if (length > NEW_OEM_DATA_RSP_SIZE)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: invalid length of Oem Data response", __func__);
+      return;
+   }
+
+   skb = alloc_skb(NLMSG_SPACE(sizeof(tAniMsgHdr) + length),
+                   GFP_KERNEL);
+   if (skb == NULL)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: alloc_skb failed", __func__);
+      return;
+   }
+
+   nlh = (struct nlmsghdr *)skb->data;
+   nlh->nlmsg_pid = 0;  /* from kernel */
+   nlh->nlmsg_flags = 0;
+   nlh->nlmsg_seq = 0;
+   nlh->nlmsg_type = WLAN_NL_MSG_OEM;
+   aniHdr = NLMSG_DATA(nlh);
+   aniHdr->type = ANI_MSG_OEM_DATA_RSP;
+
+   aniHdr->length = length;
+   nlh->nlmsg_len = NLMSG_LENGTH((sizeof(tAniMsgHdr) + aniHdr->length));
+   oemData = (tANI_U8 *) ((char *)aniHdr + sizeof(tAniMsgHdr));
+   vos_mem_copy(oemData, oemDataRsp, length);
+
+   skb_put(skb, NLMSG_SPACE((sizeof(tAniMsgHdr) + aniHdr->length)));
+
+   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+             "%s: sending Oem Data Response of len (%d) to process pid (%d)",
+             __func__, length, pHddCtx->oem_pid);
+
+   (void)nl_srv_ucast(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
+
+   return;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief oem_process_channel_info_req_msg() - process oem channel_info request
+
+  This function responds with channel info to oem process
+
+  \param -
+     - numOfChannels - number of channels
+     - chanList - channel list
+
+  \return - 0 for success, non zero for failure
+
+  --------------------------------------------------------------------------*/
+static int oem_process_channel_info_req_msg(int numOfChannels, char *chanList)
+{
+   struct sk_buff *skb;
+   struct nlmsghdr *nlh;
+   tAniMsgHdr *aniHdr;
+   tHddChannelInfo *pHddChanInfo;
+   tHddChannelInfo hddChanInfo;
+   tANI_U8 chanId;
+   tANI_U32 reg_info_1;
+   tANI_U32 reg_info_2;
+   eHalStatus status = eHAL_STATUS_FAILURE;
+   int i;
+   tANI_U8 *buf;
+
+   /* OEM message is always to a specific process and cannot be a broadcast */
+   if (pHddCtx->oem_pid == 0)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: invalid dest pid", __func__);
+      return -1;
+   }
+
+   skb = alloc_skb(NLMSG_SPACE(sizeof(tAniMsgHdr) + sizeof(tANI_U8) +
+                   numOfChannels * sizeof(tHddChannelInfo)), GFP_KERNEL);
+   if (skb == NULL)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: alloc_skb failed", __func__);
+      return -1;
+   }
+
+   nlh = (struct nlmsghdr *)skb->data;
+   nlh->nlmsg_pid = 0;  /* from kernel */
+   nlh->nlmsg_flags = 0;
+   nlh->nlmsg_seq = 0;
+   nlh->nlmsg_type = WLAN_NL_MSG_OEM;
+   aniHdr = NLMSG_DATA(nlh);
+   aniHdr->type = ANI_MSG_CHANNEL_INFO_RSP;
+
+   aniHdr->length = sizeof(tANI_U8) + numOfChannels * sizeof(tHddChannelInfo);
+   nlh->nlmsg_len = NLMSG_LENGTH((sizeof(tAniMsgHdr) + aniHdr->length));
+
+   /* First byte of message body will have num of channels */
+   buf = (char *) ((char *)aniHdr + sizeof(tAniMsgHdr));
+   *buf++ = numOfChannels;
+
+   /* Next follows channel info struct for each channel id.
+       * If chan id is wrong or SME returns failure for a channel
+       * then fill in 0 in channel info for that particular channel
+       */
+   for (i = 0 ; i < numOfChannels; i++)
+   {
+      pHddChanInfo = (tHddChannelInfo *) ((char *) buf +
+                                        i * sizeof(tHddChannelInfo));
+
+      chanId = chanList[i];
+      status = sme_getRegInfo(pHddCtx->hHal, chanId,
+                              &reg_info_1, &reg_info_2);
+      if (eHAL_STATUS_SUCCESS == status)
+      {
+         /* band center freq1, and freq2 depends on peer's capability
+                  * and at this time we might not be associated on the given
+                  * channel, so fill freq1=mhz, and freq2=0
+                  */
+         hddChanInfo.chan_id = chanId;
+         hddChanInfo.reserved0 = 0;
+         hddChanInfo.mhz = vos_chan_to_freq(chanId);
+         hddChanInfo.band_center_freq1 = hddChanInfo.mhz;
+         hddChanInfo.band_center_freq2 = 0;
+
+         /* set only DFS flag in info, rest of the fields will be filled in
+                 *  by the OEM App
+                 */
+         hddChanInfo.info = 0;
+         if (NV_CHANNEL_DFS == vos_nv_getChannelEnabledState(chanId))
+             hddChanInfo.info |= (1 << WLAN_HAL_CHAN_FLAG_DFS);
+
+         hddChanInfo.reg_info_1 = reg_info_1;
+         hddChanInfo.reg_info_2 = reg_info_2;
+      }
+      else
+      {
+         /* chanId passed to sme_getRegInfo is not valid, fill in zeros
+                  * in channel info struct
+                  */
+         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                   "%s: sme_getRegInfo failed for chan (%d), return info 0",
+                   __func__, chanId);
+         hddChanInfo.chan_id = chanId;
+         hddChanInfo.reserved0 = 0;
+         hddChanInfo.mhz = 0;
+         hddChanInfo.band_center_freq1 = 0;
+         hddChanInfo.band_center_freq2 = 0;
+         hddChanInfo.info = 0;
+         hddChanInfo.reg_info_1 = 0;
+         hddChanInfo.reg_info_2 = 0;
+      }
+      vos_mem_copy(pHddChanInfo, &hddChanInfo, sizeof(tHddChannelInfo));
+   }
+
+   skb_put(skb, NLMSG_SPACE((sizeof(tAniMsgHdr) + aniHdr->length)));
+
+   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+             "%s: sending channel info resp for num channels (%d) to pid (%d)",
+             __func__, numOfChannels, pHddCtx->oem_pid);
+
+   (void)nl_srv_ucast(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
+
+   return 0;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief oem_process_data_req_msg() - process oem data request
+
+  This function sends oem message to SME
+
+  \param -
+     - oemDataLen - Length to OEM Data buffer
+     - oemData - Pointer to OEM Data buffer
+
+  \return - eHalStatus enumeration
+
+  --------------------------------------------------------------------------*/
+void oem_process_data_req_msg(int oemDataLen, char *oemData)
+{
+   tOemDataReqNewConfig oemDataReqNewConfig;
+   hdd_adapter_t *pAdapter = NULL;
+
+   /* for now, STA interface only */
+   pAdapter = hdd_get_adapter(pHddCtx, WLAN_HDD_INFRA_STATION);
+   if (!pAdapter)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: No adapter for STA mode", __func__);
+      return;
+   }
+
+   if (!oemData)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: oemData is null", __func__);
+      return;
+   }
+
+   vos_mem_zero(&oemDataReqNewConfig, sizeof(tOemDataReqNewConfig));
+   vos_mem_copy(&oemDataReqNewConfig.selfMacAddr,
+                pAdapter->macAddressCurrent.bytes, sizeof(tSirMacAddr));
+   vos_mem_copy(&oemDataReqNewConfig.oemDataReqNew, oemData, oemDataLen);
+
+   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+             "selfMacAddr: " MAC_ADDRESS_STR" ",
+              MAC_ADDR_ARRAY(oemDataReqNewConfig.selfMacAddr));
+
+   sme_OemDataReqNew(pHddCtx->hHal,
+                           &oemDataReqNewConfig);
+}
+
+/*
+ * Callback function invoked by Netlink service for all netlink
+ * messages (from user space) addressed to WLAN_NL_MSG_OEM
+ */
+
+/**
+ * oem_msg_callback() - callback invoked by netlink service
+ * @skb:    skb with netlink message
+ *
+ * This function gets invoked by netlink service when a message
+ * is received from user space addressed to WLAN_NL_MSG_OEM
+ *
+ * Return: zero on success
+ *         On error, error number will be returned.
+ */
+static int oem_msg_callback(struct sk_buff *skb)
+{
+   struct nlmsghdr *nlh;
+   tAniMsgHdr *msg_hdr;
+   int ret;
+   char *sign_str = NULL;
+   char* aniMsgBody;
+   tANI_U32 *oemMsgSubType;
+
+   nlh = (struct nlmsghdr *)skb->data;
+
+   if (!nlh) {
+       hddLog(LOGE, FL("Netlink header null"));
+       return -EPERM;
+   }
+
+   ret = wlan_hdd_validate_context(pHddCtx);
+   if (0 != ret) {
+       hddLog(LOGE, FL("HDD context is not valid"));
+       return ret;
+   }
+
+   msg_hdr = NLMSG_DATA(nlh);
+
+   if (!msg_hdr) {
+       hddLog(LOGE, FL("Message header null"));
+       send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid, OEM_ERR_NULL_MESSAGE_HEADER);
+       return -EPERM;
+   }
+
+   if (nlh->nlmsg_len < NLMSG_LENGTH(sizeof(tAniMsgHdr) + msg_hdr->length)) {
+       hddLog(LOGE, FL("Invalid nl msg len, nlh->nlmsg_len (%d), msg_hdr->len (%d)"),
+              nlh->nlmsg_len, msg_hdr->length);
+       send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
+                                  OEM_ERR_INVALID_MESSAGE_LENGTH);
+       return -EPERM;
+   }
+
+   hddLog(LOG1, FL("Received App msg type: %d"), msg_hdr->type);
+
+   switch (msg_hdr->type) {
+   case ANI_MSG_APP_REG_REQ:
+      /* Registration request is only allowed for Qualcomm Application */
+      hddLog(LOG1, FL("Received App Req Req from App process pid(%d), len(%d)"),
+                   nlh->nlmsg_pid, msg_hdr->length);
+
+      sign_str = (char *)((char *)msg_hdr + sizeof(tAniMsgHdr));
+      if ((OEM_APP_SIGNATURE_LEN == msg_hdr->length) &&
+          (0 == strncmp(sign_str, OEM_APP_SIGNATURE_STR,
+                        OEM_APP_SIGNATURE_LEN))) {
+          hddLog(LOG1, FL("Valid App Req Req from oem app process pid(%d)"),
+                       nlh->nlmsg_pid);
+
+          pHddCtx->oem_app_registered = TRUE;
+          pHddCtx->oem_pid = nlh->nlmsg_pid;
+          send_oem_reg_rsp_nlink_msg();
+      } else {
+          hddLog(LOGE, FL("Invalid signature in App Reg Request from pid(%d)"),
+                 nlh->nlmsg_pid);
+          send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
+                                       OEM_ERR_INVALID_SIGNATURE);
+          return -EPERM;
+      }
+      break;
+
+   case ANI_MSG_OEM_DATA_REQ:
+      hddLog(LOG1, FL("Received Oem Data Request length(%d) from pid: %d"),
+                   msg_hdr->length, nlh->nlmsg_pid);
+
+      if ((!pHddCtx->oem_app_registered) ||
+          (nlh->nlmsg_pid != pHddCtx->oem_pid)) {
+          /* either oem app is not registered yet or pid is different */
+          hddLog(LOGE, FL("OEM DataReq: app not registered(%d) or incorrect pid(%d)"),
+                 pHddCtx->oem_app_registered, nlh->nlmsg_pid);
+          send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
+                                       OEM_ERR_APP_NOT_REGISTERED);
+          return -EPERM;
+      }
+
+      if ((!msg_hdr->length) || (OEM_DATA_REQ_SIZE < msg_hdr->length)) {
+          hddLog(LOGE, FL("Invalid length (%d) in Oem Data Request"),
+                       msg_hdr->length);
+          send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
+                                       OEM_ERR_INVALID_MESSAGE_LENGTH);
+          return -EPERM;
+      }
+      aniMsgBody = (char *)((char *)msg_hdr + sizeof(tAniMsgHdr));
+      oemMsgSubType = (tANI_U32*) aniMsgBody;
+      hddLog(LOGE, FL("oemMsgSubType: 0x%x"), *oemMsgSubType);
+
+      oem_process_data_req_msg(msg_hdr->length,
+                              (char *) ((char *)msg_hdr +
+                              sizeof(tAniMsgHdr)));
+      break;
+
+   case ANI_MSG_CHANNEL_INFO_REQ:
+      hddLog(LOG1,
+             FL("Received channel info request, num channel(%d) from pid: %d"),
+             msg_hdr->length, nlh->nlmsg_pid);
+
+      if ((!pHddCtx->oem_app_registered) ||
+          (nlh->nlmsg_pid != pHddCtx->oem_pid)) {
+          /* either oem app is not registered yet or pid is different */
+          hddLog(LOGE,
+                 FL("Chan InfoReq: app not registered(%d) or incorrect pid(%d)"),
+                 pHddCtx->oem_app_registered, nlh->nlmsg_pid);
+          send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
+                                     OEM_ERR_APP_NOT_REGISTERED);
+          return -EPERM;
+      }
+
+      /* message length contains list of channel ids */
+      if ((!msg_hdr->length) ||
+          (WNI_CFG_VALID_CHANNEL_LIST_LEN < msg_hdr->length)) {
+          hddLog(LOGE,
+                 FL("Invalid length (%d) in channel info request"),
+                 msg_hdr->length);
+          send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
+                                    OEM_ERR_INVALID_MESSAGE_LENGTH);
+          return -EPERM;
+      }
+      oem_process_channel_info_req_msg(msg_hdr->length,
+                            (char *)((char*)msg_hdr + sizeof(tAniMsgHdr)));
+      break;
+
+   default:
+      hddLog(LOGE,
+             FL("Received Invalid message type (%d), length (%d)"),
+             msg_hdr->type, msg_hdr->length);
+      send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
+                                 OEM_ERR_INVALID_MESSAGE_TYPE);
+      return -EPERM;
+   }
+   return 0;
+}
+
+static int __oem_msg_callback(struct sk_buff *skb)
+{
+    int ret;
+
+    vos_ssr_protect(__func__);
+    ret = oem_msg_callback(skb);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief oem_activate_service() - Activate oem message handler
+
+  This function registers a handler to receive netlink message from
+  an OEM application process.
+
+  \param -
+     - pAdapter - pointer to HDD adapter
+
+  \return - 0 for success, non zero for failure
+
+  --------------------------------------------------------------------------*/
+int oem_activate_service(void *pAdapter)
+{
+   pHddCtx = (struct hdd_context_s*) pAdapter;
+
+   /* Register the msg handler for msgs addressed to WLAN_NL_MSG_OEM */
+   nl_srv_register(WLAN_NL_MSG_OEM, __oem_msg_callback);
+   return 0;
+}
+
+
 #endif
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_p2p.c b/wlan/prima/CORE/HDD/src/wlan_hdd_p2p.c
index 615da70..12593cb 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_p2p.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_p2p.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -177,7 +177,6 @@
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     rem_on_channel_request_type_t req_type;
 
-
     if (pHddCtx == NULL)
     {
         hddLog(LOGE, "%s: Hdd Context is NULL", __func__);
@@ -200,8 +199,16 @@
             pRemainChanCtx->rem_on_chan_request,
             pRemainChanCtx->chan.center_freq,
             pRemainChanCtx->cookie);
-    vos_timer_stop(&pRemainChanCtx->hdd_remain_on_chan_timer);
-    vos_timer_destroy(&pRemainChanCtx->hdd_remain_on_chan_timer);
+    if(!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                    &pRemainChanCtx->hdd_remain_on_chan_timer)))
+    {
+        hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
+    }
+    if(!VOS_IS_STATUS_SUCCESS(vos_timer_destroy(
+                    &pRemainChanCtx->hdd_remain_on_chan_timer)))
+    {
+        hddLog( LOGE, FL("Failed to destroy hdd_remain_on_chan_timer"));
+    }
     if ( REMAIN_ON_CHANNEL_REQUEST == pRemainChanCtx->rem_on_chan_request )
     {
         if( cfgState->buf )
@@ -258,6 +265,10 @@
             vos_mem_free(pRemainChanCtx->action_pkt_buff.frame_ptr);
         }
     }
+
+    hddLog( LOG1, FL(
+                "Freeing ROC ctx cfgState->remain_on_chan_ctx=%p"),
+            cfgState->remain_on_chan_ctx);
     vos_mem_free( pRemainChanCtx );
     pRemainChanCtx = NULL;
     cfgState->remain_on_chan_ctx = NULL;
@@ -294,7 +305,11 @@
                     "Cancel Existing ROC (cookie=%llu)",
                     pRemainChanCtx->cookie);
 
-            vos_timer_stop(&pRemainChanCtx->hdd_remain_on_chan_timer);
+            if(!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                           &pRemainChanCtx->hdd_remain_on_chan_timer)))
+            {
+                hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
+            }
         }
         /* Wait till remain on channel ready indication before issuing cancel
          * remain on channel request, otherwise if remain on channel not
@@ -318,6 +333,10 @@
                         "%s: timeout waiting for remain on channel"
                         " ready indication %d",
                         __func__, status);
+                vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                      WLAN_LOG_INDICATOR_HOST_DRIVER,
+                      WLAN_LOG_REASON_HDD_TIME_OUT,
+                      FALSE, TRUE);
                 return VOS_STATUS_E_FAILURE;
             }
 
@@ -354,8 +373,8 @@
             }
             else
                 pRemainChanCtx->hdd_remain_on_chan_cancel_in_progress = TRUE;
-            mutex_unlock(&pHddCtx->roc_lock);
             INIT_COMPLETION(pAdapter->cancel_rem_on_chan_var);
+            mutex_unlock(&pHddCtx->roc_lock);
 
             /* Issue abort remain on chan request to sme.
              * The remain on channel callback will make sure the remain_on_chan
@@ -382,14 +401,14 @@
             status = wait_for_completion_interruptible_timeout(
                                     &pAdapter->cancel_rem_on_chan_var,
                                     msecs_to_jiffies(WAIT_CANCEL_REM_CHAN));
+            hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_ROC);
             if (0 >= status)
             {
-                hddLog( LOGE,
-                       "%s: timeout waiting for cancel remain on channel"
-                         " ready indication %d",
-                          __func__, status);
+                hddLog(LOGE,
+                       FL("Timeout waiting for cancel remain on channel ready indication %d"),
+                       status);
+                return VOS_STATUS_E_FAILURE;
             }
-            hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_ROC);
          }
          else
          {
@@ -477,8 +496,8 @@
     }
 
     pRemainChanCtx->hdd_remain_on_chan_cancel_in_progress = TRUE;
-    mutex_unlock(&pHddCtx->roc_lock);
     INIT_COMPLETION(pAdapter->cancel_rem_on_chan_var);
+    mutex_unlock(&pHddCtx->roc_lock);
     hddLog( LOG1,"%s: Cancel Remain on Channel on timeout", __func__);
     if ( ( WLAN_HDD_INFRA_STATION == pAdapter->device_mode ) ||
           ( WLAN_HDD_P2P_CLIENT == pAdapter->device_mode ) ||
@@ -498,6 +517,9 @@
         WLANSAP_CancelRemainOnChannel(
                 (WLAN_HDD_GET_CTX(pAdapter))->pvosContext);
     }
+
+    wlan_hdd_start_stop_tdls_source_timer(pHddCtx, eTDLS_SUPPORT_ENABLED);
+
     hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_ROC);
 }
 
@@ -557,6 +579,9 @@
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                 FL("Not able to initalize remain_on_chan timer"));
+        hddLog( LOG1, FL(
+                    "Freeing ROC ctx cfgState->remain_on_chan_ctx=%p"),
+                cfgState->remain_on_chan_ctx);
         cfgState->remain_on_chan_ctx = NULL;
         vos_mem_free(pRemainChanCtx);
         mutex_unlock(&pHddCtx->roc_lock);
@@ -597,9 +622,21 @@
                     FL(" RemainOnChannel returned fail"));
 
             mutex_lock(&pHddCtx->roc_lock);
-            cfgState->remain_on_chan_ctx = NULL;
-            vos_timer_destroy(&pRemainChanCtx->hdd_remain_on_chan_timer);
-            vos_mem_free (pRemainChanCtx);
+            pRemainChanCtx = cfgState->remain_on_chan_ctx;
+            hddLog( LOG1, FL(
+                        "Freeing ROC ctx cfgState->remain_on_chan_ctx=%p"),
+                         cfgState->remain_on_chan_ctx);
+            if (pRemainChanCtx)
+            {
+                if(!VOS_IS_STATUS_SUCCESS(vos_timer_destroy
+                            (&pRemainChanCtx->hdd_remain_on_chan_timer)))
+                {
+                    hddLog( LOGE, FL(
+                        "Failed to destroy hdd_remain_on_chan_timer"));
+                }
+                vos_mem_free(pRemainChanCtx);
+                cfgState->remain_on_chan_ctx = NULL;
+            }
             mutex_unlock(&pHddCtx->roc_lock);
             hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_ROC);
             return -EINVAL;
@@ -629,9 +666,21 @@
             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                     "%s: WLANSAP_RemainOnChannel returned fail", __func__);
             mutex_lock(&pHddCtx->roc_lock);
-            cfgState->remain_on_chan_ctx = NULL;
-            vos_timer_destroy(&pRemainChanCtx->hdd_remain_on_chan_timer);
-            vos_mem_free (pRemainChanCtx);
+            pRemainChanCtx = cfgState->remain_on_chan_ctx;
+            hddLog( LOG1, FL(
+                        "Freeing ROC ctx cfgState->remain_on_chan_ctx=%p"),
+                         cfgState->remain_on_chan_ctx);
+            if (pRemainChanCtx)
+            {
+                if(!VOS_IS_STATUS_SUCCESS(vos_timer_destroy
+                            (&pRemainChanCtx->hdd_remain_on_chan_timer)))
+                {
+                    hddLog( LOGE, FL(
+                        "Failed to destroy hdd_remain_on_chan_timer"));
+                }
+                vos_mem_free (pRemainChanCtx);
+                cfgState->remain_on_chan_ctx = NULL;
+            }
             mutex_unlock(&pHddCtx->roc_lock);
             hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_ROC);
             return -EINVAL;
@@ -653,6 +702,8 @@
 
     }
 
+    wlan_hdd_start_stop_tdls_source_timer(pHddCtx, eTDLS_SUPPORT_DISABLED);
+
     pAdapter->is_roc_inprogress = TRUE;
     EXIT();
     return 0;
@@ -1053,7 +1104,10 @@
            if (cfgState->remain_on_chan_ctx)
                cfgState->remain_on_chan_ctx->is_pending_roc_cancelled = TRUE;
            mutex_unlock(&pHddCtx->roc_lock);
-
+           vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_HDD_TIME_OUT,
+                 FALSE, TRUE);
            return 0;
 
        }
@@ -1068,7 +1122,11 @@
     }
     if (NULL != cfgState->remain_on_chan_ctx)
     {
-        vos_timer_stop(&cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer);
+        if(!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                    &cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer)))
+        {
+            hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
+        }
         if (TRUE == pRemainChanCtx->hdd_remain_on_chan_cancel_in_progress)
         {
             mutex_unlock(&pHddCtx->roc_lock);
@@ -1089,8 +1147,8 @@
         else
             pRemainChanCtx->hdd_remain_on_chan_cancel_in_progress = TRUE;
     }
-    mutex_unlock(&pHddCtx->roc_lock);
     INIT_COMPLETION(pAdapter->cancel_rem_on_chan_var);
+    mutex_unlock(&pHddCtx->roc_lock);
     /* Issue abort remain on chan request to sme.
      * The remain on channel callback will make sure the remain_on_chan
      * expired event is sent.
@@ -1201,7 +1259,7 @@
     int status;
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38))
-    hdd_adapter_t *goAdapter;
+    uint8_t home_ch = 0;
 #endif
 
     ENTER();
@@ -1336,12 +1394,21 @@
     }
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38))
-    goAdapter = hdd_get_adapter( pAdapter->pHddCtx, WLAN_HDD_P2P_GO );
-
+    if ( (( WLAN_HDD_SOFTAP == pAdapter->device_mode ) ||
+          ( WLAN_HDD_P2P_GO == pAdapter->device_mode )) &&
+          (test_bit(SOFTAP_BSS_STARTED, &pAdapter->event_flags)))
+    {
+        home_ch = pAdapter->sessionCtx.ap.operatingChannel;
+    }
+    else if ((pAdapter->device_mode == WLAN_HDD_INFRA_STATION) &&
+            (pAdapter->sessionCtx.station.conn_info.connState ==
+             eConnectionState_Associated))
+    {
+        home_ch = pAdapter->sessionCtx.station.conn_info.operationChannel;
+    }
     //If GO adapter exists and operating on same frequency
     //then we will not request remain on channel
-    if( goAdapter && ( ieee80211_frequency_to_channel(chan->center_freq)
-                         == goAdapter->sessionCtx.ap.operatingChannel ) )
+    if (ieee80211_frequency_to_channel(chan->center_freq) == home_ch)
     {
         /*  if GO exist and is not off channel
          *  wait time should be zero.
@@ -1386,8 +1453,12 @@
                 else if ( actionFrmType == WLAN_HDD_GO_NEG_CNF ||
                           actionFrmType == WLAN_HDD_INVITATION_RESP )
                    wait = wait + ACTION_FRAME_ACK_WAIT;
-                vos_timer_stop(
-                      &pRemainChanCtx->hdd_remain_on_chan_timer);
+
+                if (!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                                &pRemainChanCtx->hdd_remain_on_chan_timer)))
+                {
+                    hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
+                }
                 status = vos_timer_start(
                        &pRemainChanCtx->hdd_remain_on_chan_timer,
                        wait);
@@ -1532,7 +1603,9 @@
             goto err;
         }
     }
-    else if (WLAN_HDD_P2P_GO == pAdapter->device_mode)
+    else if( ( WLAN_HDD_SOFTAP== pAdapter->device_mode ) ||
+            ( WLAN_HDD_P2P_GO == pAdapter->device_mode )
+           )
      {
         if( VOS_STATUS_SUCCESS !=
              WLANSAP_SendAction( (WLAN_HDD_GET_CTX(pAdapter))->pvosContext,
@@ -1698,11 +1771,25 @@
 
     cfgState->actionFrmState = HDD_IDLE;
 
-    hddLog( LOG1, "Send Action cnf, actionSendSuccess %d", actionSendSuccess);
     if( NULL == cfgState->buf )
     {
         return;
     }
+    if (cfgState->is_go_neg_ack_received)
+    {
+        cfgState->is_go_neg_ack_received = 0;
+        /* Sometimes its possible that host may receive the ack for GO
+         * negotiation req after sending go negotaition confirmation,
+         * in such case drop the ack received for the go negotiation
+         * request, so that supplicant waits for the confirmation ack
+         * from firmware.
+         */
+        hddLog( LOG1, FL("Drop the pending ack received in cfgState->actionFrmState %d"),
+                cfgState->actionFrmState);
+        return;
+    }
+
+    hddLog( LOG1, "Send Action cnf, actionSendSuccess %d", actionSendSuccess);
 
     /* If skb is NULL it means this packet was received on CFG80211 interface
      * else it was received on Monitor interface */
@@ -2486,8 +2573,12 @@
                               extend_time = ACTION_FRAME_DEFAULT_WAIT;
                       if (completion_done(&pAdapter->rem_on_chan_ready_event))
                       {
-                          vos_timer_stop(
-                                    &pRemainChanCtx->hdd_remain_on_chan_timer);
+                          if(!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                                   &pRemainChanCtx->hdd_remain_on_chan_timer)))
+                          {
+                              hddLog( LOGE, FL(
+                                    "Failed to stop hdd_remain_on_chan_timer"));
+                          }
                           status = vos_timer_start(
                                      &pRemainChanCtx->hdd_remain_on_chan_timer,
                                      extend_time);
@@ -2524,6 +2615,8 @@
                  }
              }
              if (pRemainChanCtx != NULL &&
+                  vos_timer_is_initialized(
+                     &cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer) &&
                   VOS_TIMER_STATE_RUNNING != vos_timer_getCurrentState(
                       &cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer))
                  hddLog( LOG1, "%s:"
@@ -2538,6 +2631,8 @@
              {
                  hddLog(LOG1, "%s: ACK_PENDING and But received RESP for Action frame ",
                          __func__);
+                 cfgState->is_go_neg_ack_received = 1;
+
                  hdd_sendActionCnf(pAdapter, TRUE);
              }
             }
@@ -2577,6 +2672,9 @@
                 hddLog(VOS_TRACE_LEVEL_INFO,"[TDLS] %s <--- OTA",
                     tdls_action_frame_type[actionFrmType]);
             }
+            vos_tdls_tx_rx_mgmt_event(SIR_MAC_ACTION_TDLS,
+              SIR_MAC_ACTION_RX, SIR_MAC_MGMT_ACTION,
+              actionFrmType, &pbFrames[WLAN_HDD_80211_FRM_DA_OFFSET+6]);
         }
 
         if((pbFrames[WLAN_HDD_PUBLIC_ACTION_FRAME_OFFSET] == WLAN_HDD_QOS_ACTION_FRAME)&&
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_scan.c b/wlan/prima/CORE/HDD/src/wlan_hdd_scan.c
index 709fdec..3cc5b1d 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_scan.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_scan.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -514,7 +514,7 @@
    event.cmd = IWEVCUSTOM;
    p = custom;
    p += scnprintf(p, MAX_CUSTOM_LEN, " Age: %lu",
-                 vos_timer_get_system_ticks() - descriptor->nReceivedTime);
+                 vos_timer_get_system_time() - descriptor->nReceivedTime);
    event.u.data.length = p - custom;
    current_event = iwe_stream_add_point (scanInfo->info,current_event, end,
                                          &event, custom);
@@ -542,11 +542,16 @@
 
   --------------------------------------------------------------------------*/
 
-VOS_STATUS hdd_processSpoofMacAddrRequest(hdd_context_t *pHddCtx)
+void __hdd_processSpoofMacAddrRequest(struct work_struct *work)
 {
+    hdd_context_t *pHddCtx =
+        container_of(to_delayed_work(work), hdd_context_t, spoof_mac_addr_work);
 
     ENTER();
 
+    if (wlan_hdd_validate_context(pHddCtx))
+        return;
+
     mutex_lock(&pHddCtx->spoofMacAddr.macSpoofingLock);
 
     if (pHddCtx->spoofMacAddr.isEnabled) {
@@ -556,7 +561,7 @@
                 pHddCtx->spoofMacAddr.isEnabled = FALSE;
                 mutex_unlock(&pHddCtx->spoofMacAddr.macSpoofingLock);
                 hddLog(LOGE, FL("Failed to generate random Mac Addr"));
-                return VOS_STATUS_E_FAILURE;
+                return;
         }
     }
 
@@ -584,7 +589,14 @@
 
     EXIT();
 
-    return VOS_STATUS_SUCCESS;
+    return;
+}
+
+void hdd_processSpoofMacAddrRequest(struct work_struct *work)
+{
+    vos_ssr_protect(__func__);
+    __hdd_processSpoofMacAddrRequest(work);
+    vos_ssr_unprotect(__func__);
 }
 
 /**---------------------------------------------------------------------------
@@ -825,7 +837,24 @@
        scanRequest.uIEFieldLen = pHddCtx->scan_info.scanAddIE.length;
        scanRequest.pIEField = pHddCtx->scan_info.scanAddIE.addIEdata;
    }
+   if (pHddCtx->spoofMacAddr.isEnabled &&
+       pHddCtx->cfg_ini->enableMacSpoofing == 1)
+   {
+        hddLog(LOG1, FL("MAC Spoofing enabled for current scan"));
+        /*
+         * Updating SelfSta Mac Addr in TL which will be used to get
+         * staidx to fill TxBds for probe request during current scan
+         */
+        status = WLANTL_updateSpoofMacAddr(pHddCtx->pvosContext,
+             &pHddCtx->spoofMacAddr.randomMacAddr,
+             &pAdapter->macAddressCurrent);
 
+        if (status != eHAL_STATUS_SUCCESS)
+        {
+           hddLog(LOGE, FL("Failed to update MAC Spoof Addr in TL"));
+           goto error;
+        }
+   }
    status = sme_ScanRequest( (WLAN_HDD_GET_CTX(pAdapter))->hHal, pAdapter->sessionId,&scanRequest, &scanId, &hdd_ScanRequestCallback, dev ); 
    if (!HAL_STATUS_SUCCESS(status))
    {
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_softap_tx_rx.c b/wlan/prima/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
index 15cc940..6e02ec3 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
@@ -96,6 +96,8 @@
 #define HDD_SAP_TX_TIMEOUT_RATELIMIT_BURST    1
 #define HDD_SAP_TX_STALL_SSR_THRESHOLD        5
 #define HDD_SAP_TX_STALL_RECOVERY_THRESHOLD HDD_SAP_TX_STALL_SSR_THRESHOLD - 2
+#define HDD_SAP_TX_STALL_FATAL_EVENT_THRESHOLD    2
+
 
 static DEFINE_RATELIMIT_STATE(hdd_softap_tx_timeout_rs,                 \
                               HDD_SAP_TX_TIMEOUT_RATELIMIT_INTERVAL,    \
@@ -276,6 +278,41 @@
    return status;
 }
 
+/**
+ * hdd_softap_get_connected_sta() -  provide number of connected STA
+ * @pHostapdAdapter: pAdapter for SAP
+ *
+ * This function is invoked for SAP mode to get connected STA.
+ *
+ * Return:  Total number of connected STA to SAP.
+ */
+v_U8_t hdd_softap_get_connected_sta(hdd_adapter_t *pHostapdAdapter)
+{
+    v_U8_t i, sta_ct = 0;
+    v_CONTEXT_t pVosContext = NULL;
+    ptSapContext pSapCtx = NULL;
+
+    pVosContext = (WLAN_HDD_GET_CTX(pHostapdAdapter))->pvosContext;
+    pSapCtx = VOS_GET_SAP_CB(pVosContext);
+    if (pSapCtx == NULL) {
+        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                 FL("psapCtx is NULL"));
+        goto error;
+    }
+
+    spin_lock_bh(&pSapCtx->staInfo_lock);
+    // get stations associated with SAP
+    for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
+        if (pSapCtx->aStaInfo[i].isUsed &&
+                  (!vos_is_macaddr_broadcast(&pSapCtx->aStaInfo[i].macAddrSTA)))
+               sta_ct++;
+    }
+    spin_unlock_bh( &pSapCtx->staInfo_lock );
+
+error:
+    return sta_ct;
+}
+
 /**============================================================================
   @brief hdd_softap_hard_start_xmit() - Function registered with the Linux OS for 
   transmitting packets. There are 2 versions of this function. One that uses
@@ -318,6 +355,13 @@
        return os_status;
    }
 
+   if (pHddCtx == NULL)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD_SAP_DATA, VOS_TRACE_LEVEL_ERROR,
+            FL("pHddCtx is NULL"));
+      goto xmit_done;
+   }
+
    pDestMacAddress = (v_MACADDR_t*)skb->data;
    
    ++pAdapter->hdd_stats.hddTxRxStats.txXmitCalled;
@@ -409,6 +453,8 @@
     {
        VOS_TRACE( VOS_MODULE_ID_HDD_SAP_DATA, VOS_TRACE_LEVEL_WARN,
             "%s: station %d ac %d queue over limit %d", __func__, STAId, ac, pktListSize);
+       ++pAdapter->hdd_stats.hddTxRxStats.txXmitBackPressured;
+       ++pAdapter->hdd_stats.hddTxRxStats.txXmitBackPressuredAC[ac];
        pSapCtx->aStaInfo[STAId].txSuspended[ac] = VOS_TRUE;
        netif_stop_subqueue(dev, skb_get_queue_mapping(skb));
        txSuspended = VOS_TRUE;
@@ -727,6 +773,8 @@
                 "%s: Cannot recover from Data stall Issue SSR",
                 __func__);
       WLANTL_FatalError();
+      // reset count after issuing the SSR
+      pAdapter->hdd_stats.hddTxRxStats.continuousTxTimeoutCount = 0;
       return;
    }
 
@@ -741,7 +789,15 @@
       hdd_wmm_tx_snapshot(pAdapter);
       WLANTL_TLDebugMessage(WLANTL_DEBUG_TX_SNAPSHOT);
    }
-
+   /* Call fatal event if data stall is for
+    * HDD_TX_STALL_FATAL_EVENT_THRESHOLD times
+    */
+   if (HDD_SAP_TX_STALL_FATAL_EVENT_THRESHOLD ==
+       pAdapter->hdd_stats.hddTxRxStats.continuousTxTimeoutCount)
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                   WLAN_LOG_INDICATOR_HOST_DRIVER,
+                   WLAN_LOG_REASON_DATA_STALL,
+                   FALSE, TRUE);
 } 
 
 void hdd_softap_tx_timeout(struct net_device *dev)
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_tdls.c b/wlan/prima/CORE/HDD/src/wlan_hdd_tdls.c
index b7ae28a..b6b7906 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_tdls.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_tdls.c
@@ -56,13 +56,7 @@
 static void wlan_hdd_tdls_implicit_send_discovery_request(tdlsCtx_t *pHddTdlsCtx);
 #endif
 
-static u8 wlan_hdd_tdls_hash_key (
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
-                                  const u8 *mac
-#else
-                                  u8 *mac
-#endif
-                                 )
+static u8 wlan_hdd_tdls_hash_key (const u8 *mac)
 {
     int i;
     u8 key = 0;
@@ -73,6 +67,95 @@
     return key;
 }
 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/**
+ * hdd_send_wlan_tdls_teardown_event()- send TDLS teardown event
+ *
+ * @reason: reason for tear down.
+ * @peer_mac: peer mac
+ *
+ * This Function send TDLS teardown diag event
+ *
+ * Return: void.
+ */
+void hdd_send_wlan_tdls_teardown_event(uint32_t reason,
+                                      uint8_t *peer_mac)
+{
+   WLAN_VOS_DIAG_EVENT_DEF(tdls_tear_down,
+                      struct vos_event_tdls_teardown);
+   vos_mem_zero(&tdls_tear_down,
+                    sizeof(tdls_tear_down));
+
+   tdls_tear_down.reason = reason;
+   vos_mem_copy(tdls_tear_down.peer_mac,
+        peer_mac, HDD_MAC_ADDR_LEN);
+   WLAN_VOS_DIAG_EVENT_REPORT(&tdls_tear_down,
+       EVENT_WLAN_TDLS_TEARDOWN);
+}
+
+/**
+ * hdd_wlan_tdls_enable_link_event()- send TDLS enable link event
+ *
+ * @peer_mac: peer mac
+ * @is_off_chan_supported: Does peer supports off chan
+ * @is_off_chan_configured: If off channel is configured
+ * @is_off_chan_established: If off chan is established
+ *
+ * This Function send TDLS enable link diag event
+ *
+ * Return: void.
+ */
+
+void hdd_wlan_tdls_enable_link_event(const uint8_t *peer_mac,
+                           uint8_t is_off_chan_supported,
+                           uint8_t is_off_chan_configured,
+                           uint8_t is_off_chan_established)
+{
+   WLAN_VOS_DIAG_EVENT_DEF(tdls_event,
+                 struct vos_event_tdls_enable_link);
+   vos_mem_zero(&tdls_event,
+                          sizeof(tdls_event));
+
+   vos_mem_copy(tdls_event.peer_mac,
+                     peer_mac, HDD_MAC_ADDR_LEN);
+
+   tdls_event.is_off_chan_supported =
+                  is_off_chan_supported;
+   tdls_event.is_off_chan_configured =
+                  is_off_chan_configured;
+   tdls_event.is_off_chan_established =
+                  is_off_chan_established;
+
+   WLAN_VOS_DIAG_EVENT_REPORT(&tdls_event,
+       EVENT_WLAN_TDLS_ENABLE_LINK);
+}
+
+/**
+ * hdd_wlan_block_scan_by_tdls()- send event
+ * if scan is blocked by tdls
+ *
+ * This Function send send diag event if scan is
+ * blocked by tdls
+ *
+ * Return: void.
+ */
+
+void hdd_wlan_block_scan_by_tdls(void)
+{
+  WLAN_VOS_DIAG_EVENT_DEF(tdls_scan_block_status,
+                     struct vos_event_tdls_scan_rejected);
+
+  vos_mem_zero(&tdls_scan_block_status,
+               sizeof(tdls_scan_block_status));
+
+  tdls_scan_block_status.status = true;
+  WLAN_VOS_DIAG_EVENT_REPORT(&tdls_scan_block_status,
+                                 EVENT_TDLS_SCAN_BLOCK);
+}
+
+#endif
+
+
 /**
  * wlan_hdd_tdls_disable_offchan_and_teardown_links - Disable offchannel
  * and teardown TDLS links
@@ -146,11 +229,29 @@
         if (!hddctx->tdlsConnInfo[staIdx].staId)
             continue;
 
+        mutex_lock(&hddctx->tdls_lock);
         curr_peer = wlan_hdd_tdls_find_all_peer(hddctx,
                 hddctx->tdlsConnInfo[staIdx].peerMac.bytes);
 
         if (!curr_peer)
+        {
+            mutex_unlock(&hddctx->tdls_lock);
             continue;
+        }
+
+        wlan_hdd_tdls_reset_peer(adapter, curr_peer->peerMac);
+
+        hddLog(LOG1, FL("indicate TDLS teardown (staId %d)"),
+                         curr_peer->staId);
+
+        /* Indicate teardown to supplicant */
+        wlan_hdd_tdls_indicate_teardown(
+                curr_peer->pHddTdlsCtx->pAdapter,
+                curr_peer,
+                eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
+        hdd_send_wlan_tdls_teardown_event(eTDLS_TEARDOWN_CONCURRENCY,
+                                            curr_peer->peerMac);
+        mutex_unlock(&hddctx->tdls_lock);
 
         /* Del Sta happened already as part of sme_DeleteAllTDLSPeers
          * Hence clear hdd data structure.
@@ -158,26 +259,17 @@
         hdd_roamDeregisterTDLSSTA(adapter,
                                   hddctx->tdlsConnInfo[staIdx].staId);
         wlan_hdd_tdls_decrement_peer_count(adapter);
-        wlan_hdd_tdls_reset_peer(adapter, curr_peer->peerMac);
 
         hddctx->tdlsConnInfo[staIdx].staId = 0 ;
         hddctx->tdlsConnInfo[staIdx].sessionId = 255;
         vos_mem_zero(&hddctx->tdlsConnInfo[staIdx].peerMac,
                  sizeof(v_MACADDR_t)) ;
         wlan_hdd_tdls_check_bmps(adapter);
-
-        hddLog(LOG1, FL("indicate TDLS teardown (staId %d)"),
-                curr_peer->staId);
-
-        /* Indicate teardown to supplicant */
-        wlan_hdd_tdls_indicate_teardown(
-                curr_peer->pHddTdlsCtx->pAdapter,
-                curr_peer,
-                eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
     }
 
 done:
-    wlan_hdd_tdls_set_mode(hddctx, eTDLS_SUPPORT_DISABLED, FALSE);
+    wlan_hdd_tdls_set_mode(hddctx, eTDLS_SUPPORT_DISABLED, FALSE,
+                           HDD_SET_TDLS_MODE_SOURCE_P2P);
     hddLog(LOG1, FL("TDLS Support Disabled"));
 }
 
@@ -193,46 +285,6 @@
         wlan_hdd_tdls_disable_offchan_and_teardown_links(hddctx);
 }
 
-static v_VOID_t wlan_hdd_tdls_start_peer_discover_timer(tdlsCtx_t *pHddTdlsCtx,
-                                                        tANI_BOOLEAN mutexLock,
-                                                        v_U32_t discoveryExpiry)
-{
-    hdd_station_ctx_t *pHddStaCtx;
-    hdd_context_t *pHddCtx;
-
-    ENTER();
-
-    if ((NULL == pHddTdlsCtx) || (NULL == pHddTdlsCtx->pAdapter) )
-    {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-               FL(" pHddTdlsCtx or pAdapter points to NULL"));
-        return;
-    }
-
-    pHddCtx = WLAN_HDD_GET_CTX( pHddTdlsCtx->pAdapter );
-
-    if(0 != (wlan_hdd_validate_context(pHddCtx)))
-    {
-        return;
-    }
-
-    if ( mutexLock )
-    {
-       mutex_lock(&pHddCtx->tdls_lock);
-    }
-
-    pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pHddTdlsCtx->pAdapter);
-
-    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "beacon rssi: %d",
-               pHddTdlsCtx->ap_rssi);
-
-    if ( mutexLock )
-        mutex_unlock(&pHddCtx->tdls_lock);
-
-    EXIT();
-    return;
-}
-
 #ifdef TDLS_USE_SEPARATE_DISCOVERY_TIMER
 static v_VOID_t wlan_hdd_tdls_discover_peer_cb( v_PVOID_t userData )
 {
@@ -244,7 +296,6 @@
     tdlsCtx_t *pHddTdlsCtx;
     int discover_req_sent = 0;
     v_U32_t discover_expiry = TDLS_SUB_DISCOVERY_PERIOD;
-    tANI_BOOLEAN doMutexLock = eANI_BOOLEAN_TRUE;
     v_CONTEXT_t pVosContext;
 
     ENTER();
@@ -337,14 +388,12 @@
                   "discovery_peer_cnt is %d , Starting SUB_DISCOVERY_TIMER",
                   pHddTdlsCtx->discovery_peer_cnt);
         discover_expiry = TDLS_SUB_DISCOVERY_PERIOD;
-        doMutexLock = eANI_BOOLEAN_FALSE;
         goto done;
     }
     discover_expiry = pHddTdlsCtx->threshold_config.discovery_period_t;
 
     wlan_hdd_tdls_peer_reset_discovery_processed(pHddTdlsCtx);
 
-    mutex_unlock(&pHddCtx->tdls_lock);
 
     /* Commenting out the following function as it was introducing
      * a race condition when pHddTdlsCtx is deleted. Also , this
@@ -357,15 +406,112 @@
      */
 
 done:
-    wlan_hdd_tdls_start_peer_discover_timer(pHddTdlsCtx, doMutexLock, discover_expiry);
-
-    if ( !doMutexLock )
-        mutex_unlock(&pHddCtx->tdls_lock);
+    mutex_unlock(&pHddCtx->tdls_lock);
     EXIT();
     return;
 }
 #endif
 
+static v_VOID_t wlan_hdd_tdls_idle_cb( v_PVOID_t userData )
+{
+#ifdef CONFIG_TDLS_IMPLICIT
+    tdlsConnInfo_t *tdlsInfo = (tdlsConnInfo_t *) userData;
+    hddTdlsPeer_t *curr_peer;
+    tdlsCtx_t *pHddTdlsCtx;
+    hdd_context_t *pHddCtx;
+    v_CONTEXT_t pVosContext;
+    hdd_adapter_t *pAdapter = NULL;
+
+    ENTER();
+
+    if (!tdlsInfo->staId)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                FL("peer (staidx %u) doesn't exists"), tdlsInfo->staId);
+        return;
+    }
+
+    pVosContext = vos_get_global_context(VOS_MODULE_ID_HDD, NULL);
+    if (NULL == pVosContext)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  FL("pVosContext points to NULL"));
+        return;
+    }
+
+    pHddCtx = vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
+    if (0 != (wlan_hdd_validate_context(pHddCtx)))
+    {
+        return;
+    }
+
+    pAdapter = hdd_get_adapter_by_sme_session_id(pHddCtx, tdlsInfo->sessionId);
+
+    if (!pAdapter)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                FL("pAdapter is NULL"));
+        return;
+    }
+
+    mutex_lock(&pHddCtx->tdls_lock);
+
+    curr_peer = wlan_hdd_tdls_find_peer(pAdapter,
+            (u8 *) &tdlsInfo->peerMac.bytes[0], FALSE);
+
+    if (NULL == curr_peer)
+    {
+      mutex_unlock(&pHddCtx->tdls_lock);
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+              FL("Invalid tdls idle timer expired"));
+      return;
+    }
+
+    pHddTdlsCtx = curr_peer->pHddTdlsCtx;
+    if (0 != (wlan_hdd_validate_tdls_context(pHddCtx, pHddTdlsCtx)))
+    {
+        mutex_unlock(&pHddCtx->tdls_lock);
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  FL("Invalid pHddTdlsCtx context"));
+        return;
+    }
+
+    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+              "%s: Tx/Rx Idle " MAC_ADDRESS_STR " tx_pkt: %d, rx_pkt: %d, idle_packet_n: %d",
+              __func__, MAC_ADDR_ARRAY(curr_peer->peerMac),
+              curr_peer->tx_pkt,
+              curr_peer->rx_pkt,
+              curr_peer->pHddTdlsCtx->threshold_config.idle_packet_n);
+
+    /* Check tx/rx statistics on this tdls link for recent activities and
+     * then decide whether to tear down the link or keep it.
+     */
+    if ((curr_peer->tx_pkt >= curr_peer->pHddTdlsCtx->threshold_config.idle_packet_n) || (curr_peer->rx_pkt >= curr_peer->pHddTdlsCtx->threshold_config.idle_packet_n))
+    {
+      /* this tdls link got back to normal, so keep it */
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+               "%s: tdls link to " MAC_ADDRESS_STR " back to normal, will stay",
+               __func__, MAC_ADDR_ARRAY(curr_peer->peerMac));
+    }
+    else
+    {
+      /* this tdls link needs to get torn down */
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                "%s: trigger tdls link to " MAC_ADDRESS_STR " down",
+                __func__, MAC_ADDR_ARRAY(curr_peer->peerMac));
+
+      wlan_hdd_tdls_indicate_teardown(curr_peer->pHddTdlsCtx->pAdapter,
+                                      curr_peer,
+                                      eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
+      hdd_send_wlan_tdls_teardown_event(eTDLS_TEARDOWN_TXRX_THRESHOLD,
+                                           curr_peer->peerMac);
+
+    }
+    mutex_unlock(&pHddCtx->tdls_lock);
+    EXIT();
+#endif
+}
+
 static v_VOID_t wlan_hdd_tdls_update_peer_cb( v_PVOID_t userData )
 {
     int i;
@@ -409,6 +555,23 @@
                        " tdls_support %d", __func__, MAC_ADDR_ARRAY(curr_peer->peerMac),
                        curr_peer->link_status, curr_peer->tdls_support);
 
+            if ((pHddCtx->tdls_mode == eTDLS_SUPPORT_DISABLED) &&
+                    (eTDLS_LINK_DISCOVERING == curr_peer->link_status)) {
+                curr_peer->tdls_support = eTDLS_CAP_UNKNOWN;
+                wlan_hdd_tdls_set_peer_link_status(
+                        curr_peer,
+                        eTDLS_LINK_IDLE,
+                        eTDLS_LINK_UNSPECIFIED);
+
+                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                        "%s: TDLS is disabled. Resetting link_status of peer "
+                        MAC_ADDRESS_STR " to %d, tdls_support %d", __func__,
+                        MAC_ADDR_ARRAY(curr_peer->peerMac),
+                        curr_peer->link_status, curr_peer->tdls_support);
+
+                goto next_peer;
+            }
+
             if (eTDLS_CAP_SUPPORTED == curr_peer->tdls_support) {
                 VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                     "tx %d, rx %d (thr.pkt %d/idle %d), rssi %d (thr.trig %d/hys %d/tear %d)",
@@ -462,6 +625,10 @@
                         wlan_hdd_tdls_indicate_teardown(pHddTdlsCtx->pAdapter,
                                                         curr_peer,
                                                         eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
+                        hdd_send_wlan_tdls_teardown_event(
+                               eTDLS_TEARDOWN_RSSI_THRESHOLD,
+                               curr_peer->peerMac);
+
 #endif
                         goto next_peer;
                     }
@@ -475,6 +642,17 @@
                             pHddTdlsCtx->threshold_config.idle_packet_n) &&
                         (curr_peer->rx_pkt <
                             pHddTdlsCtx->threshold_config.idle_packet_n))) {
+                        if (!vos_timer_is_initialized(&curr_peer->peerIdleTimer))
+                        {
+                            v_U8_t staId = (v_U8_t)curr_peer->staId;
+                            tdlsConnInfo_t *tdlsInfo;
+
+                            tdlsInfo = wlan_hdd_get_conn_info(pHddCtx, staId);
+                            vos_timer_init(&curr_peer->peerIdleTimer,
+                                    VOS_TIMER_TYPE_SW,
+                                    wlan_hdd_tdls_idle_cb,
+                                    tdlsInfo);
+                        }
                         if (VOS_TIMER_STATE_RUNNING !=
                                 vos_timer_getCurrentState(&curr_peer->peerIdleTimer)) {
                             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
@@ -485,8 +663,11 @@
                                                         pHddTdlsCtx->threshold_config.idle_timeout_t);
                         }
                     } else {
-                        if (VOS_TIMER_STATE_RUNNING ==
-                                vos_timer_getCurrentState(&curr_peer->peerIdleTimer)) {
+                        if (vos_timer_is_initialized(
+                                &curr_peer->peerIdleTimer) &&
+                            VOS_TIMER_STATE_RUNNING ==
+                                vos_timer_getCurrentState(
+                                             &curr_peer->peerIdleTimer)) {
                             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
                                     "Tx/Rx Idle timer stop: " MAC_ADDRESS_STR "!",
                                        MAC_ADDR_ARRAY(curr_peer->peerMac));
@@ -555,82 +736,6 @@
     EXIT();
 }
 
-static v_VOID_t wlan_hdd_tdls_idle_cb( v_PVOID_t userData )
-{
-#ifdef CONFIG_TDLS_IMPLICIT
-    hddTdlsPeer_t *curr_peer;
-    tdlsCtx_t *pHddTdlsCtx;
-    hdd_context_t *pHddCtx;
-    v_CONTEXT_t pVosContext;
-
-    ENTER();
-
-    pVosContext = vos_get_global_context(VOS_MODULE_ID_HDD, NULL);
-    if (NULL == pVosContext)
-    {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  FL("pVosContext points to NULL"));
-        return;
-    }
-    pHddCtx = vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
-    if (0 != (wlan_hdd_validate_context(pHddCtx)))
-    {
-        return;
-    }
-
-    mutex_lock(&pHddCtx->tdls_lock);
-
-    curr_peer = (hddTdlsPeer_t *)userData;
-    if (NULL == curr_peer)
-    {
-      mutex_unlock(&pHddCtx->tdls_lock);
-      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-              FL("Invalid tdls idle timer expired"));
-      return;
-    }
-
-    pHddTdlsCtx = curr_peer->pHddTdlsCtx;
-    if (0 != (wlan_hdd_validate_tdls_context(pHddCtx, pHddTdlsCtx)))
-    {
-        mutex_unlock(&pHddCtx->tdls_lock);
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  FL("Invalid pHddTdlsCtx context"));
-        return;
-    }
-
-    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-              "%s: Tx/Rx Idle " MAC_ADDRESS_STR " tx_pkt: %d, rx_pkt: %d, idle_packet_n: %d",
-              __func__, MAC_ADDR_ARRAY(curr_peer->peerMac),
-              curr_peer->tx_pkt,
-              curr_peer->rx_pkt,
-              curr_peer->pHddTdlsCtx->threshold_config.idle_packet_n);
-
-    /* Check tx/rx statistics on this tdls link for recent activities and
-     * then decide whether to tear down the link or keep it.
-     */
-    if ((curr_peer->tx_pkt >= curr_peer->pHddTdlsCtx->threshold_config.idle_packet_n) || (curr_peer->rx_pkt >= curr_peer->pHddTdlsCtx->threshold_config.idle_packet_n))
-    {
-      /* this tdls link got back to normal, so keep it */
-      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-               "%s: tdls link to " MAC_ADDRESS_STR " back to normal, will stay",
-               __func__, MAC_ADDR_ARRAY(curr_peer->peerMac));
-    }
-    else
-    {
-      /* this tdls link needs to get torn down */
-      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                "%s: trigger tdls link to " MAC_ADDRESS_STR " down",
-                __func__, MAC_ADDR_ARRAY(curr_peer->peerMac));
-
-      wlan_hdd_tdls_indicate_teardown(curr_peer->pHddTdlsCtx->pAdapter,
-                                      curr_peer,
-                                      eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
-    }
-    mutex_unlock(&pHddCtx->tdls_lock);
-    EXIT();
-#endif
-}
-
 static v_VOID_t wlan_hdd_tdls_discovery_timeout_peer_cb(v_PVOID_t userData)
 {
     int i;
@@ -789,37 +894,13 @@
     }
 }
 
-static void wlan_hdd_tdls_schedule_scan(struct work_struct *work)
-{
-    tdls_scan_context_t *scan_ctx =
-          container_of(work, tdls_scan_context_t, tdls_scan_work.work);
-
-    if (NULL == scan_ctx)
-    {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 FL("scan_ctx is NULL"));
-        return;
-    }
-
-    if (unlikely(TDLS_CTX_MAGIC != scan_ctx->magic))
-        return;
-
-    scan_ctx->attempt++;
-
-    wlan_hdd_cfg80211_scan(scan_ctx->wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
-                           scan_ctx->dev,
-#endif
-                           scan_ctx->scan_request);
-}
-
 void wlan_hdd_tdls_btCoex_cb(void *data, int indType)
 {
     hdd_adapter_t *pAdapter;
     hdd_context_t *pHddCtx;
     u16 connectedTdlsPeers;
-    tdlsCtx_t *pHddTdlsCtx;
     hddTdlsPeer_t *currPeer;
+    tANI_U16 numCurrTdlsPeers = 0;
 
     ENTER();
     if ((NULL == data) || (indType < 0))
@@ -852,14 +933,6 @@
         return;
     }
 
-    pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
-    if (NULL == pHddTdlsCtx)
-    {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  FL("pHddTdlsCtx is not valid"));
-        return;
-    }
-
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
               "%s: BtCoex notification type %d", __func__, indType);
    /* BtCoex notification type enabled, Disable TDLS */
@@ -867,15 +940,16 @@
    {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                   FL("BtCoex notification, Disable TDLS"));
-
+        mutex_lock(&pHddCtx->tdls_lock);
         /* tdls is in progress */
-        currPeer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, TRUE);
+        currPeer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, FALSE);
         if (NULL != currPeer)
         {
             wlan_hdd_tdls_set_peer_link_status (currPeer,
                                                 eTDLS_LINK_IDLE,
                                                 eTDLS_LINK_UNSPECIFIED);
         }
+        mutex_unlock(&pHddCtx->tdls_lock);
 
         /* while tdls is up */
         if (eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode ||
@@ -883,8 +957,8 @@
         {
             connectedTdlsPeers = wlan_hdd_tdlsConnectedPeers(pAdapter);
             /* disable implicit trigger logic & tdls operatoin */
-            wlan_hdd_tdls_set_mode(pHddCtx, eTDLS_SUPPORT_DISABLED, FALSE);
-            pHddCtx->is_tdls_btc_enabled = FALSE;
+            wlan_hdd_tdls_set_mode(pHddCtx, eTDLS_SUPPORT_DISABLED, FALSE,
+                                   HDD_SET_TDLS_MODE_SOURCE_BTC);
 
             /* teardown the peers on the btcoex */
             if (connectedTdlsPeers)
@@ -892,6 +966,7 @@
                tANI_U8 staIdx;
                hddTdlsPeer_t *curr_peer;
 
+               mutex_lock(&pHddCtx->tdls_lock);
                for (staIdx = 0; staIdx < HDD_MAX_NUM_TDLS_STA; staIdx++)
                {
                     if (pHddCtx->tdlsConnInfo[staIdx].staId)
@@ -900,19 +975,26 @@
                                   ("%s: indicate TDLS teardown (staId %d)"),
                                   __func__,pHddCtx->tdlsConnInfo[staIdx].staId);
 
-                        #ifdef CONFIG_TDLS_IMPLICIT
+#ifdef CONFIG_TDLS_IMPLICIT
                         curr_peer = wlan_hdd_tdls_find_all_peer(pHddCtx,
                                    pHddCtx->tdlsConnInfo[staIdx].peerMac.bytes);
                         if(curr_peer) {
                            wlan_hdd_tdls_indicate_teardown(
                                    curr_peer->pHddTdlsCtx->pAdapter, curr_peer,
                                    eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
+                           hdd_send_wlan_tdls_teardown_event(
+                                                eTDLS_TEARDOWN_BTCOEX,
+                                                curr_peer->peerMac);
                         }
-                        #endif
+#endif
                     }
                }
+               mutex_unlock(&pHddCtx->tdls_lock);
             }
         }
+        /* stop TCP delack timer if BtCoex is enable  */
+        set_bit(WLAN_BTCOEX_MODE, &pHddCtx->mode);
+        hdd_manage_delack_timer(pHddCtx);
    }
    /* BtCoex notification type enabled, Enable TDLS */
    else if (indType == SIR_COEX_IND_TYPE_TDLS_ENABLE)
@@ -926,10 +1008,18 @@
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                       ("%s: revert tdls mode %d"), __func__,
                       pHddCtx->tdls_mode_last);
-            pHddCtx->is_tdls_btc_enabled = TRUE;
-            wlan_hdd_tdls_set_mode(pHddCtx, pHddCtx->tdls_mode_last, FALSE);
+            wlan_hdd_tdls_set_mode(pHddCtx, pHddCtx->tdls_mode_last, FALSE,
+                                   HDD_SET_TDLS_MODE_SOURCE_BTC);
         }
-   }
+
+        clear_bit(WLAN_BTCOEX_MODE, &pHddCtx->mode);
+        numCurrTdlsPeers = wlan_hdd_tdlsConnectedPeers(pAdapter);
+        if(numCurrTdlsPeers == 0) {
+             /* start delack timer if BtCoex is disable and tdls is not present */
+             hdd_manage_delack_timer(pHddCtx);
+        }
+  }
+
    EXIT();
    return;
 }
@@ -942,10 +1032,7 @@
 
     pHddCtx->connected_peer_count = 0;
 
-    pHddCtx->tdls_scan_ctxt.magic = 0;
-    pHddCtx->tdls_scan_ctxt.attempt = 0;
-    pHddCtx->tdls_scan_ctxt.reject = 0;
-    pHddCtx->tdls_scan_ctxt.scan_request = NULL;
+    wlan_hdd_init_deinit_defer_scan_context(&pHddCtx->scan_ctxt);
 
     for (staIdx = 0; staIdx < HDD_MAX_NUM_TDLS_STA; staIdx++)
     {
@@ -954,7 +1041,7 @@
          vos_mem_zero(&pHddCtx->tdlsConnInfo[staIdx].peerMac,
                                             sizeof(v_MACADDR_t)) ;
     }
-    pHddCtx->is_tdls_btc_enabled = TRUE;
+
     status = sme_RegisterBtCoexTDLSCallback(pHddCtx->hHal,
                                             wlan_hdd_tdls_btCoex_cb);
     if (status != eHAL_STATUS_SUCCESS) {
@@ -995,9 +1082,10 @@
 
     if (test_bit(TDLS_INIT_DONE, &pAdapter->event_flags))
     {
-        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                "%s: TDLS INIT DONE set to 1, no point in re-init", __func__);
-        return -EALREADY;
+        hddLog(LOG1,
+                FL("TDLS INIT DONE set to 1, no point in re-init"));
+        /* Return success as TDLS is already initialized */
+        return 0;
     }
 
     if ((FALSE == pHddCtx->cfg_ini->fEnableTDLSSupport) ||
@@ -1079,9 +1167,7 @@
     pHddTdlsCtx->threshold_config.rssi_trigger_threshold = pHddCtx->cfg_ini->fTDLSRSSITriggerThreshold;
     pHddTdlsCtx->threshold_config.rssi_teardown_threshold = pHddCtx->cfg_ini->fTDLSRSSITeardownThreshold;
 
-    vos_init_delayed_work(&pHddCtx->tdls_scan_ctxt.tdls_scan_work,
-                          wlan_hdd_tdls_schedule_scan);
-     set_bit(TDLS_INIT_DONE, &pAdapter->event_flags);
+    set_bit(TDLS_INIT_DONE, &pAdapter->event_flags);
 
     return 0;
 }
@@ -1121,19 +1207,18 @@
     pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
     if (NULL == pHddTdlsCtx)
     {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                 FL("pHddTdlsCtx is NULL"));
         return;
     }
 
-    vos_flush_delayed_work(&pHddCtx->tdls_scan_ctxt.tdls_scan_work);
-
     /* must stop timer here before freeing peer list, because peerIdleTimer is
     part of peer list structure. */
     wlan_hdd_tdls_timers_destroy(pHddTdlsCtx);
     wlan_hdd_tdls_free_list(pHddTdlsCtx);
 
-    wlan_hdd_tdls_free_scan_request(&pHddCtx->tdls_scan_ctxt);
+    wlan_hdd_init_deinit_defer_scan_context(&pHddCtx->scan_ctxt);
+
     pHddTdlsCtx->magic = 0;
     pHddTdlsCtx->pAdapter = NULL;
     vos_mem_free(pHddTdlsCtx);
@@ -1167,7 +1252,8 @@
                        "%s: " MAC_ADDRESS_STR " -> stop idle timer",
                        __func__,
                        MAC_ADDR_ARRAY(curr_peer->peerMac));
-            vos_timer_stop ( &curr_peer->peerIdleTimer );
+            if (vos_timer_is_initialized(&curr_peer->peerIdleTimer))
+                vos_timer_stop ( &curr_peer->peerIdleTimer );
             if (vos_timer_is_initialized(&curr_peer->initiatorWaitTimeoutTimer))
                 vos_timer_stop( &curr_peer->initiatorWaitTimeoutTimer );
         }
@@ -1206,20 +1292,25 @@
         list_for_each (pos, head) {
             curr_peer = list_entry (pos, hddTdlsPeer_t, node);
 
-            VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                       "%s: " MAC_ADDRESS_STR " -> destroy idle timer",
-                       __func__,
-                       MAC_ADDR_ARRAY(curr_peer->peerMac));
-            vos_timer_stop ( &curr_peer->peerIdleTimer );
-            vos_timer_destroy ( &curr_peer->peerIdleTimer );
+            if (vos_timer_is_initialized(&curr_peer->peerIdleTimer)){
+                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                        "%s: " MAC_ADDRESS_STR " -> destroy idle timer",
+                        __func__,
+                        MAC_ADDR_ARRAY(curr_peer->peerMac));
+                vos_timer_stop ( &curr_peer->peerIdleTimer );
+                vos_timer_destroy ( &curr_peer->peerIdleTimer );
+            }
             if (vos_timer_is_initialized(&curr_peer->initiatorWaitTimeoutTimer))
             {
+                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                        "%s: " MAC_ADDRESS_STR " -> destroy initiatorWaitTimeoutTimer",
+                        __func__,
+                        MAC_ADDR_ARRAY(curr_peer->peerMac));
                 vos_timer_stop(&curr_peer->initiatorWaitTimeoutTimer);
                 vos_timer_destroy(&curr_peer->initiatorWaitTimeoutTimer);
             }
         }
     }
-
 }
 
 /* destroy all the tdls timers running */
@@ -1266,6 +1357,9 @@
         return peer;
     }
 
+    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+              FL("peer mac address %pM"), mac);
+
     /* not found, allocate and add the list */
     peer = vos_mem_malloc(sizeof(hddTdlsPeer_t));
     if (NULL == peer) {
@@ -1289,16 +1383,17 @@
     vos_mem_zero(peer, sizeof(hddTdlsPeer_t));
     vos_mem_copy(peer->peerMac, mac, sizeof(peer->peerMac));
     peer->pHddTdlsCtx = pHddTdlsCtx;
-
-    vos_timer_init(&peer->peerIdleTimer,
-                    VOS_TIMER_TYPE_SW,
-                    wlan_hdd_tdls_idle_cb,
-                    peer);
     list_add_tail(&peer->node, head);
 
     return peer;
 }
 
+/*
+ * NOTE:
+ * The Callers of this function should ensure to release the
+ * tdls_lock before calling this function to avoid deadlocks.
+ */
+
 int wlan_hdd_tdls_set_cap(hdd_adapter_t *pAdapter,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
                                    const u8* mac,
@@ -1382,15 +1477,29 @@
     tANI_S32 res = 0;
     /*EXT TDLS*/
     hddTdlsPeer_t *curr_peer;
+    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
 
-    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, TRUE);
+    if (pHddCtx == NULL)
+    {
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 FL("pHddCtx is NULL"));
+        return;
+    }
+
+    mutex_lock(&pHddCtx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
+       mutex_unlock(&pHddCtx->tdls_lock);
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  "%s: curr_peer is NULL", __func__);
         return;
     }
 
+    hddLog(VOS_TRACE_LEVEL_INFO,
+           "tdls set peer " MAC_ADDRESS_STR " link status to %u",
+           MAC_ADDR_ARRAY(curr_peer->peerMac), linkStatus);
+
     curr_peer->link_status= linkStatus;
 
     /*EXT TDLS*/
@@ -1400,13 +1509,15 @@
         /*save the reason for any further query*/
         curr_peer->reason = reason;
         wlan_hdd_tdls_get_wifi_hal_state(curr_peer, &state, &res);
-
+        mutex_unlock(&pHddCtx->tdls_lock);
         (*curr_peer->state_change_notification)(mac,
                                              state,
                                              res,
-                                             curr_peer->pHddTdlsCtx->pAdapter);
-
+                                             pAdapter);
     }
+    else
+        mutex_unlock(&pHddCtx->tdls_lock);
+
     /*EXT TDLS*/
     return;
 }
@@ -1414,15 +1525,24 @@
 int wlan_hdd_tdls_recv_discovery_resp(hdd_adapter_t *pAdapter, u8 *mac)
 {
     hddTdlsPeer_t *curr_peer;
-    tdlsCtx_t *pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
+    tdlsCtx_t *pHddTdlsCtx = NULL;
     hdd_context_t *pHddCtx;
 
     ENTER();
 
+    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    if (0 != wlan_hdd_validate_context(pHddCtx))
+        return -1;
+
+    mutex_lock(&pHddCtx->tdls_lock);
+
+    pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
     if ( NULL == pHddTdlsCtx )
     {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 FL("pHddTdlsCtx is NULL device mode = %d"), pAdapter->device_mode);
+        mutex_unlock(&pHddCtx->tdls_lock);
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  FL("pHddTdlsCtx is NULL device mode = %d"),
+                  pAdapter->device_mode);
         return -1;
     }
 
@@ -1430,29 +1550,26 @@
 
     if(0 != (wlan_hdd_validate_context(pHddCtx)))
     {
+        mutex_unlock(&pHddCtx->tdls_lock);
         return 0;
     }
 
-    mutex_lock(&pHddCtx->tdls_lock);
     curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
 
     if (NULL == curr_peer)
     {
+       mutex_unlock(&pHddCtx->tdls_lock);
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
-        mutex_unlock(&pHddCtx->tdls_lock);
         return -1;
     }
-    mutex_unlock(&pHddCtx->tdls_lock);
 
     if (pHddTdlsCtx->discovery_sent_cnt)
         pHddTdlsCtx->discovery_sent_cnt--;
 
-    mutex_lock(&pHddCtx->tdls_lock);
 
     wlan_hdd_tdls_check_power_save_prohibited(pAdapter);
 
-    mutex_unlock(&pHddCtx->tdls_lock);
     if (0 == pHddTdlsCtx->discovery_sent_cnt)
     {
         vos_timer_stop(&pHddTdlsCtx->peerDiscoveryTimeoutTimer);
@@ -1463,6 +1580,8 @@
                pHddTdlsCtx->discovery_sent_cnt, MAC_ADDR_ARRAY(curr_peer->peerMac),
                curr_peer->link_status);
 
+    curr_peer->tdls_support = eTDLS_CAP_SUPPORTED;
+
     if (eTDLS_LINK_DISCOVERING == curr_peer->link_status)
     {
         /* Since we are here, it means Throughput threshold is alredy met. Make sure RSSI
@@ -1472,11 +1591,36 @@
             wlan_hdd_tdls_set_peer_link_status(curr_peer,
                                                eTDLS_LINK_DISCOVERED,
                                                eTDLS_LINK_SUCCESS);
+
             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
             "Rssi Threshold met: "MAC_ADDRESS_STR" rssi = %d threshold= %d" ,
              MAC_ADDR_ARRAY(curr_peer->peerMac), curr_peer->rssi,
              pHddTdlsCtx->threshold_config.rssi_trigger_threshold);
-            cfg80211_tdls_oper_request(pAdapter->dev, curr_peer->peerMac, NL80211_TDLS_SETUP, FALSE, GFP_KERNEL);
+
+            if (pHddCtx->tdls_mode != eTDLS_SUPPORT_DISABLED)
+            {
+                /* TDLS can be disabled from multiple sources like
+                 * scan, p2p-listen, p2p, btc etc ...
+                 * Dont initiate tdls setup if tdls is disabled
+                 */
+                cfg80211_tdls_oper_request(pAdapter->dev, curr_peer->peerMac,
+                                           NL80211_TDLS_SETUP, FALSE,
+                                           GFP_KERNEL);
+            }
+            else
+            {
+                curr_peer->tdls_support = eTDLS_CAP_UNKNOWN;
+                wlan_hdd_tdls_set_peer_link_status(
+                        curr_peer,
+                        eTDLS_LINK_IDLE,
+                        eTDLS_LINK_UNSPECIFIED);
+
+                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                        "%s: TDLS is disabled. Resetting link_status of peer "
+                        MAC_ADDRESS_STR " to %d, tdls_support %d", __func__,
+                        MAC_ADDR_ARRAY(curr_peer->peerMac),
+                        curr_peer->link_status, curr_peer->tdls_support);
+            }
         }
         else
         {
@@ -1495,13 +1639,14 @@
                                                eTDLS_LINK_IDLE,
                                                eTDLS_LINK_UNSPECIFIED);
         }
+        mutex_unlock(&pHddCtx->tdls_lock);
     }
     else
     {
+        mutex_unlock(&pHddCtx->tdls_lock);
         wlan_hdd_tdls_check_bmps(pAdapter);
     }
 
-    curr_peer->tdls_support = eTDLS_CAP_SUPPORTED;
     EXIT();
     return 0;
 }
@@ -1514,7 +1659,8 @@
 #endif
                                 tCsrStaParams *StaParams,
                                 tANI_BOOLEAN isBufSta,
-                                tANI_BOOLEAN isOffChannelSupported)
+                                tANI_BOOLEAN isOffChannelSupported,
+                                tANI_BOOLEAN isQosWmmSta)
 {
     hddTdlsPeer_t *curr_peer;
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
@@ -1550,7 +1696,7 @@
 
     curr_peer->supported_oper_classes_len =
                StaParams->supported_oper_classes_len;
-    curr_peer->qos = StaParams->capability & CAPABILITIES_QOS_OFFSET;
+    curr_peer->qos = isQosWmmSta;
 
     mutex_unlock(&pHddCtx->tdls_lock);
     return 0;
@@ -1615,16 +1761,24 @@
                            tANI_S8 rxRssi)
 {
     hddTdlsPeer_t *curr_peer;
+    hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
 
-    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, TRUE);
+    if (0 != (wlan_hdd_validate_context(hdd_ctx))) {
+        return -1;
+    }
+
+    mutex_lock(&hdd_ctx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 "%s: curr_peer is NULL", __func__);
+        mutex_unlock(&hdd_ctx->tdls_lock);
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                FL("curr_peer is NULL"));
         return -1;
     }
 
     curr_peer->rssi = rxRssi;
+    mutex_unlock(&hdd_ctx->tdls_lock);
 
     return 0;
 }
@@ -1659,21 +1813,6 @@
     return 0;
 }
 
-int wlan_hdd_tdls_get_responder(hdd_adapter_t *pAdapter, u8 *mac)
-{
-    hddTdlsPeer_t *curr_peer;
-
-    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, TRUE);
-    if (curr_peer == NULL)
-    {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 "%s: curr_peer is NULL", __func__);
-        return -1;
-    }
-
-    return (curr_peer->is_responder);
-}
-
 int wlan_hdd_tdls_set_signature(hdd_adapter_t *pAdapter,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
                                 const u8 *mac,
@@ -1715,22 +1854,90 @@
     memcpy(mac, skb->data+6, 6);
 }
 
-int wlan_hdd_tdls_increment_pkt_count(hdd_adapter_t *pAdapter,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
-                                      const u8 *mac,
-#else
-                                      u8 *mac,
-#endif
-                                      u8 tx)
+/**
+ * wlan_hdd_tdls_is_forced_peer - function to check if peer is forced peer
+ * @adapter: pointer to hdd apater
+ * @mac: peer mac address
+ *
+ * Function identified is the peer is forced for tdls connection
+ *
+ * return: true: peer is forced false: peer is not forced
+ */
+static bool wlan_hdd_tdls_is_forced_peer(hdd_adapter_t *adapter,
+                                         const u8 *mac)
+{
+    hddTdlsPeer_t *peer;
+    hdd_context_t *hddctx = WLAN_HDD_GET_CTX(adapter);
+    bool is_forced_peer;
+
+    mutex_lock(&hddctx->tdls_lock);
+    peer = wlan_hdd_tdls_find_peer(adapter, mac, FALSE);
+    if (!peer)
+    {
+        is_forced_peer = false;
+        goto ret;
+    }
+
+    if (!peer->isForcedPeer)
+    {
+        is_forced_peer = false;
+        goto ret;
+    }
+    is_forced_peer = true;
+
+ret:
+    mutex_unlock(&hddctx->tdls_lock);
+    return is_forced_peer;
+}
+
+/**
+ * wlan_hdd_tdls_increment_pkt_count - function to increment tdls tx packet cnt
+ * @pAdapter: pointer to hdd adapter
+ * @skb: pointer to sk_buff
+ *
+ * Function to increment packet count if packet is destined to tdls peer
+ *
+ * return: None
+ */
+static void wlan_hdd_tdls_increment_pkt_count(hdd_adapter_t *pAdapter,
+                                      struct sk_buff *skb)
 {
     hddTdlsPeer_t *curr_peer;
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    hdd_station_ctx_t *hdd_sta_ctx;
+    u8 mac[6];
 
     if (0 != (wlan_hdd_validate_context(pHddCtx)))
-        return -EINVAL;
+        return;
 
     if (eTDLS_SUPPORT_ENABLED != pHddCtx->tdls_mode)
-        return -1;
+        goto error;
+
+    if (!pHddCtx->cfg_ini->fEnableTDLSImplicitTrigger)
+        goto error;
+
+    wlan_hdd_tdls_extract_da(skb, mac);
+
+    if (pHddCtx->cfg_ini->fTDLSExternalControl)
+    {
+        if (!wlan_hdd_tdls_is_forced_peer(pAdapter, mac))
+            goto error;
+    }
+
+    hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+
+    if (vos_is_macaddr_group((v_MACADDR_t *)mac))
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_MED,
+                  "broadcast packet, not adding to peer list");
+        goto error;
+    }
+
+    if (memcmp(hdd_sta_ctx->conn_info.bssId, mac, 6) == 0) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_MED,
+                  "packet da is bssid, not adding to peer list");
+        goto error;
+    }
 
     mutex_lock(&pHddCtx->tdls_lock);
     curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
@@ -1739,16 +1946,20 @@
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                  FL("curr_peer is NULL"));
         mutex_unlock(&pHddCtx->tdls_lock);
-        return -1;
+        goto error;
     }
 
-    if (tx)
-        curr_peer->tx_pkt++;
-    else
-        curr_peer->rx_pkt++;
+    curr_peer->tx_pkt++;
 
     mutex_unlock(&pHddCtx->tdls_lock);
-    return 0;
+
+error:
+    return;
+}
+
+void wlan_hdd_tdls_notify_packet(hdd_adapter_t *adapter, struct sk_buff *skb)
+{
+    wlan_hdd_tdls_increment_pkt_count(adapter, skb);
 }
 
 static int wlan_hdd_tdls_check_config(tdls_config_params_t *config)
@@ -1842,14 +2053,17 @@
         return -EINVAL;
     }
 
+    mutex_lock(&pHddCtx->tdls_lock);
     if (NULL == pHddTdlsCtx)
     {
+        mutex_unlock(&pHddCtx->tdls_lock);
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("TDLS not enabled!"));
         return -1;
     }
 
     if (wlan_hdd_tdls_check_config(config) != 0)
     {
+        mutex_unlock(&pHddCtx->tdls_lock);
         return -1;
     }
 
@@ -1857,6 +2071,7 @@
     req_tdls_mode = config->tdls + 1;
     if (pHddCtx->tdls_mode == req_tdls_mode)
     {
+        mutex_unlock(&pHddCtx->tdls_lock);
         hddLog(VOS_TRACE_LEVEL_ERROR, "%s already in mode %d", __func__, config->tdls);
         return -1;
     }
@@ -1880,7 +2095,10 @@
             config->rssi_trigger_threshold,
             config->rssi_teardown_threshold);
 
-    wlan_hdd_tdls_set_mode(pHddCtx, req_tdls_mode, TRUE);
+    mutex_unlock(&pHddCtx->tdls_lock);
+
+    wlan_hdd_tdls_set_mode(pHddCtx, req_tdls_mode, TRUE,
+                           HDD_SET_TDLS_MODE_SOURCE_USER);
 
     return 0;
 }
@@ -1945,11 +2163,7 @@
    otherwise, it returns NULL
 */
 hddTdlsPeer_t *wlan_hdd_tdls_find_peer(hdd_adapter_t *pAdapter,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
                                        const u8 *mac,
-#else
-                                       u8 *mac,
-#endif
                                        tANI_BOOLEAN mutexLock)
 {
     u8 key;
@@ -1983,8 +2197,6 @@
     list_for_each(pos, head) {
         curr_peer = list_entry (pos, hddTdlsPeer_t, node);
         if (!memcmp(mac, curr_peer->peerMac, 6)) {
-            VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                     "findTdlsPeer: found staId %d", curr_peer->staId);
             if ( mutexLock )
                 mutex_unlock(&pHddCtx->tdls_lock);
             return curr_peer;
@@ -2010,7 +2222,6 @@
     hddTdlsPeer_t *curr_peer= NULL;
     VOS_STATUS status = 0;
 
-    mutex_lock(&pHddCtx->tdls_lock);
     status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
     while ( NULL != pAdapterNode && VOS_STATUS_SUCCESS == status )
     {
@@ -2022,14 +2233,12 @@
             curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, FALSE);
             if (curr_peer)
             {
-                mutex_unlock(&pHddCtx->tdls_lock);
                 return curr_peer;
             }
         }
         status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
         pAdapterNode = pNext;
     }
-    mutex_unlock(&pHddCtx->tdls_lock);
     return curr_peer;
 }
 
@@ -2050,13 +2259,11 @@
     if (0 != (wlan_hdd_validate_context(pHddCtx)))
         return -EINVAL;
 
-    mutex_lock(&pHddCtx->tdls_lock);
     curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
     if (curr_peer == NULL)
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  "%s: curr_peer is NULL", __func__);
-        mutex_unlock(&pHddCtx->tdls_lock);
         return -1;
     }
 
@@ -2076,11 +2283,14 @@
         pHddCtx->isTdlsScanCoexistence = FALSE;
     }
 
-    if(eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode) {
+    if((eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode) &&
+            (vos_timer_is_initialized(&curr_peer->peerIdleTimer)) &&
+            (VOS_TIMER_STATE_RUNNING ==
+             vos_timer_getCurrentState(&curr_peer->peerIdleTimer)))
+    {
         vos_timer_stop( &curr_peer->peerIdleTimer );
     }
 
-    mutex_unlock(&pHddCtx->tdls_lock);
     return 0;
 }
 
@@ -2287,7 +2497,7 @@
     if (0 != wlan_hdd_sta_tdls_init(pAdapter))
     {
         mutex_unlock(&pHddCtx->tdls_lock);
-        hddLog(VOS_TRACE_LEVEL_ERROR,"%s: wlan_hdd_sta_tdls_init failed",__func__);
+        hddLog(LOGE, FL("wlan_hdd_sta_tdls_init failed"));
         return;
     }
 
@@ -2320,18 +2530,19 @@
 
 void wlan_hdd_tdls_disconnection_callback(hdd_adapter_t *pAdapter)
 {
-    tdlsCtx_t *pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
-    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-
-    if (NULL == pHddCtx)
-    {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-               FL(" pHddCtx points to NULL"));
-       return;
-    }
+    tdlsCtx_t *pHddTdlsCtx;
+    hdd_context_t *pHddCtx;
 
     VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,"%s", __func__);
 
+    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+
+    if (0 != wlan_hdd_validate_context(pHddCtx))
+        return;
+
+    mutex_lock(&pHddCtx->tdls_lock);
+
+    pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
     if (NULL == pHddTdlsCtx)
     {
        mutex_unlock(&pHddCtx->tdls_lock);
@@ -2340,8 +2551,6 @@
         return;
     }
 
-    mutex_lock(&pHddCtx->tdls_lock);
-
     pHddTdlsCtx->discovery_sent_cnt = 0;
     wlan_hdd_tdls_check_power_save_prohibited(pHddTdlsCtx->pAdapter);
 
@@ -2428,16 +2637,17 @@
        return;
     }
 
-    curr_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, TRUE);
+    mutex_lock(&pHddCtx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, FALSE);
     if (NULL != curr_peer)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                 "%s: tdls in progress. Dont check for BMPS " MAC_ADDRESS_STR,
                 __func__, MAC_ADDR_ARRAY (curr_peer->peerMac));
+        mutex_unlock(&pHddCtx->tdls_lock);
         return;
     }
 
-    mutex_lock(&pHddCtx->tdls_lock);
     pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
     if (NULL == pHddTdlsCtx)
     {
@@ -2446,7 +2656,7 @@
                 FL("pHddTdlsCtx points to NULL"));
         return;
     }
-    if ((TDLS_CTX_MAGIC != pHddCtx->tdls_scan_ctxt.magic) &&
+    if ((TDLS_CTX_MAGIC != pHddCtx->scan_ctxt.magic) &&
         (0 == pHddCtx->connected_peer_count) &&
         (0 == pHddTdlsCtx->discovery_sent_cnt))
     {
@@ -2472,21 +2682,6 @@
     return;
 }
 
-u8 wlan_hdd_tdls_is_peer_progress(hdd_adapter_t *pAdapter, u8 *mac)
-{
-    hddTdlsPeer_t *curr_peer;
-
-    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, TRUE);
-    if (curr_peer == NULL)
-    {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 "%s: curr_peer is NULL", __func__);
-        return 0;
-    }
-
-    return (eTDLS_LINK_CONNECTING == curr_peer->link_status);
-}
-
 /* return pointer to hddTdlsPeer_t if TDLS is ongoing. Otherwise return NULL.
  * mac - if NULL check for all the peer list, otherwise, skip this mac when skip_self is TRUE
  * skip_self - if TRUE, skip this mac. otherwise, check all the peer list. if
@@ -2597,7 +2792,8 @@
 
 void wlan_hdd_tdls_set_mode(hdd_context_t *pHddCtx,
                             eTDLSSupportMode tdls_mode,
-                            v_BOOL_t bUpdateLast)
+                            v_BOOL_t bUpdateLast,
+                            enum tdls_disable_source source)
 {
     hdd_adapter_list_node_t *pAdapterNode = NULL, *pNext = NULL;
     VOS_STATUS status;
@@ -2619,6 +2815,23 @@
         mutex_unlock(&pHddCtx->tdls_lock);
         hddLog(VOS_TRACE_LEVEL_INFO, "%s already in mode %d", __func__,
                                      (int)tdls_mode);
+
+        if (tdls_mode == eTDLS_SUPPORT_DISABLED)
+        {
+            /*
+             * TDLS is already disabled hence set source mask and return
+             */
+            set_bit((unsigned long)source, &pHddCtx->tdls_source_bitmap);
+            return;
+        }
+        if (tdls_mode == eTDLS_SUPPORT_ENABLED)
+        {
+            /*
+             * TDLS is already disabled hence set source mask and return
+             */
+            clear_bit((unsigned long)source, &pHddCtx->tdls_source_bitmap);
+            return;
+        }
         return;
     }
 
@@ -2631,10 +2844,40 @@
        if (NULL != pHddTdlsCtx)
        {
            if(eTDLS_SUPPORT_ENABLED == tdls_mode)
+           {
+               clear_bit((unsigned long)source, &pHddCtx->tdls_source_bitmap);
+
+               /*
+                * Check if any TDLS source bit is set and if bitmap is
+                * not zero then we should not enable TDLS
+                */
+               if (pHddCtx->tdls_source_bitmap)
+               {
+                   mutex_unlock(&pHddCtx->tdls_lock);
+                   return;
+               }
                wlan_hdd_tdls_implicit_enable(pHddTdlsCtx);
-           else if((eTDLS_SUPPORT_DISABLED == tdls_mode) ||
-                   (eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == tdls_mode))
+           }
+           else if((eTDLS_SUPPORT_DISABLED == tdls_mode))
+           {
+               set_bit((unsigned long)source, &pHddCtx->tdls_source_bitmap);
                wlan_hdd_tdls_implicit_disable(pHddTdlsCtx);
+           }
+           else if ((eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == tdls_mode))
+           {
+               clear_bit((unsigned long)source, &pHddCtx->tdls_source_bitmap);
+
+               /*
+                * Check if any TDLS source bit is set and if bitmap is
+                * not zero then we should not enable TDLS
+                */
+               if (pHddCtx->tdls_source_bitmap)
+               {
+                   mutex_unlock(&pHddCtx->tdls_lock);
+                   return;
+               }
+               wlan_hdd_tdls_implicit_disable(pHddTdlsCtx);
+           }
        }
        status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
        pAdapterNode = pNext;
@@ -2683,13 +2926,6 @@
         return;
     }
 
-    if (TRUE == sme_IsPmcBmps(WLAN_HDD_GET_HAL_CTX(pHddTdlsCtx->pAdapter)))
-    {
-        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                   "%s: Disable BMPS", __func__);
-        hdd_disable_bmps_imps(pHddCtx, WLAN_HDD_INFRA_STATION);
-    }
-
     /* This function is called in mutex_lock */
     temp_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, FALSE);
     if (NULL != temp_peer)
@@ -2790,71 +3026,6 @@
     return;
 }
 
-void wlan_hdd_tdls_free_scan_request (tdls_scan_context_t *tdls_scan_ctx)
-{
-    if (NULL == tdls_scan_ctx)
-    {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 FL("tdls_scan_ctx is NULL"));
-        return;
-    }
-
-    tdls_scan_ctx->attempt = 0;
-    tdls_scan_ctx->reject = 0;
-    tdls_scan_ctx->magic = 0;
-    tdls_scan_ctx->scan_request = NULL;
-        return;
-}
-
-int wlan_hdd_tdls_copy_scan_context(hdd_context_t *pHddCtx,
-                            struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
-                            struct net_device *dev,
-#endif
-                            struct cfg80211_scan_request *request)
-{
-    tdls_scan_context_t *scan_ctx;
-
-    ENTER();
-    if(0 != (wlan_hdd_validate_context(pHddCtx)))
-    {
-        return 0;
-    }
-
-    scan_ctx = &pHddCtx->tdls_scan_ctxt;
-
-    scan_ctx->wiphy = wiphy;
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
-    scan_ctx->dev = dev;
-#endif
-
-    scan_ctx->scan_request = request;
-
-    EXIT();
-    return 0;
-}
-
-static void wlan_hdd_tdls_scan_init_work(hdd_context_t *pHddCtx,
-                                struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
-                                struct net_device *dev,
-#endif
-                                struct cfg80211_scan_request *request,
-                                unsigned long delay)
-{
-    if (TDLS_CTX_MAGIC != pHddCtx->tdls_scan_ctxt.magic)
-    {
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
-        wlan_hdd_tdls_copy_scan_context(pHddCtx, wiphy, dev, request);
-#else
-        wlan_hdd_tdls_copy_scan_context(pHddCtx, wiphy, request);
-#endif
-        pHddCtx->tdls_scan_ctxt.attempt = 0;
-        pHddCtx->tdls_scan_ctxt.magic = TDLS_CTX_MAGIC;
-    }
-    schedule_delayed_work(&pHddCtx->tdls_scan_ctxt.tdls_scan_work, delay);
-}
-
 /* return negative = caller should stop and return error code immediately
    return 0 = caller should stop and return success immediately
    return 1 = caller can continue to scan
@@ -2879,42 +3050,47 @@
     }
 
     /* if tdls is not enabled, then continue scan */
-    if ((eTDLS_SUPPORT_NOT_ENABLED == pHddCtx->tdls_mode) ||
-        (pHddCtx->is_tdls_btc_enabled == FALSE))
+    if ((eTDLS_SUPPORT_NOT_ENABLED == pHddCtx->tdls_mode))
         return 1;
-    curr_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, TRUE);
+
+    mutex_lock(&pHddCtx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, FALSE);
     if (NULL != curr_peer)
     {
-        if (pHddCtx->tdls_scan_ctxt.reject++ >= TDLS_MAX_SCAN_REJECT)
+        if (pHddCtx->scan_ctxt.reject++ >= TDLS_MAX_SCAN_REJECT)
         {
-            pHddCtx->tdls_scan_ctxt.reject = 0;
+            pHddCtx->scan_ctxt.reject = 0;
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                     "%s: " MAC_ADDRESS_STR ". scan rejected %d. force it to idle",
-                    __func__, MAC_ADDR_ARRAY (curr_peer->peerMac), pHddCtx->tdls_scan_ctxt.reject);
+                    __func__, MAC_ADDR_ARRAY (curr_peer->peerMac), pHddCtx->scan_ctxt.reject);
 
             wlan_hdd_tdls_set_peer_link_status (curr_peer,
                                                 eTDLS_LINK_IDLE,
                                                 eTDLS_LINK_UNSPECIFIED);
+            mutex_unlock(&pHddCtx->tdls_lock);
             return 1;
         }
+        mutex_unlock(&pHddCtx->tdls_lock);
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                 "%s: tdls in progress. scan rejected %d",
-                __func__, pHddCtx->tdls_scan_ctxt.reject);
+                __func__, pHddCtx->scan_ctxt.reject);
         return -EBUSY;
     }
+    else
+        mutex_unlock(&pHddCtx->tdls_lock);
 
     /* tdls teardown is ongoing */
     if (eTDLS_SUPPORT_DISABLED == pHddCtx->tdls_mode)
     {
         connectedTdlsPeers = wlan_hdd_tdlsConnectedPeers(pAdapter);
-        if (connectedTdlsPeers && (pHddCtx->tdls_scan_ctxt.attempt < TDLS_MAX_SCAN_SCHEDULE))
+        if (connectedTdlsPeers && (pHddCtx->scan_ctxt.attempt < TDLS_MAX_SCAN_SCHEDULE))
         {
             delay = (unsigned long)(TDLS_DELAY_SCAN_PER_CONNECTION*connectedTdlsPeers);
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                     "%s: tdls disabled, but still connected_peers %d attempt %d. schedule scan %lu msec",
-                    __func__, connectedTdlsPeers, pHddCtx->tdls_scan_ctxt.attempt, delay);
+                    __func__, connectedTdlsPeers, pHddCtx->scan_ctxt.attempt, delay);
 
-            wlan_hdd_tdls_scan_init_work (pHddCtx, wiphy,
+            wlan_hdd_defer_scan_init_work (pHddCtx, wiphy,
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
                                           dev,
 #endif
@@ -2926,7 +3102,7 @@
         /* no connected peer or max retry reached, scan continue */
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                 "%s: tdls disabled. connected_peers %d attempt %d. scan allowed",
-                __func__, connectedTdlsPeers, pHddCtx->tdls_scan_ctxt.attempt);
+                __func__, connectedTdlsPeers, pHddCtx->scan_ctxt.attempt);
         return 1;
     }
 
@@ -2955,9 +3131,11 @@
              (TRUE == sme_IsFeatureSupportedByFW(TDLS_SCAN_COEXISTENCE)) &&
              (connectedTdlsPeers == 1) )
         {
+            mutex_lock(&pHddCtx->tdls_lock);
             /* get connected peer information */
             connected_peer = wlan_hdd_tdls_get_connected_peer(pAdapter);
             if (NULL == connected_peer) {
+                mutex_unlock(&pHddCtx->tdls_lock);
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
                     "%s: Invalid connected_peer, Continue Scanning", __func__);
                 /* scan should continue */
@@ -2969,20 +3147,23 @@
 
             if (connected_peer->isBufSta)
             {
-                 pHddCtx->isTdlsScanCoexistence = TRUE;
-                 if ((cfg_param->dynSplitscan) && (!pHddCtx->issplitscan_enabled))
-                 {
-                           pHddCtx->issplitscan_enabled = TRUE;
-                           sme_enable_disable_split_scan(
-                                               WLAN_HDD_GET_HAL_CTX(pAdapter),
-                                               cfg_param->nNumStaChanCombinedConc,
-                                               cfg_param->nNumP2PChanCombinedConc);
-                 }
-                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                           ("%s:%d TDLS Scan Co-exist supported splitscan_enabled =%d "),
-                            __func__, __LINE__, pHddCtx->issplitscan_enabled);
-                 return 1;
+                mutex_unlock(&pHddCtx->tdls_lock);
+                pHddCtx->isTdlsScanCoexistence = TRUE;
+                if ((cfg_param->dynSplitscan) && (!pHddCtx->issplitscan_enabled))
+                {
+                    pHddCtx->issplitscan_enabled = TRUE;
+                    sme_enable_disable_split_scan(
+                            WLAN_HDD_GET_HAL_CTX(pAdapter),
+                            cfg_param->nNumStaChanCombinedConc,
+                            cfg_param->nNumP2PChanCombinedConc);
+                }
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                        ("%s:%d TDLS Scan Co-exist supported splitscan_enabled =%d "),
+                        __func__, __LINE__, pHddCtx->issplitscan_enabled);
+                return 1;
             }
+            else
+                mutex_unlock(&pHddCtx->tdls_lock);
 
         }
         else
@@ -3003,7 +3184,8 @@
                     sme_IsFeatureSupportedByFW(TDLS_SCAN_COEXISTENCE));
 
         /* disable implicit trigger logic & tdls operatoin */
-        wlan_hdd_tdls_set_mode(pHddCtx, eTDLS_SUPPORT_DISABLED, FALSE);
+        wlan_hdd_tdls_set_mode(pHddCtx, eTDLS_SUPPORT_DISABLED, FALSE,
+                               HDD_SET_TDLS_MODE_SOURCE_SCAN);
         /* fall back to the implementation of teardown the peers on the scan
          * when the number of connected peers are more than one. TDLS Scan
          * coexistance feature is exercised only when a single peer is
@@ -3016,20 +3198,30 @@
             tANI_U8 staIdx;
             hddTdlsPeer_t *curr_peer;
 
+            mutex_lock(&pHddCtx->tdls_lock);
             for (staIdx = 0; staIdx < HDD_MAX_NUM_TDLS_STA; staIdx++)
             {
                 if (pHddCtx->tdlsConnInfo[staIdx].staId)
                 {
                     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                                   ("%s: indicate TDLS teardown (staId %d)"), __func__, pHddCtx->tdlsConnInfo[staIdx].staId) ;
+                                   ("%s: indicate TDLS teardown (staId %d)"),
+                                   __func__, pHddCtx->tdlsConnInfo[staIdx].staId) ;
 
 #ifdef CONFIG_TDLS_IMPLICIT
-                    curr_peer = wlan_hdd_tdls_find_all_peer(pHddCtx, pHddCtx->tdlsConnInfo[staIdx].peerMac.bytes);
-                    if(curr_peer)
-                        wlan_hdd_tdls_indicate_teardown(curr_peer->pHddTdlsCtx->pAdapter, curr_peer, eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
+                    curr_peer = wlan_hdd_tdls_find_all_peer(pHddCtx,
+                            pHddCtx->tdlsConnInfo[staIdx].peerMac.bytes);
+                    if(curr_peer) {
+                        wlan_hdd_tdls_indicate_teardown(
+                                curr_peer->pHddTdlsCtx->pAdapter, curr_peer,
+                                eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
+                        hdd_send_wlan_tdls_teardown_event(
+                                               eTDLS_TEARDOWN_SCAN,
+                                               curr_peer->peerMac);
+                    }
 #endif
                 }
             }
+            mutex_unlock(&pHddCtx->tdls_lock);
             /* schedule scan */
             delay = (unsigned long)(TDLS_DELAY_SCAN_PER_CONNECTION*connectedTdlsPeers);
 
@@ -3038,7 +3230,7 @@
                     __func__, pHddCtx->tdls_mode, wlan_hdd_tdlsConnectedPeers(pAdapter),
                     delay);
 
-            wlan_hdd_tdls_scan_init_work (pHddCtx, wiphy,
+            wlan_hdd_defer_scan_init_work (pHddCtx, wiphy,
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
                                           dev,
 #endif
@@ -3066,16 +3258,15 @@
         return;
     }
 
-    /* if tdls is not enabled or BtCoex is on then don't revert tdls mode */
-    if ((eTDLS_SUPPORT_NOT_ENABLED == pHddCtx->tdls_mode) ||
-        (pHddCtx->is_tdls_btc_enabled == FALSE)) {
-            hddLog(VOS_TRACE_LEVEL_ERROR, FL("Failed to revert: Mode=%d, BTC enabled=%d"),
-                   pHddCtx->tdls_mode, pHddCtx->is_tdls_btc_enabled);
+    /* if tdls is not enabled then don't revert tdls mode */
+    if ((eTDLS_SUPPORT_NOT_ENABLED == pHddCtx->tdls_mode)) {
+            hddLog(VOS_TRACE_LEVEL_INFO, FL("Failed to revert: Mode=%d"),
+                   pHddCtx->tdls_mode);
             return;
     }
 
     /* free allocated memory at scan time */
-    wlan_hdd_tdls_free_scan_request (&pHddCtx->tdls_scan_ctxt);
+    wlan_hdd_init_deinit_defer_scan_context(&pHddCtx->scan_ctxt);
 
     /* if tdls was enabled before scan, re-enable tdls mode */
     if(eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode_last ||
@@ -3084,7 +3275,8 @@
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                        ("%s: revert tdls mode %d"), __func__, pHddCtx->tdls_mode_last);
 
-        wlan_hdd_tdls_set_mode(pHddCtx, pHddCtx->tdls_mode_last, FALSE);
+        wlan_hdd_tdls_set_mode(pHddCtx, pHddCtx->tdls_mode_last, FALSE,
+                               HDD_SET_TDLS_MODE_SOURCE_SCAN);
     }
     wlan_hdd_tdls_check_bmps(pAdapter);
 
@@ -3229,7 +3421,9 @@
 
     hddTdlsPeer_t *curr_peer;
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, TRUE);
+
+    mutex_lock(&pHddCtx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
@@ -3253,6 +3447,7 @@
             wlan_hdd_tdls_get_wifi_hal_state(curr_peer, state, reason);
         }
     }
+    mutex_unlock(&pHddCtx->tdls_lock);
     return (0);
 }
 
@@ -3348,6 +3543,44 @@
             MAC_ADDR_ARRAY(mac), rssiAvg);
 }
 
+/**
+ * wlan_hdd_tdls_reenable() - Re-Enable TDLS
+ * @hddctx: pointer to hdd context
+ *
+ * Function re-enable's TDLS which might be disabled during concurrency
+ *
+ * Return: None
+ */
+void wlan_hdd_tdls_reenable(hdd_context_t *pHddCtx)
+{
+
+    if ((TRUE != pHddCtx->cfg_ini->fEnableTDLSSupport) ||
+        (TRUE != sme_IsFeatureSupportedByFW(TDLS))) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  FL("tdls support not enabled"));
+        return;
+    }
+
+    /* if tdls is not enabled then don't revert tdls mode */
+    if ((eTDLS_SUPPORT_NOT_ENABLED == pHddCtx->tdls_mode)) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  FL("TDLS disabled so no need to enable: Mode=%d"),
+                  pHddCtx->tdls_mode);
+            return;
+    }
+
+    if (eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode_last ||
+         eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY ==
+                               pHddCtx->tdls_mode_last) {
+            /* Enable TDLS support Once P2P session ends since
+             * upond detection of concurrency TDLS might be disabled
+             */
+             hddLog(LOG1, FL("TDLS mode set to %d"), pHddCtx->tdls_mode_last);
+             wlan_hdd_tdls_set_mode(pHddCtx, pHddCtx->tdls_mode_last,
+                                    FALSE, HDD_SET_TDLS_MODE_SOURCE_P2P);
+    }
+}
+
 tdlsConnInfo_t *wlan_hdd_get_conn_info(hdd_context_t *pHddCtx,
                                        tANI_U8 idx)
 {
@@ -3366,42 +3599,30 @@
     return NULL;
 }
 
-/**
- * wlan_hdd_tdls_reenable() - Re-Enable TDLS
- * @hddctx: pointer to hdd context
- *
- * Function re-enable's TDLS which might be disabled during concurrency
- *
- * Return: None
- */
-void wlan_hdd_tdls_reenable(hdd_context_t *pHddCtx)
+void wlan_hdd_change_tdls_mode(void *data)
 {
-    if ((TRUE != pHddCtx->cfg_ini->fEnableTDLSSupport) ||
-        (TRUE != sme_IsFeatureSupportedByFW(TDLS))) {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  FL("tdls support not enabled"));
-        return;
-    }
+    hdd_context_t *hdd_ctx = (hdd_context_t *)data;
 
-    /* if tdls is not enabled or BtCoex is on then don't revert tdls mode */
-    if ((eTDLS_SUPPORT_NOT_ENABLED == pHddCtx->tdls_mode) ||
-        (pHddCtx->is_tdls_btc_enabled == FALSE)) {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  FL("btc disable tdls so no need to enable: Mode=%d, BTC enabled=%d"),
-                  pHddCtx->tdls_mode, pHddCtx->is_tdls_btc_enabled);
-        return;
-    }
-
-    if (eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode_last ||
-        eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY ==
-                              pHddCtx->tdls_mode_last) {
-        /* Enable TDLS support Once P2P session ends since
-         * upond detection of concurrency TDLS might be disabled
-         */
-        hddLog(LOG1, FL("TDLS mode set to %d"), pHddCtx->tdls_mode_last);
-        wlan_hdd_tdls_set_mode(pHddCtx, pHddCtx->tdls_mode_last,
-                               FALSE);
-    }
+    wlan_hdd_tdls_set_mode(hdd_ctx, eTDLS_SUPPORT_ENABLED, FALSE,
+                           HDD_SET_TDLS_MODE_SOURCE_OFFCHANNEL);
 }
-/*EXT TDLS*/
 
+void wlan_hdd_start_stop_tdls_source_timer(hdd_context_t *pHddCtx,
+                                           eTDLSSupportMode tdls_mode)
+{
+    if (VOS_TIMER_STATE_RUNNING ==
+            vos_timer_getCurrentState(&pHddCtx->tdls_source_timer))
+        vos_timer_stop(&pHddCtx->tdls_source_timer);
+
+    if (tdls_mode == eTDLS_SUPPORT_DISABLED) {
+        wlan_hdd_tdls_set_mode(pHddCtx, tdls_mode, FALSE,
+                               HDD_SET_TDLS_MODE_SOURCE_OFFCHANNEL);
+    }
+
+    vos_timer_start(&pHddCtx->tdls_source_timer,
+                    pHddCtx->cfg_ini->tdls_enable_defer_time);
+
+    return;
+}
+
+/*EXT TDLS*/
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_trace.c b/wlan/prima/CORE/HDD/src/wlan_hdd_trace.c
index 0713e1c..6901109 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_trace.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_trace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -135,3 +135,65 @@
 {
     vosTraceRegister(VOS_MODULE_ID_HDD, (tpvosTraceCb)&hddTraceDump);
 }
+
+/**
+ * hdd_state_info_dump() - prints state information of hdd layer
+ */
+static void hdd_state_info_dump(void)
+{
+    v_CONTEXT_t vos_ctx_ptr;
+    hdd_context_t *hdd_ctx_ptr = NULL;
+    hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
+    VOS_STATUS status;
+    hdd_station_ctx_t *hdd_sta_ctx = NULL;
+    hdd_adapter_t *adapter =NULL;
+
+    /* get the global voss context */
+    vos_ctx_ptr = vos_get_global_context(VOS_MODULE_ID_VOSS, NULL);
+
+    if (!vos_ctx_ptr) {
+        hddLog(LOGE, FL("Invalid Global VOSS Context"));
+        VOS_ASSERT(0);
+        return;
+    }
+    hdd_ctx_ptr = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx_ptr);
+    if (!hdd_ctx_ptr) {
+       hddLog(LOGE, FL("HDD context is Null"));
+       return;
+    }
+
+    hddLog(LOG1,
+           FL("mScanPending %d isWlanSuspended %d disable_dfs_flag %d"),
+           hdd_ctx_ptr->scan_info.mScanPending,
+           hdd_ctx_ptr->isWlanSuspended, hdd_ctx_ptr->disable_dfs_flag);
+
+    status = hdd_get_front_adapter(hdd_ctx_ptr, &adapter_node);
+
+    while (NULL != adapter_node && VOS_STATUS_SUCCESS == status) {
+       adapter = adapter_node->pAdapter;
+       if (adapter->dev)
+           hddLog(LOG1, FL("device name: %s"), adapter->dev->name);
+       switch (adapter->device_mode) {
+       case WLAN_HDD_INFRA_STATION:
+       case WLAN_HDD_P2P_CLIENT:
+           hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+           hddLog(LOG1, FL("connState: %d device_mode: %d"),
+                  hdd_sta_ctx->conn_info.connState, adapter->device_mode);
+           break;
+
+       default:
+           break;
+       }
+       status = hdd_get_next_adapter(hdd_ctx_ptr, adapter_node, &next);
+       adapter_node = next;
+    }
+}
+
+/**
+ * hdd_register_debug_callback() - registration function for hdd layer
+ * to print hdd state information
+ */
+void hdd_register_debug_callback()
+{
+    vos_register_debug_callback(VOS_MODULE_ID_HDD, &hdd_state_info_dump);
+}
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_tx_rx.c b/wlan/prima/CORE/HDD/src/wlan_hdd_tx_rx.c
index f673d8e..5404e1a 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_tx_rx.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_tx_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -98,6 +98,7 @@
 #define EAPOL_M3_BIT_MASK 0x8013
 #define EAPOL_M4_BIT_MASK 0x0003
 
+
 int gRatefromIdx[] = {
  10,20,55,100,
  10,20,55,110,
@@ -1188,6 +1189,7 @@
                 "%s: Request firmware for recovery",__func__);
       WLANTL_TLDebugMessage(WLANTL_DEBUG_FW_CLEANUP);
    }
+
    /*
     * This function is getting called in softirq context, So don't hold
     * any mutex.
@@ -1205,12 +1207,13 @@
                     "%s: Cannot recover from Data stall Issue SSR",
                       __func__);
           WLANTL_FatalError();
+          // reset count after issuing the SSR
+          pAdapter->hdd_stats.hddTxRxStats.continuousTxTimeoutCount = 0;
           return;
       }
    }
    else
    {
-       mutex_unlock(&pHddCtx->roc_lock);
       VOS_TRACE(VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_ERROR,
                 "Remain on channel in progress");
       /* The supplicant can retry "P2P Invitation Request" for 120 times
@@ -1244,7 +1247,15 @@
       hdd_wmm_tx_snapshot(pAdapter);
       WLANTL_TLDebugMessage(WLANTL_DEBUG_TX_SNAPSHOT);
    }
-
+   /* Call fatal event if data stall is for
+    * HDD_TX_STALL_FATAL_EVENT_THRESHOLD times
+    */
+   if (HDD_TX_STALL_FATAL_EVENT_THRESHOLD ==
+       pAdapter->hdd_stats.hddTxRxStats.continuousTxTimeoutCount)
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                   WLAN_LOG_INDICATOR_HOST_DRIVER,
+                   WLAN_LOG_REASON_DATA_STALL,
+                   FALSE, TRUE);
 }
 
 /**============================================================================
@@ -2085,30 +2096,7 @@
 
 #endif
 
-#ifdef FEATURE_WLAN_TDLS
-    if (eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode)
-    {
-        hdd_station_ctx_t *pHddStaCtx = &pAdapter->sessionCtx.station;
-        u8 mac[6];
-
-        wlan_hdd_tdls_extract_da(skb, mac);
-
-        if (vos_is_macaddr_group((v_MACADDR_t *)mac)) {
-            VOS_TRACE( VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_INFO_MED,
-                      "broadcast packet, not adding to peer list");
-        } else if (memcmp(pHddStaCtx->conn_info.bssId,
-                            mac, 6) != 0) {
-            VOS_TRACE( VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_INFO_MED,
-                      "extract mac: " MAC_ADDRESS_STR,
-                      MAC_ADDR_ARRAY(mac) );
-
-            wlan_hdd_tdls_increment_pkt_count(pAdapter, mac, 1);
-        } else {
-            VOS_TRACE( VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_INFO_MED,
-                       "packet da is bssid, not adding to peer list");
-        }
-    }
-#endif
+   wlan_hdd_tdls_notify_packet(pAdapter, skb);
 
    //Return VOS packet to TL;
    *ppVosPacket = pVosPacket;
@@ -2366,55 +2354,77 @@
 static void hdd_mon_add_rx_radiotap_hdr (struct sk_buff *skb,
              int rtap_len,  v_PVOID_t  pRxPacket, hdd_mon_ctx_t *pMonCtx)
 {
-    u8 rtap_temp[20] = {0};
+    u8 rtap_temp[28] = {0};
     struct ieee80211_radiotap_header *rthdr;
     unsigned char *pos;
+    u32 mac_time;
     u16 rx_flags = 0;
     u16 rateIdx;
-    s8        currentRSSI, currentRSSI0, currentRSSI1;
+    u16 channel_flags = 0;
+    u8 rfBand;
+    s8 currentRSSI, currentRSSI0, currentRSSI1;
+    s8 noise;
 
+    mac_time = WDA_GET_RX_TIMESTAMP(pRxPacket);
     rateIdx = WDA_GET_RX_MAC_RATE_IDX(pRxPacket);
     if( rateIdx >= 210 && rateIdx <= 217)
        rateIdx-=202;
     if( rateIdx >= 218 && rateIdx <= 225 )
        rateIdx-=210;
 
-    if(rateIdx > (sizeof(gRatefromIdx)/ sizeof(int))) {
+    if(rateIdx >= (sizeof(gRatefromIdx)/ sizeof(int))) {
        VOS_TRACE( VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_ERROR,
                   "%s: invalid rateIdx %d make it 0", __func__, rateIdx);
        rateIdx = 0;
     }
+    rfBand = WDA_GET_RX_RFBAND(pRxPacket);
+    if (IS_5G_BAND(rfBand))
+        channel_flags |= IEEE80211_CHAN_5GHZ;
+    else
+        channel_flags |= IEEE80211_CHAN_2GHZ;
     currentRSSI0 = WDA_GETRSSI0(pRxPacket) - 100;
     currentRSSI1 = WDA_GETRSSI1(pRxPacket) - 100;
     currentRSSI  = (currentRSSI0 > currentRSSI1) ? currentRSSI0 : currentRSSI1;
+    noise = WDA_GET_RX_SNR(pRxPacket);
 
     rthdr = (struct ieee80211_radiotap_header *)(&rtap_temp[0]);
 
     /* radiotap header, set always present flags */
-    rthdr->it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS)   |
+    rthdr->it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_TSFT) |
+                                    (1 << IEEE80211_RADIOTAP_FLAGS) |
                                     (1 << IEEE80211_RADIOTAP_CHANNEL) |
+                                    (1 << IEEE80211_RADIOTAP_RATE) |
+                                    (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
+                                    (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE) |
                                     (1 << IEEE80211_RADIOTAP_RX_FLAGS));
     rthdr->it_len = cpu_to_le16(rtap_len);
 
     pos = (unsigned char *) (rthdr + 1);
 
+    /* IEEE80211_RADIOTAP_TSFT */
+    put_unaligned_le64(mac_time, pos);
+    pos += 8;
+
     /* IEEE80211_RADIOTAP_FLAGS */
     *pos = 0;
     pos++;
 
     /* IEEE80211_RADIOTAP_RATE */
-    rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
     *pos = gRatefromIdx[rateIdx]/5;
-
     pos++;
 
     /* IEEE80211_RADIOTAP_CHANNEL */
     put_unaligned_le16(pMonCtx->ChannelNo, pos);
-    pos += 4;
+    pos += 2;
+    put_unaligned_le16(channel_flags, pos);
+    pos += 2;
 
     /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
     *pos = currentRSSI;
-    rthdr->it_present |=cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
+    pos++;
+
+    /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
+    *pos = noise;
     pos++;
 
     if ((pos - (u8 *)rthdr) & 1)
@@ -2490,7 +2500,7 @@
     if(!conversion)
     {
          pMonCtx = WLAN_HDD_GET_MONITOR_CTX_PTR(pAdapter);
-         needed_headroom = sizeof(struct ieee80211_radiotap_header) + 10;
+         needed_headroom = sizeof(struct ieee80211_radiotap_header) + 18;
          hdd_mon_add_rx_radiotap_hdr( skb, needed_headroom, pvBDHeader, pMonCtx );
     }
 
@@ -2682,7 +2692,15 @@
                           HDD_WAKE_LOCK_DURATION,
                           WIFI_POWER_EVENT_WAKELOCK_HOLD_RX);
 #endif
-      rxstat = netif_rx_ni(skb);
+      if (pNextVosPacket)
+      {
+          rxstat = netif_rx(skb);
+      }
+      else
+      {
+          rxstat = netif_rx_ni(skb);
+      }
+
       if (NET_RX_SUCCESS == rxstat)
       {
          ++pAdapter->hdd_stats.hddTxRxStats.rxDelivered;
@@ -2833,7 +2851,7 @@
      */
     if ((pHddCtx->isTdlsScanCoexistence == FALSE) && (pHddCtx->issplitscan_enabled))
     {
-       VOS_TRACE( VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_ERROR,
+       VOS_TRACE( VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_INFO,
                         "%s: Disable split scan", __func__);
        pHddCtx->issplitscan_enabled = FALSE;
        sme_enable_disable_split_scan(
@@ -2939,8 +2957,31 @@
 
     wlan_hdd_get_eapol_params(skb, &eapol_params, event_type);
     wlan_hdd_event_eapol_log(eapol_params);
-    VOS_TRACE( VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_INFO,
-               "Eapol subtype is %d and key info is %d\n",
-               eapol_params.event_sub_type,eapol_params.eapol_key_info);
+
+    if ((eapol_params.eapol_key_info & EAPOL_MASK )== EAPOL_M1_BIT_MASK)
+    {
+        hddLog(LOG1, FL("%s: M1 packet"),eapol_params.event_sub_type ==
+               WIFI_EVENT_DRIVER_EAPOL_FRAME_RECEIVED ? "RX" : "TX");
+    }
+    else if ((eapol_params.eapol_key_info & EAPOL_MASK )== EAPOL_M2_BIT_MASK)
+    {
+        hddLog(LOG1, FL("%s: M2 packet"),eapol_params.event_sub_type ==
+               WIFI_EVENT_DRIVER_EAPOL_FRAME_RECEIVED ? "RX" : "TX");
+
+    }
+
+    else if ((eapol_params.eapol_key_info & EAPOL_MASK )== EAPOL_M3_BIT_MASK)
+    {
+        hddLog(LOG1, FL("%s: M3 packet"),eapol_params.event_sub_type ==
+               WIFI_EVENT_DRIVER_EAPOL_FRAME_RECEIVED ? "RX" : "TX");
+    }
+
+    else if ((eapol_params.eapol_key_info & EAPOL_MASK )== EAPOL_M4_BIT_MASK)
+    {
+        hddLog(LOG1, FL("%s: M4 packet"),eapol_params.event_sub_type ==
+               WIFI_EVENT_DRIVER_EAPOL_FRAME_RECEIVED ? "RX" : "TX");
+
+    }
+
 }
 #endif /* FEATURE_WLAN_DIAG_SUPPORT */
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_wext.c b/wlan/prima/CORE/HDD/src/wlan_hdd_wext.c
index e21df64..2bd2df2 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_wext.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_wext.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -172,7 +172,8 @@
 #endif
 #define  WE_SET_RTS_CTS_HTVHT             21
 #define  WE_SET_MONITOR_STATE             22
-#define  WE_SET_PROXIMITY_ENABLE          23
+#define  WE_SET_PKT_STATS_ENABLE_DISABLE  23
+#define  WE_SET_PROXIMITY_ENABLE  24
 
 /* Private ioctls and their sub-ioctls */
 #define WLAN_PRIV_SET_NONE_GET_INT    (SIOCIWFIRSTPRIV + 1)
@@ -185,6 +186,7 @@
 #define WE_GET_SAP_AUTO_CHANNEL_SELECTION 8
 #define WE_GET_CONCURRENCY_MODE 9
 #define WE_GET_SCAN_BAND_PREFERENCE     10
+#define WE_GET_ANTENA_DIVERSITY_SELECTION 11
 /* Private ioctls and their sub-ioctls */
 #define WLAN_PRIV_SET_INT_GET_INT     (SIOCIWFIRSTPRIV + 2)
 
@@ -223,7 +225,14 @@
 #define WE_GET_11W_INFO      9
 #endif
 #define WE_GET_STATES        10
-#define WE_GET_SNR           11
+#ifdef WLAN_FEATURE_RMC
+#define WE_GET_IBSS_STA_INFO 11
+#endif
+#define WE_GET_SNR           12
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+#define WE_GET_OEM_DATA_CAP  13
+#endif
 
 /* Private ioctls and their sub-ioctls */
 #define WLAN_PRIV_SET_NONE_GET_NONE   (SIOCIWFIRSTPRIV + 6)
@@ -238,10 +247,14 @@
 #define WE_DISPLAY_DXE_SNAP_SHOT   7
 #define WE_SET_REASSOC_TRIGGER     8
 #define WE_DISPLAY_DATAPATH_SNAP_SHOT    9
+#ifdef WLAN_FEATURE_RMC
+#define WE_IBSS_GET_PEER_INFO_ALL 10
+#endif
 #define WE_STOP_OBSS_SCAN    11
 #define WE_DUMP_ROAM_TIMER_LOG     12
 #define WE_RESET_ROAM_TIMER_LOG    13
 #define WE_GET_FW_LOGS             14
+#define WE_GET_FW_MEMDUMP          15
 
 /* Private ioctls and their sub-ioctls */
 #define WLAN_PRIV_SET_VAR_INT_GET_NONE   (SIOCIWFIRSTPRIV + 7)
@@ -255,6 +268,9 @@
 #ifdef FEATURE_WLAN_TDLS
 #define WE_TDLS_CONFIG_PARAMS   5
 #endif
+#ifdef WLAN_FEATURE_RMC
+#define WE_IBSS_GET_PEER_INFO   6
+#endif
 
 #define WE_MTRACE_DUMP_CMD    8
 #define WE_MTRACE_SELECTIVE_MODULE_LOG_ENABLE_CMD    9
@@ -403,7 +419,9 @@
 int wlan_hdd_set_filter(hdd_context_t *pHddCtx, tpPacketFilterCfg pRequest,
                            v_U8_t sessionId);
 #endif
-
+static int get_fwr_memdump(struct net_device *,
+                            struct iw_request_info *,
+                            union iwreq_data *, char *);
 /**---------------------------------------------------------------------------
 
   \brief mem_alloc_copy_from_user_helper -
@@ -553,6 +571,163 @@
     return;
 }
 
+#ifdef WLAN_FEATURE_RMC
+void hdd_get_ibss_peer_info_cb(v_VOID_t *pUserData, v_VOID_t *pPeerInfoRsp)
+{
+   hdd_adapter_t *pAdapter = (hdd_adapter_t *)pUserData;
+   tSirPeerInfoRspParams *pPeerInfo = (tSirPeerInfoRspParams *)pPeerInfoRsp;
+   hdd_station_ctx_t *pStaCtx =  WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+   v_U8_t   i;
+
+   if (NULL != pPeerInfo && eHAL_STATUS_SUCCESS == pPeerInfo->status)
+   {
+      pStaCtx->ibss_peer_info.status = pPeerInfo->status;
+      pStaCtx->ibss_peer_info.numIBSSPeers = pPeerInfo->numPeers;
+      for (i = 0; i < pPeerInfo->numPeers; i++)
+      {
+         memcpy(&pStaCtx->ibss_peer_info.ibssPeerList[i],
+                &pPeerInfo->peerInfoParams[i], sizeof(hdd_ibss_peer_info_params_t));
+      }
+   }
+   else
+   {
+      hddLog(LOGE,
+            FL("PEER_INFO_CMD_STATUS is not SUCCESS"));
+   }
+
+   complete(&pAdapter->ibss_peer_info_comp);
+}
+
+v_MACADDR_t* hdd_wlan_get_ibss_mac_addr_from_staid(hdd_adapter_t *pAdapter, v_U8_t staIdx)
+{
+   v_U8_t idx;
+   hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+
+   for ( idx = 0; idx < HDD_MAX_NUM_IBSS_STA; idx++ )
+   {
+      if ( 0 != pHddStaCtx->conn_info.staId[ idx ] &&
+           staIdx == pHddStaCtx->conn_info.staId[ idx ])
+      {
+         return (&pHddStaCtx->conn_info.peerMacAddress[ idx ]);
+      }
+   }
+   return NULL;
+}
+
+eHalStatus hdd_wlan_get_ibss_peer_info(hdd_adapter_t *pAdapter, v_U8_t staIdx)
+{
+    eHalStatus status = eHAL_STATUS_FAILURE;
+    tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
+    hdd_station_ctx_t *pStaCtx =  WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+    hdd_ibss_peer_info_t *pPeerInfo = &pStaCtx->ibss_peer_info;
+
+    status = sme_RequestIBSSPeerInfo(hHal, pAdapter, hdd_get_ibss_peer_info_cb,
+                                     VOS_FALSE, staIdx);
+
+    INIT_COMPLETION(pAdapter->ibss_peer_info_comp);
+
+    if (eHAL_STATUS_SUCCESS == status)
+    {
+       long ret;
+       ret  = wait_for_completion_interruptible_timeout
+                (&pAdapter->ibss_peer_info_comp,
+                msecs_to_jiffies(IBSS_PEER_INFO_REQ_TIMOEUT));
+       if (ret <= 0)
+       {
+          hddLog(VOS_TRACE_LEVEL_ERROR,
+                  FL("failed wait on ibss_peer_info_comp %ld"), ret);
+          return eHAL_STATUS_FAILURE;
+       }
+
+       /** Print the peer info */
+       pr_info("pPeerInfo->numIBSSPeers = %d ", pPeerInfo->numIBSSPeers);
+       pr_info("============================================================");
+       {
+          v_MACADDR_t *macAddr = hdd_wlan_get_ibss_mac_addr_from_staid(pAdapter,
+                                 staIdx);
+          v_U32_t  txRateMbps = ((pPeerInfo->ibssPeerList[0].txRate)*500*1000)/1000000;
+
+          if (NULL != macAddr)
+          {
+             pr_info("PEER ADDR :" MAC_ADDRESS_STR " TxRate: %d Mbps  RSSI: %d",
+                     MAC_ADDR_ARRAY(macAddr->bytes),
+                      (int)txRateMbps, (int)pPeerInfo->ibssPeerList[0].rssi);
+          }
+          else
+          {
+             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                       " ERROR: PEER MAC ADDRESS NOT FOUND ");
+          }
+       }
+    }
+    else
+    {
+       hddLog(VOS_TRACE_LEVEL_WARN,
+              "%s: Warning: sme_RequestIBSSPeerInfo Request failed", __func__);
+    }
+
+    return status;
+}
+
+eHalStatus hdd_wlan_get_ibss_peer_info_all(hdd_adapter_t *pAdapter)
+{
+    eHalStatus status = eHAL_STATUS_FAILURE;
+    tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
+    hdd_station_ctx_t *pStaCtx =  WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+    hdd_ibss_peer_info_t *pPeerInfo = &pStaCtx->ibss_peer_info;
+    int i;
+
+    status = sme_RequestIBSSPeerInfo(hHal, pAdapter, hdd_get_ibss_peer_info_cb,
+                                     VOS_TRUE, 0xFF);
+    INIT_COMPLETION(pAdapter->ibss_peer_info_comp);
+
+    if (eHAL_STATUS_SUCCESS == status)
+    {
+       long ret;
+       ret  = wait_for_completion_interruptible_timeout
+                (&pAdapter->ibss_peer_info_comp,
+                 msecs_to_jiffies(IBSS_PEER_INFO_REQ_TIMOEUT));
+       if (ret <= 0)
+       {
+          hddLog(VOS_TRACE_LEVEL_ERROR,
+                  FL("failed wait on ibss_peer_info_comp %ld"), ret);
+          return eHAL_STATUS_FAILURE;
+       }
+
+       /** Print the peer info */
+       pr_info("pPeerInfo->numIBSSPeers = %d ", (int)pPeerInfo->numIBSSPeers);
+       pr_info("============================================================");
+       for (i = 0; i < pPeerInfo->numIBSSPeers; i++)
+       {
+          v_U8_t staIdx = pPeerInfo->ibssPeerList[i].staIdx;
+          v_MACADDR_t *macAddr = hdd_wlan_get_ibss_mac_addr_from_staid(pAdapter,
+                                                                       staIdx);
+          v_U32_t  txRateMbps = ((pPeerInfo->ibssPeerList[0].txRate)*500*1000)/1000000;
+
+          pr_info("STAIDX:%d ", (int)pPeerInfo->ibssPeerList[i].staIdx);
+          if (NULL != macAddr)
+          {
+             pr_info(" PEER ADDR :" MAC_ADDRESS_STR " TxRate: %d Mbps RSSI: %d",
+                     MAC_ADDR_ARRAY(macAddr->bytes),
+                     (int)txRateMbps, (int)pPeerInfo->ibssPeerList[i].rssi);
+          }
+          else
+          {
+             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                       " ERROR: PEER MAC ADDRESS NOT FOUND ");
+          }
+       }
+    }
+    else
+    {
+       hddLog(VOS_TRACE_LEVEL_WARN,
+              "%s: Warning: sme_RequestIBSSPeerInfo Request failed", __func__);
+    }
+
+    return status;
+}
+#endif /* WLAN_FEATURE_RMC */
+
 int hdd_wlan_get_rts_threshold(hdd_adapter_t *pAdapter, union iwreq_data *wrqu)
 {
     tHalHandle hHal;
@@ -964,7 +1139,7 @@
    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
    if (!pHddCtx->mgmt_frame_logging)
    {
-      hddLog(VOS_TRACE_LEVEL_ERROR,"%s: Frame Logging not init!", __func__);
+      hddLog(LOGW, FL("Frame Logging not init!"));
       return VOS_STATUS_E_AGAIN;
    }
 
@@ -3415,7 +3590,8 @@
    hstatus = sme_GetStatistics(WLAN_HDD_GET_HAL_CTX(pAdapter),
                                eCSR_HDD,
                                SME_SUMMARY_STATS |
-                               SME_GLOBAL_CLASSA_STATS,
+                               SME_GLOBAL_CLASSA_STATS |
+                               SME_PER_PKT_STATS,
                                hdd_get_station_statisticsCB,
                                0, // not periodic
                                FALSE, //non-cached results
@@ -4176,15 +4352,15 @@
     }
     else if (strcasecmp(cmd, "scan-active") == 0)
     {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                   FL("making default scan to active"));
+        hddLog(LOG1,
+                FL("making default scan to active"));
         pHddCtx->scan_info.scan_mode = eSIR_ACTIVE_SCAN;
         ret = snprintf(cmd, cmd_len, "OK");
     }
     else if (strcasecmp(cmd, "scan-passive") == 0)
     {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                   FL("making default scan to passive"));
+        hddLog(LOG1,
+               FL("making default scan to passive"));
         pHddCtx->scan_info.scan_mode = eSIR_PASSIVE_SCAN;
         ret = snprintf(cmd, cmd_len, "OK");
     }
@@ -4525,10 +4701,64 @@
    return ret;
 }
 
+/* cat /proc/net/wireless invokes this function to get wireless stats */
 static struct iw_statistics * __get_wireless_stats(struct net_device *dev)
 {
-   ENTER();
-   return NULL;
+    hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_context_t *pHddCtx;
+    hdd_station_ctx_t *pHddStaCtx;
+    v_S7_t snr = 0, rssi = 0;
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+
+    ENTER();
+
+    if (NULL == pAdapter)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "%s: Adapter is NULL",__func__);
+        return NULL;
+    }
+
+    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    status = wlan_hdd_validate_context(pHddCtx);
+    if (0 != status)
+    {
+       return NULL;
+    }
+
+    pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+    if (NULL == pHddStaCtx)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "%s: STA Context is NULL",__func__);
+        return NULL;
+    }
+
+    if (eConnectionState_Associated == pHddStaCtx->conn_info.connState)
+    {
+        wlan_hdd_get_station_stats(pAdapter);
+        wlan_hdd_get_snr(pAdapter, &snr);
+        wlan_hdd_get_rssi(pAdapter, &rssi);
+
+        vos_mem_zero(&pAdapter->iwStats, sizeof(pAdapter->iwStats));
+        pAdapter->iwStats.status = 0;
+        pAdapter->iwStats.qual.qual = snr;
+        pAdapter->iwStats.qual.level = rssi;
+        pAdapter->iwStats.qual.noise = rssi - snr;
+        pAdapter->iwStats.discard.code = 0;
+        pAdapter->iwStats.discard.retries= 0;
+        pAdapter->iwStats.miss.beacon = 0;
+        pAdapter->iwStats.qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+    }
+    else
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
+            FL("not in associated state: %d"), pHddStaCtx->conn_info.connState);
+        return NULL;
+    }
+
+    EXIT();
+    return &(pAdapter->iwStats);
 }
 
 static struct iw_statistics *get_wireless_stats(struct net_device *dev)
@@ -5359,13 +5589,81 @@
     return ret;
 }
 
+int wlan_hdd_set_proximity(int set_value)
+{
+    sHwCalValues hwCalValues;
+    uint16 hwCalTxPower;
+    uint8 txPwr = TX_PWR_DEF;
+
+    hddLog(LOG1, FL("WE_SET_PROXIMITY_ENABLE: %d"), set_value);
+
+    if (TRUE == set_value) {
+        if(vos_nv_read( VNV_HW_CAL_VALUES, &hwCalValues,
+                        NULL, sizeof(sHwCalValues) )
+                            != VOS_STATUS_SUCCESS) {
+            return -EINVAL;
+        }
+        hwCalTxPower = (uint16)(hwCalValues.calData.hwParam7 >> 16);
+
+        hddLog(LOG1, FL("hwCalTxPower:%x nv_data:%x"),
+                hwCalTxPower, hwCalValues.calData.hwParam7);
+
+        txPwr = (int8)(hwCalTxPower & 0x00FF);
+        txPwr = txPwr/10;
+        if (txPwr < TX_PWR_MIN)
+            txPwr = TX_PWR_MIN;
+        if (txPwr > TX_PWR_MAX)
+            txPwr = TX_PWR_MAX;
+
+        if (sme_SetMaxTxPowerPerBand(eCSR_BAND_24, txPwr) !=
+                                eHAL_STATUS_SUCCESS) {
+            hddLog(VOS_TRACE_LEVEL_ERROR,
+              FL("Setting tx power failed for 2.4GHz band %d"), txPwr);
+            return -EIO;
+        }
+
+        txPwr = (int8)((hwCalTxPower >> 8) & 0x00FF);
+        txPwr /= 10;
+        if (txPwr < TX_PWR_MIN)
+            txPwr = TX_PWR_MIN;
+        if (txPwr > TX_PWR_MAX)
+            txPwr = TX_PWR_MAX;
+
+        if (sme_SetMaxTxPowerPerBand(eCSR_BAND_5G, txPwr) !=
+                                eHAL_STATUS_SUCCESS) {
+            hddLog(VOS_TRACE_LEVEL_ERROR,
+              FL("setting tx power failed for 5GHz band %d"), txPwr);
+            return -EIO;
+        }
+    }
+    else if(FALSE == set_value) {
+        if (sme_SetMaxTxPowerPerBand(eCSR_BAND_24, txPwr) !=
+                                eHAL_STATUS_SUCCESS) {
+            hddLog(VOS_TRACE_LEVEL_ERROR,
+              FL("Setting tx power failed for 2.4GHz band %d"), txPwr);
+            return -EIO;
+        }
+
+        if (sme_SetMaxTxPowerPerBand(eCSR_BAND_5G, txPwr) !=
+                                eHAL_STATUS_SUCCESS) {
+            hddLog(VOS_TRACE_LEVEL_ERROR,
+              FL("setting tx power failed for 5GHz band %d"), txPwr);
+            return -EIO;
+        }
+    }
+    else {
+        return -EINVAL;
+    }
+
+    return eHAL_STATUS_SUCCESS;
+}
 /* set param sub-ioctls */
 static int __iw_setint_getnone(struct net_device *dev,
                                struct iw_request_info *info,
                                union iwreq_data *wrqu, char *extra)
 {
     hdd_adapter_t *pAdapter;
-    tHalHandle hHal;
+    tHalHandle hHal = NULL;
     hdd_wext_state_t  *pWextState;
     hdd_context_t *pHddCtx;
     hdd_mon_ctx_t *pMonCtx = NULL;
@@ -5420,8 +5718,8 @@
             tSmeConfigParams smeConfig;
             memset(&smeConfig, 0x00, sizeof(smeConfig));
 
-            if((ENABLE_11D == set_value) || (DISABLE_11D == set_value)) {
-
+            if(((ENABLE_11D == set_value) || (DISABLE_11D == set_value)) &&
+              (hHal)) {
                 sme_GetConfigParam(hHal,&smeConfig);
                 smeConfig.csrConfig.Is11dSupportEnabled = (v_BOOL_t)set_value;
 
@@ -5466,16 +5764,20 @@
               case  0: //Full Power
               {
                  struct statsContext context;
-                 eHalStatus status;
+                 eHalStatus status = eHAL_STATUS_FAILURE;
 
                  init_completion(&context.completion);
 
                  context.pAdapter = pAdapter;
                  context.magic = POWER_CONTEXT_MAGIC;
 
+                 if (NULL == hHal)
+                    return -EINVAL;
+
                  status = sme_RequestFullPower(WLAN_HDD_GET_HAL_CTX(pAdapter),
                               iw_power_callback_fn, &context,
                               eSME_FULL_PWR_NEEDED_BY_HDD);
+
                  if (eHAL_STATUS_PMC_PENDING == status)
                  {
                     int lrc = wait_for_completion_interruptible_timeout(
@@ -5507,23 +5809,32 @@
                  break;
               }
               case  1: //Enable BMPS
-                 sme_EnablePowerSave(hHal, ePMC_BEACON_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_EnablePowerSave(hHal, ePMC_BEACON_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  2: //Disable BMPS
-                 sme_DisablePowerSave(hHal, ePMC_BEACON_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_DisablePowerSave(hHal, ePMC_BEACON_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  3: //Request Bmps
               {
                  struct statsContext context;
-                 eHalStatus status;
+                 eHalStatus status = eHAL_STATUS_FAILURE;
 
                  init_completion(&context.completion);
 
                  context.pAdapter = pAdapter;
                  context.magic = POWER_CONTEXT_MAGIC;
 
+                 if (NULL == hHal)
+                    return -EINVAL;
+
                  status = sme_RequestBmps(WLAN_HDD_GET_HAL_CTX(pAdapter),
-                           iw_power_callback_fn, &context);
+                              iw_power_callback_fn, &context);
                  if (eHAL_STATUS_PMC_PENDING == status)
                  {
                     int lrc = wait_for_completion_interruptible_timeout(
@@ -5555,26 +5866,44 @@
                  break;
               }
               case  4: //Enable IMPS
-                 sme_EnablePowerSave(hHal, ePMC_IDLE_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_EnablePowerSave(hHal, ePMC_IDLE_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  5: //Disable IMPS
-                 sme_DisablePowerSave(hHal, ePMC_IDLE_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_DisablePowerSave(hHal, ePMC_IDLE_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  6: //Enable Standby
-                 sme_EnablePowerSave(hHal, ePMC_STANDBY_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_EnablePowerSave(hHal, ePMC_STANDBY_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  7: //Disable Standby
-                 sme_DisablePowerSave(hHal, ePMC_STANDBY_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_DisablePowerSave(hHal, ePMC_STANDBY_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  8: //Request Standby
 #ifdef CONFIG_HAS_EARLYSUSPEND
 #endif
                  break;
               case  9: //Start Auto Bmps Timer
-                 sme_StartAutoBmpsTimer(hHal);
+                 if (hHal)
+                     sme_StartAutoBmpsTimer(hHal);
+                 else
+                     ret = -EINVAL;
                  break;
               case  10://Stop Auto BMPS Timer
-                 sme_StopAutoBmpsTimer(hHal);
+                 if (hHal)
+                     sme_StopAutoBmpsTimer(hHal);
+                 else
+                     ret = -EINVAL;
                  break;
 #ifdef CONFIG_HAS_EARLYSUSPEND
               case  11://suspend to standby
@@ -5607,7 +5936,8 @@
         case WE_SET_MAX_ASSOC:
         {
             if ((WNI_CFG_ASSOC_STA_LIMIT_STAMIN > set_value) ||
-                (WNI_CFG_ASSOC_STA_LIMIT_STAMAX < set_value))
+                (WNI_CFG_ASSOC_STA_LIMIT_STAMAX < set_value) ||
+                (NULL == hHal))
             {
                 ret = -EINVAL;
             }
@@ -5642,6 +5972,9 @@
 
         case  WE_SET_DATA_INACTIVITY_TO:
         {
+           if (NULL == hHal)
+               return -EINVAL;
+
            if  ((set_value < CFG_DATA_INACTIVITY_TIMEOUT_MIN) ||
                 (set_value > CFG_DATA_INACTIVITY_TIMEOUT_MAX) ||
                 (ccmCfgSetInt((WLAN_HDD_GET_CTX(pAdapter))->hHal,
@@ -5661,6 +5994,9 @@
            tSirMacAddr bssid = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
            tSirMacAddr selfMac = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
 
+           if (NULL == hHal)
+               return -EINVAL;
+
            hddLog(VOS_TRACE_LEVEL_INFO, "%s: Setting maximum tx power %d dBm",
                   __func__, set_value);
            if( sme_SetMaxTxPower(hHal, bssid, selfMac, set_value) !=
@@ -5775,7 +6111,10 @@
         {
            hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
            pHddCtx->cfg_ini->gEnableDebugLog = set_value;
-           sme_UpdateConnectDebug(pHddCtx->hHal, set_value);
+           if (hHal)
+               sme_UpdateConnectDebug(pHddCtx->hHal, set_value);
+           else
+               ret = -1;
            break;
         }
 #ifdef FEATURE_WLAN_TDLS
@@ -5813,8 +6152,9 @@
             }
             hddLog(LOG1, "WE_SET_BAND_PREFERRENCE val %d ", set_value);
 
-            if (eCSR_BAND_ALL == set_value ||
-                    eCSR_BAND_24 == set_value || eCSR_BAND_5G == set_value) {
+            if ((eCSR_BAND_ALL == set_value ||
+                    eCSR_BAND_24 == set_value || eCSR_BAND_5G == set_value) &&
+                    (hHal)) {
                 sme_GetConfigParam(hHal, &smeConfig);
                 smeConfig.csrConfig.scanBandPreference = set_value;
 
@@ -5841,6 +6181,9 @@
             hddLog(LOG1, FL(
              "Set Miracast vendor tuning %d"), set_value);
 
+           if (NULL == hHal)
+               return -EINVAL;
+
             if (1 == set_value || 0 == set_value)
             {
                 if (eHAL_STATUS_SUCCESS != sme_SetMiracastVendorConfig(pHddCtx->hHal,
@@ -5873,7 +6216,7 @@
         {
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                       "%s: TDLS_2040_BSS_COEXISTENCE %d", __func__, set_value);
-            if (set_value == 0 || set_value == 1)
+            if ((set_value == 0 || set_value == 1) && (hHal))
             {
                 sme_SetTdls2040BSSCoexistence(WLAN_HDD_GET_HAL_CTX(pAdapter),
                                               set_value);
@@ -5895,6 +6238,9 @@
 
            hddLog( LOG1, FL("WE_SET_RTS_CTS_HTVHT set value %d"), set_value);
 
+           if (NULL == hHal)
+               return -EINVAL;
+
            if (eHAL_STATUS_SUCCESS !=
                         sme_SetRtsCtsHtVht( pHddCtx->hHal, set_value))
            {
@@ -5914,6 +6260,7 @@
            {
                hddLog(LOGE, "invalid mode %d", mode);
                ret = -EIO;
+               break;
            }
 
            pMonCtx =  WLAN_HDD_GET_MONITOR_CTX_PTR(pAdapter);
@@ -5921,6 +6268,7 @@
            {
              hddLog(LOGE, "Monitor Context NULL");
              ret = -EIO;
+             break;
            }
            if (pMonCtx->state == set_value)
            {
@@ -5952,74 +6300,43 @@
            }
            break;
         }
-        case WE_SET_PROXIMITY_ENABLE:
+        case WE_SET_PKT_STATS_ENABLE_DISABLE:
         {
-            sHwCalValues hwCalValues;
-            uint16 hwCalTxPower;
-            uint8 txPwr = TX_PWR_DEF;
-
-            hddLog(LOG1, FL("WE_SET_PROXIMITY_ENABLE: %d"), set_value);
-
-            if (TRUE == set_value) {
-                if(vos_nv_read( VNV_HW_CAL_VALUES, &hwCalValues,
-                                NULL, sizeof(sHwCalValues) )
-                                    != VOS_STATUS_SUCCESS) {
-                    ret = -EINVAL;
-                    break;
-                }
-                hwCalTxPower = (uint16)(hwCalValues.calData.hwParam7 >> 16);
-
-                hddLog(LOG1, FL("hwCalTxPower:%x nv_data:%x"),
-                        hwCalTxPower, hwCalValues.calData.hwParam7);
-
-                txPwr = (int8)(hwCalTxPower & 0x00FF);
-                txPwr = txPwr/10;
-                if (txPwr < TX_PWR_MIN)
-                    txPwr = TX_PWR_MIN;
-                if (txPwr > TX_PWR_MAX)
-                    txPwr = TX_PWR_MAX;
-
-                if (sme_SetMaxTxPowerPerBand(eCSR_BAND_24, txPwr) !=
-                                        eHAL_STATUS_SUCCESS) {
-                    hddLog(VOS_TRACE_LEVEL_ERROR,
-                      FL("Setting tx power failed for 2.4GHz band %d"), txPwr);
-                    ret = -EIO;
-                }
-
-                txPwr = (int8)((hwCalTxPower >> 8) & 0x00FF);
-                txPwr /= 10;
-                if (txPwr < TX_PWR_MIN)
-                    txPwr = TX_PWR_MIN;
-                if (txPwr > TX_PWR_MAX)
-                    txPwr = TX_PWR_MAX;
-
-                if (sme_SetMaxTxPowerPerBand(eCSR_BAND_5G, txPwr) !=
-                                        eHAL_STATUS_SUCCESS) {
-                    hddLog(VOS_TRACE_LEVEL_ERROR,
-                      FL("setting tx power failed for 5GHz band %d"), txPwr);
-                    ret = -EIO;
-                }
+            hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+            tAniWifiStartLog start_log;
+            if (!pHddCtx->cfg_ini->wlanPerPktStatsLogEnable ||
+                 !vos_isPktStatsEnabled())
+            {
+                hddLog(LOGE, FL("per pkt stats not enabled"));
+                return -EINVAL;
             }
-            else if(FALSE == set_value) {
-                if (sme_SetMaxTxPowerPerBand(eCSR_BAND_24, txPwr) !=
-                                        eHAL_STATUS_SUCCESS) {
-                    hddLog(VOS_TRACE_LEVEL_ERROR,
-                      FL("Setting tx power failed for 2.4GHz band %d"), txPwr);
-                    ret = -EIO;
-                }
+            hddLog(LOG1, FL("Set Pkt Stats %d"), set_value);
 
-                if (sme_SetMaxTxPowerPerBand(eCSR_BAND_5G, txPwr) !=
-                                        eHAL_STATUS_SUCCESS) {
-                    hddLog(VOS_TRACE_LEVEL_ERROR,
-                      FL("setting tx power failed for 5GHz band %d"), txPwr);
-                    ret = -EIO;
-                }
+            if (1 == set_value || 0 == set_value)
+            {
+                start_log.ringId = RING_ID_PER_PACKET_STATS;
+                start_log.flag = 0;
+                if (set_value)
+                   start_log.verboseLevel = WLAN_LOG_LEVEL_ACTIVE;
+                else
+                   start_log.verboseLevel = WLAN_LOG_LEVEL_OFF;
+
+                vos_set_ring_log_level(start_log.ringId, start_log.verboseLevel);
             }
-            else {
+            else
+            {
+                hddLog(LOGE,
+                FL("Invalid value %d in WE_SET_PKT_STATS_ENABLE_DISABLE IOCTL"),
+                    set_value);
                 ret = -EINVAL;
             }
             break;
         }
+        case WE_SET_PROXIMITY_ENABLE:
+        {
+            ret = wlan_hdd_set_proximity(set_value);
+            break;
+        }
         default:
         {
             hddLog(LOGE, "Invalid IOCTL setvalue command %d value %d",
@@ -6224,6 +6541,113 @@
     return ret;
 }
 
+static void hdd_GetCurrentAntennaIndex(int antennaId, void *pContext)
+{
+   struct statsContext *context;
+   hdd_adapter_t *pAdapter;
+
+   if (NULL == pContext)
+   {
+      hddLog(VOS_TRACE_LEVEL_ERROR,
+             "%s: Bad param, pContext [%p]",
+             __func__, pContext);
+      return;
+   }
+
+   context = pContext;
+   pAdapter      = context->pAdapter;
+
+   spin_lock(&hdd_context_lock);
+
+   if ((NULL == pAdapter) || (ANTENNA_CONTEXT_MAGIC != context->magic))
+   {
+      /* the caller presumably timed out so there is nothing we can do */
+      spin_unlock(&hdd_context_lock);
+      hddLog(VOS_TRACE_LEVEL_WARN,
+             "%s: Invalid context, pAdapter [%p] magic [%08x]",
+              __func__, pAdapter, context->magic);
+      return;
+   }
+
+   context->magic = 0;
+   pAdapter->antennaIndex = antennaId;
+
+   complete(&context->completion);
+   spin_unlock(&hdd_context_lock);
+}
+
+static VOS_STATUS wlan_hdd_get_current_antenna_index(hdd_adapter_t *pAdapter,
+                                                     int *antennaIndex)
+{
+   hdd_context_t *pHddCtx;
+   eHalStatus halStatus;
+   struct statsContext context;
+   long lrc;
+
+   ENTER();
+   if (NULL == pAdapter)
+   {
+       hddLog(VOS_TRACE_LEVEL_WARN,
+              "%s: Invalid context, pAdapter", __func__);
+       return VOS_STATUS_E_FAULT;
+   }
+   pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+   if (0 != (wlan_hdd_validate_context(pHddCtx)))
+   {
+       return VOS_STATUS_E_FAULT;
+   }
+   if (TRUE != sme_IsFeatureSupportedByFW(ANTENNA_DIVERSITY_SELECTION))
+   {
+       hddLog(VOS_TRACE_LEVEL_ERROR,
+              "%s: ANTENNA_DIVERSITY_SELECTION is not supported by Firwmare",
+               __func__);
+       return VOS_STATUS_E_NOSUPPORT;
+   }
+   init_completion(&context.completion);
+   context.pAdapter = pAdapter;
+   context.magic = ANTENNA_CONTEXT_MAGIC;
+
+   halStatus = sme_GetCurrentAntennaIndex(pHddCtx->hHal,
+                                         hdd_GetCurrentAntennaIndex,
+                                         &context, pAdapter->sessionId);
+   if (eHAL_STATUS_SUCCESS != halStatus)
+   {
+       spin_lock(&hdd_context_lock);
+       context.magic = 0;
+       spin_unlock(&hdd_context_lock);
+       hddLog(VOS_TRACE_LEVEL_ERROR,"%s: Unable to retrieve Antenna Index",
+              __func__);
+       /* we'll returned a cached value below */
+       *antennaIndex = -1;
+       return VOS_STATUS_E_FAILURE;
+   }
+   else
+   {
+       /* request was sent -- wait for the response */
+       lrc = wait_for_completion_interruptible_timeout(&context.completion,
+                                    msecs_to_jiffies(WLAN_WAIT_TIME_STATS));
+       if (lrc <= 0)
+       {
+           spin_lock(&hdd_context_lock);
+           context.magic = 0;
+           spin_unlock(&hdd_context_lock);
+           hddLog(VOS_TRACE_LEVEL_ERROR, "%s:SME %s while retrieving Antenna"
+                                         " Index",
+                  __func__, (0 == lrc) ? "timeout" : "interrupt");
+           *antennaIndex = -1;
+           return VOS_STATUS_E_FAILURE;
+       }
+   }
+   spin_lock(&hdd_context_lock);
+   context.magic = 0;
+   spin_unlock(&hdd_context_lock);
+
+   *antennaIndex = pAdapter->antennaIndex;
+
+   EXIT();
+   return VOS_STATUS_SUCCESS;
+}
+
 /* get param sub-ioctls */
 static int __iw_setnone_getint(struct net_device *dev,
                                struct iw_request_info *info,
@@ -6234,7 +6658,6 @@
     hdd_context_t *pHddCtx;
     int *value = (int *)extra;
     int ret = 0; /* success */
-    tSmeConfigParams smeConfig;
 
     ENTER();
 
@@ -6352,6 +6775,7 @@
 
         case WE_GET_SCAN_BAND_PREFERENCE:
         {
+            tSmeConfigParams smeConfig;
             sme_GetConfigParam(hHal, &smeConfig);
             *value = smeConfig.csrConfig.scanBandPreference;
 
@@ -6359,7 +6783,11 @@
                       "scanBandPreference = %d\n", *value);
             break;
         }
-
+        case WE_GET_ANTENA_DIVERSITY_SELECTION:
+        {
+             wlan_hdd_get_current_antenna_index(pAdapter, value);
+             break;
+        }
         default:
         {
             hddLog(LOGE, "Invalid IOCTL get_value command %d ",value[0]);
@@ -6910,6 +7338,37 @@
            break;
        }
 #endif
+#ifdef WLAN_FEATURE_RMC
+        case WE_GET_IBSS_STA_INFO:
+        {
+            hdd_station_ctx_t *pHddStaCtx =
+                WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+            int idx = 0;
+            int length = 0, buf = 0;
+
+            for (idx = 0; idx < HDD_MAX_NUM_IBSS_STA; idx++)
+            {
+               if (0 != pHddStaCtx->conn_info.staId[ idx ])
+               {
+                   buf = snprintf
+                             (
+                             (extra + length), WE_MAX_STR_LEN - length,
+                             "\n%d .%02x:%02x:%02x:%02x:%02x:%02x\n",
+                             pHddStaCtx->conn_info.staId[ idx ],
+                             pHddStaCtx->conn_info.peerMacAddress[idx].bytes[0],
+                             pHddStaCtx->conn_info.peerMacAddress[idx].bytes[1],
+                             pHddStaCtx->conn_info.peerMacAddress[idx].bytes[2],
+                             pHddStaCtx->conn_info.peerMacAddress[idx].bytes[3],
+                             pHddStaCtx->conn_info.peerMacAddress[idx].bytes[4],
+                             pHddStaCtx->conn_info.peerMacAddress[idx].bytes[5]
+                             );
+                   length += buf;
+               }
+            }
+            wrqu->data.length = strlen(extra)+1;
+            break;
+        }
+#endif
         case WE_GET_SNR:
         {
             v_S7_t s7snr = 0;
@@ -6944,6 +7403,13 @@
             break;
         }
 
+#ifdef FEATURE_OEM_DATA_SUPPORT
+        case WE_GET_OEM_DATA_CAP:
+        {
+            return iw_get_oem_data_cap(dev, info, wrqu, extra);
+        }
+#endif /* FEATURE_OEM_DATA_SUPPORT */
+
         default:
         {
             hddLog(LOGE, "%s: Invalid IOCTL command %d", __func__, sub_cmd );
@@ -7032,6 +7498,13 @@
                  wlan_hdd_get_intf_addr( WLAN_HDD_GET_CTX(pAdapter) ),TRUE);
           break;
         }
+#ifdef WLAN_FEATURE_RMC
+        case WE_IBSS_GET_PEER_INFO_ALL:
+        {
+            hdd_wlan_get_ibss_peer_info_all(pAdapter);
+            break;
+        }
+#endif
         case WE_STOP_AP:
         {
            /*FIX ME: Need to be revisited if multiple SAPs to be supported */
@@ -7177,8 +7650,15 @@
         {
             vos_fatal_event_logs_req(WLAN_LOG_TYPE_NON_FATAL,
                      WLAN_LOG_INDICATOR_IOCTL,
-                     WLAN_LOG_REASON_CODE_UNUSED,
-                     TRUE);
+                     WLAN_LOG_REASON_IOCTL,
+                     TRUE, TRUE);
+            break;
+        }
+        case WE_GET_FW_MEMDUMP:
+        {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                     "FW_MEM_DUMP requested ");
+            get_fwr_memdump(dev,info,wrqu,extra);
             break;
         }
         default:
@@ -7272,31 +7752,33 @@
         return;
     }
 
-    for(i =0; i< HDD_MAX_NUM_IBSS_STA; i++)
-   {
-        if(pPeerInfo->ibssStaInfo[i].isUsed)
-        {
-             hddLog(LOGE, "******IBSS STAIndex: %d*********", i);
-             for ( j=0; j< NUM_TX_QUEUES; j++)
-             {
-                spin_lock_bh(&pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].lock);
-                hddLog(LOGE, "HDD TxQueue Info For AC: %d Count: %d PrevAdress:%p, NextAddress:%p",
-                       j, pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].count,
-                       pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].anchor.prev,
-                       pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].anchor.next);
-                spin_unlock_bh(&pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].lock);
-             }
+    for (i = 0; i < HDD_MAX_NUM_IBSS_STA; i++) {
+        if (pPeerInfo->ibssStaInfo[i].isUsed) {
+            hddLog(LOGE, "******IBSS STAIndex: %d*********", i);
+            for (j = 0; j < NUM_TX_QUEUES; j++) {
+                if (pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].count) {
+                    spin_lock_bh(
+                        &pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].lock);
+                    hddLog(LOGE,
+                        "HDD TxQueue Info For AC: %d Count: %d PrevAdress:%p, NextAddress:%p",
+                        j, pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].count,
+                        pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].anchor.prev,
+                        pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].anchor.next);
+                    spin_unlock_bh(
+                        &pPeerInfo->ibssStaInfo[i].wmm_tx_queue[j].lock);
+                }
+            }
         }
     }
 
-
 }
+
 static int __iw_set_var_ints_getnone(struct net_device *dev,
                                      struct iw_request_info *info,
                                      union iwreq_data *wrqu, char *extra)
 {
     hdd_adapter_t *pAdapter;
-    tHalHandle hHal;
+    tHalHandle hHal = NULL;
     int sub_cmd;
     int *apps_args = (int *) extra;
     hdd_station_ctx_t *pStaCtx = NULL ;
@@ -7370,21 +7852,29 @@
     {
         case WE_LOG_DUMP_CMD:
             {
-                if (apps_args[0] == 26) {
-                    if (!pHddCtx->cfg_ini->crash_inject_enabled) {
-                        hddLog(LOGE, "Crash Inject ini disabled, Ignore Crash Inject");
-                        return 0;
-                    }
+               if(apps_args[0] == 26) {
+                if (!pHddCtx->cfg_ini->crash_inject_enabled) {
+                 hddLog(LOGE, "Crash Inject ini disabled, Ignore Crash Inject");
+                    return 0;
                 }
+             }
                 hddLog(LOG1, "%s: LOG_DUMP %d arg1 %d arg2 %d arg3 %d arg4 %d",
                         __func__, apps_args[0], apps_args[1], apps_args[2],
                         apps_args[3], apps_args[4]);
-
-                logPrintf(hHal, apps_args[0], apps_args[1], apps_args[2],
-                        apps_args[3], apps_args[4]);
+                if (hHal)
+                  logPrintf(hHal, apps_args[0], apps_args[1], apps_args[2],
+                          apps_args[3], apps_args[4]);
 
             }
             break;
+#ifdef WLAN_FEATURE_RMC
+        case WE_IBSS_GET_PEER_INFO:
+             {
+                pr_info ( "Station ID = %d\n",apps_args[0]);
+                hdd_wlan_get_ibss_peer_info(pAdapter, apps_args[0]);
+             }
+              break;
+#endif
 
         case WE_P2P_NOA_CMD:
             {
@@ -7429,8 +7919,9 @@
                        "bitmask_of_module %d ",
                         __func__, apps_args[0], apps_args[1], apps_args[2],
                         apps_args[3]);
-                vosTraceDumpAll((void*)hHal , apps_args[0], apps_args[1],
-                                apps_args[2], apps_args[3]);
+                if (hHal)
+                  vosTraceDumpAll((void*)hHal , apps_args[0], apps_args[1],
+                                  apps_args[2], apps_args[3]);
 
             }
             break;
@@ -7441,7 +7932,9 @@
                            // in the Riva dump command
                 if((apps_args[0] >= 40 ) && (apps_args[0] <= 160 ))
                 {
-                    logPrintf(hHal, cmd, staId, apps_args[0], apps_args[1], apps_args[2]);
+                    if (hHal)
+                      logPrintf(hHal, cmd, staId, apps_args[0], apps_args[1],
+                                apps_args[2]);
                 }
                 else
                 {
@@ -7484,12 +7977,18 @@
                v_U32_t magic = 0;
                struct completion cmpVar;
                long waitRet = 0;
+               tVOS_CON_MODE mode = hdd_get_conparam();
+
+               if (VOS_MONITOR_MODE != mode) {
+                  hddLog(LOGE, FL("invalid mode %d"), mode);
+                  return -EIO;
+               }
 
                pMonCtx =  WLAN_HDD_GET_MONITOR_CTX_PTR(pAdapter);
                if( pMonCtx == NULL )
                {
                  hddLog(LOGE, "Monitor Context NULL");
-                 break;
+                 return -EIO;
                }
                hddLog(LOG1, "%s: Monitor MOde Configuration: ChNo=%d ChBW=%d CRCCheck=%d type=%d ConversionBit=%d",
                         __func__, apps_args[0], apps_args[1], apps_args[2],
@@ -7520,8 +8019,7 @@
                         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                                     FL("failed to post MON MODE REQ"));
                         magic = 0;
-                        ret = -EIO;
-                        break;
+                        return -EIO;
                     }
                     waitRet = wait_for_completion_timeout(&cmpVar,
                                                        MON_MODE_MSG_TIMEOUT);
@@ -7540,12 +8038,18 @@
                v_U32_t magic = 0;
                struct completion cmpVar;
                long waitRet = 0;
+               tVOS_CON_MODE mode = hdd_get_conparam();
+
+               if (VOS_MONITOR_MODE != mode) {
+                  hddLog(LOGE, FL("invalid mode %d"), mode);
+                  return -EIO;
+               }
 
                pMonCtx =  WLAN_HDD_GET_MONITOR_CTX_PTR(pAdapter);
                if( pMonCtx == NULL )
                {
                   hddLog(LOGE, "Monitor Context NULL");
-                  break;
+                  return -EIO;
                }
                /* Input Validation Part of FW */
                pMonCtx->numOfMacFilters=1;
@@ -7570,8 +8074,7 @@
                         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                                     FL("failed to post MON MODE REQ"));
                         magic = 0;
-                        ret = -EIO;
-                        break;
+                        return -EIO;
                     }
                     waitRet = wait_for_completion_timeout(&cmpVar,
                                                        MON_MODE_MSG_TIMEOUT);
@@ -8456,7 +8959,8 @@
        copied individually. */
        memcpy(&keepaliveRequest, pRequest, wrqu->data.length);
 
-       hddLog(VOS_TRACE_LEVEL_ERROR, "set Keep: TP before SME %d", keepaliveRequest.timePeriod);
+       hddLog(VOS_TRACE_LEVEL_INFO, "set Keep: TP before SME %d",
+                                     keepaliveRequest.timePeriod);
 
     if (eHAL_STATUS_SUCCESS != sme_SetKeepAlive(WLAN_HDD_GET_HAL_CTX(pAdapter),
                                         pAdapter->sessionId, &keepaliveRequest))
@@ -9299,7 +9803,7 @@
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "PNO ssid length input is not valid %s",ptr);
-        return VOS_STATUS_E_FAILURE;
+        goto error;
     }
 
     if (( 0 == pnoRequest.aNetworks[i].ssId.length ) ||
@@ -9355,7 +9859,7 @@
     {
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
                 "Incorrect number of channels");
-      return VOS_STATUS_E_FAILURE;
+      goto error;
     }
 
     if ( 0 !=  pnoRequest.aNetworks[i].ucChannelCount)
@@ -9367,7 +9871,7 @@
                            &nOffset))
             {    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                            "PNO network channel input is not valid %s",ptr);
-                  return VOS_STATUS_E_FAILURE;
+                  goto error;
             }
             /*Advance to next channel number*/
             ptr += nOffset;
@@ -9887,6 +10391,32 @@
     return ret;
 }
 
+static int get_fwr_memdump(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra)
+{
+    hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    int ret;
+    ENTER();
+   // HddCtx sanity
+   ret = wlan_hdd_validate_context(pHddCtx);
+   if (0 != ret)
+   {
+      return ret;
+   }
+   if( !pHddCtx->cfg_ini->enableFwrMemDump ||
+      (FALSE == sme_IsFeatureSupportedByFW(MEMORY_DUMP_SUPPORTED)))
+   {
+      hddLog(VOS_TRACE_LEVEL_INFO, FL("FW dump Logging not supported"));
+      return -EINVAL;
+   }
+   ret = wlan_hdd_fw_mem_dump_req(pHddCtx);
+
+   EXIT();
+   return ret;
+}
+
 static int __iw_set_power_params_priv(struct net_device *dev,
                                       struct iw_request_info *info,
                                       union iwreq_data *wrqu, char *extra)
@@ -10154,7 +10684,7 @@
     hddTdlsPeer_t *connPeer = NULL;
     hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-
+    tSirMacAddr peerMac;
     if (offchanmode < 0 || offchanmode > 4)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
@@ -10183,6 +10713,7 @@
                      "%s: No TDLS Connected Peer", __func__);
            return -1;
        }
+       vos_mem_copy(peerMac, connPeer->peerMac, sizeof(tSirMacAddr));
        mutex_unlock(&pHddCtx->tdls_lock);
     }
     else
@@ -10208,7 +10739,7 @@
            {
 
                sme_SendTdlsChanSwitchReq(WLAN_HDD_GET_HAL_CTX(pAdapter),
-                                       pAdapter->sessionId, connPeer->peerMac,
+                                       pAdapter->sessionId, peerMac,
                                        tdlsOffCh, tdlsOffChBwOffset,
                                        offchanmode);
            }
@@ -10482,7 +11013,9 @@
     {   WE_SET_RTS_CTS_HTVHT,
         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
         0, "setRtsCtsHtVht" },
-
+    {   WE_SET_PKT_STATS_ENABLE_DISABLE,
+        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+        0, "setPktStats" },
     {   WE_SET_PROXIMITY_ENABLE,
         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
         0, "setProximity" },
@@ -10538,6 +11071,11 @@
         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
         "get_scan_pref"},
 
+    {   WE_GET_ANTENA_DIVERSITY_SELECTION,
+        0,
+        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+        "getCurAnt"},
+
     /* handlers for main ioctl */
     {   WLAN_PRIV_SET_CHAR_GET_NONE,
         IW_PRIV_TYPE_CHAR| 512,
@@ -10658,11 +11196,24 @@
         IW_PRIV_TYPE_CHAR| WE_MAX_STR_LEN,
         "getPMFInfo" },
 #endif
+#ifdef WLAN_FEATURE_RMC
+    {
+        WE_GET_IBSS_STA_INFO,
+        0,
+        IW_PRIV_TYPE_CHAR| WE_MAX_STR_LEN,
+        "getIbssSTAs" },
+#endif
     {   WE_GET_SNR,
         0,
         IW_PRIV_TYPE_CHAR| WE_MAX_STR_LEN,
         "getSNR" },
-
+#ifdef FEATURE_OEM_DATA_SUPPORT
+   {
+        WE_GET_OEM_DATA_CAP,
+        0,
+        IW_PRIV_TYPE_CHAR| WE_MAX_STR_LEN,
+        "getOemDataCap" },
+#endif /* FEATURE_OEM_DATA_SUPPORT */
     /* handlers for main ioctl */
     {   WLAN_PRIV_SET_NONE_GET_NONE,
         0,
@@ -10678,6 +11229,13 @@
         0,
         0,
         "initAP" },
+#ifdef WLAN_FEATURE_RMC
+    {
+        WE_IBSS_GET_PEER_INFO_ALL,
+        0,
+        0,
+       "ibssPeerInfoAll" },
+#endif
     {   WE_STOP_AP,
         0,
         0,
@@ -10729,6 +11287,11 @@
         0,
         0,
         "getFwLogs" },
+    {
+        WE_GET_FW_MEMDUMP,
+        0,
+        0,
+        "getFwMemDump" },
     /* handlers for main ioctl */
     {   WLAN_PRIV_SET_VAR_INT_GET_NONE,
         IW_PRIV_TYPE_INT | MAX_VAR_ARGS,
@@ -10742,6 +11305,12 @@
         IW_PRIV_TYPE_INT | MAX_VAR_ARGS,
         0,
         "dump" },
+#ifdef WLAN_FEATURE_RMC
+    {   WE_IBSS_GET_PEER_INFO,
+        IW_PRIV_TYPE_INT | MAX_VAR_ARGS,
+        0,
+        "ibssPeerInfo" },
+#endif
 
     /* handlers for sub-ioctl */
     {   WE_MTRACE_SELECTIVE_MODULE_LOG_ENABLE_CMD,
@@ -10838,7 +11407,8 @@
 
     {
         WLAN_SET_KEEPALIVE_PARAMS,
-        IW_PRIV_TYPE_BYTE  | sizeof(tKeepAliveRequest),
+        IW_PRIV_TYPE_BYTE  | sizeof(tKeepAliveRequest) |
+        IW_PRIV_SIZE_FIXED,
         0,
         "setKeepAlive" },
 #ifdef WLAN_FEATURE_PACKET_FILTERING
diff --git a/wlan/prima/CORE/HDD/src/wlan_hdd_wmm.c b/wlan/prima/CORE/HDD/src/wlan_hdd_wmm.c
index 14e93c4..b6d5c21 100644
--- a/wlan/prima/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/wlan/prima/CORE/HDD/src/wlan_hdd_wmm.c
@@ -357,7 +357,7 @@
 static void hdd_wmm_free_context (hdd_wmm_qos_context_t* pQosContext)
 {
    v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
-   hdd_context_t *pHddCtx;
+   hdd_context_t *pHddCtx = NULL;
 
    if (NULL == pVosContext)
    {
@@ -420,7 +420,7 @@
    union iwreq_data wrqu;
    char buf[MAX_NOTIFY_LEN+1];
    v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
-   hdd_context_t *pHddCtx;
+   hdd_context_t *pHddCtx = NULL;
 
    if (NULL == pVosContext)
    {
@@ -550,7 +550,7 @@
     v_U32_t currentTrafficCnt = 0;
     WLANTL_ACEnumType acType = 0;
     v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
-    hdd_context_t *pHddCtx;
+    hdd_context_t *pHddCtx = NULL;
 
     ENTER();
     if (NULL == pVosContext)
@@ -734,7 +734,7 @@
    hdd_wmm_ac_status_t *pAc;
    VOS_STATUS status;
    v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
-   hdd_context_t *pHddCtx;
+   hdd_context_t *pHddCtx = NULL;
 
    if (NULL == pVosContext)
    {
@@ -986,7 +986,7 @@
       VOS_TRACE( VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_ERROR,
                  "%s: Setup failed, not a QoS AP",
                  __func__);
-      if (!HDD_WMM_HANDLE_IMPLICIT == pQosContext->handle)
+      if (HDD_WMM_HANDLE_IMPLICIT != pQosContext->handle)
       {
          VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
                    "%s: Explicit Qos, notifying userspace",
@@ -1429,7 +1429,7 @@
 #endif
    sme_QosWmmTspecInfo qosInfo;
    v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
-   hdd_context_t *pHddCtx;
+   hdd_context_t *pHddCtx = NULL;
    int ret = 0;
 
    if (NULL == pVosContext)
@@ -1796,7 +1796,7 @@
 {
    hdd_wmm_qos_context_t* pQosContext;
    v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
-   hdd_context_t *pHddCtx;
+   hdd_context_t *pHddCtx = NULL;
 
    if (NULL == pVosContext)
    {
@@ -2738,7 +2738,7 @@
 #endif
    v_BOOL_t found = VOS_FALSE;
    v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
-   hdd_context_t *pHddCtx;
+   hdd_context_t *pHddCtx = NULL;
 
    if (NULL == pVosContext)
    {
@@ -2937,7 +2937,7 @@
    sme_QosStatusType smeStatus;
 #endif
    v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
-   hdd_context_t *pHddCtx;
+   hdd_context_t *pHddCtx = NULL;
 
    if (NULL == pVosContext)
    {
@@ -3062,7 +3062,7 @@
    hdd_wmm_qos_context_t *pQosContext;
    hdd_wlan_wmm_status_e status = HDD_WLAN_WMM_STATUS_LOST;
    v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
-   hdd_context_t *pHddCtx;
+   hdd_context_t *pHddCtx = NULL;
 
    if (NULL == pVosContext)
    {
diff --git a/wlan/prima/CORE/MAC/inc/aniGlobal.h b/wlan/prima/CORE/MAC/inc/aniGlobal.h
index be90e1f..1d50dbf 100644
--- a/wlan/prima/CORE/MAC/inc/aniGlobal.h
+++ b/wlan/prima/CORE/MAC/inc/aniGlobal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -92,6 +92,8 @@
 #endif
 #include "p2p_Api.h"
 
+#include "limRMC.h"
+
 #if defined WLAN_FEATURE_VOWIFI_11R
 #include <limFTDefs.h>
 #endif
@@ -253,6 +255,11 @@
     void *pMlmDeauthReq;
 }tLimDisassocDeauthCnfReq;
 
+typedef struct {
+    tANI_U32 failed_count[MAX_TIDS];
+    v_TIME_t failed_timestamp[MAX_TIDS];
+} tLimStaBAInfo;
+
 typedef struct sAniSirLim
 {
     //////////////////////////////////////     TIMER RELATED START ///////////////////////////////////////////
@@ -906,6 +913,7 @@
     tANI_U32 remOnChnSeqNum;
     tANI_U32 txBdToken;
     tANI_U32 EnableTdls2040BSSCoexIE;
+    tLimStaBAInfo staBaInfo[WLAN_MAX_STA_COUNT];
 } tAniSirLim, *tpAniSirLim;
 
 typedef struct sLimMgmtFrameRegistration
@@ -1049,6 +1057,9 @@
     v_BOOL_t isTdlsPowerSaveProhibited;
 #endif
     tANI_U8 fScanOffload;
+#ifdef WLAN_FEATURE_RMC
+    tLimRmcContext  rmcContext;
+#endif /* WLAN_FEATURE_RMC */
     tANI_U8 isCoalesingInIBSSAllowed;
     tANI_U32 fEnableDebugLog;
     tANI_U32 fDeferIMPSTime;
@@ -1068,6 +1079,13 @@
     v_BOOL_t fActiveScanOnDFSChannels;
     tAuthAckStatus  authAckStatus;
     sir_mgmt_frame_ind_callback mgmt_frame_ind_cb;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    v_U8_t PERroamCandidatesCnt;
+    tSirCandidateChanInfo candidateChannelInfo[SIR_PER_ROAM_MAX_CANDIDATE_CNT];
+    tSirRoamAPInfo previousRoamApInfo[SIR_PER_ROAM_MAX_CANDIDATE_CNT];
+    v_U32_t PERroamTimeout;
+    v_U32_t currentBssScore;
+#endif
 } tAniSirGlobal;
 
 #ifdef FEATURE_WLAN_TDLS
diff --git a/wlan/prima/CORE/MAC/inc/qwlan_version.h b/wlan/prima/CORE/MAC/inc/qwlan_version.h
index f21d131..937076b 100644
--- a/wlan/prima/CORE/MAC/inc/qwlan_version.h
+++ b/wlan/prima/CORE/MAC/inc/qwlan_version.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -41,11 +41,11 @@
 
 #define QWLAN_VERSION_MAJOR            3
 #define QWLAN_VERSION_MINOR            0
-#define QWLAN_VERSION_PATCH            10
+#define QWLAN_VERSION_PATCH            11
 #define QWLAN_VERSION_EXTRA            ""
 
-#define QWLAN_VERSION_BUILD            85
+#define QWLAN_VERSION_BUILD            40
 
-#define QWLAN_VERSIONSTR               "3.0.10.085"
+#define QWLAN_VERSIONSTR               "3.0.11.40"
 
 #endif /* QWLAN_VERSION_H */
diff --git a/wlan/prima/CORE/MAC/inc/sirApi.h b/wlan/prima/CORE/MAC/inc/sirApi.h
index 2f2ae30..8994dc3 100644
--- a/wlan/prima/CORE/MAC/inc/sirApi.h
+++ b/wlan/prima/CORE/MAC/inc/sirApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -142,8 +142,8 @@
 #define WLAN_EXTSCAN_MAX_CHANNELS                 16
 #define WLAN_EXTSCAN_MAX_BUCKETS                  16
 #define WLAN_EXTSCAN_MAX_HOTLIST_APS              128
-#define WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS   64
 #define WLAN_EXTSCAN_MAX_RSSI_SAMPLE_SIZE     8
+#define WLAN_EXTSCAN_MAX_HOTLIST_SSIDS            8
 #endif /* WLAN_FEATURE_EXTSCAN */
 
 #define WLAN_DISA_MAX_PAYLOAD_SIZE                1600
@@ -710,7 +710,7 @@
     //used only in scan case.
     tANI_U8              channelIdSelf;
     tANI_U8              sSirBssDescriptionRsvd[3];
-    tANI_TIMESTAMP nReceivedTime;     //base on a tick count. It is a time stamp, not a relative time.
+    v_TIME_t nReceivedTime;     //base on a tick count. It is a time stamp, not a relative time.
 #if defined WLAN_FEATURE_VOWIFI
     tANI_U32       parentTSF;
     tANI_U32       startTSF[2];
@@ -719,11 +719,11 @@
     tANI_U8              mdiePresent;
     tANI_U8              mdie[SIR_MDIE_SIZE];                // MDIE for 11r, picked from the beacons
 #endif
-#ifdef FEATURE_WLAN_ESE
-    tANI_U16             QBSSLoad_present;
-    tANI_U16             QBSSLoad_avail; 
+#if defined(FEATURE_WLAN_ESE) || defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD)
+    tANI_U8              QBSSLoad_present;
+    tANI_U8              QBSS_ChanLoad;
+    tANI_U16             QBSSLoad_avail;
 #endif
-    // Please keep the structure 4 bytes aligned above the ieFields
 
     tANI_U8              fProbeRsp; //whether it is from a probe rsp
     tANI_U8              reservedPadding1;
@@ -731,9 +731,14 @@
     tANI_U8              reservedPadding3;
     tANI_U32             WscIeLen;
     tANI_U8              WscIeProbeRsp[WSCIE_PROBE_RSP_LEN];
-    tANI_U8              reservedPadding4;
-    
+    tANI_U8              HTCapsPresent;
+    tANI_U8              vhtCapsPresent;
+    tANI_U8              wmeInfoPresent;
+    tANI_U8              beacomformingCapable;
+    tANI_U8              chanWidth;
+    /* Please keep the structure 4 bytes aligned above the ieFields */
     tANI_U32             ieFields[1];
+
 } tSirBssDescription, *tpSirBssDescription;
 
 /// Definition for response message to previously
@@ -1041,6 +1046,7 @@
     tANI_U8             dot11mode;              // to support BT-AMP     
     tVOS_CON_MODE       staPersona;             //Persona
     tANI_BOOLEAN        bOSENAssociation;       //HS2.0
+    tANI_BOOLEAN        bWPSAssociation;       //WPS
     ePhyChanBondState   cbMode;                 // Pass CB mode value in Join.
 
     /*This contains the UAPSD Flag for all 4 AC
@@ -1201,6 +1207,7 @@
     tANI_U8*             beaconPtr;
     tANI_U32             assocReqLength;
     tANI_U8*             assocReqPtr;
+    uint32_t             rate_flags;
 } tSirSmeAssocInd, *tpSirSmeAssocInd;
 
 
@@ -1617,6 +1624,7 @@
     tSirMacAddr         peerMacAddr;
     tAniStaStatStruct  perStaStats; // STA stats
     tANI_U16            staId;
+    tANI_U16            assocId;
     tANI_U32            reasonCode;
 } tSirSmeDisassocInd, *tpSirSmeDisassocInd;
 
@@ -1629,6 +1637,7 @@
     tSirResultCodes     statusCode;
     tSirMacAddr         bssId;            
     tSirMacAddr         peerMacAddr;
+    tANI_U16            assocId;
 } tSirSmeDisassocCnf, *tpSirSmeDisassocCnf;
 
 /// Definition for Deauthetication request
@@ -1666,6 +1675,7 @@
     tSirMacAddr         peerMacAddr;
 
     tANI_U16            staId;
+    tANI_U16            assocId;
     tANI_U32            reasonCode;
 } tSirSmeDeauthInd, *tpSirSmeDeauthInd;
 
@@ -1678,8 +1688,18 @@
     tSirResultCodes     statusCode;
     tSirMacAddr         bssId;             // AP BSSID
     tSirMacAddr        peerMacAddr;
+    tANI_U16            assocId;
 } tSirSmeDeauthCnf, *tpSirSmeDeauthCnf;
 
+typedef struct sSirSmeDisConDoneInd
+{
+    tANI_U16           messageType;
+    tANI_U16           length;
+    tANI_U8            sessionId;
+    tSirResultCodes    reasonCode;
+    tSirMacAddr        peerMacAddr;
+}tSirSmeDisConDoneInd, *tpSirSmeDisConDoneInd;
+
 /// Definition for stop BSS request message
 typedef struct sSirSmeStopBssReq
 {
@@ -2114,7 +2134,8 @@
     PE_GLOBAL_CLASS_B_STATS_INFO    = 0x00000004,
     PE_GLOBAL_CLASS_C_STATS_INFO    = 0x00000008,
     PE_GLOBAL_CLASS_D_STATS_INFO    = 0x00000010,
-    PE_PER_STA_STATS_INFO           = 0x00000020
+    PE_PER_STA_STATS_INFO           = 0x00000020,
+    PE_PER_TX_PKT_STATS_INFO        = 0x00000040,
 }ePEStatsMask;
 
 /*
@@ -2296,6 +2317,16 @@
 
 } tAniDHCPInd, *tpAniDHCPInd;
 
+#ifdef WLAN_FEATURE_RMC
+typedef struct sAniTXFailMonitorInd
+{
+    tANI_U16                msgType; // message type is same as the request type
+    tANI_U16                msgLen;  // length of the entire request
+    tANI_U8                 tx_fail_count;
+    void                    *txFailIndCallback;
+} tAniTXFailMonitorInd, *tpAniTXFailMonitorInd;
+#endif /* WLAN_FEATURE_RMC */
+
 typedef struct sAniSummaryStatsInfo
 {
     tANI_U32 retry_cnt[4];         //Total number of packets(per AC) that were successfully transmitted with retries
@@ -2427,6 +2458,13 @@
 
 }tAniPerStaStatsInfo, *tpAniPerStaStatsInfo;
 
+typedef struct sAniPerTxPktStatsInfo
+{
+    tANI_U32 lastTxRate;       // 802.11 data rate at which the last data frame is transmitted.
+    tANI_U32  txAvgRetry;      // Average number of retries per 10 packets.
+}tAniPerTxPktStatsInfo, *tpAniPerTxPktStatsInfo;
+
+
 /**********************PE Statistics end*************************/
 
 
@@ -3729,8 +3767,25 @@
     tANI_U8 setMcstBcstFilter;
 }tSirWlanSetRxpFilters,*tpSirWlanSetRxpFilters;
 
-typedef void(*FWLoggingInitReqCb)(void *fwlogInitCbContext, VOS_STATUS status);
+typedef struct
+{
+  //FW mail box address
+  uint64 logMailBoxAddr;
+  tANI_U32 status;
+  //Logging mail box version
+  tANI_U8 logMailBoxVer;
+  //Qshrink is enabled
+  tANI_U8 logCompressEnabled;
+  /* used to tell fwr mem dump size */
+  tANI_U32 fw_mem_dump_max_size;
+  //Reserved for future purpose
+  tANI_U32 reserved1;
+  tANI_U32 reserved2;
+}tAniLoggingInitRsp, *tpAniLoggingInitRsp;
+
+typedef void(*FWLoggingInitReqCb)(void *fwlogInitCbContext, tAniLoggingInitRsp *pRsp);
 typedef void ( *tGetFrameLogCallback) (void *pContext);
+typedef void(*RssiMonitorReqCb)(void *rssiMonitorCbContext, VOS_STATUS status);
 
 typedef struct sAniGetFrameLogReq
 {
@@ -3767,6 +3822,48 @@
     void                   *fwlogInitCbContext;
 }tSirFWLoggingInitParam,*tpSirFWLoggingInitParam;
 
+/**
+ * struct sir_allowed_action_frames - Parameters to set Allowed action frames
+ * @bitmask: Bits to convey the allowed action frames
+ * @reserved: For future use
+ */
+struct sir_allowed_action_frames {
+    uint32_t bitmask;
+    uint32_t reserved;
+};
+
+/*
+ * struct rssi_monitor_req - rssi monitoring
+ * @request_id: request id
+ * @session_id: session id
+ * @min_rssi: minimum rssi
+ * @max_rssi: maximum rssi
+ * @control: flag to indicate start or stop
+ */
+typedef struct sSirRssiMonitorReq
+{
+    tANI_U32               requestId;
+    tANI_U32               sessionId;
+    tANI_S8                minRssi;
+    tANI_S8                maxRssi;
+    tANI_U8                currentBssId[6];
+    RssiMonitorReqCb       rssiMonitorCallback;
+    void                   *rssiMonitorCbContext;
+}tSirRssiMonitorReq, *tpSirRssiMonitorReq;
+
+
+/**
+ * struct rssi_breach_event - rssi breached event structure
+ * @request_id: request id
+ * @curr_rssi: current rssi
+ * @curr_bssid: current bssid
+ */
+struct rssi_breach_event {
+        tANI_U32     request_id;
+        v_MACADDR_t  curr_bssid;
+        tANI_S8      curr_rssi;
+};
+
 typedef struct sSirFatalEventLogsReqParam
 {
     tANI_U32 reason_code;
@@ -3879,6 +3976,35 @@
 #endif //FEATURE_WLAN_SCAN_PNO
 
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+#define SIR_PER_ROAM_MAX_AP_CNT 20
+#define SIR_PER_ROAM_MAX_CANDIDATE_CNT 10
+typedef struct __attribute__((packed))
+{
+    tANI_U8    channelNumber;
+    tANI_U8    channelCCA;
+    tANI_U8    otherApCount;
+    tANI_S8    otherApRssi[SIR_PER_ROAM_MAX_AP_CNT];
+} tSirCandidateChanInfo, * tpSirCandidateChanInfo;
+
+typedef struct sPERRoamScanStart
+{
+    tANI_U16                msgType;
+    tANI_U16                msgLen;
+    tANI_U8                 start;
+} tPERRoamScanStart, *tpPERRoamScanStart;
+
+typedef struct sSirRoamAPInfo
+{
+    tSirMacAddr bssAddr;
+    unsigned int timeStamp;
+} tSirRoamAPInfo, *tpSirRoamAPInfo;
+
+typedef struct __attribute__((packed))
+{
+    tANI_U32    candidateCount;
+    tSirCandidateChanInfo  channelInfo[SIR_PER_ROAM_MAX_CANDIDATE_CNT];
+} tSirPerRoamScanResult, * tpSirPerRoamScanResult;
+
 typedef struct
 {
   tSirMacSSid ssId;
@@ -3924,6 +4050,35 @@
   tSirRoamNetworkType ConnectedNetwork;
   tSirMobilityDomainInfo MDID;
 } tSirRoamOffloadScanReq, *tpSirRoamOffloadScanReq;
+
+/**
+ * struct sSirPERRoamOffloadScanReq - Offload PER config params
+ * @sessionId: session id
+ * @rateUpThreshold: rate at which to stop monitoring the rate
+ * @rateDownThreshold: rate at which to start monitoring
+ * @isPERRoamCCAEnabled: CCA sensing is enabled or disabled
+ * @waitPeriodForNextPERScan: time to wait before start monitoring again once a
+ * scan has been triggered
+ * @PERtimerThreshold: time to collect stats to trigger roam scan
+ * @PERroamTriggerPercent: minimum percentage of packets needs to be below
+ * rateDownThreshold to trigger a roam scan
+ */
+typedef struct sSirPERRoamOffloadScanReq
+{
+  tANI_U16  sessionId;
+  tANI_U16  rateUpThreshold;
+  tANI_U16  rateDownThreshold;
+  tANI_U16  isPERRoamCCAEnabled;
+  tANI_U32  waitPeriodForNextPERScan;
+  tANI_U32  PERtimerThreshold;
+  tANI_U32  PERroamTriggerPercent;
+} tSirPERRoamOffloadScanReq, *tpSirPERRoamOffloadScanReq;
+
+typedef struct sSirPERRoamTriggerScanReq
+{
+  tANI_BOOLEAN roamScanReq;
+} tSirPERRoamTriggerScanReq, *tpSirPERRoamTriggerScanReq;
+
 #endif //WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 
 #define SIR_NOCHANGE_POWER_VALUE  0xFFFFFFFF
@@ -4255,6 +4410,7 @@
     tANI_U16            transactionId; // Transaction ID for cmd
     tSirResultCodes        statusCode;
     tSirMacAddr            peerMac;
+    tANI_U16            sta_idx;
 }tSirTdlsLinkEstablishReqRsp, *tpSirTdlsLinkEstablishReqRsp;
 
 /* TDLS Request struct SME-->PE */
@@ -4325,6 +4481,7 @@
     tANI_U16            transactionId; // Transaction ID for cmd
     tSirResultCodes        statusCode;
     tSirMacAddr            peerMac;
+    tANI_U16            sta_idx;
 }tSirTdlsChanSwitchReqRsp, *tpSirTdlsChanSwitchReqRsp;
 #endif /* FEATURE_WLAN_TDLS */
 
@@ -4333,6 +4490,7 @@
    tANI_U16               messageType;
    tANI_U16               length;
    tANI_U8                seesionId;
+   tSirMacAddr            bssid;
 } tSirSetActiveModeSetBncFilterReq, *tpSirSetActiveModeSetBncFilterReq;
 
 typedef enum
@@ -4346,6 +4504,7 @@
    tANI_U16               messageType;
    tANI_U16               length;
    tANI_U8                seesionId;
+   tSirMacAddr            bssid;
 } tSirSmeHT40OBSSStopScanInd, *tpSirSmeHT40OBSSStopScanInd;
 
 typedef struct sSirSmeHT40OBSSScanInd
@@ -4408,6 +4567,9 @@
     tANI_U8   sessionId;
     tANI_U8   bssid[WNI_CFG_BSSID_LEN];
     tANI_U8   channel;
+#ifndef QCA_WIFI_ISOC
+    tANI_U8   handoff_src;
+#endif
 } tAniHandoffReq, *tpAniHandoffReq;
 
 typedef struct sSirScanOffloadReq {
@@ -4599,10 +4761,10 @@
      * 0 implies MCAST RA, positive value implies fixed rate,
      * -1 implies ignore this param
      */
-    tANI_S32 reliableMcastDataRate;//unit Mbpsx10
+    tANI_S32 rmcDataRate;//unit Mbpsx10
 
     /* TX flag to differentiate between HT20, HT40 etc */
-    tTxrateinfoflags reliableMcastDataRateTxFlag;
+    tTxrateinfoflags rmcDataRateTxFlag;
 
     /*
      * MCAST(or BCAST) fixed data rate in 2.4 GHz, unit Mbpsx10,
@@ -4624,6 +4786,102 @@
 
 } tSirRateUpdateInd, *tpSirRateUpdateInd;
 
+#ifdef WLAN_FEATURE_RMC
+
+#define SIR_RMC_NUM_MAX_RULERS  8  /* HAL_NUM_MAX_RULERS */
+typedef struct sSirSetRMCReq
+{
+    tANI_U16       msgType;
+    tANI_U16       msgLen;
+    tSirMacAddr    mcastTransmitter;
+} tSirSetRMCReq, *tpSirSetRMCReq;
+
+typedef struct sSirRMCInfo
+{
+    tANI_U32      dialogToken;
+    tANI_U8       action;
+    tSirMacAddr   mcastRuler;
+} tSirRMCInfo, *tpSirRMCInfo;
+
+typedef struct sSirRmcRulerSelectInd
+{
+    tANI_U16      status;
+    tSirMacAddr   mcastTransmitter;
+    tSirMacAddr   mcastGroup;
+    tSirMacAddr   ruler[SIR_RMC_NUM_MAX_RULERS];
+} tSirRmcRulerSelectInd, *tpSirRmcRulerSelectInd;
+
+typedef struct sSirRmcBecomeRulerInd
+{
+    tANI_U16      status;
+    tSirMacAddr   mcastTransmitter;
+    tSirMacAddr   mcastGroup;
+} tSirRmcBecomeRulerInd, *tpSirRmcBecomeRulerInd;
+
+typedef struct sSirRmcRulerReq
+{
+    // Common for all types are requests
+    tANI_U16      msgType; // message type is same as the request type
+    tANI_U16      msgLen;  // length of the entire request
+    tANI_U8       cmd;     // tRulerReqCmdType
+    tSirMacAddr   mcastTransmitter;
+    tSirMacAddr   mcastGroup;
+    tSirMacAddr   blacklist[SIR_RMC_NUM_MAX_RULERS];
+} tSirRmcRulerReq, *tpSirRmcRulerReq;
+
+typedef struct sSirRmcUpdateInd
+{
+    // Common for all types are requests
+    tANI_U16      msgType;    // message type is same as the request type
+    tANI_U16      msgLen;     // length of the entire request
+    tANI_U8       indication; // trulerUpdateIndType
+    tANI_U8       role;       // tRoleType
+    tSirMacAddr   mcastTransmitter;
+    tSirMacAddr   mcastGroup;
+    tSirMacAddr   mcastRuler;
+    tSirMacAddr   ruler[SIR_RMC_NUM_MAX_RULERS];
+} tSirRmcUpdateInd, *tpSirRmcUpdateInd;
+
+/*---------------------------------------------------------------------------
+* tSirIbssGetPeerInfoReqParams
+*--------------------------------------------------------------------------*/
+typedef struct
+{
+    tANI_BOOLEAN    allPeerInfoReqd; // If set, all IBSS peers stats are reported
+    tANI_U8         staIdx;          // If allPeerInfoReqd is not set, only stats
+                                     // of peer with staIdx is reported
+}tSirIbssGetPeerInfoReqParams, *tpSirIbssGetPeerInfoReqParams;
+
+/*---------------------------------------------------------------------------
+* tSirIbssGetPeerInfoParams
+*--------------------------------------------------------------------------*/
+typedef struct
+{
+   tANI_U8  staIdx;      //StaIdx
+   tANI_U32 txRate;       //Tx Rate
+   tANI_U32 mcsIndex;    //MCS Index
+   tANI_U32 txRateFlags; //TxRate Flags
+   tANI_S8  rssi;        //RSSI
+}tSirIbssPeerInfoParams;
+
+typedef struct
+{
+   tANI_U32   status;
+   tANI_U8    numPeers;
+   tSirIbssPeerInfoParams  peerInfoParams[32];
+}tSirPeerInfoRspParams, *tpSirIbssPeerInfoRspParams;
+
+/*---------------------------------------------------------------------------
+* tSirIbssGetPeerInfoRspParams
+*--------------------------------------------------------------------------*/
+typedef struct
+{
+   tANI_U16   mesgType;
+   tANI_U16   mesgLen;
+   tSirPeerInfoRspParams ibssPeerInfoRspParams;
+} tSirIbssGetPeerInfoRspParams, *tpSirIbssGetPeerInfoRspParams;
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
 // Set batch scan resposne from FW
 typedef struct
@@ -4716,6 +4974,7 @@
                     tSirFwStatsResult *fwStatsRsp, void *pContext);
 typedef void (*sir_mgmt_frame_ind_callback)(tSirSmeMgmtFrameInd *frame_ind);
 
+typedef void (*tAntennaDivSelCB)(int antennaId, void *pContext);
 
 /**
  * struct sir_sme_mgmt_frame_cb_req - Register a
@@ -4783,6 +5042,26 @@
   void *data;
 }tSirFWStatsInfo;
 
+typedef PACKED_PRE struct PACKED_POST
+{
+  tANI_U16 status;
+  tANI_U32 selectedAntennaId;
+  tANI_U32 reserved;
+} tSirAntennaDivSelRsp, *tpSirntennaDivSelRsp;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tAntennaDivSelCB callback;
+   void *data;
+   tANI_U32 reserved;
+}tSirAntennaDiversitySelectionReq;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tAntennaDivSelCB callback;
+   void *data;
+}tSirAntennaDiversitySelectionInfo;
+
 /*---------------------------------------------------------------------------
   WLAN_HAL_LL_NOTIFY_STATS
 ---------------------------------------------------------------------------*/
@@ -5053,6 +5332,32 @@
     tANI_U32 contentionNumSamples;
 } tSirWifiWmmAcStat, *tpSirWifiWmmAcStat;
 
+#ifdef FEATURE_EXT_LL_STAT
+typedef PACKED_PRE struct PACKED_POST
+{
+    /* Average Beacon spread offset is the averaged
+     * time delay between TBTT and beacon TSF
+     */
+    tANI_U64 avg_bcn_spread;
+    /* Average number of frames received from AP after
+     * receiving the ACK for a frame with PM=1
+     */
+    tANI_U32 avg_rx_frms_leaked;
+    /* Rx leak watch window currently in force to minimize data loss
+     * because of leaky AP. Rx leak window is the time driver waits
+     * before shutting down the radio or switching the channel and
+     * after receiving an ACK for a data frame with PM bit set)
+     */
+    tANI_U32 rx_leak_window;
+
+    /* Takes value of 1 if AP leaks packets after sending
+     * an ACK for PM=1 otherwise 0
+     */
+    tANI_U32 is_leaky_ap;
+
+} tSirWifiIfaceLeakyApStat, *tpSirWifiIfaceLeakyApStat;
+#endif
+
 /* Interface statistics - corresponding to 2nd most
  * LSB in wifi statistics bitmap  for getting statistics
  */
@@ -5077,6 +5382,10 @@
     tANI_S32            rssiAck;
     // per ac data packet statistics
     tSirWifiWmmAcStat    AccessclassStats[WIFI_AC_MAX];
+#ifdef FEATURE_EXT_LL_STAT
+    //Leaky Ap Stats
+    tSirWifiIfaceLeakyApStat leakyApStat;
+#endif
 } tSirWifiIfaceStat, *tpSirWifiIfaceStat;
 
 /* Peer statistics - corresponding to 3rd most LSB in
@@ -5156,7 +5465,6 @@
    tSirMacAddr  bssid;   // AP BSSID
    tANI_S32     low;     // low threshold
    tANI_S32     high;    // high threshold
-   tANI_U32     channel; // channel hint
 } tSirAPThresholdParam, *tpSirAPThresholdParam;
 
 typedef struct
@@ -5177,9 +5485,10 @@
     tANI_U32      maxScanReportingThreshold;
 
     tANI_U32      maxHotlistAPs;
-    tANI_U32      maxSignificantWifiChangeAPs;
+    tANI_U32      maxHotlistSSIDs;
 
     tANI_U32      maxBsidHistoryEntries;
+
 } tSirEXTScanCapabilitiesEvent, *tpSirEXTScanCapabilitiesEvent;
 
 /* WLAN_HAL_EXT_SCAN_RESULT_IND */
@@ -5214,21 +5523,72 @@
     tANI_U16      capability;          // capabilities advertised in the beacon
 } tSirWifiScanResult, *tpSirWifiScanResult;
 
+/**
+ * struct tExtscanCachedScanResult - extscan cached scan result
+ * @scan_id: a unique identifier for the scan unit
+ * @flags: a bitmask with additional information about scan
+ * @num_results: number of bssids retrieved by the scan
+ * @ap: wifi scan bssid results info
+ */
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    tANI_U16            scan_id;
+    tANI_U8             flags;
+    tANI_U8             num_results;
+
+    tSirWifiScanResult   ap[32];
+} tExtscanCachedScanResult, *tpExtscanCachedScanResult;
+
 /* WLAN_HAL_BSSID_HOTLIST_RESULT_IND */
 
 typedef PACKED_PRE struct PACKED_POST
 {
     tANI_U32             requestId;
-    tANI_U32             numOfAps;     // numbers of APs
+    tANI_BOOLEAN         bss_found;
+    tANI_U32             numHotlistBss;     // numbers of APs
 
     /*
      * 0 for last fragment
      * 1 still more fragment(s) coming
      */
     tANI_BOOLEAN         moreData;
-    tSirWifiScanResult    ap[1];
+    tSirWifiScanResult   bssHotlist[1];
+} tSirEXTScanHotlistMatch, *tpSirEXTScanHotlistMatch;
+
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    tANI_U32             requestId;
+    /*
+     * It gives number of scan ids
+     */
+    tANI_U32             scanResultSize;
+
+    /*
+     * 0 for last fragment
+     * 1 still more fragment(s) coming
+     */
+    tANI_BOOLEAN         moreData;
+    tANI_U8 result[1];
 } tSirWifiScanResultEvent, *tpSirWifiScanResultEvent;
 
+/* WLAN_HAL_SSID_HOTLIST_RESULT_IND */
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    tANI_U32             requestId;
+    tANI_BOOLEAN         ssid_found;
+    tANI_U32             numHotlistSsid;     // numbers of SSIDs
+
+    /*
+     * 0 for last fragment
+     * 1 still more fragment(s) coming
+     */
+    tANI_BOOLEAN         moreData;
+    tSirWifiScanResult   ssidHotlist[1];
+} tSirEXTScanSsidHotlistMatch, *tpSirEXTScanSsidHotlistMatch;
+
 typedef PACKED_PRE struct PACKED_POST
 {
     tANI_U8       elemId;       // Element Identifier
@@ -5284,6 +5644,10 @@
      */
     tANI_U8      reportEvents;
 
+    tANI_U32        max_period;
+    tANI_U32        exponent;
+    tANI_U32        step_count;
+
     tANI_U8      numChannels;
 
     /*
@@ -5300,9 +5664,12 @@
     tANI_U32                maxAPperScan;
 
     /* in %, when buffer is this much full, wake up host */
-    tANI_U32                reportThreshold;
+    tANI_U32                reportThresholdPercent;
+    tANI_U32                reportThresholdNumScans;
 
-    tANI_U8               numBuckets;
+    tANI_U32                homeAwayTime;       //in units of milliseconds
+
+    tANI_U8                 numBuckets;
     tSirWifiScanBucketSpec  buckets[WLAN_EXTSCAN_MAX_BUCKETS];
 } tSirEXTScanStartReqParams, *tpSirEXTScanStartReqParams;
 
@@ -5328,8 +5695,8 @@
 {
     tANI_U32               requestId;
     tANI_U8                sessionId;    // session Id mapped to vdev_id
-
-    tANI_U32               numAp;        // number of hotlist APs
+    tANI_U32               lostBssidSampleSize;
+    tANI_U32               numBssid;        // number of hotlist APs
     tSirAPThresholdParam   ap[WLAN_EXTSCAN_MAX_HOTLIST_APS];    // hotlist APs
 } tSirEXTScanSetBssidHotListReqParams, *tpSirEXTScanSetBssidHotListReqParams;
 
@@ -5353,65 +5720,46 @@
 
 typedef struct
 {
-    tANI_U32              requestId;
-    tANI_U8               sessionId;
-
-    /* number of samples for averaging RSSI */
-    tANI_U32              rssiSampleSize;
-
-    /* number of missed samples to confirm AP loss */
-    tANI_U32              lostApSampleSize;
-
-    /* number of APs breaching threshold required for firmware
-     * to generate event
-     */
-    tANI_U32              minBreaching;
-
-    tANI_U32              numAp;
-    tSirAPThresholdParam  ap[WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS];
-} tSirEXTScanSetSignificantChangeReqParams,
- *tpSirEXTScanSetSignificantChangeReqParams;
-
-typedef PACKED_PRE struct PACKED_POST
-{
-    tANI_U32        requestId;
-    tANI_U32        status;
-} tSirEXTScanSetSignificantChangeRspParams,
-  *tpSirEXTScanSetSignificantChangeRspParams;
-
-/*---------------------------------------------------------------------------
- * WLAN_HAL_SIG_RSSI_RESULT_IND
- *-------------------------------------------------------------------------*/
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   tSirMacAddr bssid;                  // BSSID
-   tANI_U32  channel;                   // channel frequency in MHz
-   tANI_U8   numRssi;                    // number of rssi samples
-   tANI_S32   rssi[WLAN_EXTSCAN_MAX_RSSI_SAMPLE_SIZE]; // RSSI history in db
-} tSirSigRssiResultParams, *tpSirSigRssiResultParams;
-
-typedef PACKED_PRE struct PACKED_POST
-{
-    tANI_U32     requestId;
-    tANI_U32     numSigRssiBss;
-    tANI_BOOLEAN moreData;
-    tSirSigRssiResultParams sigRssiResult[1];
-} tSirWifiSignificantChangeEvent, *tpSirWifiSignificantChangeEvent;
-
-typedef struct
-{
     tANI_U32      requestId;
     tANI_U8       sessionId;
-} tSirEXTScanResetSignificantChangeReqParams,
-  *tpSirEXTScanResetSignificantChangeReqParams;
+} tSirEXTScanResetSsidHotlistReqParams, *tpSirEXTScanResetSsidHotlistReqParams;
 
 typedef PACKED_PRE struct PACKED_POST
 {
     tANI_U32      requestId;
     tANI_U32      status;
-} tSirEXTScanResetSignificantChangeRspParams,
-  *tpSirEXTScanResetSignificantChangeRspParams;
+} tSirEXTScanResetSsidHotlistRspParams, *tpSirEXTScanResetSsidHotlistRspParams;
+
+
+/**
+ * struct sir_ssid_hotlist_param - param for SSID Hotlist
+ * @ssid: SSID which is being hotlisted
+ * @band: Band in which the given SSID should be scanned
+ * @rssi_low: Low bound on RSSI
+ * @rssi_high: High bound on RSSI
+ */
+typedef struct
+{
+    tSirMacSSid ssid;
+    tANI_U8 band;
+    tANI_S32 rssi_low;
+    tANI_S32 rssi_high;
+}tSirSsidThresholdParam, *tpSirSsidThresholdParam;
+
+typedef struct
+{
+    tANI_U32 request_id;
+    tANI_U8 session_id;
+    tANI_U32 lost_ssid_sample_size;
+    tANI_U32 ssid_count;
+    tSirSsidThresholdParam ssid[WLAN_EXTSCAN_MAX_HOTLIST_SSIDS];
+}tSirEXTScanSetSsidHotListReqParams, *tpSirEXTScanSetSsidHotListReqParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    tANI_U32      requestId;
+    tANI_U32      status;
+} tSirEXTScanSetSsidHotListRspParams, *tpSirEXTScanSetSsidHotListRspParams;
 
 /*---------------------------------------------------------------------------
  *  * WLAN_HAL_EXTSCAN_RESULT_AVAILABLE_IND
@@ -5448,7 +5796,11 @@
 }tSirEXTScanProgressIndParams,
  *tpSirEXTScanProgressIndParams;
 
-
+typedef PACKED_PRE struct PACKED_POST
+{
+    tANI_BOOLEAN  pause; // 1 -> pause, 0 -> unpause
+    tANI_U32      reserved; //reserved for future use
+}tSirHighPriorityDataInfoInd, *tpSirHighPriorityDataInfoInd;
 
 #endif /* WLAN_FEATURE_EXTSCAN */
 
@@ -5623,6 +5975,20 @@
     tANI_U8     SetTdls2040BSSCoex; //enabled or disabled
 } tAniSetTdls2040BSSCoex, *tpAniSetTdls2040BSSCoex;
 
+/**
+ * struct sir_wifi_start_log - Structure to store the params sent to start/
+ * stop logging
+ * @ringId:        Attribute which indicates the type of logging like per packet
+ *                 statistics, connectivity etc.
+ * @verboseLevel: Verbose level which can be 0,1,2,3
+ * @flag:          Flag field for future use
+ */
+typedef struct sir_wifi_start_log {
+    tANI_U32 ringId;
+    tANI_U32 verboseLevel;
+    tANI_U32 flag;
+}tAniWifiStartLog, *tpAniWifiStartLog;
+
 typedef struct
 {
     tANI_U16   mesgType;
@@ -5638,4 +6004,54 @@
     void *data;
     tSirMonModeCb callback;
 }tSirMonModeReq, *ptSirMonModeReq;
+
+/**
+ * struct tAniFwrDumpRsp - firmware dump response details.
+ *
+ * This structure is used to store the firmware dump
+ * response from the firmware.
+ */
+typedef struct
+{
+    tANI_U32 dump_status;
+}tAniFwrDumpRsp, *tpAniFwrDumpRsp;
+
+typedef void (*FWMemDumpReqCb)(void *fwMemDumpReqContext, tAniFwrDumpRsp *dump_rsp);
+
+/**
+ * struct tAniFwrDumpReq - firmware memory dump request details.
+.*.@FWMemDumpReqCb - Associated Callback
+ *.@fwMemDumpReqContext - Callback context
+ * @reserved - reserved field 1.
+ *
+ * This structure carries information about the firmware
+ * memory dump request.
+ */
+typedef struct
+{
+    FWMemDumpReqCb  fwMemDumpReqCallback;
+    void *          fwMemDumpReqContext;
+    tANI_U32        reserved1;
+}tAniFwrDumpReq, *tpAniFwrDumpReq;
+
+/**
+* struct tSetWifiConfigParams - Structure to store the wificonfig related params
+* @paramType: 1. Average Stats factor 2. Guard type
+* @paramvalue: Value to be set in the firmware.
+* @bssId: macaddr of the connected BssId
+*/
+typedef struct
+{
+   tANI_U8  paramType;
+   tANI_U8  sessionId;
+   tANI_U32 paramValue;
+   tSirMacAddr  bssId;
+} tSetWifiConfigParams, *tpSetWifiConfigParams;
+
+typedef struct {
+   tANI_U8   param;
+   tANI_U32  value;
+} tModifyRoamParamsReqParams, * tpModifyRoamParamsReqParams;
+
+
 #endif /* __SIR_API_H */
diff --git a/wlan/prima/CORE/MAC/inc/sirMacProtDef.h b/wlan/prima/CORE/MAC/inc/sirMacProtDef.h
index abe09c8..b635693 100644
--- a/wlan/prima/CORE/MAC/inc/sirMacProtDef.h
+++ b/wlan/prima/CORE/MAC/inc/sirMacProtDef.h
@@ -179,7 +179,8 @@
 #define SIR_MAC_ACTION_FST            18
 #define SIR_MAC_ACTION_VHT            21
 
-
+#define SIR_MAC_ACTION_TX             1
+#define SIR_MAC_ACTION_RX             2
 // QoS management action codes
 
 #define SIR_MAC_QOS_ADD_TS_REQ      0
@@ -2447,6 +2448,18 @@
 } __ani_attr_packed tSirMacVendorSpecificFrameHdr, *tpSirMacVendorSpecificFrameHdr;
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+typedef __ani_attr_pre_packed struct sSirMacIbssExtNetworkFrameHdr
+{
+    tANI_U8    category;
+    tANI_U8    Oui[3];
+    tANI_U8    MagicCode[6];
+    tANI_U8    version;
+    tANI_U8    actionID;
+    tANI_U32   dialogToken;
+} __ani_attr_packed tSirMacIbssExtNetworkFrameHdr, *tpSirMacIbssExtNetworkFrameHdr;
+#endif /* WLAN_FEATURE_RMC */
+
 typedef __ani_attr_pre_packed struct sSirMacVendorSpecificPublicActionFrameHdr
 {
     tANI_U8    category;
@@ -2878,6 +2891,24 @@
 
 #define SIR_MAC_MIN_IE_LEN 2 // Minimum IE length for IE validation
 
+#ifdef WLAN_FEATURE_RMC
+
+// RMC action codes
+#define SIR_MAC_RMC_ENABLE_REQ                  0
+#define SIR_MAC_RMC_DISABLE_REQ                 1
+#define SIR_MAC_RMC_RULER_INFORM_SELECTED      2
+#define SIR_MAC_RMC_RULER_INFORM_CANCELLED     3
+
+// RMC protocol version
+#define SIR_MAC_RMC_VER 0x01
+
+// Organization Identifier
+#define SIR_MAC_RMC_OUI             "\x00\x16\x32"
+#define SIR_MAC_RMC_OUI_SIZE        3
+
+#define SIR_MAC_RMC_MCAST_ADDRESS  "\x01\x00\x5E\x00\x02\x0A"
+
+#endif /* WLAN_FEATURE_RMC */
 
 #define SIR_MAC_TI_TYPE_REASSOC_DEADLINE        1
 #define SIR_MAC_TI_TYPE_KEY_LIFETIME            2
diff --git a/wlan/prima/CORE/MAC/inc/wniApi.h b/wlan/prima/CORE/MAC/inc/wniApi.h
index 97d127c..ff69d7f 100644
--- a/wlan/prima/CORE/MAC/inc/wniApi.h
+++ b/wlan/prima/CORE/MAC/inc/wniApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -132,6 +132,7 @@
     eWNI_SME_DEAUTH_REQ,
     eWNI_SME_DEAUTH_RSP,
     eWNI_SME_DEAUTH_IND,
+    eWNI_SME_DISCONNECT_DONE_IND,
     eWNI_SME_WM_STATUS_CHANGE_NTF,
     eWNI_SME_IBSS_NEW_PEER_IND,
     eWNI_SME_IBSS_PEER_DEPARTED_IND,
@@ -355,10 +356,17 @@
     eWNI_SME_CANDIDATE_FOUND_IND, /*ROAM candidate indication from FW*/
     eWNI_SME_HANDOFF_REQ,/*upper layer requested handoff to driver in STA mode*/
     eWNI_SME_ROAM_SCAN_OFFLOAD_RSP,/*Fwd the LFR scan offload rsp from FW to SME*/
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    eWNI_SME_ROAM_SCAN_TRIGGER_RSP,
+#endif
 #ifdef FEATURE_WLAN_LPHB
     eWNI_SME_LPHB_IND,
 #endif /* FEATURE_WLAN_LPHB */
-
+#ifdef WLAN_FEATURE_RMC
+    eWNI_SME_ENABLE_RMC_REQ,
+    eWNI_SME_DISABLE_RMC_REQ,
+    eWNI_SME_IBSS_PEER_INFO_RSP,
+#endif /* WLAN_FEATURE_RMC */
     eWNI_SME_GET_TSM_STATS_REQ,
     eWNI_SME_GET_TSM_STATS_RSP,
     eWNI_SME_TSM_IE_IND,
diff --git a/wlan/prima/CORE/MAC/inc/wniCfg.h b/wlan/prima/CORE/MAC/inc/wniCfg.h
index a993414..5c2f926 100644
--- a/wlan/prima/CORE/MAC/inc/wniCfg.h
+++ b/wlan/prima/CORE/MAC/inc/wniCfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -340,12 +340,12 @@
      WNI_CFG_FLEX_CONNECT_POWER_FACTOR,
      WNI_CFG_ANTENNA_DIVESITY,
      WNI_CFG_GO_LINK_MONITOR_TIMEOUT,
+     WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY,
      WNI_CFG_ATH_DISABLE,
      WNI_CFG_BTC_ACTIVE_WLAN_LEN,
      WNI_CFG_BTC_ACTIVE_BT_LEN,
      WNI_CFG_BTC_SAP_ACTIVE_WLAN_LEN,
      WNI_CFG_BTC_SAP_ACTIVE_BT_LEN,
-     WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY,
      WNI_CFG_ASD_PROBE_INTERVAL,
      WNI_CFG_ASD_TRIGGER_THRESHOLD,
      WNI_CFG_ASD_RTT_RSSI_HYST_THRESHOLD,
@@ -387,7 +387,10 @@
      WNI_CFG_LINK_FAIL_TIMEOUT,
      WNI_CFG_LINK_FAIL_TX_CNT,
      WNI_CFG_OPTIMIZE_CA_EVENT,
+     WNI_CFG_ACTIVE_PASSIVE_CON,
+     WNI_CFG_EXT_SCAN_CONC_MODE,
      WNI_CFG_ENABLE_MAC_ADDR_SPOOFING,
+     WNI_CFG_DISABLE_BAR_WAKE_UP_HOST,
      WNI_CFG_SAR_BOFFSET_SET_CORRECTION
 };
 
@@ -1698,6 +1701,10 @@
 #define WNI_CFG_GO_LINK_MONITOR_TIMEOUT_STAMAX    50
 #define WNI_CFG_GO_LINK_MONITOR_TIMEOUT_STADEF    10
 
+#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMIN    100
+#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMAX    1000
+#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STADEF    300
+
 #define WNI_CFG_ATH_DISABLE_STAMIN    0
 #define WNI_CFG_ATH_DISABLE_STAMAX    1
 #define WNI_CFG_ATH_DISABLE_STADEF    0
@@ -1718,10 +1725,6 @@
 #define WNI_CFG_BTC_SAP_ACTIVE_BT_LEN_STAMAX    250000
 #define WNI_CFG_BTC_SAP_ACTIVE_BT_LEN_STADEF    30000
 
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMIN    0
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMAX    4294967295
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STADEF    300
-
 #define WNI_CFG_ASD_PROBE_INTERVAL_STAMIN    1
 #define WNI_CFG_ASD_PROBE_INTERVAL_STAMAX    500
 #define WNI_CFG_ASD_PROBE_INTERVAL_STADEF    50
@@ -1851,7 +1854,7 @@
 #define WNI_CFG_BURST_MODE_BE_TXOP_VALUE_STADEF    0
 
 #define WNI_CFG_ENABLE_DYNAMIC_RA_START_RATE_STAMIN 0
-#define WNI_CFG_ENABLE_DYNAMIC_RA_START_RATE_STAMAX 1
+#define WNI_CFG_ENABLE_DYNAMIC_RA_START_RATE_STAMAX 65535
 #define WNI_CFG_ENABLE_DYNAMIC_RA_START_RATE_STADEF 0
 
 #define WNI_CFG_BTC_FAST_WLAN_CONN_PREF_STAMIN 0
@@ -1893,16 +1896,29 @@
 #define WNI_CFG_OPTIMIZE_CA_EVENT_ENABLE  1
 #define WNI_CFG_OPTIMIZE_CA_EVENT_DEFAULT 0
 
+#define WNI_CFG_ACTIVE_PASSIVE_CON_MIN 0
+#define WNI_CFG_ACTIVE_PASSIVE_CON_MAX 1
+#define WNI_CFG_ACTIVE_PASSIVE_CON_DEF 1
+
+#define WNI_CFG_EXT_SCAN_CONC_MODE_MIN    0
+#define WNI_CFG_EXT_SCAN_CONC_MODE_MAX    2
+#define WNI_CFG_EXT_SCAN_CONC_MODE_DEF    1
+
 #define WNI_CFG_ENABLE_MAC_ADDR_SPOOFING_MIN 0
 #define WNI_CFG_ENABLE_MAC_ADDR_SPOOFING_MAX 2
 #define WNI_CFG_ENABLE_MAC_ADDR_SPOOFING_DEF 1
 
+#define WNI_CFG_DISABLE_BAR_WAKE_UP_HOST_MIN 0
+#define WNI_CFG_DISABLE_BAR_WAKE_UP_HOST_MAX 1
+#define WNI_CFG_DISABLE_BAR_WAKE_UP_HOST_DEF 0
+
 #define WNI_CFG_SAR_BOFFSET_SET_CORRECTION_MIN 0
 #define WNI_CFG_SAR_BOFFSET_SET_CORRECTION_MAX  1
 #define WNI_CFG_SAR_BOFFSET_SET_CORRECTION_DEFAULT 0
 
-#define CFG_PARAM_MAX_NUM        355
-#define CFG_STA_IBUF_MAX_SIZE    289
+
+#define CFG_PARAM_MAX_NUM        358
+#define CFG_STA_IBUF_MAX_SIZE    292
 #define CFG_STA_SBUF_MAX_SIZE    3389
 
 #define CFG_STA_MAGIC_DWORD    0xbeefbeef
diff --git a/wlan/prima/CORE/MAC/src/cfg/cfgApi.c b/wlan/prima/CORE/MAC/src/cfg/cfgApi.c
index cd76522..9047d3a 100644
--- a/wlan/prima/CORE/MAC/src/cfg/cfgApi.c
+++ b/wlan/prima/CORE/MAC/src/cfg/cfgApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1055,7 +1055,7 @@
         return eSIR_FAILURE;
       }
 #if defined WLAN_VOWIFI_DEBUG
-      PELOGE(cfgLog( pMac, LOGE, "RRM = %d",val );)
+      PELOGE(cfgLog( pMac, LOG1, "RRM = %d",val );)
 #endif
       if (val)
         pCapInfo->rrm = 1;
diff --git a/wlan/prima/CORE/MAC/src/cfg/cfgParamName.c b/wlan/prima/CORE/MAC/src/cfg/cfgParamName.c
index af2d1c7..5fda170 100644
--- a/wlan/prima/CORE/MAC/src/cfg/cfgParamName.c
+++ b/wlan/prima/CORE/MAC/src/cfg/cfgParamName.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -341,12 +341,12 @@
     (unsigned char *)"FLEX_CONNECT_POWER_FACTOR",
     (unsigned char *)"ANTENNA_DIVESITY",
     (unsigned char *)"GO_LINK_MONITOR_TIMEOUT",
+    (unsigned char *)"RMC_ACTION_PERIOD_FREQUENCY",
     (unsigned char *)"ATH_DISABLE",
     (unsigned char *)"BTC_ACTIVE_WLAN_LEN",
     (unsigned char *)"BTC_ACTIVE_BT_LEN",
     (unsigned char *)"BTC_SAP_ACTIVE_WLAN_LEN",
     (unsigned char *)"BTC_SAP_ACTIVE_BT_LEN",
-    (unsigned char *)"RMC_ACTION_PERIOD_FREQUENCY",
     (unsigned char *)"ASD_PROBE_INTERVAL",
     (unsigned char *)"ASD_TRIGGER_THRESHOLD",
     (unsigned char *)"ASD_RTT_RSSI_HYST_THRESHOLD",
@@ -371,6 +371,7 @@
     (unsigned char *)"BTC_DYN_OPP_TX_QUEUE_THOLD",
     (unsigned char *)"TDLS_WMM_MODE_ENABLED",
     (unsigned char *)"BURST_MODE_BE_TXOP_VALUE",
+    (unsigned char *)"EXT_SCAN_CONC_MODE",
 };
 
 
diff --git a/wlan/prima/CORE/MAC/src/cfg/cfgProcMsg.c b/wlan/prima/CORE/MAC/src/cfg/cfgProcMsg.c
index 5413298..ab7ed15 100644
--- a/wlan/prima/CORE/MAC/src/cfg/cfgProcMsg.c
+++ b/wlan/prima/CORE/MAC/src/cfg/cfgProcMsg.c
@@ -1440,6 +1440,12 @@
      WNI_CFG_GO_LINK_MONITOR_TIMEOUT_STAMIN,
      WNI_CFG_GO_LINK_MONITOR_TIMEOUT_STAMAX,
      WNI_CFG_GO_LINK_MONITOR_TIMEOUT_STADEF},
+    {WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY,
+     CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT | CFG_CTL_NTF_HAL,
+     WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMIN,
+     WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMAX,
+     WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STADEF},
+
     {WNI_CFG_ATH_DISABLE,
      CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT,
      WNI_CFG_ATH_DISABLE_STAMIN,
@@ -1465,11 +1471,6 @@
      WNI_CFG_BTC_SAP_ACTIVE_BT_LEN_STAMIN,
      WNI_CFG_BTC_SAP_ACTIVE_BT_LEN_STAMAX,
      WNI_CFG_BTC_SAP_ACTIVE_BT_LEN_STADEF},
-    {WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY,
-     CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT | CFG_CTL_NTF_HAL,
-     WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMIN,
-     4294967295u,
-     WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STADEF},
     {WNI_CFG_ASD_PROBE_INTERVAL,
      CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT | CFG_CTL_NTF_HAL,
      WNI_CFG_ASD_PROBE_INTERVAL_STAMIN,
@@ -1677,11 +1678,26 @@
      WNI_CFG_OPTIMIZE_CA_EVENT_DISABLE,
      WNI_CFG_OPTIMIZE_CA_EVENT_ENABLE,
      WNI_CFG_OPTIMIZE_CA_EVENT_DEFAULT},
+    {WNI_CFG_ACTIVE_PASSIVE_CON,
+     CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT | CFG_CTL_NTF_HAL,
+     WNI_CFG_ACTIVE_PASSIVE_CON_MIN,
+     WNI_CFG_ACTIVE_PASSIVE_CON_MAX,
+     WNI_CFG_ACTIVE_PASSIVE_CON_DEF},
+    {WNI_CFG_EXT_SCAN_CONC_MODE,
+     CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT | CFG_CTL_NTF_HAL,
+     WNI_CFG_EXT_SCAN_CONC_MODE_MIN,
+     WNI_CFG_EXT_SCAN_CONC_MODE_MAX,
+     WNI_CFG_EXT_SCAN_CONC_MODE_DEF},
     {WNI_CFG_ENABLE_MAC_ADDR_SPOOFING,
      CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT | CFG_CTL_NTF_HAL,
      WNI_CFG_ENABLE_MAC_ADDR_SPOOFING_MIN,
      WNI_CFG_ENABLE_MAC_ADDR_SPOOFING_MAX,
      WNI_CFG_ENABLE_MAC_ADDR_SPOOFING_DEF},
+    {WNI_CFG_DISABLE_BAR_WAKE_UP_HOST,
+     CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT | CFG_CTL_NTF_HAL,
+     WNI_CFG_DISABLE_BAR_WAKE_UP_HOST_MIN,
+     WNI_CFG_DISABLE_BAR_WAKE_UP_HOST_MAX,
+     WNI_CFG_DISABLE_BAR_WAKE_UP_HOST_DEF},
     {WNI_CFG_SAR_BOFFSET_SET_CORRECTION,
      CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT | CFG_CTL_NTF_HAL,
      WNI_CFG_SAR_BOFFSET_SET_CORRECTION_MIN,
diff --git a/wlan/prima/CORE/MAC/src/cfg/cfgUtil/cfg.txt b/wlan/prima/CORE/MAC/src/cfg/cfgUtil/cfg.txt
index 87aba50..c08458f 100644
--- a/wlan/prima/CORE/MAC/src/cfg/cfgUtil/cfg.txt
+++ b/wlan/prima/CORE/MAC/src/cfg/cfgUtil/cfg.txt
@@ -1,5 +1,5 @@
  *
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -4601,7 +4601,18 @@
 *
 *
 
-* ATH Enable/Disable
+* RMC action period frequency (milli seconds)
+*
+WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY    I    4    7
+V    RW    NP
+HAL
+100   1000    300
+V    RW    NP
+HAL
+100   1000    300
+*
+*
+
 *
 WNI_CFG_ATH_DISABLE	I    4    7
 V    RW    NP
@@ -4658,18 +4669,6 @@
 *
 *
 
-* RMC action period frequency (milli seconds)
-*
-WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY    I    4    7
-V    RW    NP
-HAL
-0   0xFFFFFFFF    300
-V    RW    NP
-HAL
-0   0xFFFFFFFF    300
-*
-*
-
 * Rssi probe interval (milli seconds)
 *
 WNI_CFG_ASD_PROBE_INTERVAL    I    4    7
diff --git a/wlan/prima/CORE/MAC/src/cfg/cfgUtil/dot11f.frms b/wlan/prima/CORE/MAC/src/cfg/cfgUtil/dot11f.frms
index 87bbc65..18c9889 100644
--- a/wlan/prima/CORE/MAC/src/cfg/cfgUtil/dot11f.frms
+++ b/wlan/prima/CORE/MAC/src/cfg/cfgUtil/dot11f.frms
@@ -419,6 +419,31 @@
     ouiSubtype, 1;
 }
 
+FF RMCOUI (3)
+{
+     oui[3];
+}
+
+FF MagicCode (6)
+{
+     magic[6];
+}
+
+FF RMCVersion (1)
+{
+     version, 1;
+}
+
+FF RMCDialogToken (4)
+{
+     token, 4;
+}
+
+FF Ruler (6)
+{
+     mac[6];
+}
+
 FF VhtMembershipStatusArray(8)                    // 8.4.1.51
 {
     membershipStatusArray[8];
@@ -4242,6 +4267,17 @@
     MANDIE  QosMapSet;
 }
 
+FRAME RMC
+{
+    FF     Category;
+    FF     RMCOUI;
+    FF     MagicCode;
+    FF     RMCVersion;
+    FF     Action;
+    FF     RMCDialogToken;
+    FF     Ruler;
+}
+
 FRAME VHTGidManagementActionFrame
 {
     FF     Category;
diff --git a/wlan/prima/CORE/MAC/src/dph/dphHashTable.c b/wlan/prima/CORE/MAC/src/dph/dphHashTable.c
index 90926f5..161779d 100644
--- a/wlan/prima/CORE/MAC/src/dph/dphHashTable.c
+++ b/wlan/prima/CORE/MAC/src/dph/dphHashTable.c
@@ -443,6 +443,7 @@
 #ifdef WLAN_FEATURE_11W
       ptr->last_assoc_received_time = 0;
 #endif
+
       ptr->next = 0;
     }
   else
diff --git a/wlan/prima/CORE/MAC/src/include/dot11f.h b/wlan/prima/CORE/MAC/src/include/dot11f.h
index e08fd48..32e6981 100644
--- a/wlan/prima/CORE/MAC/src/include/dot11f.h
+++ b/wlan/prima/CORE/MAC/src/include/dot11f.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -30,7 +30,7 @@
   *
   *
   * This file was automatically generated by 'framesc'
-  * Mon Nov 10 19:49:53 2014 from the following file(s):
+  * Wed Sep  9 10:17:04 2015 from the following file(s):
   *
   * dot11f.frms
   *
@@ -316,6 +316,16 @@
 
 void dot11fPackFfListenInterval(tpAniSirGlobal, tDot11fFfListenInterval*, tANI_U8*);
 
+typedef struct sDot11fFfMagicCode {
+    tANI_U8 magic[6];
+} tDot11fFfMagicCode;
+
+#define DOT11F_FF_MAGICCODE_LEN ( 6 )
+
+void dot11fUnpackFfMagicCode(tpAniSirGlobal, tANI_U8*, tDot11fFfMagicCode*);
+
+void dot11fPackFfMagicCode(tpAniSirGlobal, tDot11fFfMagicCode*, tANI_U8*);
+
 typedef struct sDot11fFfMaxTxPower {
     tANI_U8 maxTxPower;
 } tDot11fFfMaxTxPower;
@@ -388,6 +398,36 @@
 
 void dot11fPackFfRCPI(tpAniSirGlobal, tDot11fFfRCPI*, tANI_U8*);
 
+typedef struct sDot11fFfRMCDialogToken {
+    tANI_U32 token;
+} tDot11fFfRMCDialogToken;
+
+#define DOT11F_FF_RMCDIALOGTOKEN_LEN ( 4 )
+
+void dot11fUnpackFfRMCDialogToken(tpAniSirGlobal, tANI_U8*, tDot11fFfRMCDialogToken*);
+
+void dot11fPackFfRMCDialogToken(tpAniSirGlobal, tDot11fFfRMCDialogToken*, tANI_U8*);
+
+typedef struct sDot11fFfRMCOUI {
+    tANI_U8 oui[3];
+} tDot11fFfRMCOUI;
+
+#define DOT11F_FF_RMCOUI_LEN ( 3 )
+
+void dot11fUnpackFfRMCOUI(tpAniSirGlobal, tANI_U8*, tDot11fFfRMCOUI*);
+
+void dot11fPackFfRMCOUI(tpAniSirGlobal, tDot11fFfRMCOUI*, tANI_U8*);
+
+typedef struct sDot11fFfRMCVersion {
+    tANI_U8 version;
+} tDot11fFfRMCVersion;
+
+#define DOT11F_FF_RMCVERSION_LEN ( 1 )
+
+void dot11fUnpackFfRMCVersion(tpAniSirGlobal, tANI_U8*, tDot11fFfRMCVersion*);
+
+void dot11fPackFfRMCVersion(tpAniSirGlobal, tDot11fFfRMCVersion*, tANI_U8*);
+
 typedef struct sDot11fFfRSNI {
     tANI_U8 rsni;
 } tDot11fFfRSNI;
@@ -408,6 +448,16 @@
 
 void dot11fPackFfReason(tpAniSirGlobal, tDot11fFfReason*, tANI_U8*);
 
+typedef struct sDot11fFfRuler {
+    tANI_U8 mac[6];
+} tDot11fFfRuler;
+
+#define DOT11F_FF_RULER_LEN ( 6 )
+
+void dot11fUnpackFfRuler(tpAniSirGlobal, tANI_U8*, tDot11fFfRuler*);
+
+void dot11fPackFfRuler(tpAniSirGlobal, tDot11fFfRuler*, tANI_U8*);
+
 typedef struct sDot11fFfRxAntennaId {
     tANI_U8 antennaId;
 } tDot11fFfRxAntennaId;
@@ -7298,6 +7348,30 @@
 } /* End extern "C". */
 #endif /* C++ */
 
+typedef struct sDot11fRMC{
+    tDot11fFfCategory       Category;
+    tDot11fFfRMCOUI         RMCOUI;
+    tDot11fFfMagicCode      MagicCode;
+    tDot11fFfRMCVersion     RMCVersion;
+    tDot11fFfAction         Action;
+    tDot11fFfRMCDialogToken RMCDialogToken;
+    tDot11fFfRuler         Ruler;
+} tDot11fRMC;
+
+#define DOT11F_RMC ( 41 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+
+tANI_U32 dot11fUnpackRMC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fRMC *pFrm);
+tANI_U32 dot11fPackRMC(tpAniSirGlobal pCtx, tDot11fRMC *pFrm, tANI_U8 *pBuf, tANI_U32 nBuf, tANI_U32 *pnConsumed);
+tANI_U32 dot11fGetPackedRMCSize(tpAniSirGlobal pCtx, tDot11fRMC *pFrm, tANI_U32 *pnNeeded);
+
+#ifdef __cplusplus
+} /* End extern "C". */
+#endif /* C++ */
+
 typedef struct sDot11fRadioMeasurementReport{
     tDot11fFfCategory          Category;
     tDot11fFfAction            Action;
@@ -7306,7 +7380,7 @@
     tDot11fIEMeasurementReport MeasurementReport[4];
 } tDot11fRadioMeasurementReport;
 
-#define DOT11F_RADIOMEASUREMENTREPORT ( 41 )
+#define DOT11F_RADIOMEASUREMENTREPORT ( 42 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7329,7 +7403,7 @@
     tDot11fIEMeasurementRequest MeasurementRequest[2];
 } tDot11fRadioMeasurementRequest;
 
-#define DOT11F_RADIOMEASUREMENTREQUEST ( 42 )
+#define DOT11F_RADIOMEASUREMENTREQUEST ( 43 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7380,7 +7454,7 @@
     tDot11fIEQosMapSet          QosMapSet;
 } tDot11fReAssocRequest;
 
-#define DOT11F_REASSOCREQUEST ( 43 )
+#define DOT11F_REASSOCREQUEST ( 44 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7430,7 +7504,7 @@
     tDot11fIEQosMapSet          QosMapSet;
 } tDot11fReAssocResponse;
 
-#define DOT11F_REASSOCRESPONSE ( 44 )
+#define DOT11F_REASSOCRESPONSE ( 45 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7450,7 +7524,7 @@
     tDot11fFfSMPowerModeSet SMPowerModeSet;
 } tDot11fSMPowerSave;
 
-#define DOT11F_SMPOWERSAVE ( 45 )
+#define DOT11F_SMPOWERSAVE ( 46 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7470,7 +7544,7 @@
     tDot11fFfTransactionId TransactionId;
 } tDot11fSaQueryReq;
 
-#define DOT11F_SAQUERYREQ ( 46 )
+#define DOT11F_SAQUERYREQ ( 47 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7490,7 +7564,7 @@
     tDot11fFfTransactionId TransactionId;
 } tDot11fSaQueryRsp;
 
-#define DOT11F_SAQUERYRSP ( 47 )
+#define DOT11F_SAQUERYRSP ( 48 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7511,7 +7585,7 @@
     tDot11fIELinkIdentifier LinkIdentifier;
 } tDot11fTDLSDisReq;
 
-#define DOT11F_TDLSDISREQ ( 48 )
+#define DOT11F_TDLSDISREQ ( 49 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7545,7 +7619,7 @@
     tDot11fIEVHTCaps              VHTCaps;
 } tDot11fTDLSDisRsp;
 
-#define DOT11F_TDLSDISRSP ( 49 )
+#define DOT11F_TDLSDISRSP ( 50 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7568,7 +7642,7 @@
     tDot11fIEPUBufferStatus PUBufferStatus;
 } tDot11fTDLSPeerTrafficInd;
 
-#define DOT11F_TDLSPEERTRAFFICIND ( 50 )
+#define DOT11F_TDLSPEERTRAFFICIND ( 51 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7589,7 +7663,7 @@
     tDot11fIELinkIdentifier LinkIdentifier;
 } tDot11fTDLSPeerTrafficRsp;
 
-#define DOT11F_TDLSPEERTRAFFICRSP ( 51 )
+#define DOT11F_TDLSPEERTRAFFICRSP ( 52 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7620,7 +7694,7 @@
     tDot11fIEOperatingMode        OperatingMode;
 } tDot11fTDLSSetupCnf;
 
-#define DOT11F_TDLSSETUPCNF ( 52 )
+#define DOT11F_TDLSSETUPCNF ( 53 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7658,7 +7732,7 @@
     tDot11fIEVHTCaps              VHTCaps;
 } tDot11fTDLSSetupReq;
 
-#define DOT11F_TDLSSETUPREQ ( 53 )
+#define DOT11F_TDLSSETUPREQ ( 54 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7698,7 +7772,7 @@
     tDot11fIEOperatingMode        OperatingMode;
 } tDot11fTDLSSetupRsp;
 
-#define DOT11F_TDLSSETUPRSP ( 54 )
+#define DOT11F_TDLSSETUPRSP ( 55 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7720,7 +7794,7 @@
     tDot11fIELinkIdentifier LinkIdentifier;
 } tDot11fTDLSTeardown;
 
-#define DOT11F_TDLSTEARDOWN ( 55 )
+#define DOT11F_TDLSTEARDOWN ( 56 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7741,7 +7815,7 @@
     tDot11fIETPCReport   TPCReport;
 } tDot11fTPCReport;
 
-#define DOT11F_TPCREPORT ( 56 )
+#define DOT11F_TPCREPORT ( 57 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7762,7 +7836,7 @@
     tDot11fIETPCRequest  TPCRequest;
 } tDot11fTPCRequest;
 
-#define DOT11F_TPCREQUEST ( 57 )
+#define DOT11F_TPCREQUEST ( 58 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7783,7 +7857,7 @@
     tDot11fFfVhtUserPositionArray     VhtUserPositionArray;
 } tDot11fVHTGidManagementActionFrame;
 
-#define DOT11F_VHTGIDMANAGEMENTACTIONFRAME ( 58 )
+#define DOT11F_VHTGIDMANAGEMENTACTIONFRAME ( 59 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7806,7 +7880,7 @@
     tDot11fIEESETrafStrmRateSet ESETrafStrmRateSet;
 } tDot11fWMMAddTSRequest;
 
-#define DOT11F_WMMADDTSREQUEST ( 59 )
+#define DOT11F_WMMADDTSREQUEST ( 60 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7829,7 +7903,7 @@
     tDot11fIEESETrafStrmMet ESETrafStrmMet;
 } tDot11fWMMAddTSResponse;
 
-#define DOT11F_WMMADDTSRESPONSE ( 60 )
+#define DOT11F_WMMADDTSRESPONSE ( 61 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -7851,7 +7925,7 @@
     tDot11fIEWMMTSPEC    WMMTSPEC;
 } tDot11fWMMDelTS;
 
-#define DOT11F_WMMDELTS ( 61 )
+#define DOT11F_WMMDELTS ( 62 )
 
 #ifdef __cplusplus
 extern "C" {
diff --git a/wlan/prima/CORE/MAC/src/include/parserApi.h b/wlan/prima/CORE/MAC/src/include/parserApi.h
index 0b2192c..39281f2 100644
--- a/wlan/prima/CORE/MAC/src/include/parserApi.h
+++ b/wlan/prima/CORE/MAC/src/include/parserApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -106,8 +106,10 @@
 #ifdef WLAN_FEATURE_VOWIFI_11R
     tANI_U8                   mdie[SIR_MDIE_SIZE];
 #endif
+#if defined(FEATURE_WLAN_ESE) || defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD)
 #ifdef FEATURE_WLAN_ESE
     tDot11fIEESETxmitPower    eseTxPwr;
+#endif
     tDot11fIEQBSSLoad         QBSSLoad;
 #endif
     tANI_U8                   ssidPresent;
@@ -734,7 +736,8 @@
 tSirRetStatus
 PopulateDot11fRatesTdls(tpAniSirGlobal p_mac,
                            tDot11fIESuppRates *p_supp_rates,
-                           tDot11fIEExtSuppRates *p_ext_supp_rates);
+                           tDot11fIEExtSuppRates *p_ext_supp_rates,
+                           tANI_U8 curr_oper_channel);
 
 tSirRetStatus PopulateDot11fTPCReport(tpAniSirGlobal      pMac,
                                       tDot11fIETPCReport *pDot11f,
diff --git a/wlan/prima/CORE/MAC/src/include/sirParams.h b/wlan/prima/CORE/MAC/src/include/sirParams.h
index 9fd6014..1f64736 100644
--- a/wlan/prima/CORE/MAC/src/include/sirParams.h
+++ b/wlan/prima/CORE/MAC/src/include/sirParams.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -127,9 +127,23 @@
 #ifdef FEATURE_WLAN_TDLS
    TDLS_OFF_CHANNEL      = 51,
 #endif
+   RTT3                  = 52,
    MGMT_FRAME_LOGGING    = 53,
    ENHANCED_TXBD_COMPLETION = 54,
    LOGGING_ENHANCEMENT   = 55,
+
+#ifdef WLAN_FEATURE_EXTSCAN
+   EXT_SCAN_ENHANCED     = 56,
+#endif
+
+   MEMORY_DUMP_SUPPORTED = 57,
+   PER_PKT_STATS_SUPPORTED  = 58,
+   EXT_LL_STAT              = 60,
+   WIFI_CONFIG            = 61,
+   ANTENNA_DIVERSITY_SELECTION  = 62,
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+   PER_BASED_ROAMING = 63,
+#endif
    //MAX_FEATURE_SUPPORTED = 128
 } placeHolderInCapBitmap;
 
@@ -625,35 +639,51 @@
 #define SIR_HAL_DHCP_STOP_IND              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 205)
 #define SIR_HAL_IBSS_PEER_INACTIVITY_IND   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 206)
 
-#define SIR_HAL_LPHB_WAIT_EXPIRE_IND       (SIR_HAL_ITC_MSG_TYPES_BEGIN + 207)
+#define SIR_HAL_LPHB_CONF_IND              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 207)
+#define SIR_HAL_LPHB_WAIT_EXPIRE_IND       (SIR_HAL_ITC_MSG_TYPES_BEGIN + 208)
 
-#define SIR_HAL_ADD_PERIODIC_TX_PTRN_IND   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 208)
-#define SIR_HAL_DEL_PERIODIC_TX_PTRN_IND   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 209)
+#define SIR_HAL_ADD_PERIODIC_TX_PTRN_IND   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 209)
+#define SIR_HAL_DEL_PERIODIC_TX_PTRN_IND   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 210)
 
-#ifdef FEATURE_WLAN_BATCH_SCAN
-#define SIR_HAL_SET_BATCH_SCAN_REQ         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 210)
-#define SIR_HAL_SET_BATCH_SCAN_RSP         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 211)
-#define SIR_HAL_STOP_BATCH_SCAN_IND        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 212)
-#define SIR_HAL_TRIGGER_BATCH_SCAN_RESULT_IND (SIR_HAL_ITC_MSG_TYPES_BEGIN + 213)
-#endif
+#ifdef WLAN_FEATURE_RMC
+#define SIR_HAL_RMC_BECOME_RULER          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 211)
+#define SIR_HAL_RMC_RULER_SELECT_RESP     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 212)
+#define SIR_HAL_RMC_RULER_REQ             (SIR_HAL_ITC_MSG_TYPES_BEGIN + 213)
+#define SIR_HAL_RMC_UPDATE_IND             (SIR_HAL_ITC_MSG_TYPES_BEGIN + 214)
+
+/* For IBSS peer info related messages */
+#define SIR_HAL_IBSS_PEER_INFO_REQ         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 215)
+#define SIR_HAL_IBSS_PEER_INFO_RSP         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 216)
+#endif /* WLAN_FEATURE_RMC */
 
 #define SIR_HAL_RATE_UPDATE_IND            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 217)
-#define SIR_HAL_START_SCAN_OFFLOAD_REQ     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 218)
-#define SIR_HAL_START_SCAN_OFFLOAD_RSP     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 219)
-#define SIR_HAL_UPDATE_CHAN_LIST_REQ       (SIR_HAL_ITC_MSG_TYPES_BEGIN + 220)
 
-#define SIR_HAL_SET_MAX_TX_POWER_PER_BAND_REQ \
-        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 221)
-#define SIR_HAL_SET_MAX_TX_POWER_PER_BAND_RSP \
-        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 222)
+#ifdef FEATURE_WLAN_BATCH_SCAN
+#define SIR_HAL_SET_BATCH_SCAN_REQ         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 218)
+#define SIR_HAL_SET_BATCH_SCAN_RSP         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 219)
+#define SIR_HAL_STOP_BATCH_SCAN_IND        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 220)
+#define SIR_HAL_TRIGGER_BATCH_SCAN_RESULT_IND (SIR_HAL_ITC_MSG_TYPES_BEGIN + 221)
+#endif
 
+#define SIR_HAL_START_SCAN_OFFLOAD_REQ     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 223)
+#define SIR_HAL_START_SCAN_OFFLOAD_RSP     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 224)
+#define SIR_HAL_UPDATE_CHAN_LIST_REQ       (SIR_HAL_ITC_MSG_TYPES_BEGIN + 225)
+
+#ifdef WLAN_FEATURE_RMC
+#define SIR_HAL_TX_FAIL_MONITOR_IND         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 226)
+#endif /* WLAN_FEATURE_RMC */
 
 /* OBSS Scan start Indication to FW*/
 #define SIR_HAL_HT40_OBSS_SCAN_IND      (SIR_HAL_ITC_MSG_TYPES_BEGIN +227)
 /* OBSS Scan stop Indication to FW*/
 #define SIR_HAL_HT40_OBSS_STOP_SCAN_IND (SIR_HAL_ITC_MSG_TYPES_BEGIN +228)
 
-#define SIR_HAL_BCN_MISS_RATE_REQ         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 229)
+#define SIR_HAL_SET_MAX_TX_POWER_PER_BAND_REQ \
+        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 229)
+#define SIR_HAL_SET_MAX_TX_POWER_PER_BAND_RSP \
+        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 230)
+
+#define SIR_HAL_BCN_MISS_RATE_REQ         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 231)
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
 #define SIR_HAL_LL_STATS_CLEAR_REQ      (SIR_HAL_ITC_MSG_TYPES_BEGIN + 232)
@@ -673,10 +703,11 @@
 #define SIR_HAL_EXTSCAN_SET_BSS_HOTLIST_RSP    (SIR_HAL_ITC_MSG_TYPES_BEGIN + 243)
 #define SIR_HAL_EXTSCAN_RESET_BSS_HOTLIST_REQ  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 244)
 #define SIR_HAL_EXTSCAN_RESET_BSS_HOTLIST_RSP  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 245)
-#define SIR_HAL_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 246)
-#define SIR_HAL_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 247)
-#define SIR_HAL_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ (SIR_HAL_ITC_MSG_TYPES_BEGIN + 248)
-#define SIR_HAL_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP (SIR_HAL_ITC_MSG_TYPES_BEGIN + 249)
+#define SIR_HAL_EXTSCAN_SET_SSID_HOTLIST_REQ   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 246)
+#define SIR_HAL_EXTSCAN_SET_SSID_HOTLIST_RSP   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 247)
+#define SIR_HAL_EXTSCAN_RESET_SSID_HOTLIST_REQ (SIR_HAL_ITC_MSG_TYPES_BEGIN + 248)
+#define SIR_HAL_EXTSCAN_RESET_SSID_HOTLIST_RSP (SIR_HAL_ITC_MSG_TYPES_BEGIN + 249)
+
 #define SIR_HAL_EXTSCAN_GET_CACHED_RESULTS_REQ (SIR_HAL_ITC_MSG_TYPES_BEGIN + 250)
 #define SIR_HAL_EXTSCAN_GET_CACHED_RESULTS_RSP (SIR_HAL_ITC_MSG_TYPES_BEGIN + 251)
 
@@ -684,7 +715,8 @@
 #define SIR_HAL_EXTSCAN_SCAN_AVAILABLE_IND     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 253)
 #define SIR_HAL_EXTSCAN_SCAN_RESULT_IND        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 254)
 #define SIR_HAL_EXTSCAN_HOTLIST_MATCH_IND      (SIR_HAL_ITC_MSG_TYPES_BEGIN + 255)
-#define SIR_HAL_EXTSCAN_SIGNF_WIFI_CHANGE_IND  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 256)
+#define SIR_HAL_EXTSCAN_SSID_HOTLIST_MATCH_IND (SIR_HAL_ITC_MSG_TYPES_BEGIN + 256)
+
 #define SIR_HAL_EXTSCAN_FULL_SCAN_RESULT_IND   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 257)
 
 #endif /* WLAN_FEATURE_EXTSCAN */
@@ -712,12 +744,28 @@
 #define SIR_HAL_MON_START_REQ               (SIR_HAL_ITC_MSG_TYPES_BEGIN + 269)
 #define SIR_HAL_MON_STOP_REQ                (SIR_HAL_ITC_MSG_TYPES_BEGIN + 270)
 #define SIR_HAL_FATAL_EVENT_LOGS_REQ         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 271)
-#define SIR_HAL_LPHB_CONF_IND              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 272)
+#define SIR_HAL_SEND_LOG_DONE_IND            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 272)
 #define SIR_HAL_LOST_LINK_PARAMS_IND         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 273)
 #define SIR_HAL_SEND_FREQ_RANGE_CONTROL_IND  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 274)
-#define SIR_HAL_SEND_LOG_DONE_IND            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 275)
-
+#define SIR_HAL_FW_MEM_DUMP_REQ              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 275)
+#define SIR_HAL_RSSI_MON_START_REQ           (SIR_HAL_ITC_MSG_TYPES_BEGIN + 276)
+#define SIR_HAL_RSSI_MON_STOP_REQ            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 277)
+#define SIR_HAL_HIGH_PRIORITY_DATA_INFO_IND  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 278)
+#define SIR_HAL_WIFI_CONFIG_PARAMS           (SIR_HAL_ITC_MSG_TYPES_BEGIN + 279)
+#define SIR_HAL_START_OEM_DATA_REQ_IND_NEW   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 280)
+#define SIR_HAL_START_OEM_DATA_RSP_IND_NEW   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 281)
+#define SIR_HAL_ANTENNA_DIVERSITY_SELECTION_REQ (SIR_HAL_ITC_MSG_TYPES_BEGIN + 282)
+#define SIR_HAL_MODIFY_ROAM_PARAMS_IND     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 283)
+#define SIR_HAL_SET_ALLOWED_ACTION_FRAMES  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 284)
+#define SIR_HAL_PAUSE_TL_IND               (SIR_HAL_ITC_MSG_TYPES_BEGIN + 285)
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+#define SIR_HAL_PER_ROAM_SCAN_OFFLOAD_REQ  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 286)
+#define SIR_HAL_PER_ROAM_SCAN_OFFLOAD_RSP  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 287)
+#define SIR_HAL_PER_ROAM_SCAN_TRIGGER_REQ  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 288)
+#define SIR_HAL_PER_ROAM_SCAN_TRIGGER_RSP  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 289)
+#endif
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
+
 // CFG message types
 #define SIR_CFG_MSG_TYPES_BEGIN        (SIR_CFG_MODULE_ID << 8)
 #define SIR_CFG_ITC_MSG_TYPES_BEGIN    (SIR_CFG_MSG_TYPES_BEGIN+0xB0)
diff --git a/wlan/prima/CORE/MAC/src/pe/include/limSession.h b/wlan/prima/CORE/MAC/src/pe/include/limSession.h
index 8a94e6c..bd9f228 100644
--- a/wlan/prima/CORE/MAC/src/pe/include/limSession.h
+++ b/wlan/prima/CORE/MAC/src/pe/include/limSession.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -92,6 +92,7 @@
     tSirNwType              nwType;
     tpSirSmeStartBssReq     pLimStartBssReq;        //handle to smestart bss req
     tANI_BOOLEAN            bOSENAssociation;       //handle to OSEN assoc req
+    tANI_BOOLEAN            bWPSAssociation;        //WPS Registration
     tpSirSmeJoinReq         pLimJoinReq;            // handle to sme join req
     tpSirSmeJoinReq         pLimReAssocReq;         //handle to sme reassoc req
     tpLimMlmJoinReq         pLimMlmJoinReq;         //handle to MLM join Req
@@ -358,8 +359,8 @@
     tSirQosMapSet QosMapSet;
     tANI_U8  isKeyInstalled;
     tANI_BOOLEAN is11Gonly;
-    tANI_BOOLEAN is_ext_caps_present;
     tANI_BOOLEAN addBssfailed;
+    tANI_BOOLEAN is_ext_caps_present;
 }tPESession, *tpPESession;
 
 #define LIM_MAX_ACTIVE_SESSIONS 4
diff --git a/wlan/prima/CORE/MAC/src/pe/include/limTrace.h b/wlan/prima/CORE/MAC/src/pe/include/limTrace.h
index 13f1e26..24ffb8c 100644
--- a/wlan/prima/CORE/MAC/src/pe/include/limTrace.h
+++ b/wlan/prima/CORE/MAC/src/pe/include/limTrace.h
@@ -93,6 +93,7 @@
 
 
 void limTraceInit(tpAniSirGlobal pMac);
+void lim_register_debug_callback(void);
 void limTraceReset(tpAniSirGlobal pMac);
 void limTraceUpdateMgmtStat(tpAniSirGlobal pMac, tANI_U8 subtype);
 void limTraceDumpMgmtStat(tpAniSirGlobal pMac, tANI_U8 subtype);
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limApi.c b/wlan/prima/CORE/MAC/src/pe/lim/limApi.c
index defbd47..f49aa01 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limApi.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -444,6 +444,7 @@
     pMac->lim.gHTDualCTSProtection = 0;
     pMac->lim.gHTSTBCBasicMCS = 0;
     pMac->lim.gAddBA_Declined = 0;               // Flag to Decline the BAR if the particular bit (0-7) is being set   
+    vos_mem_set(&pMac->lim.staBaInfo, sizeof(pMac->lim.staBaInfo), 0);
 }
 
 static tSirRetStatus __limInitConfig( tpAniSirGlobal pMac )
@@ -762,6 +763,10 @@
     limFTOpen(pMac);
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+    limRmcInit(pMac);
+#endif /* WLAN_FEATURE_RMC */
+
     vos_list_init(&pMac->lim.gLimMgmtFrameRegistratinQueue);
 
 #if 0
@@ -857,6 +862,10 @@
     limCleanupMlm(pMac);
     limCleanupLmm(pMac);
 
+#ifdef WLAN_FEATURE_RMC
+    limRmcCleanup(pMac);
+#endif /* WLAN_FEATURE_RMC */
+
     // free up preAuth table
     if (pMac->lim.gLimPreAuthTimerTable.pTable != NULL)
     {
@@ -1055,6 +1064,7 @@
 #ifdef LIM_TRACE_RECORD
     MTRACE(limTraceInit(pMac));
 #endif
+    lim_register_debug_callback();
     return eSIR_SUCCESS;
 }
 
@@ -1786,9 +1796,10 @@
                   pBeacon->capabilityInfo.privacy, pBeacon->wpaPresent,
                                                          pBeacon->rsnPresent);
     limLog(pMac, LOG1,
-            FL("pSession:: Privacy :%d EncyptionType: %d"),
+            FL("pSession:: Privacy :%d EncyptionType: %d WPS %d OSEN %d"),
                   SIR_MAC_GET_PRIVACY(pSession->limCurrentBssCaps),
-                                               pSession->encryptType);
+                       pSession->encryptType, pSession->bWPSAssociation,
+                       pSession->bOSENAssociation);
 
     /* This is handled by sending probe req due to IOT issues so return TRUE
      */
@@ -1830,13 +1841,18 @@
      * in beacon. Therefore no need to
      * check for security type in case
      * OSEN session.
+     * For WPS registration session no need to detect
+     * security mismatch as it wont match and
+     * driver may end up sending probe request without
+     * WPS IE during WPS registartion process.
      */
     /*TODO: AP capability mismatch
      * is not checked here because
      * no logic for beacon parsing
      * is avilable for HS2.0.
      */
-    if (pSession->bOSENAssociation)
+    if (pSession->bOSENAssociation ||
+             pSession->bWPSAssociation)
         return eSIR_TRUE;
 
     return eSIR_FALSE;
@@ -2217,11 +2233,11 @@
     }
     pSmeLostLinkParams =
     (tpSirSmeLostLinkParamsInd)vos_mem_malloc(sizeof(tSirSmeLostLinkParamsInd));
-
-    if (pSmeLostLinkParams == NULL)
+    if (NULL == pSmeLostLinkParams)
     {
-        limLog(pMac, LOGE,
-          FL("pSmeLostLinkParams is NULL"));
+        limLog(pMac, LOGP,
+            FL("Failed to alloc mem of size %zu for tSirSmeLostLinkParamsInd"),
+            sizeof(*pSmeLostLinkParams));
         return;
     }
     vos_mem_set(pSmeLostLinkParams, sizeof(tSirSmeLostLinkParamsInd), 0);
@@ -2345,7 +2361,7 @@
     }
 
     pSirSmeMicFailureInd->messageType = eWNI_SME_MIC_FAILURE_IND;
-    pSirSmeMicFailureInd->length = sizeof(pSirSmeMicFailureInd);
+    pSirSmeMicFailureInd->length = sizeof(*pSirSmeMicFailureInd);
     pSirSmeMicFailureInd->sessionId = psessionEntry->smeSessionId;
 
     vos_mem_copy(pSirSmeMicFailureInd->bssId,
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limAssocUtils.c b/wlan/prima/CORE/MAC/src/pe/lim/limAssocUtils.c
index 3bce9f4..44c301e 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limAssocUtils.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limAssocUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -823,15 +823,14 @@
 
         psessionEntry->limAID = 0;
 
-
     }
 
     if ((mlmStaContext.cleanupTrigger ==
                                       eLIM_HOST_DISASSOC) ||
         (mlmStaContext.cleanupTrigger ==
-                                      eLIM_LINK_MONITORING_DISASSOC) ||
+                                      eLIM_PROMISCUOUS_MODE_DISASSOC) ||
         (mlmStaContext.cleanupTrigger ==
-                                      eLIM_PROMISCUOUS_MODE_DISASSOC))
+                                      eLIM_LINK_MONITORING_DISASSOC))
     {
         /**
          * Host or LMM driven Disassociation.
@@ -845,6 +844,7 @@
                      (tANI_U8 *) staDsAddr,
                       sizeof(tSirMacAddr));
         mlmDisassocCnf.resultCode = statusCode;
+        mlmDisassocCnf.aid          = staDsAssocId;
         mlmDisassocCnf.disassocTrigger =
                                    mlmStaContext.cleanupTrigger;
         /* Update PE session Id*/
@@ -854,10 +854,8 @@
                           LIM_MLM_DISASSOC_CNF,
                           (tANI_U32 *) &mlmDisassocCnf);
     }
-    else if ((mlmStaContext.cleanupTrigger ==
-                                           eLIM_HOST_DEAUTH) ||
-             (mlmStaContext.cleanupTrigger ==
-                                           eLIM_LINK_MONITORING_DEAUTH))
+    else if ((mlmStaContext.cleanupTrigger == eLIM_HOST_DEAUTH) ||
+             (mlmStaContext.cleanupTrigger == eLIM_LINK_MONITORING_DEAUTH))
     {
         /**
          * Host or LMM driven Deauthentication.
@@ -869,6 +867,7 @@
                      (tANI_U8 *) staDsAddr,
                       sizeof(tSirMacAddr));
         mlmDeauthCnf.resultCode    = statusCode;
+        mlmDeauthCnf.aid           = staDsAssocId;
         mlmDeauthCnf.deauthTrigger =
                                    mlmStaContext.cleanupTrigger;
         /* PE session Id */
@@ -2520,8 +2519,14 @@
         }
         else
         {
-            pAddStaParams->htLdpcCapable = pStaDs->htLdpcCapable;
-            pAddStaParams->vhtLdpcCapable = pStaDs->vhtLdpcCapable;
+            if (psessionEntry->txLdpcIniFeatureEnabled & 0x1)
+                pAddStaParams->htLdpcCapable = pStaDs->htLdpcCapable;
+            else
+                pAddStaParams->htLdpcCapable = 0;
+            if (psessionEntry->txLdpcIniFeatureEnabled & 0x2)
+                pAddStaParams->vhtLdpcCapable = pStaDs->vhtLdpcCapable;
+            else
+                pAddStaParams->vhtLdpcCapable = 0;
         }
     }
     else if( STA_ENTRY_SELF == pStaDs->staType)
@@ -3837,8 +3842,16 @@
             }
             else
             {
-                pAddBssParams->staContext.htLdpcCapable = (tANI_U8)pAssocRsp->HTCaps.advCodingCap;
-                pAddBssParams->staContext.vhtLdpcCapable = (tANI_U8)pAssocRsp->VHTCaps.ldpcCodingCap;
+                if (psessionEntry->txLdpcIniFeatureEnabled & 0x1)
+                    pAddBssParams->staContext.htLdpcCapable =
+                            (tANI_U8)pAssocRsp->HTCaps.advCodingCap;
+                else
+                    pAddBssParams->staContext.htLdpcCapable = 0;
+                if (psessionEntry->txLdpcIniFeatureEnabled & 0x2)
+                    pAddBssParams->staContext.vhtLdpcCapable =
+                        (tANI_U8)pAssocRsp->VHTCaps.ldpcCodingCap;
+                else
+                    pAddBssParams->staContext.vhtLdpcCapable = 0;
             }
 
             if( pBeaconStruct->HTInfo.present )
@@ -3934,6 +3947,7 @@
         psessionEntry->limMlmState = eLIM_MLM_WT_ADD_BSS_RSP_ASSOC_STATE;
     else
         psessionEntry->limMlmState = eLIM_MLM_WT_ADD_BSS_RSP_REASSOC_STATE;
+
     MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId, psessionEntry->limMlmState));
 
     limLog(pMac, LOG1, FL("staContext wmmEnabled: %d encryptType: %d "
@@ -4282,8 +4296,16 @@
             }
             else
             {
-                pAddBssParams->staContext.htLdpcCapable = (tANI_U8)pBeaconStruct->HTCaps.advCodingCap;
-                pAddBssParams->staContext.vhtLdpcCapable = (tANI_U8)pBeaconStruct->VHTCaps.ldpcCodingCap;
+                if (psessionEntry->txLdpcIniFeatureEnabled & 0x1)
+                    pAddBssParams->staContext.htLdpcCapable =
+                            (tANI_U8)pBeaconStruct->HTCaps.advCodingCap;
+                else
+                    pAddBssParams->staContext.htLdpcCapable = 0;
+                if (psessionEntry->txLdpcIniFeatureEnabled & 0x2)
+                    pAddBssParams->staContext.vhtLdpcCapable =
+                        (tANI_U8)pBeaconStruct->VHTCaps.ldpcCodingCap;
+                else
+                    pAddBssParams->staContext.vhtLdpcCapable = 0;
             }
             
             if( pBeaconStruct->HTInfo.present )
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limFT.c b/wlan/prima/CORE/MAC/src/pe/lim/limFT.c
index 8cbe6b8..8058e13 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limFT.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limFT.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -297,9 +297,6 @@
          */
         return bufConsumed;
     }
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
-        limDiagEventReport(pMac, WLAN_PE_DIAG_PRE_AUTH_REQ_EVENT, psessionEntry, 0, 0);
-#endif
 
     // Dont need to suspend if APs are in same channel
     if (psessionEntry->currentOperChannel != pMac->ft.ftPEContext.pFTPreAuthReq->preAuthchannelNum) 
@@ -389,6 +386,10 @@
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
     PELOGE(limLog( pMac, LOG1, "%s: FT Auth Rsp Timer Started", __func__);)
 #endif
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+      limDiagEventReport(pMac, WLAN_PE_DIAG_ROAM_AUTH_START_EVENT,
+             pMac->lim.pSessionEntry, eSIR_SUCCESS, eSIR_SUCCESS);
+#endif
 
     limSendAuthMgmtFrame(pMac, &authFrame,
         pMac->ft.ftPEContext.pFTPreAuthReq->preAuthbssId,
@@ -1151,11 +1152,6 @@
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
     PELOGE(limLog( pMac, LOG1, "Posted Auth Rsp to SME with status of 0x%x", status);)
 #endif
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
-    if (status == eSIR_SUCCESS)
-        limDiagEventReport(pMac, WLAN_PE_DIAG_PREAUTH_DONE, psessionEntry,
-                           status, 0);
-#endif
     limSysProcessMmhMsgApi(pMac, &mmhMsg,  ePROT);
 }
 
@@ -1177,7 +1173,8 @@
     tANI_U8 sessionId;
     tpSirBssDescription  pbssDescription;
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
-    limDiagEventReport(pMac, WLAN_PE_DIAG_PRE_AUTH_RSP_EVENT, psessionEntry, (tANI_U16)status, 0);
+    limDiagEventReport(pMac, WLAN_PE_DIAG_PRE_AUTH_RSP_EVENT,
+                       psessionEntry, status, eSIR_SUCCESS);
 #endif
 
     // Save the status of pre-auth
@@ -1317,6 +1314,12 @@
         vos_mem_free(pMlmReassocReq);
         return;
     }
+
+    lim_update_caps_info_for_bss(pMac, &caps,
+                  psessionEntry->pLimReAssocReq->bssDescription.capabilityInfo);
+
+    limLog(pMac, LOG1, FL("Capabilities info FT Reassoc: 0x%X"), caps);
+
     pMlmReassocReq->capabilityInfo = caps;
 
     /* Update PE sessionId*/
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c b/wlan/prima/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c
index f8f66fc..4ca42d3 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -49,6 +49,9 @@
 #include "limSendMessages.h"
 #include "limSession.h"
 #include "limIbssPeerMgmt.h"
+#ifdef WLAN_FEATURE_RMC
+#include "limRMC.h"
+#endif
 
 
 /**
@@ -820,6 +823,10 @@
 limIbssDelete(
     tpAniSirGlobal pMac,tpPESession psessionEntry)
 {
+#ifdef WLAN_FEATURE_RMC
+    limRmcIbssDelete(pMac);
+#endif /* WLAN_FEATURE_RMC */
+
     limIbssDeleteAllPeers(pMac,psessionEntry);
 
     ibss_coalesce_free(pMac);
@@ -1141,6 +1148,93 @@
     return retCode;
 }
 
+static void
+__limIbssSearchAndDeletePeer(tpAniSirGlobal    pMac,
+                             tpPESession psessionEntry,
+                             tSirMacAddr macAddr)
+{
+   tLimIbssPeerNode *pTempNode, *pPrevNode;
+   tLimIbssPeerNode *pTempNextNode = NULL;
+   tpDphHashNode     pStaDs=NULL;
+   tANI_U16          peerIdx=0;
+   tANI_U16          staIndex=0;
+   tANI_U8           ucUcastSig;
+   tANI_U8           ucBcastSig;
+
+   pPrevNode = pTempNode  = pMac->lim.gLimIbssPeerList;
+
+   limLog(pMac, LOG1,
+       FL(" PEER ADDR :" MAC_ADDRESS_STR ),MAC_ADDR_ARRAY(macAddr));
+
+   /** Compare Peer */
+   while (NULL != pTempNode)
+   {
+      pTempNextNode = pTempNode->next;
+
+      /* Delete the STA with MAC address */
+      if (vos_mem_compare( (tANI_U8 *) macAddr,
+               (tANI_U8 *) &pTempNode->peerMacAddr,
+               sizeof(tSirMacAddr)) )
+      {
+         pStaDs = dphLookupHashEntry(pMac, macAddr,
+               &peerIdx, &psessionEntry->dph.dphHashTable);
+         if (pStaDs)
+         {
+            staIndex = pStaDs->staIndex;
+            ucUcastSig = pStaDs->ucUcastSig;
+            ucBcastSig = pStaDs->ucBcastSig;
+
+#ifdef WLAN_FEATURE_RMC
+            limRmcTransmitterDelete(pMac, pStaDs->staAddr);
+#endif /* WLAN_FEATURE_RMC */
+
+            /* Send DEL STA only if STA id is valid, mean ADD STA was
+             * success.
+             */
+            if(HAL_STA_INVALID_IDX != staIndex)
+               limDelSta(pMac, pStaDs, false /*asynchronous*/, psessionEntry);
+            limDeleteDphHashEntry(pMac,
+                                     pStaDs->staAddr, peerIdx, psessionEntry);
+            limReleasePeerIdx(pMac, peerIdx, psessionEntry);
+
+            /* Send indication to upper layers only if ADD STA was success
+             * i.e staid is Valid.
+             */
+            if(HAL_STA_INVALID_IDX != staIndex)
+                ibss_status_chg_notify(pMac, macAddr, staIndex,
+                                   ucUcastSig, ucBcastSig,
+                                   eWNI_SME_IBSS_PEER_DEPARTED_IND,
+                                   psessionEntry->smeSessionId );
+            if (pTempNode == pMac->lim.gLimIbssPeerList)
+            {
+               pMac->lim.gLimIbssPeerList = pTempNode->next;
+               pPrevNode = pMac->lim.gLimIbssPeerList;
+            }
+            else
+               pPrevNode->next = pTempNode->next;
+
+            vos_mem_free(pTempNode);
+            pMac->lim.gLimNumIbssPeers--;
+
+            pTempNode = pTempNextNode;
+            break;
+         }
+      }
+      pPrevNode = pTempNode;
+      pTempNode = pTempNextNode;
+   }
+   /*
+    * if it is the last peer walking out, we better
+    * we set IBSS state to inactive.
+    */
+   if (0 == pMac->lim.gLimNumIbssPeers)
+   {
+       VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+            "Last STA from IBSS walked out");
+       psessionEntry->limIbssActive = false;
+   }
+}
+
 /* handle the response from HAL for an ADD STA request */
 tSirRetStatus
 limIbssAddStaRsp(
@@ -1158,19 +1252,25 @@
         return eSIR_FAILURE;
     }
 
-    pStaDs = dphLookupHashEntry(pMac, pAddStaParams->staMac, &peerIdx, &psessionEntry->dph.dphHashTable);
+    pStaDs = dphLookupHashEntry(pMac,
+                pAddStaParams->staMac, &peerIdx,
+                  &psessionEntry->dph.dphHashTable);
     if (pStaDs == NULL)
     {
-        PELOGE(limLog(pMac, LOGE, FL("IBSS: ADD_STA_RSP for unknown MAC addr "));)
-        limPrintMacAddr(pMac, pAddStaParams->staMac, LOGE);
+        limLog(pMac, LOGE,
+           FL("IBSS: ADD_STA_RSP for unknown MAC addr: "MAC_ADDRESS_STR),
+           MAC_ADDR_ARRAY(pAddStaParams->staMac));
         vos_mem_free(pAddStaParams);
         return eSIR_FAILURE;
     }
 
     if (pAddStaParams->status != eHAL_STATUS_SUCCESS)
     {
-        PELOGE(limLog(pMac, LOGE, FL("IBSS: ADD_STA_RSP error (%x) "), pAddStaParams->status);)
-        limPrintMacAddr(pMac, pAddStaParams->staMac, LOGE);
+        limLog(pMac, LOGE,
+          FL("IBSS: ADD_STA_RSP error (%x) from MAC: " MAC_ADDRESS_STR),
+          pAddStaParams->status, MAC_ADDR_ARRAY(pAddStaParams->staMac));
+        __limIbssSearchAndDeletePeer(pMac,
+                      psessionEntry, pAddStaParams->staMac);
         vos_mem_free(pAddStaParams);
         return eSIR_FAILURE;
     }
@@ -1184,10 +1284,15 @@
 
     PELOGW(limLog(pMac, LOGW, FL("IBSS: sending IBSS_NEW_PEER msg to SME!"));)
 
-    ibss_status_chg_notify(pMac, pAddStaParams->staMac, pStaDs->staIndex, 
+    ibss_status_chg_notify(pMac, pAddStaParams->staMac, pStaDs->staIndex,
                            pStaDs->ucUcastSig, pStaDs->ucBcastSig,
                            eWNI_SME_IBSS_NEW_PEER_IND,
                            psessionEntry->smeSessionId);
+
+#ifdef WLAN_FEATURE_RMC
+    limRmcTriggerRulerSelection(pMac, psessionEntry->selfMacAddr);
+#endif
+
     vos_mem_free(pAddStaParams);
 
     return eSIR_SUCCESS;
@@ -1266,8 +1371,6 @@
     ibss_coalesce_free(pMac);
 }
 
-
-
 void
 limIbssDelBssRsp(
     tpAniSirGlobal  pMac,
@@ -1353,80 +1456,6 @@
     }
 }
 
-static void
-__limIbssSearchAndDeletePeer(tpAniSirGlobal    pMac,
-                             tpPESession psessionEntry,
-                             tSirMacAddr macAddr)
-{
-   tLimIbssPeerNode *pTempNode, *pPrevNode;
-   tLimIbssPeerNode *pTempNextNode = NULL;
-   tpDphHashNode     pStaDs=NULL;
-   tANI_U16          peerIdx=0;
-   tANI_U16          staIndex=0;
-   tANI_U8           ucUcastSig;
-   tANI_U8           ucBcastSig;
-
-   pPrevNode = pTempNode  = pMac->lim.gLimIbssPeerList;
-
-   limLog(pMac, LOG1, FL(" PEER ADDR :" MAC_ADDRESS_STR ),MAC_ADDR_ARRAY(macAddr));
-
-   /** Compare Peer */
-   while (NULL != pTempNode)
-   {
-      pTempNextNode = pTempNode->next;
-
-      /* Delete the STA with MAC address */
-      if (vos_mem_compare( (tANI_U8 *) macAddr,
-               (tANI_U8 *) &pTempNode->peerMacAddr,
-               sizeof(tSirMacAddr)) )
-      {
-         pStaDs = dphLookupHashEntry(pMac, macAddr,
-               &peerIdx, &psessionEntry->dph.dphHashTable);
-         if (pStaDs)
-         {
-            staIndex = pStaDs->staIndex;
-            ucUcastSig = pStaDs->ucUcastSig;
-            ucBcastSig = pStaDs->ucBcastSig;
-
-            (void) limDelSta(pMac, pStaDs, false /*asynchronous*/, psessionEntry);
-            limDeleteDphHashEntry(pMac, pStaDs->staAddr, peerIdx, psessionEntry);
-            limReleasePeerIdx(pMac, peerIdx, psessionEntry);
-
-            /* Send indication to upper layers */
-            ibss_status_chg_notify(pMac, macAddr, staIndex,
-                                   ucUcastSig, ucBcastSig,
-                                   eWNI_SME_IBSS_PEER_DEPARTED_IND,
-                                   psessionEntry->smeSessionId );
-            if (pTempNode == pMac->lim.gLimIbssPeerList)
-            {
-               pMac->lim.gLimIbssPeerList = pTempNode->next;
-               pPrevNode = pMac->lim.gLimIbssPeerList;
-            }
-            else
-               pPrevNode->next = pTempNode->next;
-
-            vos_mem_free(pTempNode);
-            pMac->lim.gLimNumIbssPeers--;
-
-            pTempNode = pTempNextNode;
-            break;
-         }
-      }
-      pPrevNode = pTempNode;
-      pTempNode = pTempNextNode;
-   }
-   /*
-    * if it is the last peer walking out, we better
-    * we set IBSS state to inactive.
-    */
-   if (0 == pMac->lim.gLimNumIbssPeers)
-   {
-       VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
-            "Last STA from IBSS walked out");
-       psessionEntry->limIbssActive = false;
-   }
-}
-
 /**
  * limIbssCoalesce()
  *
@@ -1679,6 +1708,10 @@
                     ucUcastSig = pStaDs->ucUcastSig;
                     ucBcastSig = pStaDs->ucBcastSig;
 
+#ifdef WLAN_FEATURE_RMC
+                    limRmcTransmitterDelete(pMac, pStaDs->staAddr);
+#endif /* WLAN_FEATURE_RMC */
+
                     (void) limDelSta(pMac, pStaDs, false /*asynchronous*/,psessionEntry);
                     limDeleteDphHashEntry(pMac, pStaDs->staAddr, peerIdx,psessionEntry);
                     limReleasePeerIdx(pMac, peerIdx, psessionEntry);
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c b/wlan/prima/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c
index 1c92204..94aa90f 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c
@@ -166,7 +166,12 @@
                      return;
                  }
                  else
+                 {
+                     limSendDisassocMgmtFrame(pMac,
+                                     eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON,
+                                     pStaDs->staAddr, psessionEntry, FALSE);
                      limTriggerSTAdeletion(pMac, pStaDs, psessionEntry);
+                 }
              }
              else
              {
@@ -290,82 +295,37 @@
 void
 limTriggerSTAdeletion(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpPESession psessionEntry)
 {
-    tSirSmeDeauthReq    *pSmeDeauthReq;
-    tANI_U8             *pBuf;
-    tANI_U8             *pLen;
-    tANI_U16            msgLength = 0;
-
-    if (! pStaDs)
-    {
-        PELOGW(limLog(pMac, LOGW, FL("Skip STA deletion (invalid STA)"));)
-        return;
-    }
-    /**
-     * MAC based Authentication was used. Trigger
-     * Deauthentication frame to peer since it will
-     * take care of disassociation as well.
-     */
-
-    pSmeDeauthReq = vos_mem_malloc(sizeof(tSirSmeDeauthReq));
-    if (NULL == pSmeDeauthReq)
-    {
-        limLog(pMac, LOGP, FL("AllocateMemory failed for eWNI_SME_DEAUTH_REQ "));
-        return;
-    }
-
-    pBuf = (tANI_U8 *) &pSmeDeauthReq->messageType;
-
-    //messageType
-    limCopyU16((tANI_U8*)pBuf, eWNI_SME_DISASSOC_REQ);
-    pBuf += sizeof(tANI_U16);
-    msgLength += sizeof(tANI_U16);
-
-    //length
-    pLen = pBuf;
-    pBuf += sizeof(tANI_U16);
-    msgLength += sizeof(tANI_U16);
-
-    //sessionId
-    *pBuf = psessionEntry->smeSessionId;
-    pBuf++;
-    msgLength++;
-
-    //transactionId
-    limCopyU16((tANI_U8*)pBuf, psessionEntry->transactionId);
-    pBuf += sizeof(tANI_U16);
-    msgLength += sizeof(tANI_U16);
-
-    //bssId
-    vos_mem_copy(pBuf, psessionEntry->bssId, sizeof(tSirMacAddr));
-    pBuf += sizeof(tSirMacAddr);
-    msgLength += sizeof(tSirMacAddr);
-
-    //peerMacAddr
-    vos_mem_copy(pBuf, pStaDs->staAddr, sizeof(tSirMacAddr));
-    pBuf += sizeof(tSirMacAddr);
-    msgLength += sizeof(tSirMacAddr);
-
-    //reasonCode 
-    limCopyU16((tANI_U8*)pBuf,
-            (tANI_U16)eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON);
-    pBuf += sizeof(tANI_U16);
-    msgLength += sizeof(tANI_U16);
-
-    //Do not send disassoc OTA
-    //pBuf[0] = 1 means do not send the disassoc frame over the air
-    //pBuf[0] = 0 means send the disassoc frame over the air
-    pBuf[0]= 0;
-    pBuf += sizeof(tANI_U8);
-    msgLength += sizeof(tANI_U8);
+    tLimMlmDisassocInd mlmDisassocInd;
 
 
-  
-    //Fill in length
-    limCopyU16((tANI_U8*)pLen , msgLength);
+     if (!pStaDs)
+     {
+         PELOGW(limLog(pMac, LOGW, FL("Skip STA deletion (invalid STA)"));)
+         return;
+     }
 
-    limPostSmeMessage(pMac, eWNI_SME_DISASSOC_REQ, (tANI_U32 *) pSmeDeauthReq);
-    vos_mem_free(pSmeDeauthReq);
+     if ((pStaDs->mlmStaContext.mlmState == eLIM_MLM_WT_DEL_STA_RSP_STATE) ||
+         (pStaDs->mlmStaContext.mlmState == eLIM_MLM_WT_DEL_BSS_RSP_STATE)) {
+         /* Already in the process of deleting context for the peer */
+         PELOGE(limLog(pMac, LOGE,
+                 FL("Deletion is in progress for peer:%pM"), pStaDs->staAddr);)
+         return;
+     }
 
+     pStaDs->mlmStaContext.disassocReason =
+              eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON;
+     pStaDs->mlmStaContext.cleanupTrigger = eLIM_LINK_MONITORING_DISASSOC;
+     vos_mem_copy(&mlmDisassocInd.peerMacAddr, pStaDs->staAddr,
+                  sizeof(tSirMacAddr));
+     mlmDisassocInd.reasonCode = eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON;
+     mlmDisassocInd.disassocTrigger = eLIM_LINK_MONITORING_DISASSOC;
+
+     /* Update PE session Id  */
+     mlmDisassocInd.sessionId = psessionEntry->peSessionId;
+     limPostSmeMessage(pMac, LIM_MLM_DISASSOC_IND,
+                       (tANI_U32 *) &mlmDisassocInd);
+     // Issue Disassoc Indication to SME.
+     limSendSmeDisassocInd(pMac, pStaDs, psessionEntry);
 } /*** end limTriggerSTAdeletion() ***/
 
 
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limLogDump.c b/wlan/prima/CORE/MAC/src/pe/lim/limLogDump.c
index f0a6f45..9280c7d 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limLogDump.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limLogDump.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -57,6 +57,10 @@
 #endif
 #include "smeInside.h"
 #include "wlan_qct_wda.h"
+#ifdef WLAN_FEATURE_RMC
+#include "wlan_qct_tl.h"
+#include "limRMC.h"
+#endif
 #include "wlan_qct_wdi_dts.h"
 
 void WDA_TimerTrafficStatsInd(tWDA_CbContext *pWDA);
@@ -1208,7 +1212,7 @@
         state = (tSirMacHTMIMOPowerSaveState) arg1;
 
     pMBMsg = vos_mem_malloc(WNI_CFG_MB_HDR_LEN + sizeof(tSirMacHTMIMOPowerSaveState));
-    if(NULL == pMBMsg)
+    if (NULL == pMBMsg)
     {
         p += log_sprintf( pMac,p, "pMBMsg is NULL\n");
         return p;
@@ -1516,6 +1520,8 @@
         case 5:
             statsMask = PE_PER_STA_STATS_INFO;
             break;
+        case 6:
+            statsMask = PE_PER_TX_PKT_STATS_INFO;
         default:
             return p;
     }
@@ -2366,6 +2372,102 @@
 }
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+
+static char *
+dump_lim_enable_rmc_data_path
+(
+    tpAniSirGlobal pMac,
+    tANI_U32 arg1,
+    tANI_U32 arg2,
+    tANI_U32 arg3,
+    tANI_U32 arg4,
+    char *p
+)
+{
+    v_MACADDR_t rmcTransmitterAddr;
+    v_VOID_t * pVosContext = vos_get_global_context(VOS_MODULE_ID_WDA, NULL);
+
+    rmcTransmitterAddr.bytes[0] = (tANI_U8)((arg1 & 0xFF000000) >> 24);
+    rmcTransmitterAddr.bytes[1] = (tANI_U8)((arg1 & 0x00FF0000) >> 16);
+    rmcTransmitterAddr.bytes[2] = (tANI_U8)((arg1 & 0x0000FF00) >>  8);
+    rmcTransmitterAddr.bytes[3] = (tANI_U8)((arg1 & 0x000000FF));
+    rmcTransmitterAddr.bytes[4] = (tANI_U8)((arg2 & 0xFF000000) >> 24);
+    rmcTransmitterAddr.bytes[5] = (tANI_U8)((arg2 & 0x00FF0000) >> 16);
+
+    limLog(pMac, LOGE,
+        FL("Enable RMC data path for MCAST transmitter:" MAC_ADDRESS_STR),
+        MAC_ADDR_ARRAY( rmcTransmitterAddr.bytes));
+
+    /*Input format is in MAC address fromat for example
+      iwpriv wlan0 dump 0xaabbccdd 0xeeff0000 translates into enable RMC for
+      MAC address 0xaa:0xbb:0xcc:0xdd:0xee:0xff*/
+
+    /*Enable TL data path*/
+    WLANTL_EnableRMC( pVosContext, &rmcTransmitterAddr );
+
+  return p;
+}
+
+static char *
+dump_lim_disable_rmc_data_path
+(
+    tpAniSirGlobal pMac,
+    tANI_U32 arg1,
+    tANI_U32 arg2,
+    tANI_U32 arg3,
+    tANI_U32 arg4,
+    char *p
+)
+{
+    v_MACADDR_t rmcTransmitterAddr;
+    v_VOID_t * pVosContext = vos_get_global_context(VOS_MODULE_ID_WDA, NULL);
+
+    rmcTransmitterAddr.bytes[0] = (tANI_U8)((arg1 & 0xFF000000) >> 24);
+    rmcTransmitterAddr.bytes[1] = (tANI_U8)((arg1 & 0x00FF0000) >> 16);
+    rmcTransmitterAddr.bytes[2] = (tANI_U8)((arg1 & 0x0000FF00) >>  8);
+    rmcTransmitterAddr.bytes[3] = (tANI_U8)((arg1 & 0x000000FF));
+    rmcTransmitterAddr.bytes[4] = (tANI_U8)((arg2 & 0xFF000000) >> 24);
+    rmcTransmitterAddr.bytes[5] = (tANI_U8)((arg2 & 0x00FF0000) >> 16);
+
+
+    limLog(pMac, LOGE,
+        FL("Disable RMC data path for MCAST transmitter:" MAC_ADDRESS_STR),
+        MAC_ADDR_ARRAY( rmcTransmitterAddr.bytes));
+
+    /*Input format is in MAC address fromat for example
+      iwpriv wlan0 dump 0xaabbccdd 0xeeff0000 translates into enable RMC for
+      MAC address 0xaa:0xbb:0xcc:0xdd:0xee:0xff*/
+
+    /*Disable TL data path*/
+    WLANTL_DisableRMC( pVosContext, &rmcTransmitterAddr );
+
+    return p;
+}
+
+static char *
+dump_lim_rmc_status(tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2,
+             tANI_U32 arg3, tANI_U32 arg4, char *p)
+{
+    limRmcDumpStatus(pMac);
+    return p;
+}
+
+static char *
+dump_set_mcast_dup_detect(tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2,
+             tANI_U32 arg3, tANI_U32 arg4, char *p)
+{
+    v_VOID_t * pVosContext = vos_get_global_context(VOS_MODULE_ID_WDA, NULL);
+    v_U8_t enable;
+
+    enable = (tANI_U8)arg1;
+
+    /* Enable or Disable Multicast Duplicate Detection */
+    WLANTL_SetMcastDuplicateDetection( pVosContext, enable);
+
+    return p;
+}
+#endif /* WLAN_FEATURE_RMC */
 
 static char *
 dump_set_max_probe_req(tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2,
@@ -2465,7 +2567,17 @@
     {369,   "PE.LIM: pkts/rateIdx: iwpriv wlan0 dump 368 <staId> <boolean to flush counter>",    dump_lim_get_pkts_rcvd_per_rate_idx},
     {370,   "PE.LIM: pkts/rssi: : iwpriv wlan0 dump 369 <staId> <boolean to flush counter>",    dump_lim_get_pkts_rcvd_per_rssi_values},
 #endif
+#ifdef WLAN_FEATURE_RMC
+    {371,   "PE.LIM: Enable RMC data path in TL for input MCAST addr",
+        dump_lim_enable_rmc_data_path },
+    {372,   "PE.LIM: Disable RMC data path in TL for input MCAST addr",
+        dump_lim_disable_rmc_data_path },
+    {373,   "PE.LIM: Dump RMC transmitter and ruler status", dump_lim_rmc_status },
+#endif /* WLAN_FEATURE_RMC */
     {374,   "PE.LIM: MAS RX stats MAC eff <MAC eff in percentage>",  dump_limRateInfoBasedOnMacEff},
+#ifdef WLAN_FEATURE_RMC
+    {375,   "PE.LIM: Enable(1)/Disable(0) RMC duplicate detection", dump_set_mcast_dup_detect },
+#endif /* WLAN_FEATURE_RMC */
     {376,   "PE.LIM: max number of probe per scan", dump_set_max_probe_req },
 };
 
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limP2P.c b/wlan/prima/CORE/MAC/src/pe/lim/limP2P.c
index 04028f0..d3028fe 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limP2P.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limP2P.c
@@ -342,7 +342,8 @@
         }
         /* Store PE sessionId in session Table  */
         psessionEntry->peSessionId = sessionId;
-
+        /* Store SME session Id in sessionTable */
+        psessionEntry->smeSessionId = pMac->lim.gpLimRemainOnChanReq->sessionId;
         psessionEntry->limSystemRole = eLIM_P2P_DEVICE_ROLE;
         CFG_GET_STR( nSirStatus, pMac,  WNI_CFG_SUPPORTED_RATES_11A,
                psessionEntry->rateSet.rate, val , SIR_MAC_MAX_NUMBER_OF_RATES );
@@ -1167,6 +1168,7 @@
 
 #ifdef WLAN_FEATURE_11W
     pActionHdr = (tpSirMacActionFrameHdr) (pFrame + sizeof(tSirMacMgmtHdr));
+    pMacHdr = (tpSirMacMgmtHdr)pFrame;
 
     /*
      * Setting Protected bit only for Robust Action Frames
@@ -1175,29 +1177,10 @@
      */
     if ((SIR_MAC_MGMT_ACTION == pFc->subType) &&
         psessionEntry->limRmfEnabled && (!limIsGroupAddr(pMacHdr->da)) &&
-        lim_is_robust_mgmt_action_frame(pActionHdr->category))
-    {
-        pMacHdr = (tpSirMacMgmtHdr)pFrame;
+        lim_is_robust_mgmt_action_frame(pActionHdr->category)) {
         /* All psession checks are already done at start */
         limSetProtectedBit(pMac, psessionEntry, pMacHdr->da, pMacHdr);
 
-        /*
-         * If wep bit is not set in MAC header of robust management action frame
-         * then we are trying to send RMF via non PMF connection.
-         * Drop the packet instead of sending malform packet.
-         */
-        if (0 ==  pMacHdr->fc.wep)
-        {
-            limLog(pMac, LOGE,
-                FL("Drop action frame with category[%d] due to non-PMF conn"),
-                pActionHdr->category);
-            limSendSmeRsp(pMac, eWNI_SME_ACTION_FRAME_SEND_CNF,
-                    eHAL_STATUS_FAILURE, pMbMsg->sessionId, 0);
-            palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
-                    ( void* ) pFrame, ( void* ) pPacket );
-            return;
-        }
-
     }
 #endif
 
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessActionFrame.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessActionFrame.c
index bff5151..ab54e41 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessActionFrame.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessActionFrame.c
@@ -59,6 +59,9 @@
 #include "rrmApi.h"
 #endif
 #include "limSessionUtils.h"
+#ifdef WLAN_FEATURE_RMC
+#include "limRMC.h"
+#endif
 
 #if defined(FEATURE_WLAN_ESE) && !defined(FEATURE_WLAN_ESE_UPLOAD)
 #include "eseApi.h"
@@ -175,6 +178,11 @@
        limLog(pMac, LOGW, FL("Ignoring channel switch on session %d"), psessionEntry->peSessionId);
        return eSIR_SUCCESS;
     }
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_CHANNEL_SWITCH_ANOUNCEMENT,
+                       psessionEntry, eSIR_SUCCESS, LIM_SWITCH_CHANNEL_CSA);
+#endif
+
     psessionEntry->channelChangeCSA =  LIM_SWITCH_CHANNEL_CSA;
     /* Deactivate and change reconfigure the timeout value */
     //limDeactivateAndChangeTimer(pMac, eLIM_CHANNEL_SWITCH_TIMER);
@@ -1312,8 +1320,8 @@
     if (!(IS_HWSTA_IDX(pSta->staIndex)))
     {
         status = eSIR_MAC_REQ_DECLINED_STATUS;
-        limLog( pMac, LOGE,
-            FL( "Sta Id is not HW Sta Id, Status code is %d " ), status);
+        limLog( pMac, LOG1,
+            FL( "ta Id is not HW Sta Id, Status code is %d " ), status);
         goto returnAfterError;
     }
 #endif //WLAN_SOFTAP_VSTA_FEATURE
@@ -1524,7 +1532,8 @@
   if(eSIR_SUCCESS != limSearchAndDeleteDialogueToken(pMac, frmAddBARsp.DialogToken.token,
         pSta->assocId, frmAddBARsp.AddBAParameterSet.tid))
   {
-      PELOGW(limLog(pMac, LOGE, FL("dialogueToken in received addBARsp did not match with outstanding requests"));)
+      limLog(pMac, LOGE,
+        FL("dialogueToken in received addBARsp did not match with outstanding requests"));
       return;
   }
 
@@ -1532,6 +1541,10 @@
   if( eSIR_MAC_SUCCESS_STATUS == frmAddBARsp.Status.status )
   {
     tANI_U32 val;
+    pMac->lim.staBaInfo[pSta->staIndex].
+        failed_count[frmAddBARsp.AddBAParameterSet.tid] = 0;
+    pMac->lim.staBaInfo[pSta->staIndex].
+        failed_timestamp[frmAddBARsp.AddBAParameterSet.tid] = 0;
     if (wlan_cfgGetInt(pMac, WNI_CFG_NUM_BUFF_ADVERT , &val) != eSIR_SUCCESS)
     {
         limLog(pMac, LOG1, FL("Unable to get WNI_CFG_NUM_BUFF_ADVERT"));
@@ -1558,8 +1571,13 @@
     }
   }
   else
+  {
+    pMac->lim.staBaInfo[pSta->staIndex].
+       failed_count[frmAddBARsp.AddBAParameterSet.tid]++;
+    pMac->lim.staBaInfo[pSta->staIndex].failed_timestamp[
+       frmAddBARsp.AddBAParameterSet.tid] = jiffies_to_msecs(jiffies);
     goto returnAfterError;
-
+  }
   // Change STA state to wait for ADDBA Rsp from HAL
   LIM_SET_STA_BA_STATE(pSta, frmAddBARsp.AddBAParameterSet.tid, eLIM_BA_STATE_WT_ADD_RSP);
 
@@ -2260,6 +2278,12 @@
 
     switch (pActionHdr->category)
     {
+
+        /*
+         * WARNING: If you add Action frame category case here, set the
+         * corresponding bit to 1 in sme_set_allowed_action_frames() for
+         * the FW to hand over that frame to host without dropping itself
+         */
         case SIR_MAC_ACTION_QOS_MGMT:
             if ( (psessionEntry->limQosEnabled) ||
                   (pActionHdr->actionID == SIR_MAC_QOS_MAP_CONFIGURE) )
@@ -2422,7 +2446,9 @@
     }
 #if defined WLAN_FEATURE_VOWIFI
     case SIR_MAC_ACTION_RRM:
-        if( pMac->rrm.rrmPEContext.rrmEnable )
+        /* Ignore RRM measurement request until DHCP is set */
+        if(pMac->rrm.rrmPEContext.rrmEnable &&
+           pMac->roam.roamSession[psessionEntry->smeSessionId].dhcp_done)
         {
             switch(pActionHdr->actionID) {
                 case SIR_MAC_RRM_RADIO_MEASURE_REQ:
@@ -2445,11 +2471,14 @@
         {
             // Else we will just ignore the RRM messages.
             limLog( pMac, LOG1,
-              FL("RRM Action frame ignored as RRM is disabled in cfg"));
+              FL("RRM Action frame ignored as rrmEnable is %d or DHCP not completed %d"),
+              pMac->rrm.rrmPEContext.rrmEnable,
+              pMac->roam.roamSession[psessionEntry->smeSessionId].dhcp_done);
         }
         break;
 #endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR) \
+    || defined (WLAN_FEATURE_RMC)
         case SIR_MAC_ACTION_VENDOR_SPECIFIC_CATEGORY:
             {
               tpSirMacVendorSpecificFrameHdr pVendorSpecific = (tpSirMacVendorSpecificFrameHdr) pActionHdr;
@@ -2473,6 +2502,57 @@
                                          pRxPacketInfo,
                                          psessionEntry, 0);
               }
+#if defined (WLAN_FEATURE_RMC)
+              else if ((eLIM_STA_IN_IBSS_ROLE == psessionEntry->limSystemRole) &&
+                  ((VOS_TRUE == vos_mem_compare(SIR_MAC_RMC_MCAST_ADDRESS,
+                    &pHdr->da[0], sizeof(tSirMacAddr))) ||
+                   (VOS_TRUE == vos_mem_compare(psessionEntry->selfMacAddr,
+                     &pHdr->da[0], sizeof(tSirMacAddr)))) &&
+                   vos_mem_compare(pVendorSpecific->Oui, SIR_MAC_RMC_OUI, 3))
+              {
+                  tANI_U8 MagicCode[] =
+                         { 0x4f, 0x58, 0x59, 0x47, 0x45, 0x4e };
+                  tpSirMacIbssExtNetworkFrameHdr pIbssExtHdr =
+                             (tpSirMacIbssExtNetworkFrameHdr) pActionHdr;
+
+                  if (vos_mem_compare(pIbssExtHdr->MagicCode,
+                      MagicCode, sizeof(MagicCode)) &&
+                      pIbssExtHdr->version == SIR_MAC_RMC_VER )
+                  {
+                      switch (pIbssExtHdr->actionID)
+                      {
+                          default:
+                              PELOGE(limLog(pMac, LOGE,
+                                 FL("Action RMC actionID %d not handled"),
+                                     pIbssExtHdr->actionID);)
+                              break;
+                          case SIR_MAC_RMC_RULER_INFORM_SELECTED:
+                              limLog(pMac, LOG1,
+                                 FL("Action RMC RULER_INFORM_SELECTED."));
+                              limProcessRMCMessages(pMac,
+                                 eLIM_RMC_OTA_RULER_INFORM_SELECTED,
+                                 (tANI_U32 *)pRxPacketInfo);
+                              break;
+                          case SIR_MAC_RMC_RULER_INFORM_CANCELLED:
+                              limLog(pMac, LOG1,
+                                 FL("Action RMC RULER_INFORM_CANCELLED."));
+                              limProcessRMCMessages(pMac,
+                                 eLIM_RMC_OTA_RULER_INFORM_CANCELLED,
+                                 (tANI_U32 *)pRxPacketInfo);
+                              break;
+                      }
+                  }
+                  else
+                  {
+                      limLog( pMac, LOG1,
+                         FL("Dropping the vendor specific action frame in IBSS "
+                             "mode because of Ibss Ext Magic mismatch "
+                             MAC_ADDRESS_STR " or Version mismatch = %d"),
+                             MAC_ADDR_ARRAY(pIbssExtHdr->MagicCode),
+                             pIbssExtHdr->version );
+                  }
+              }
+#endif /* WLAN_FEATURE_RMC */
               else
               {
                  limLog( pMac, LOG1,
@@ -2486,7 +2566,8 @@
               }
            }
            break;
-#endif
+#endif /* WLAN_FEATURE_VOWIFI_11R || FEATURE_WLAN_ESE ||
+          FEATURE_WLAN_LFR || WLAN_FEATURE_RMC */
     case SIR_MAC_ACTION_PUBLIC_USAGE:
         switch(pActionHdr->actionID) {
         case SIR_MAC_ACTION_VENDOR_SPECIFIC:
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 5728b30..66eef4a 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -1645,6 +1645,9 @@
         pMlmAssocInd->beaconPtr = psessionEntry->beacon;
         pMlmAssocInd->beaconLength = psessionEntry->bcnLen;
 
+        pMlmAssocInd->rate_flags =
+            limGetMaxRateFlags(pStaDs, psessionEntry);
+
         limPostSmeMessage(pMac, LIM_MLM_ASSOC_IND, (tANI_U32 *) pMlmAssocInd);
         vos_mem_free(pMlmAssocInd);
     }
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c
index efee182..fb8d7e4 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -85,6 +85,8 @@
     //tpSirBoardCapabilities pBoardCaps;
     tANI_BOOLEAN    qosMode; 
     tANI_U16        rxHighestRate = 0;
+    uint32_t        shortgi_20mhz_support;
+    uint32_t        shortgi_40mhz_support;
 
     limGetPhyMode(pMac, &phyMode, psessionEntry);
 
@@ -131,8 +133,6 @@
                    pStaDs->htMaxAmsduLength = ( tANI_U8 ) pAssocRsp->HTCaps.maximalAMSDUsize;
                    pStaDs->htAMpduDensity =             pAssocRsp->HTCaps.mpduDensity;
                    pStaDs->htDsssCckRate40MHzSupport = (tANI_U8)pAssocRsp->HTCaps.dsssCckMode40MHz;
-                   pStaDs->htShortGI20Mhz = (tANI_U8)pAssocRsp->HTCaps.shortGI20MHz;
-                   pStaDs->htShortGI40Mhz = (tANI_U8)pAssocRsp->HTCaps.shortGI40MHz;
                    pStaDs->htMaxRxAMpduFactor = pAssocRsp->HTCaps.maxRxAMPDUFactor;
                    limFillRxHighestSupportedRate(pMac, &rxHighestRate, pAssocRsp->HTCaps.supportedMCSSet);
                    pStaDs->supportedRates.rxHighestDataRate = rxHighestRate;
@@ -143,6 +143,41 @@
                    // In the future, may need to check for "assoc.HTCaps.delayedBA"
                    // For now, it is IMMEDIATE BA only on ALL TID's
                    pStaDs->baPolicyFlag = 0xFF;
+
+                   /*
+                    * Check if we have support for gShortGI20Mhz and
+                    * gShortGI40Mhz from ini file.
+                    */
+                   if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac,
+                                   WNI_CFG_SHORT_GI_20MHZ,
+                                   &shortgi_20mhz_support))) {
+                       if (VOS_TRUE == shortgi_20mhz_support)
+                           pStaDs->htShortGI20Mhz =
+                               (tANI_U8)pAssocRsp->HTCaps.shortGI20MHz;
+                       else
+                           pStaDs->htShortGI20Mhz = VOS_FALSE;
+                   } else {
+                       limLog(pMac, LOGE,
+                          FL("could not retrieve shortGI 20Mhz CFG,"
+                             "setting value to default"));
+                       pStaDs->htShortGI20Mhz = WNI_CFG_SHORT_GI_20MHZ_STADEF;
+                   }
+
+                   if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac,
+                                   WNI_CFG_SHORT_GI_40MHZ,
+                                   &shortgi_40mhz_support))) {
+                       if (VOS_TRUE == shortgi_40mhz_support)
+                           pStaDs->htShortGI40Mhz =
+                               (tANI_U8)pAssocRsp->HTCaps.shortGI40MHz;
+                       else
+                           pStaDs->htShortGI40Mhz = VOS_FALSE;
+                   } else {
+                       limLog(pMac, LOGE,
+                               FL("could not retrieve shortGI 40Mhz CFG,"
+                                   "setting value to default"));
+                       pStaDs->htShortGI40Mhz = WNI_CFG_SHORT_GI_40MHZ_STADEF;
+                   }
+
            }
        }
 
@@ -469,7 +504,8 @@
     }
     if(pAssocRsp->ExtCap.present)
     {
-        limLog(pMac, LOGE, FL("Filling tdls prohibited in session entry"));
+        limLog(pMac, LOG1,
+            FL("Filling tdls prohibited in session entry"));
         psessionEntry->tdlsChanSwitProhibited =
                        pAssocRsp->ExtCap.TDLSChanSwitProhibited ;
     }
@@ -675,6 +711,10 @@
     {
         // Log success
         limLog(pMac, LOG1, FL("Successfully Reassociated with BSS"));
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+        limDiagEventReport(pMac, WLAN_PE_DIAG_ROAM_ASSOC_COMP_EVENT,
+            psessionEntry, eSIR_SUCCESS, eSIR_SUCCESS);
+#endif
 #ifdef FEATURE_WLAN_ESE
         {
             tANI_U8 cnt = 0;
@@ -849,9 +889,12 @@
         else
             psessionEntry->beaconParams.fShortPreamble = true;
     }
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
-    limDiagEventReport(pMac, WLAN_PE_DIAG_CONNECTED, psessionEntry, 0, 0);
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_CONNECTED, psessionEntry,
+                       eSIR_SUCCESS, eSIR_SUCCESS);
 #endif
+
     if(pAssocRsp->OBSSScanParameters.present)
     {
         limUpdateOBSSScanParams(psessionEntry , &pAssocRsp->OBSSScanParameters);
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessAuthFrame.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
index 2adcf9e..09bb745 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
@@ -578,6 +578,19 @@
            (tANI_U32) pRxAuthFrameBody->authTransactionSeqNumber,
            (tANI_U32) pRxAuthFrameBody->authStatusCode,(tANI_U32)pMac->lim.gLimNumPreAuthContexts);)
 
+    // IOT Workaround: with invalid WEP password, some APs reply AUTH frame 4
+    // with invalid seqNumber. This AUTH frame will be dropped by driver,
+    // thus driver sends the generic status code instead of protocol status code.
+    // As a workaround, assign the correct seqNumber for the AUTH frame 4.
+    if (psessionEntry->limMlmState == eLIM_MLM_WT_AUTH_FRAME4_STATE &&
+        pRxAuthFrameBody->authTransactionSeqNumber != SIR_MAC_AUTH_FRAME_1 &&
+        pRxAuthFrameBody->authTransactionSeqNumber != SIR_MAC_AUTH_FRAME_2 &&
+        pRxAuthFrameBody->authTransactionSeqNumber != SIR_MAC_AUTH_FRAME_3) {
+        PELOGE(limLog(pMac, LOGE, FL("Workaround: Assign a correct seqNumber=4 "
+                "for AUTH frame 4"));)
+        pRxAuthFrameBody->authTransactionSeqNumber = SIR_MAC_AUTH_FRAME_4;
+    }
+
     switch (pRxAuthFrameBody->authTransactionSeqNumber)
     {
         case SIR_MAC_AUTH_FRAME_1:
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c
index de765b2..6e1b64f 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c
@@ -155,10 +155,15 @@
         if ((pMac->lim.gLimMlmState  == eLIM_MLM_WT_PROBE_RESP_STATE) ||
             (pMac->lim.gLimMlmState  == eLIM_MLM_PASSIVE_SCAN_STATE))
         {
-            limCheckAndAddBssDescription(pMac, pBeacon, pRxPacketInfo,
-                  ((pMac->lim.gLimHalScanState == eLIM_HAL_SCANNING_STATE) ?
-                    eANI_BOOLEAN_TRUE : eANI_BOOLEAN_FALSE),
-                    eANI_BOOLEAN_FALSE);
+            //If we are scanning for P2P, only accept probe rsp
+            if((pMac->lim.gLimHalScanState != eLIM_HAL_SCANNING_STATE) || (NULL == pMac->lim.gpLimMlmScanReq)
+               || !pMac->lim.gpLimMlmScanReq->p2pSearch )
+            {
+                limCheckAndAddBssDescription(pMac, pBeacon, pRxPacketInfo,
+                       ((pMac->lim.gLimHalScanState == eLIM_HAL_SCANNING_STATE) ? eANI_BOOLEAN_TRUE : eANI_BOOLEAN_FALSE),
+                       eANI_BOOLEAN_FALSE);
+
+            }
             /* Calling dfsChannelList which will convert DFS channel
              * to Active channel for x secs if this channel is DFS channel */
              limSetDFSChannelList(pMac, pBeacon->channelNumber,
@@ -283,8 +288,12 @@
         if ( (pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) ||
              (pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE) )
         {
-            limCheckAndAddBssDescription(pMac, pBeacon, pRxPacketInfo,
-                                         eANI_BOOLEAN_TRUE, eANI_BOOLEAN_FALSE);
+            //If we are scanning for P2P, only accept probe rsp
+            if((pMac->lim.gLimHalScanState != eLIM_HAL_SCANNING_STATE) || (NULL == pMac->lim.gpLimMlmScanReq)
+               || !pMac->lim.gpLimMlmScanReq->p2pSearch )
+            {
+                limCheckAndAddBssDescription(pMac, pBeacon, pRxPacketInfo, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_FALSE);
+            }
             /* Calling dfsChannelList which will convert DFS channel
              * to Active channel for x secs if this channel is DFS channel */
             limSetDFSChannelList(pMac, pBeacon->channelNumber,
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
index 32e15b2..6483854 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -229,6 +229,7 @@
             case eSIR_MAC_RSN_IE_MISMATCH_REASON:
             case eSIR_MAC_1X_AUTH_FAILURE_REASON:
             case eSIR_MAC_PREV_AUTH_NOT_VALID_REASON:
+            case eSIR_MAC_PEER_REJECT_MECHANISIM_REASON:
                 // Valid reasonCode in received Disassociation frame
                 break;
 
@@ -252,7 +253,7 @@
                        FL("received Disassoc frame with invalid reasonCode "
                        "%d from "MAC_ADDRESS_STR), reasonCode,
                        MAC_ADDR_ARRAY(pHdr->sa));)
-                return;
+                break;
         }
     }
     else
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index 62c1b81..d7cb4b1 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -75,6 +75,10 @@
 #include "wmmApsd.h"
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+#include "limRMC.h"
+#endif
+
 #include "vos_types.h"
 #include "vos_packet.h"
 #include "vos_memory.h"
@@ -86,6 +90,8 @@
 #define  SIZE_OF_FIXED_PARAM 12
 #endif
 
+#define CHECK_BIT(value, mask)    ((value) & (1 << (mask)))
+
 void limLogSessionStates(tpAniSirGlobal pMac);
 
 /** -------------------------------------------------------------
@@ -645,7 +651,7 @@
         tEXTScanFullScanResult.ap.capability =
                             *(((tANI_U16 *)&pProbeResponse->Capabilities));
 
-        vos_mem_free(pBeacon);
+        vos_mem_free(pProbeResponse);
     }
     else
     {
@@ -695,6 +701,7 @@
  */
 
 static void 
+
 limHandle80211Frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, tANI_U8 *pDeferMsg)
 {
     tANI_U8          *pRxPacketInfo = NULL;
@@ -734,14 +741,63 @@
         if ((fc.type == SIR_MAC_MGMT_FRAME) &&
                 (fc.subType != SIR_MAC_MGMT_BEACON))
         {
-            limLog(pMac, LOG1, FL("RX MGMT - Type %hu, SubType %hu, Seq.no %d"),
-                    fc.type, fc.subType,
-                    ((pHdr->seqControl.seqNumHi << 4) | (pHdr->seqControl.seqNumLo)));
+            limLog(pMac, LOG1, FL("RX MGMT - Type %hu, SubType %hu,"
+                                  "Seq.no %d, Source mac-addr "
+                                  MAC_ADDRESS_STR), fc.type, fc.subType,
+                                  ((pHdr->seqControl.seqNumHi << 4) |
+                                   (pHdr->seqControl.seqNumLo)),
+                                  MAC_ADDR_ARRAY(pHdr->sa));
         }
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-    if ( WDA_GET_ROAMCANDIDATEIND(pRxPacketInfo))
+    if (WDA_GET_ROAMCANDIDATEIND(pRxPacketInfo))
     {
-        limLog( pMac, LOG2, FL("Notify SME with candidate ind"));
+        limLog( pMac, LOGW, FL("Notify SME with candidate ind"));
+
+        if (WDA_IF_PER_ROAMCANDIDATEIND(pRxPacketInfo) &&
+            IS_FEATURE_SUPPORTED_BY_FW(PER_BASED_ROAMING) &&
+            pMac->roam.configParam.isPERRoamEnabled)
+        {
+            tSirPerRoamScanResult *candidateChanInfo =
+                (tSirPerRoamScanResult *)WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
+            int chanInfoLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo)
+                                      - sizeof(tANI_U32);
+
+            /* Translate network buffer into system buffer */
+            vos_buff_to_hl_buff((v_U8_t *)candidateChanInfo,
+                          WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo));
+
+            /* Max candidates allowed */
+            if (candidateChanInfo->candidateCount > SIR_PER_ROAM_MAX_AP_CNT)
+            {
+                limLog(pMac, LOGE,
+                       FL("Got maximum candidates as %d setting default"),
+                       candidateChanInfo->candidateCount);
+                candidateChanInfo->candidateCount = SIR_PER_ROAM_MAX_AP_CNT;
+            }
+
+            vos_mem_set(&pMac->candidateChannelInfo,
+                        sizeof(tSirCandidateChanInfo) *
+                        SIR_PER_ROAM_MAX_CANDIDATE_CNT, 0);
+
+            vos_mem_copy(&pMac->candidateChannelInfo,
+                         candidateChanInfo->channelInfo,
+                         (sizeof(tSirCandidateChanInfo) *
+                         SIR_PER_ROAM_MAX_CANDIDATE_CNT) < chanInfoLen ?
+                         (sizeof(tSirCandidateChanInfo) *
+                         SIR_PER_ROAM_MAX_CANDIDATE_CNT):
+                         chanInfoLen);
+
+            limLog(pMac, LOG1,
+                   FL("PER based Roam candidates %d"),
+                   candidateChanInfo->candidateCount);
+
+            pMac->PERroamCandidatesCnt = candidateChanInfo->candidateCount;
+        } else
+        {
+            /* Normal RSSI based roaming */
+            pMac->PERroamCandidatesCnt = 0;
+        }
+
         //send a session 0 for now - TBD
         limSendSmeCandidateFoundInd(pMac, 0);
         goto end;
@@ -1604,6 +1660,17 @@
             limMsg->bodyptr = NULL;
             break;
 
+#ifdef WLAN_FEATURE_RMC
+        case eWNI_SME_ENABLE_RMC_REQ:
+        case eWNI_SME_DISABLE_RMC_REQ:
+            /*
+             * These messages are from HDD
+             * No need to response to hdd
+             */
+            limProcessSmeReqMessages(pMac,limMsg);
+            break;
+#endif /* WLAN_FEATURE_RMC */
+
         case SIR_HAL_P2P_NOA_START_IND:
         {
             tpPESession psessionEntry = &pMac->lim.gpSession[0];
@@ -2095,8 +2162,11 @@
         {
 #ifdef WLAN_ACTIVEMODE_OFFLOAD_FEATURE
             tpPESession     psessionEntry;
-            tANI_U8 sessionId = (tANI_U8)limMsg->bodyval ;
-            psessionEntry = &pMac->lim.gpSession[sessionId];
+            tANI_U8 sessionId;
+            tSirSetActiveModeSetBncFilterReq *bcnFilterReq =
+                (tSirSetActiveModeSetBncFilterReq *)limMsg->bodyptr;
+            psessionEntry = peFindSessionByBssid(pMac, bcnFilterReq->bssid,
+                                                 &sessionId);
             if(psessionEntry != NULL && IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE)
             {
                // sending beacon filtering information down to HAL
@@ -2152,17 +2222,22 @@
     case eWNI_SME_HT40_STOP_OBSS_SCAN_IND:
         {
            tpPESession     psessionEntry = NULL;
-           tANI_U8 sessionId = (tANI_U8)limMsg->bodyval ;
+           tANI_U8 sessionId;
+           tSirSmeHT40OBSSStopScanInd *ht40StopScanInd =
+               (tSirSmeHT40OBSSStopScanInd *)limMsg->bodyptr;
 
-           psessionEntry = &pMac->lim.gpSession[sessionId];
+           psessionEntry = peFindSessionByBssid(pMac,
+                   ht40StopScanInd->bssid, &sessionId);;
            /* Sending LIM STOP OBSS SCAN Indication
                      Stop command support is only for debugging purpose */
-           if ( IS_HT40_OBSS_SCAN_FEATURE_ENABLE )
+           if (psessionEntry && IS_HT40_OBSS_SCAN_FEATURE_ENABLE)
               limSendHT40OBSSStopScanInd(pMac, psessionEntry);
            else
               VOS_TRACE(VOS_MODULE_ID_PE,VOS_TRACE_LEVEL_ERROR,
                    "OBSS Scan Stop not started ");
         }
+        vos_mem_free(limMsg->bodyptr);
+        limMsg->bodyptr = NULL;
         break;
 #ifdef WLAN_FEATURE_AP_HT40_24G
     case eWNI_SME_SET_HT_2040_MODE:
@@ -2177,6 +2252,8 @@
         {
             tpPESession     psessionEntry;
             tANI_U8         sessionId;
+            tDphHashNode   *pStaDs = NULL;
+            int i, aid;
             tTdlsLinkEstablishParams *pTdlsLinkEstablishParams;
             pTdlsLinkEstablishParams = (tTdlsLinkEstablishParams*) limMsg->bodyptr;
 
@@ -2196,10 +2273,32 @@
             }
             else
             {
-                limSendSmeTdlsLinkEstablishReqRsp(pMac,
+                for (i = 0;
+                     i < sizeof(psessionEntry->peerAIDBitmap)/sizeof(tANI_U32);
+                                                                i++) {
+                    for (aid = 0; aid < (sizeof(tANI_U32) << 3); aid++) {
+                        if (CHECK_BIT(psessionEntry->peerAIDBitmap[i], aid)) {
+                            pStaDs = dphGetHashEntry(pMac,
+                                           (aid + i*(sizeof(tANI_U32) << 3)),
+                                            &psessionEntry->dph.dphHashTable);
+                              if ((NULL != pStaDs) &&
+                                   (pTdlsLinkEstablishParams->staIdx ==
+                                                       pStaDs->staIndex))
+                                  goto send_link_resp;
+                        }
+                    }
+                }
+send_link_resp:
+                if (pStaDs)
+                   limSendSmeTdlsLinkEstablishReqRsp(pMac,
                                                   psessionEntry->smeSessionId,
-                                                  NULL,
-                                                  NULL,
+                                                  pStaDs->staAddr,
+                                                  pStaDs,
+                                                  pTdlsLinkEstablishParams->status) ;
+                else
+                   limSendSmeTdlsLinkEstablishReqRsp(pMac,
+                                                  psessionEntry->smeSessionId,
+                                                  NULL, NULL,
                                                   pTdlsLinkEstablishParams->status) ;
             }
             vos_mem_free((v_VOID_t *)(limMsg->bodyptr));
@@ -2211,6 +2310,8 @@
         {
             tpPESession     psessionEntry;
             tANI_U8         sessionId;
+            tDphHashNode   *pStaDs = NULL;
+            int i, aid;
             tTdlsChanSwitchParams *pTdlsChanSwitchParams;
             pTdlsChanSwitchParams = (tTdlsChanSwitchParams*) limMsg->bodyptr;
 
@@ -2230,11 +2331,33 @@
             }
             else
             {
-                limSendSmeTdlsChanSwitchReqRsp(pMac,
+                for (i = 0;
+                     i < sizeof(psessionEntry->peerAIDBitmap)/sizeof(tANI_U32);
+                                                                i++) {
+                    for (aid = 0; aid < (sizeof(tANI_U32) << 3); aid++) {
+                        if (CHECK_BIT(psessionEntry->peerAIDBitmap[i], aid)) {
+                            pStaDs = dphGetHashEntry(pMac,
+                                           (aid + i*(sizeof(tANI_U32) << 3)),
+                                            &psessionEntry->dph.dphHashTable);
+                              if ((NULL != pStaDs) &&
+                                   (pTdlsChanSwitchParams->staIdx ==
+                                                       pStaDs->staIndex))
+                                  goto send_chan_switch_resp;
+                        }
+                    }
+                }
+send_chan_switch_resp:
+                if (pStaDs)
+                    limSendSmeTdlsChanSwitchReqRsp(pMac,
                                                   psessionEntry->smeSessionId,
-                                                  NULL,
-                                                  NULL,
-                                                  pTdlsChanSwitchParams->status) ;
+                                                  pStaDs->staAddr,
+                                                  pStaDs,
+                                                  pTdlsChanSwitchParams->status);
+               else
+                    limSendSmeTdlsChanSwitchReqRsp(pMac,
+                                                  psessionEntry->smeSessionId,
+                                                  NULL, NULL,
+                                                  pTdlsChanSwitchParams->status);
             }
             vos_mem_free((v_VOID_t *)(limMsg->bodyptr));
             limMsg->bodyptr = NULL;
@@ -2253,6 +2376,28 @@
        limMsg->bodyptr = NULL;
        break;
     }
+#ifdef WLAN_FEATURE_RMC
+    case WDA_RMC_BECOME_RULER:
+        limProcessRMCMessages(pMac, eLIM_RMC_BECOME_RULER_RESP,
+                          (void *)limMsg->bodyptr);
+        vos_mem_free((v_VOID_t*)limMsg->bodyptr);
+        limMsg->bodyptr = NULL;
+        break ;
+
+    case WDA_RMC_RULER_SELECT_RESP:
+        limProcessRMCMessages(pMac, eLIM_RMC_RULER_SELECT_RESP,
+                          (void *)limMsg->bodyptr);
+        vos_mem_free((v_VOID_t*)limMsg->bodyptr);
+        limMsg->bodyptr = NULL;
+        break ;
+
+    case WDA_RMC_UPDATE_IND:
+        limProcessRMCMessages(pMac, eLIM_RMC_RULER_PICK_NEW,
+                          (void *)limMsg->bodyptr);
+        vos_mem_free((v_VOID_t*)limMsg->bodyptr);
+        limMsg->bodyptr = NULL;
+        break ;
+#endif /* WLAN_FEATURE_RMC */
 
     case WDA_SPOOF_MAC_ADDR_RSP:
        limProcessMlmSpoofMacAddrRsp(pMac, (tSirRetStatus)limMsg->bodyval);
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index a130859..fcf5a01 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -643,6 +643,7 @@
     tANI_U32 i;
     tANI_U8  channelPair[WNI_CFG_SCAN_CONTROL_LIST_LEN];
     tANI_U32 len = WNI_CFG_SCAN_CONTROL_LIST_LEN;
+
     if (wlan_cfgGetStr(pMac, WNI_CFG_SCAN_CONTROL_LIST, channelPair, &len)
                     != eSIR_SUCCESS)
     {
@@ -713,6 +714,16 @@
 {
 
     tANI_BOOLEAN passiveToActive = TRUE;
+    tANI_U32 cfgVal;
+
+    if (eSIR_SUCCESS == wlan_cfgGetInt(pMac, WNI_CFG_ACTIVE_PASSIVE_CON,
+                                        &cfgVal))
+    {
+        limLog(pMac, LOG1,  FL("WNI_CFG_ACTIVE_PASSIVE_CON: %d"), cfgVal);
+        if (!cfgVal)
+           return;
+    }
+
     if ((1 <= channelNum) && (165 >= channelNum))
     {
        if (eANI_BOOLEAN_TRUE == limIsconnectedOnDFSChannel(channelNum))
@@ -1090,6 +1101,27 @@
     return;
 }
 
+
+void limSendTLPauseInd(tpAniSirGlobal pMac, uint16_t staId)
+{
+    tSirMsgQ            msg;
+    tSirRetStatus       rc = eSIR_SUCCESS;
+
+    msg.type = WDA_PAUSE_TL_IND;
+    msg.bodyval = staId;
+
+    MTRACE(macTraceMsgTx(pMac, NO_SESSION, msg.type));
+
+    rc = wdaPostCtrlMsg(pMac, &msg);
+    if (rc == eSIR_SUCCESS) {
+            return;
+    }
+
+    limLog(pMac, LOGW, FL("wdaPostCtrlMsg failed, error code %d"), rc);
+
+    return;
+}
+
 /**
  * limSendHalFinishScanReq()
  *
@@ -2185,6 +2217,12 @@
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
     psessionEntry->pLimMlmReassocRetryReq = NULL;
 #endif
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_CHANNEL_SWITCH_ANOUNCEMENT,
+                       psessionEntry, eSIR_SUCCESS, LIM_SWITCH_CHANNEL_JOIN);
+#endif
+
     limLog(pMac, LOG1, FL("[limProcessMlmJoinReq]: suspend link success(%d) "
              "on sessionid: %d setting channel to: %d with secChanOffset:%d "
              "and maxtxPower: %d"), status, psessionEntry->peSessionId,
@@ -2610,6 +2648,11 @@
  
         /// Prepare and send Association request frame
         limSendAssocReqMgmtFrame(pMac, pMlmAssocReq,psessionEntry);
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+        limDiagEventReport(pMac, WLAN_PE_DIAG_ASSOC_REQ_EVENT, psessionEntry,
+                           eSIR_SUCCESS, eSIR_SUCCESS);
+#endif
+
 
   //Set the link state to postAssoc, so HW can start receiving frames from AP.
     if ((psessionEntry->bssType == eSIR_BTAMP_STA_MODE)||
@@ -2787,6 +2830,12 @@
         psessionEntry->channelChangeReasonCode = LIM_SWITCH_CHANNEL_REASSOC;
 
         /** Switch channel to the new Operating channel for Reassoc*/
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+        limDiagEventReport(pMac, WLAN_PE_DIAG_CHANNEL_SWITCH_ANOUNCEMENT,
+                   psessionEntry, eSIR_SUCCESS, LIM_SWITCH_CHANNEL_REASSOC);
+#endif
+
         limSetChannel(pMac, chanNum, secChannelOffset, psessionEntry->maxTxPower, psessionEntry->peSessionId);
 
         return;
@@ -2984,28 +3033,17 @@
     if (sendDisassocFrame && (pMlmDisassocReq->reasonCode != eSIR_MAC_DISASSOC_DUE_TO_FTHANDOFF_REASON))
     {
         pMac->lim.limDisassocDeauthCnfReq.pMlmDisassocReq = pMlmDisassocReq;
-
-
-        /* If the reason for disassociation is inactivity of STA, then
-           dont wait for acknowledgement. Also, if FW_IN_TX_PATH feature
-           is enabled do not wait for ACK */
-        if (((pMlmDisassocReq->reasonCode == eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON) &&
-            (psessionEntry->limSystemRole == eLIM_AP_ROLE)) ||
-            IS_FW_IN_TX_PATH_FEATURE_ENABLE )
+        if (IS_FW_IN_TX_PATH_FEATURE_ENABLE)
         {
-
-             limSendDisassocMgmtFrame(pMac,
-                                 pMlmDisassocReq->reasonCode,
+            limSendDisassocMgmtFrame(pMac, pMlmDisassocReq->reasonCode,
                                  pMlmDisassocReq->peerMacAddr,
                                  psessionEntry, FALSE);
-
-             /* Send Disassoc CNF and receive path cleanup */
-             limSendDisassocCnf(pMac);
+            /* Send Disassoc CNF and receive path cleanup */
+            limSendDisassocCnf(pMac);
         }
         else
         {
-             limSendDisassocMgmtFrame(pMac,
-                                 pMlmDisassocReq->reasonCode,
+            limSendDisassocMgmtFrame(pMac, pMlmDisassocReq->reasonCode,
                                  pMlmDisassocReq->peerMacAddr,
                                  psessionEntry, TRUE);
         }
@@ -4420,6 +4458,8 @@
 
             break;
     }
+    /* Reinit scan results to remove the unreachable BSS */
+    limReInitScanResults(pMac);
 } /*** limProcessAuthFailureTimeout() ***/
 
 
@@ -4559,17 +4599,36 @@
 
 
 
-    /* CR: vos packet memory is leaked when assoc rsp timeouted/failed. */
-    /* notify TL that association is failed so that TL can flush the cached frame  */
+    /*
+     * CR: vos packet memory is leaked when assoc rsp timeouted/failed.
+     * notify TL that association is failed so that TL can flush the
+     * cached frame
+     */
     WLANTL_AssocFailed (psessionEntry->staId);
 
-    // Log error
+    /* Log error */
     limLog(pMac, LOG1,
        FL("Re/Association Response not received before timeout "));
 
-    if (( (psessionEntry->limSystemRole == eLIM_AP_ROLE) || (psessionEntry->limSystemRole == eLIM_BT_AMP_AP_ROLE) )||
-        ( (psessionEntry->limMlmState != eLIM_MLM_WT_ASSOC_RSP_STATE) &&
-          (psessionEntry->limMlmState != eLIM_MLM_WT_REASSOC_RSP_STATE)  && 
+    /*
+     * Send Deauth to handle the scenareo where association timeout happened
+     * when device has missed the assoc resp sent by peer.
+     * By sending deauth try to clear the session created on peer device.
+     */
+    limLog(pMac, LOGE,
+           FL("Sessionid: %d try sending Send deauth on channel %d to BSSID: "
+           MAC_ADDRESS_STR ), psessionEntry->peSessionId,
+           psessionEntry->currentOperChannel,
+           MAC_ADDR_ARRAY(psessionEntry->bssId));
+
+    limSendDeauthMgmtFrame(pMac, eSIR_MAC_UNSPEC_FAILURE_REASON,
+                 psessionEntry->bssId,
+                 psessionEntry, FALSE);
+
+    if (((psessionEntry->limSystemRole == eLIM_AP_ROLE) ||
+          (psessionEntry->limSystemRole == eLIM_BT_AMP_AP_ROLE) )||
+        ((psessionEntry->limMlmState != eLIM_MLM_WT_ASSOC_RSP_STATE) &&
+          (psessionEntry->limMlmState != eLIM_MLM_WT_REASSOC_RSP_STATE)  &&
           (psessionEntry->limMlmState != eLIM_MLM_WT_FT_REASSOC_RSP_STATE)))
     {
         /**
@@ -4643,6 +4702,8 @@
                 eSIR_SME_REASSOC_TIMEOUT_RESULT_CODE, eSIR_MAC_UNSPEC_FAILURE_STATUS,psessionEntry);
         }
     }
+    /* Reinit scan results to remove the unreachable BSS */
+    limReInitScanResults(pMac);
 } /*** limProcessAssocFailureTimeout() ***/
 
 
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
index d1316b2..20b68ad 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -547,8 +547,14 @@
                psessionEntry->peSessionId,psessionEntry->limSmeState);)
         return;
     }
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_AUTH_COMP_EVENT, psessionEntry,
+                       pMlmAuthCnf->resultCode,
+                       pMlmAuthCnf->protStatusCode);
+#endif
+
     /// Process AUTH confirm from MLM
-    if (((tLimMlmAuthCnf *) pMsgBuf)->resultCode != eSIR_SME_SUCCESS)
+    if (pMlmAuthCnf->resultCode != eSIR_SME_SUCCESS)
     {
         if (psessionEntry->limSmeState == eLIM_SME_WT_AUTH_STATE)
                 {
@@ -567,14 +573,16 @@
             cfgAuthType = pMac->lim.gLimPreAuthType;
         
         if ((cfgAuthType == eSIR_AUTO_SWITCH) &&
-                (((tLimMlmAuthCnf *) pMsgBuf)->authType == eSIR_OPEN_SYSTEM)
-                && (eSIR_MAC_AUTH_ALGO_NOT_SUPPORTED_STATUS == ((tLimMlmAuthCnf *) pMsgBuf)->protStatusCode))
+             (pMlmAuthCnf->authType == eSIR_SHARED_KEY)
+             && ((eSIR_MAC_AUTH_ALGO_NOT_SUPPORTED_STATUS ==
+             pMlmAuthCnf->protStatusCode) ||
+             (pMlmAuthCnf->resultCode == eSIR_SME_AUTH_TIMEOUT_RESULT_CODE)))
         {
             /**
-             * When Open authentication fails with reason code "13" and
-             * authType set to 'auto switch', Try with Shared Authentication
+             * When Shared authentication fails with reason code "13" and
+             * authType set to 'auto switch', Try with Open Authentication
              */
-            authMode = eSIR_SHARED_KEY;
+            authMode = eSIR_OPEN_SYSTEM;
             // Trigger MAC based Authentication
             pMlmAuthReq = vos_mem_malloc(sizeof(tLimMlmAuthReq));
             if ( NULL == pMlmAuthReq )
@@ -628,8 +636,8 @@
                  * Need to send Join response with
                  * auth failure to Host.
                  */
-                limHandleSmeJoinResult(pMac,
-                              ((tLimMlmAuthCnf *) pMsgBuf)->resultCode, ((tLimMlmAuthCnf *) pMsgBuf)->protStatusCode,psessionEntry);
+                limHandleSmeJoinResult(pMac, pMlmAuthCnf->resultCode,
+                              pMlmAuthCnf->protStatusCode, psessionEntry);
             }
             else
             {
@@ -640,11 +648,11 @@
                 psessionEntry->limSmeState = psessionEntry->limPrevSmeState;
                 MTRACE(macTrace(pMac, TRACE_CODE_SME_STATE, psessionEntry->peSessionId, psessionEntry->limSmeState));
                 limSendSmeAuthRsp(
-                            pMac,
-                            ((tLimMlmAuthCnf *) pMsgBuf)->resultCode,
-                            ((tLimMlmAuthCnf *) pMsgBuf)->peerMacAddr,
-                            ((tLimMlmAuthCnf *) pMsgBuf)->authType,
-                            ((tLimMlmAuthCnf *) pMsgBuf)->protStatusCode,psessionEntry,psessionEntry->smeSessionId,psessionEntry->transactionId);
+                            pMac, pMlmAuthCnf->resultCode,
+                            pMlmAuthCnf->peerMacAddr, pMlmAuthCnf->authType,
+                            pMlmAuthCnf->protStatusCode, psessionEntry,
+                            psessionEntry->smeSessionId,
+                            psessionEntry->transactionId);
             }
         } // end if (cfgAuthType == eAUTO_SWITCH)
     } // if (((tLimMlmAuthCnf *) pMsgBuf)->resultCode != ...
@@ -787,12 +795,11 @@
              */
             psessionEntry->limSmeState = psessionEntry->limPrevSmeState;
             MTRACE(macTrace(pMac, TRACE_CODE_SME_STATE, psessionEntry->peSessionId, psessionEntry->limSmeState));
-            limSendSmeAuthRsp(
-                        pMac,
-                        ((tLimMlmAuthCnf *) pMsgBuf)->resultCode,
-                        ((tLimMlmAuthCnf *) pMsgBuf)->peerMacAddr,
-                        ((tLimMlmAuthCnf *) pMsgBuf)->authType,
-                        ((tLimMlmAuthCnf *) pMsgBuf)->protStatusCode,psessionEntry,psessionEntry->smeSessionId,psessionEntry->transactionId);
+            limSendSmeAuthRsp(pMac, pMlmAuthCnf->resultCode,
+                            pMlmAuthCnf->peerMacAddr, pMlmAuthCnf->authType,
+                            pMlmAuthCnf->protStatusCode, psessionEntry,
+                            psessionEntry->smeSessionId,
+                            psessionEntry->transactionId);
         }
     } // end if (((tLimMlmAuthCnf *) pMsgBuf)->resultCode != ...
 } /*** end limProcessMlmAuthCnf() ***/
@@ -1131,6 +1138,7 @@
         // Log error
         limLog(pMac, LOGP,
            FL("call to AllocateMemory failed for eWNI_SME_AUTH_IND"));
+        return;
     }
     limCopyU16((tANI_U8 *) &pSirSmeAuthInd->messageType, eWNI_SME_AUTH_IND);
     limAuthIndSerDes(pMac, (tpLimMlmAuthInd) pMsgBuf,
@@ -1206,6 +1214,8 @@
     limLog(pMac, LOGW, FL("HT40MHzIntoPresent: %d"),
                  pSirSmeAssocInd->HT40MHzIntoEnabledSta);
 #endif
+    // Fill in rate flags
+    pSirSmeAssocInd->rate_flags = pAssocInd->rate_flags;
 } /*** end limAssocIndSerDes() ***/
 
 
@@ -2062,8 +2072,14 @@
     {
         limLog( pMac, LOGE, FL( "ADD_STA failed!"));
         if(psessionEntry->limSmeState == eLIM_SME_WT_REASSOC_STATE)
+        {
            mesgType = LIM_MLM_REASSOC_CNF;
-        mlmAssocCnf.resultCode = (tSirResultCodes) eSIR_SME_REFUSED;
+           mlmAssocCnf.resultCode = (tSirResultCodes)eSIR_SME_FT_REASSOC_FAILURE;
+        }
+        else
+        {
+           mlmAssocCnf.resultCode = (tSirResultCodes) eSIR_SME_REFUSED;
+        }
         mlmAssocCnf.protStatusCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
     }
 end:
@@ -2810,7 +2826,7 @@
                        FL("could not retrieve AuthType"));
             }
             if (cfgAuthType == eSIR_AUTO_SWITCH) 
-                authMode = eSIR_OPEN_SYSTEM; // Try Open Authentication first
+                authMode = eSIR_SHARED_KEY; // Try Shared Authentication first
             else
                 authMode = cfgAuthType;
 
@@ -4312,6 +4328,10 @@
     switch(pMac->lim.gLimHalScanState)
     {
         case eLIM_HAL_FINISH_SCAN_WAIT_STATE:
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+            limDiagEventReport(pMac, WLAN_PE_DIAG_SCAN_COMP_EVENT, NULL,
+                               status, eSIR_SUCCESS);
+#endif
             pMac->lim.gLimHalScanState = eLIM_HAL_IDLE_SCAN_STATE;
             if (pMac->lim.abortScan)
                 pMac->lim.abortScan = 0;
@@ -4399,9 +4419,6 @@
         limMsgQ->bodyptr = NULL;
         return;
     }
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
-    limDiagEventReport(pMac, WLAN_PE_DIAG_HAL_ADDBA_RSP_EVENT, psessionEntry, 0, 0);
-#endif //FEATURE_WLAN_DIAG_SUPPORT
 
     // Allocate for LIM_MLM_ADDBA_CNF
     pMlmAddBACnf = vos_mem_malloc(sizeof(tLimMlmAddBACnf));
@@ -4427,6 +4444,12 @@
         pMlmAddBACnf->addBAResultCode = eSIR_MAC_SUCCESS_STATUS;
      else
         pMlmAddBACnf->addBAResultCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_HAL_ADDBA_RSP_EVENT, psessionEntry,
+                       pAddBAParams->status, pMlmAddBACnf->addBAResultCode);
+#endif //FEATURE_WLAN_DIAG_SUPPORT
+
      vos_mem_free(limMsgQ->bodyptr);
      limMsgQ->bodyptr = NULL;
      // Send ADDBA CNF to LIM
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index aa98b10..9227d6e 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -59,6 +59,10 @@
 #include "limApi.h"
 #include "wmmApsd.h"
 
+#ifdef WLAN_FEATURE_RMC
+#include "limRMC.h"
+#endif
+
 #include "sapApi.h"
 
 #if defined WLAN_FEATURE_VOWIFI
@@ -150,6 +154,8 @@
 
     if(pMac->lim.gLimSmeState != eLIM_SME_IDLE_STATE)
     {
+        limLog(pMac, LOG1, FL("setting fresh scan as false. sme state is %d"),
+               pMac->lim.gLimSmeState);
         return FALSE;
     }
     for(i =0; i < pMac->lim.maxBssId; i++)
@@ -172,6 +178,11 @@
              ))
                 {
                 validState = FALSE;
+                limLog(pMac, LOG1, FL("setting fresh scan as false."
+                      "bssType is %d system role is %d, smestate is %d"),
+                      pMac->lim.gpSession[i].bssType,
+                      pMac->lim.gpSession[i].limSystemRole,
+                      pMac->lim.gpSession[i].limSmeState);
                 break;
               }
             
@@ -1216,7 +1227,7 @@
     tpSirSmeScanReq     pScanReq;
     tANI_U8             i = 0;
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
     limDiagEventReport(pMac, WLAN_PE_DIAG_SCAN_REQ_EVENT, NULL, 0, 0);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
     
@@ -1697,8 +1708,8 @@
     tANI_U16            nSize;
     tANI_U8             sessionId;
     tpPESession         psessionEntry = NULL;
-    tANI_U8             smesessionId;
-    tANI_U16            smetransactionId;
+    tANI_U8             smesessionId = 0;
+    tANI_U16            smetransactionId = 0;
     tPowerdBm           localPowerConstraint = 0, regMax = 0;
     tANI_U16            ieLen;
     v_U8_t              *vendorIE;
@@ -1847,6 +1858,7 @@
         psessionEntry->limWmeEnabled = pSmeJoinReq->isWMEenabled;
         psessionEntry->limQosEnabled = pSmeJoinReq->isQosEnabled;
         psessionEntry->bOSENAssociation = pSmeJoinReq->bOSENAssociation;
+        psessionEntry->bWPSAssociation = pSmeJoinReq->bWPSAssociation;
 
         /* Store vendor specfic IE for CISCO AP */
         ieLen = (pSmeJoinReq->bssDescription.length +
@@ -1884,16 +1896,16 @@
                 "***__limProcessSmeJoinReq: txBFIniFeatureEnabled=%d****",
                 psessionEntry->txBFIniFeatureEnabled);
 
+            if (cfgSetInt(pMac, WNI_CFG_VHT_SU_BEAMFORMEE_CAP,
+                       psessionEntry->txBFIniFeatureEnabled) != eSIR_SUCCESS)
+            {
+                limLog(pMac, LOGP, FL("could not set  "
+                                "WNI_CFG_VHT_SU_BEAMFORMEE_CAP at CFG"));
+                retCode = eSIR_LOGP_EXCEPTION;
+                goto end;
+            }
             if( psessionEntry->txBFIniFeatureEnabled )
             {
-                if (cfgSetInt(pMac, WNI_CFG_VHT_SU_BEAMFORMEE_CAP, psessionEntry->txBFIniFeatureEnabled)
-                                                             != eSIR_SUCCESS)
-                {
-                    limLog(pMac, LOGP, FL("could not set  "
-                                  "WNI_CFG_VHT_SU_BEAMFORMEE_CAP at CFG"));
-                    retCode = eSIR_LOGP_EXCEPTION;
-                    goto end;
-                }
                 VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO_MED,
                     "***__limProcessSmeJoinReq: txBFCsnValue=%d****",
                     pSmeJoinReq->txBFCsnValue);
@@ -2018,7 +2030,8 @@
         {
             limLog(pMac, LOGP, FL("call to AllocateMemory "
                                 "failed for mlmJoinReq"));
-            return;
+            retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
+            goto end;
         }
         (void) vos_mem_set((void *) pMlmJoinReq, val, 0);
 
@@ -2268,8 +2281,9 @@
         goto end;
     }
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
-    limDiagEventReport(pMac, WLAN_PE_DIAG_REASSOC_REQ_EVENT, psessionEntry, 0, 0);
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_REASSOC_REQ_EVENT, psessionEntry,
+            eSIR_SUCCESS, eSIR_SUCCESS);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
     //pMac->lim.gpLimReassocReq = pReassocReq;//TO SUPPORT BT-AMP
 
@@ -2425,6 +2439,12 @@
         limLog(pMac, LOGP,
                FL("could not retrieve Capabilities value"));
     }
+
+    lim_update_caps_info_for_bss(pMac, &caps,
+                        pReassocReq->bssDescription.capabilityInfo);
+
+    limLog(pMac, LOG1, FL("Capabilities info Reassoc: 0x%X"), caps);
+
     pMlmReassocReq->capabilityInfo = caps;
     
     /* Update PE sessionId*/
@@ -2702,15 +2722,8 @@
             goto sendDisassoc;
     } // end switch (pMac->lim.gLimSystemRole)
 
-    if (smeDisassocReq.reasonCode == eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON)
-    {
-        /// Disassociation is triggered by Link Monitoring
-        limLog(pMac, LOG1, FL("Sending Disasscoc with reason Link Monitoring"));
-        disassocTrigger = eLIM_LINK_MONITORING_DISASSOC;
-    }
-    else
-        disassocTrigger = eLIM_HOST_DISASSOC;
-        reasonCode      = smeDisassocReq.reasonCode;
+    disassocTrigger = eLIM_HOST_DISASSOC;
+    reasonCode      = smeDisassocReq.reasonCode;
 
     if (smeDisassocReq.doNotSendOverTheAir)
     {
@@ -2856,6 +2869,14 @@
                      MAC_ADDR_ARRAY(smeDisassocCnf.peerMacAddr));)
             return;
         }
+
+       if(aid != smeDisassocCnf.assocId)
+        {
+            PELOGE(limLog(pMac, LOGE, FL("same peerMacAddr but assocId is different "
+                     "aid=%d, assocId=%d, addr= "MAC_ADDRESS_STR),
+                      aid, smeDisassocCnf.assocId, MAC_ADDR_ARRAY(smeDisassocCnf.peerMacAddr));)
+            return;
+        }
         /*
          * If MlM state is either of del_sta or del_bss state, then no need to
          * go ahead and clean up further as there must be some cleanup in
@@ -3488,7 +3509,7 @@
 
 void limProcessSmeGetAssocSTAsInfo(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
 {
-    tSirSmeGetAssocSTAsReq  getAssocSTAsReq;
+    tSirSmeGetAssocSTAsReq  getAssocSTAsReq = {0};
     tpDphHashNode           pStaDs = NULL;
     tpPESession             psessionEntry = NULL;
     tSap_Event              sapEvent;
@@ -4923,6 +4944,7 @@
          tpSirBeaconReportXmitInd pBcnReport=NULL;
          tpPESession psessionEntry=NULL;
          tANI_U8 sessionId;
+         tpEsePEContext pEseContext = NULL;
 
          if(pMsg->bodyptr == NULL)
          {
@@ -4935,7 +4957,10 @@
             limLog(pMac, LOGE, "Session Does not exist for given bssId");
             return;
          }
-         if (psessionEntry->isESEconnection)
+
+         pEseContext = &psessionEntry->eseContext;
+
+         if (psessionEntry->isESEconnection && pEseContext->curMeasReq.isValid)
              eseProcessBeaconReportXmit( pMac, pMsg->bodyptr);
          else
 #endif
@@ -5833,6 +5858,16 @@
             limSendSetTxPowerReq(pMac,  pMsgBuf);
             break ;
 
+#ifdef WLAN_FEATURE_RMC
+        case eWNI_SME_ENABLE_RMC_REQ:
+            limProcessRMCMessages(pMac, eLIM_RMC_ENABLE_REQ, pMsgBuf);
+            break ;
+
+        case eWNI_SME_DISABLE_RMC_REQ:
+            limProcessRMCMessages(pMac, eLIM_RMC_DISABLE_REQ, pMsgBuf);
+            break ;
+#endif /* WLAN_FEATURE_RMC */
+
         case eWNI_SME_MAC_SPOOF_ADDR_IND:
             __limProcessSmeSpoofMacAddrRequest(pMac,  pMsgBuf);
             break ;
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limProcessTdls.c b/wlan/prima/CORE/MAC/src/pe/lim/limProcessTdls.c
index e949a53..c254dab 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limProcessTdls.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limProcessTdls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -738,7 +738,8 @@
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             limMgmtTXComplete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                                HAL_USE_PEER_STA_REQUESTED_MASK,
                             pMac->lim.txBdToken++);
     if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
     {
@@ -858,7 +859,8 @@
 
     /* populate supported rate and ext supported rate IE */
     if (eSIR_FAILURE == PopulateDot11fRatesTdls(pMac, &tdlsDisRsp.SuppRates,
-                               &tdlsDisRsp.ExtSuppRates))
+                               &tdlsDisRsp.ExtSuppRates,
+                               psessionEntry->currentOperChannel))
         limLog(pMac, LOGE, FL("could not populate supported data rates"));
 
     /* Populate extended capability IE */
@@ -1124,9 +1126,14 @@
 
     swapBitField16(caps, ( tANI_U16* )&tdlsSetupReq.Capabilities );
 
+    limLog(pMac, LOG1, FL("Sending operating channel %d and dotl11mode %d\n"),
+           psessionEntry->currentOperChannel,
+           psessionEntry->dot11mode);
+
     /* populate supported rate and ext supported rate IE */
     PopulateDot11fRatesTdls(pMac, &tdlsSetupReq.SuppRates,
-                               &tdlsSetupReq.ExtSuppRates);
+                               &tdlsSetupReq.ExtSuppRates,
+                               psessionEntry->currentOperChannel);
 
     /* Populate extended capability IE */
     PopulateDot11fTdlsExtCapability( pMac, &tdlsSetupReq.ExtCap );
@@ -1323,7 +1330,8 @@
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             limMgmtTXComplete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                                HAL_USE_PEER_STA_REQUESTED_MASK,
                             pMac->lim.txBdToken++);
 
     if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
@@ -1532,7 +1540,8 @@
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             limMgmtTXComplete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                                HAL_USE_PEER_STA_REQUESTED_MASK,
                             pMac->lim.txBdToken++);
     if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
     {
@@ -1604,7 +1613,8 @@
 
     /* populate supported rate and ext supported rate IE */
     PopulateDot11fRatesTdls(pMac, &tdlsSetupRsp.SuppRates,
-                                &tdlsSetupRsp.ExtSuppRates);
+                                &tdlsSetupRsp.ExtSuppRates,
+                                psessionEntry->currentOperChannel);
 
     /* Populate extended capability IE */
     PopulateDot11fTdlsExtCapability( pMac, &tdlsSetupRsp.ExtCap );
@@ -1794,7 +1804,8 @@
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             limMgmtTXComplete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                                HAL_USE_PEER_STA_REQUESTED_MASK,
                             pMac->lim.txBdToken++);
     if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
     {
@@ -2043,7 +2054,8 @@
                             TID_AC_VI,
                             limTxComplete, pFrame, 
                             limMgmtTXComplete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                                HAL_USE_PEER_STA_REQUESTED_MASK,
                             pMac->lim.txBdToken++);
 
 
@@ -2517,7 +2529,20 @@
          * base channel should be less than or equal to channel width of
          * STA-AP link. So take this setting from the psessionEntry.
          */
-        pStaDs->htSupportedChannelWidthSet = psessionEntry->htSupportedChannelWidthSet ;
+        limLog(pMac, LOG1,
+               FL("supportedChannelWidthSet %x htSupportedChannelWidthSet %x"),
+               htCaps->supportedChannelWidthSet,
+               psessionEntry->htSupportedChannelWidthSet);
+
+        pStaDs->htSupportedChannelWidthSet =
+                (htCaps->supportedChannelWidthSet <
+                  psessionEntry->htSupportedChannelWidthSet) ?
+                      htCaps->supportedChannelWidthSet :
+                      psessionEntry->htSupportedChannelWidthSet;
+
+        limLog(pMac, LOG1, FL("pStaDs->htSupportedChannelWidthSet %x"),
+               pStaDs->htSupportedChannelWidthSet);
+
         pStaDs->htMIMOPSState =             htCaps->mimoPowerSave ;
         pStaDs->htMaxAmsduLength =  htCaps->maximalAMSDUsize;
         pStaDs->htAMpduDensity =    htCaps->mpduDensity;
@@ -2543,27 +2568,11 @@
     {
         pStaDs->mlmStaContext.vhtCapability = 1 ;
 
-        if (psessionEntry->currentOperChannel <= SIR_11B_CHANNEL_END)
-        {
-            /* if the channel is 2G then update the min channel widthset in
-             * pStaDs. These values are used when sending a AddSta request to
-             * firmware
-             * 11.21.1 General: The channel width of the TDLS direct link on the
-             * base channel shall not exceed the channel width of the BSS to which
-             * the TDLS peer STAs are associated.*/
-            pStaDs->vhtSupportedChannelWidthSet = WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
-            pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_20MHZ;
-            limLog(pMac, LOG1,
-                    FL("vhtSupportedChannelWidthSet = %hu,"
-                        " htSupportedChannelWidthSet %hu"),
-                    pStaDs->vhtSupportedChannelWidthSet,
-                    pStaDs->htSupportedChannelWidthSet) ;
-        }
-        else
-        {
-            pStaDs->vhtSupportedChannelWidthSet =  WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ;
-            pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_40MHZ ;
-        }
+        pStaDs->vhtSupportedChannelWidthSet =
+                    psessionEntry->vhtTxChannelWidthSet;
+
+        limLog(pMac, LOG1, FL("Vht supported channel width is set to = %d"),
+               pStaDs->vhtSupportedChannelWidthSet);
 
         pStaDs->vhtLdpcCapable = pVhtCaps->ldpcCodingCap;
         pStaDs->vhtBeamFormerCapable= pVhtCaps->suBeamFormerCap;
@@ -2964,6 +2973,9 @@
                            psessionEntry->limSmeState);
         goto lim_tdls_send_mgmt_error;
     }
+    vos_tdls_tx_rx_mgmt_event(SIR_MAC_ACTION_TDLS,
+              SIR_MAC_ACTION_TX, SIR_MAC_MGMT_ACTION,
+              pSendMgmtReq->reqType, pSendMgmtReq->peerMac);
 
     switch( pSendMgmtReq->reqType )
     {
@@ -3065,12 +3077,18 @@
         limLog(pMac, LOGE, FL("Failed to allocate memory"));
         return ;
     }
+
+    vos_mem_zero(pTdlsLinkEstablishReqRsp, sizeof(tSirTdlsLinkEstablishReqRsp));
+
     pTdlsLinkEstablishReqRsp->statusCode = status ;
-    if ( peerMac )
+    if (pStaDs && peerMac)
     {
         vos_mem_copy(pTdlsLinkEstablishReqRsp->peerMac, peerMac, sizeof(tSirMacAddr));
+        pTdlsLinkEstablishReqRsp->sta_idx = pStaDs->staIndex;
     }
+
     pTdlsLinkEstablishReqRsp->sessionId = sessionId;
+
     mmhMsg.type = eWNI_SME_TDLS_LINK_ESTABLISH_RSP ;
     mmhMsg.bodyptr = pTdlsLinkEstablishReqRsp;
     mmhMsg.bodyval = 0;
@@ -3097,12 +3115,18 @@
         PELOGE(limLog(pMac, LOGE, FL("Failed to allocate memory"));)
         return ;
     }
+
+    vos_mem_zero(pTdlsChanSwitchReqRsp, sizeof(tSirTdlsChanSwitchReqRsp));
+
     pTdlsChanSwitchReqRsp->statusCode = status ;
-    if ( peerMac )
+    if (pStaDs && peerMac )
     {
         vos_mem_copy(pTdlsChanSwitchReqRsp->peerMac, peerMac, sizeof(tSirMacAddr));
+        pTdlsChanSwitchReqRsp->sta_idx = pStaDs->staIndex;;
     }
+
     pTdlsChanSwitchReqRsp->sessionId = sessionId;
+
     mmhMsg.type = eWNI_SME_TDLS_CHANNEL_SWITCH_RSP ;
     mmhMsg.bodyptr = pTdlsChanSwitchReqRsp;
     mmhMsg.bodyval = 0;
@@ -3770,7 +3794,7 @@
         return eSIR_MEM_ALLOC_FAILED;
     }
 
-    vos_mem_set( (tANI_U8 *)pMsgTdlsChanSwitch, sizeof(tpTdlsChanSwitchParams), 0);
+    vos_mem_set( (tANI_U8 *)pMsgTdlsChanSwitch, sizeof(*pMsgTdlsChanSwitch), 0);
 
     /* if channel bw offset is not set,
        send maximum supported offset in the band */
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limRMC.c b/wlan/prima/CORE/MAC/src/pe/lim/limRMC.c
new file mode 100644
index 0000000..86b302e
--- /dev/null
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limRMC.c
@@ -0,0 +1,1382 @@
+/*
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ *
+ * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+ *
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This file was originally distributed by Qualcomm Atheros, Inc.
+ * under proprietary terms before Copyright ownership was assigned
+ * to the Linux Foundation.
+ */
+
+/*
+ * This file limRMC.c contains the code
+ * for processing RMC messages
+ *
+ */
+#include "wniApi.h"
+#include "wniCfg.h"
+#include "cfgApi.h"
+#include "sirApi.h"
+#include "schApi.h"
+#include "utilsApi.h"
+#include "limUtils.h"
+#include "limTimerUtils.h"
+#include "limSendMessages.h"
+#include "limSendMessages.h"
+#include "limSession.h"
+#include "limSessionUtils.h"
+#include "wlan_qct_wda.h"
+#include "wlan_qct_tli.h"
+#include "limRMC.h"
+
+#ifdef WLAN_FEATURE_RMC
+
+static tANI_U8
+__rmcGroupHashFunction(tSirMacAddr transmitter)
+{
+    tANI_U16 hash;
+
+    /*
+     * Generate a hash using transmitter address
+     */
+    hash = transmitter[0] + transmitter[1] + transmitter[2] +
+            transmitter[3] + transmitter[4] + transmitter[5];
+
+    return hash & (RMC_MCAST_GROUPS_HASH_SIZE - 1);
+}
+
+
+static tLimRmcGroupContext *
+__rmcGroupLookupHashEntry(tpAniSirGlobal pMac, tSirMacAddr transmitter)
+{
+    tANI_U8 index;
+    tLimRmcGroupContext *entry;
+
+    index = __rmcGroupHashFunction(transmitter);
+
+    /* Pick the correct hash table based on role */
+    entry = pMac->rmcContext.rmcGroupRxHashTable[index];
+
+    PELOG1(limLog(pMac, LOG1, FL("RMC: Hash Lookup:[%d] transmitter "
+                         MAC_ADDRESS_STR ), index,
+                         MAC_ADDR_ARRAY(transmitter));)
+    while (entry)
+    {
+        if (vos_mem_compare(transmitter, entry->transmitter,
+             sizeof(v_MACADDR_t)))
+        {
+            return entry;
+        }
+
+        entry = entry->next;
+    }
+
+    return NULL;
+}
+
+static tLimRmcGroupContext *
+__rmcGroupInsertHashEntry(tpAniSirGlobal pMac, tSirMacAddr transmitter)
+{
+    tANI_U8 index;
+    tLimRmcGroupContext *entry;
+    tLimRmcGroupContext **head;
+
+    index = __rmcGroupHashFunction(transmitter);
+
+    PELOG1(limLog(pMac, LOG1, FL("RMC: Hash Insert:[%d] group " MAC_ADDRESS_STR
+                             " transmitter " MAC_ADDRESS_STR), index,
+                             MAC_ADDR_ARRAY(mcastGroupAddr),
+                             MAC_ADDR_ARRAY(transmitter));)
+
+    head = &pMac->rmcContext.rmcGroupRxHashTable[index];
+
+    entry = __rmcGroupLookupHashEntry(pMac, transmitter);
+
+    if (entry)
+    {
+        /* If the entry exists, return it at the end */
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Hash Insert:"
+                 MAC_ADDRESS_STR "exists"), MAC_ADDR_ARRAY(transmitter));)
+    }
+    else
+    {
+        entry = (tLimRmcGroupContext *)vos_mem_malloc(sizeof(*entry));
+
+        PELOG1(limLog(pMac, LOG1, FL("RMC: Hash Insert:new entry %p"), entry);)
+
+        if (entry)
+        {
+            vos_mem_copy(entry->transmitter, transmitter, sizeof(tSirMacAddr));
+            entry->isRuler = eRMC_IS_NOT_A_RULER;
+
+            /* chain this entry */
+            entry->next = *head;
+            *head = entry;
+        }
+        else
+        {
+            PELOGE(limLog(pMac, LOGE, FL("RMC: Hash Insert:" MAC_ADDRESS_STR
+                             " alloc failed"), MAC_ADDR_ARRAY(transmitter));)
+        }
+    }
+
+    return entry;
+}
+
+/**
+ *  __rmcGroupDeleteHashEntry()
+ *
+ *FUNCTION:
+ * This function is called to delete a RMC group entry
+ *
+ *LOGIC:
+ *
+ *ASSUMPTIONS:
+ *  Should be called with lkRmcLock held.
+ *
+ *NOTE:
+ * Make sure (for the transmitter role) that the entry is
+ * not in the Pending Response queue.
+ *
+ * @param  transmitter - address of multicast transmitter
+ *
+ * @return status
+ */
+static tSirRetStatus
+__rmcGroupDeleteHashEntry(tpAniSirGlobal pMac, tSirMacAddr transmitter)
+{
+    tSirRetStatus status = eSIR_FAILURE;
+    tANI_U8 index;
+    tLimRmcGroupContext *entry, *prev, **head;
+
+    index = __rmcGroupHashFunction(transmitter);
+
+    head = &pMac->rmcContext.rmcGroupRxHashTable[index];
+    entry = *head;
+    prev = NULL;
+
+    while (entry)
+    {
+        if (vos_mem_compare(transmitter, entry->transmitter,
+             sizeof(v_MACADDR_t)))
+        {
+            if (*head == entry)
+            {
+                *head = entry->next;
+            }
+            else
+            {
+                prev->next = entry->next;
+            }
+
+            PELOG1(limLog(pMac, LOG1, FL("RMC: Hash Delete: entry %p "
+                         " transmitter " MAC_ADDRESS_STR), entry
+                             MAC_ADDR_ARRAY(transmitter));)
+
+            /* free the group entry */
+            vos_mem_free(entry);
+
+            status = eSIR_SUCCESS;
+            break;
+        }
+
+        prev = entry;
+        entry = entry->next;
+    }
+
+    return status;
+}
+
+static void
+__rmcGroupDeleteAllEntries(tpAniSirGlobal pMac)
+{
+    tLimRmcGroupContext *entry, **head;
+    int index;
+
+    PELOG1(limLog(pMac, LOG1, FL("RMC: Hash_Delete_All"),);)
+
+    for (index = 0; index < RMC_MCAST_GROUPS_HASH_SIZE; index++)
+    {
+        head = &pMac->rmcContext.rmcGroupRxHashTable[index];
+
+        entry = *head;
+
+        while (entry)
+        {
+            *head = entry->next;
+            /* free the group entry */
+            vos_mem_free(entry);
+            entry = *head;
+        }
+    }
+}
+
+static void
+__limPostMsgRulerReq ( tpAniSirGlobal pMac,
+                        tANI_U8 cmd,
+                        tSirMacAddr mcastTransmitter)
+{
+    tSirMsgQ msg;
+    tSirRmcRulerReq *pRulerReq;
+
+    pRulerReq = vos_mem_malloc(sizeof(*pRulerReq));
+    if (NULL == pRulerReq)
+    {
+       limLog(pMac, LOGE, FL("AllocateMemory() failed"));
+       return;
+    }
+
+    pRulerReq->cmd = cmd;
+
+    vos_mem_copy(pRulerReq->mcastTransmitter, mcastTransmitter,
+                 sizeof(tSirMacAddr));
+
+    /* Initialize black list */
+    vos_mem_zero(pRulerReq->blacklist, sizeof(pRulerReq->blacklist));
+
+    if (eRMC_SUGGEST_RULER_CMD == cmd)
+    {
+        /* TODO - Set the black list. */
+    }
+
+    msg.type = WDA_RMC_RULER_REQ;
+    msg.bodyptr = pRulerReq;
+    msg.bodyval = 0;
+
+    MTRACE(macTraceMsgTx(pMac, NO_SESSION, msg.type));
+    if (eSIR_SUCCESS != wdaPostCtrlMsg(pMac, &msg))
+    {
+        vos_mem_free(pRulerReq);
+        limLog(pMac, LOGE, FL("wdaPostCtrlMsg() failed"));
+    }
+
+    return;
+}
+
+static void
+__limPostMsgUpdateInd ( tpAniSirGlobal pMac,
+                        tANI_U8 indication,
+                        tANI_U8 role,
+                        tSirMacAddr mcastTransmitter,
+                        tSirMacAddr mcastRuler)
+{
+    tSirMsgQ msg;
+    tSirRmcUpdateInd *pUpdateInd;
+
+    pUpdateInd = vos_mem_malloc(sizeof(*pUpdateInd));
+    if ( NULL == pUpdateInd )
+    {
+       limLog(pMac, LOGE, FL("AllocateMemory() failed"));
+       return;
+    }
+
+    vos_mem_zero(pUpdateInd, sizeof(*pUpdateInd));
+
+    pUpdateInd->indication = indication;
+    pUpdateInd->role = role;
+
+    vos_mem_copy(pUpdateInd->mcastTransmitter,
+            mcastTransmitter, sizeof(tSirMacAddr));
+
+    vos_mem_copy(pUpdateInd->mcastRuler,
+            mcastRuler, sizeof(tSirMacAddr));
+
+    msg.type = WDA_RMC_UPDATE_IND;
+    msg.bodyptr = pUpdateInd;
+    msg.bodyval = 0;
+
+    MTRACE(macTraceMsgTx(pMac, NO_SESSION, msg.type));
+    if (eSIR_SUCCESS != wdaPostCtrlMsg(pMac, &msg))
+    {
+        vos_mem_free(pUpdateInd);
+        limLog(pMac, LOGE, FL("wdaPostCtrlMsg() failed"));
+    }
+
+    return;
+}
+
+static char *
+__limRulerMessageToString(eRmcMessageType msgType)
+{
+    switch (msgType)
+    {
+        default:
+            return "Invalid";
+        case eLIM_RMC_ENABLE_REQ:
+            return "RMC_ENABLE_REQ";
+        case eLIM_RMC_DISABLE_REQ:
+            return "RMC_DISABLE_REQ";
+        case eLIM_RMC_RULER_SELECT_RESP:
+            return "RMC_RULER_SELECT_RESP";
+        case eLIM_RMC_RULER_PICK_NEW:
+            return "RMC_RULER_PICK_NEW";
+        case eLIM_RMC_OTA_RULER_INFORM_ACK:
+            return "RMC_OTA_RULER_INFORM_ACK";
+        case eLIM_RMC_OTA_RULER_INFORM_SELECTED:
+            return "RMC_OTA_RULER_INFORM_SELECTED";
+        case eLIM_RMC_BECOME_RULER_RESP:
+            return "RMC_BECOME_RULER_RESP";
+        case eLIM_RMC_OTA_RULER_INFORM_CANCELLED:
+            return "RMC_OTA_RULER_INFORM_CANCELLED";
+    }
+}
+
+static char *
+__limRulerStateToString(eRmcRulerState state)
+{
+    switch (state)
+    {
+        default:
+            return "Invalid";
+        case eRMC_IS_NOT_A_RULER:
+            return "Device Not a Ruler";
+        case eRMC_RULER_PENDING:
+            return "Pending firmware resp";
+        case eRMC_IS_A_RULER:
+            return "Device is Ruler";
+    }
+}
+
+static char *
+__limMcastTxStateToString(eRmcMcastTxState state)
+{
+    switch (state)
+    {
+        default:
+            return "Invalid";
+        case eRMC_RULER_NOT_SELECTED:
+            return "Not Selected";
+        case eRMC_RULER_ENABLE_REQUESTED:
+            return "Enable Requested";
+        case eRMC_RULER_OTA_REQUEST_SENT:
+            return "OTA Request Sent";
+        case eRMC_RULER_ACTIVE:
+            return "Active";
+    }
+}
+
+/**
+ * __rmcRulerSelectTimerHandler()
+ *
+ *FUNCTION:
+ * This function is called upon timer expiry.
+ *
+ *
+ *ASSUMPTIONS:
+ * NA
+ *
+ *NOTE:
+ * Only one entry is processed for every invocation if this routine.
+ * This allows us to use a single timer and makes sure we do not
+ * timeout a request too early.
+ *
+ * @param  param - Message corresponding to the timer that expired
+ *
+ * @return None
+ */
+
+void
+__rmcRulerSelectTimerHandler(void *pMacGlobal, tANI_U32 param)
+{
+    tpAniSirGlobal pMac = (tpAniSirGlobal)pMacGlobal;
+    tSirMacAddr zeroMacAddr = { 0, 0, 0, 0, 0, 0 };
+    tSirRetStatus status;
+    tSirRMCInfo RMC;
+    tpPESession psessionEntry;
+    tANI_U32 cfgValue;
+
+    /*
+     * This API relies on a single active IBSS session.
+     */
+    psessionEntry = limIsIBSSSessionActive(pMac);
+    if (NULL == psessionEntry)
+    {
+        PELOGE(limLog(pMac, LOGE,
+             FL("RMC:__rmcRulerSelectTimerHandler:No active IBSS"));)
+        return;
+    }
+
+    if (wlan_cfgGetInt(pMac, WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY,
+                  &cfgValue) != eSIR_SUCCESS)
+    {
+        /**
+         * Could not get Action Period Frequency value
+         * from CFG. Log error.
+         */
+        limLog(pMac, LOGE, FL("could not retrieve ActionPeriodFrequency"));
+    }
+
+    cfgValue = SYS_MS_TO_TICKS(cfgValue);
+
+    if (pMac->rmcContext.rmcTimerValInTicks != cfgValue)
+    {
+        limLog(pMac, LOG1, FL("RMC RulerSelect timer value changed"));
+        if (tx_timer_change(&pMac->rmcContext.gRmcRulerSelectTimer,
+                 cfgValue, 0) != TX_SUCCESS)
+        {
+            limLog(pMac, LOGE,
+                FL("Unable to change RulerSelect Timer val"));
+        }
+        pMac->rmcContext.rmcTimerValInTicks = cfgValue;
+    }
+
+    /*
+     * If we are in the scanning state then we need to return
+     * from this function without any further processing
+     */
+    if (eLIM_HAL_SCANNING_STATE == pMac->lim.gLimHalScanState)
+    {
+        limLog(pMac, LOG1, FL("In scanning state, can't send action frm"));
+        if (tx_timer_activate(&pMac->rmcContext.gRmcRulerSelectTimer) !=
+            TX_SUCCESS)
+        {
+            limLog(pMac, LOGE, FL("In scanning state, "
+                                  "couldn't activate RMC RulerSelect timer"));
+        }
+        return;
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+             FL("__rmcRulerSelectTimerHandler lock acquire failed"));
+        if (tx_timer_activate(&pMac->rmcContext.gRmcRulerSelectTimer)!= TX_SUCCESS)
+        {
+            limLog(pMac, LOGE, FL("could not activate RMC RulerSelect timer"));
+        }
+        return;
+    }
+
+    vos_mem_copy(&RMC.mcastRuler, &pMac->rmcContext.ruler,
+                     sizeof(tSirMacAddr));
+
+    if (VOS_FALSE == vos_mem_compare(&zeroMacAddr,
+                            &pMac->rmcContext.ruler, sizeof(tSirMacAddr)))
+    {
+        limLog(pMac, LOG1,
+               FL("RMC Periodic Ruler_Select Ruler " MAC_ADDRESS_STR),
+                   MAC_ADDR_ARRAY(pMac->rmcContext.ruler));
+        /*
+         * Re-arm timer
+         */
+        if (tx_timer_activate(&pMac->rmcContext.gRmcRulerSelectTimer)!=
+            TX_SUCCESS)
+        {
+            limLog(pMac, LOGE, FL("could not activate RMC Response timer"));
+        }
+
+        if (!VOS_IS_STATUS_SUCCESS
+                (vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+        {
+            limLog(pMac, LOGE,
+                FL("RMC: __rmcRulerSelectTimerHandler lock release failed"));
+        }
+    }
+    else
+    {
+        limLog(pMac, LOGE,
+               FL("RMC Deactivating timer because no ruler was selected"));
+
+        if (!VOS_IS_STATUS_SUCCESS
+                (vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+        {
+            limLog(pMac, LOGE,
+                FL("RMC: __rmcRulerSelectTimerHandler lock release failed"));
+        }
+
+        return;
+    }
+
+    RMC.dialogToken = 0;
+    RMC.action = SIR_MAC_RMC_RULER_INFORM_SELECTED;
+
+    status = limSendRMCActionFrame(pMac,
+                          SIR_MAC_RMC_MCAST_ADDRESS,
+                          &RMC,
+                          psessionEntry);
+
+    if (eSIR_FAILURE == status)
+    {
+        PELOGE(limLog(pMac, LOGE,
+         FL("RMC:__rmcRulerSelectTimerHandler Action frame send failed"));)
+    }
+
+    return;
+}
+
+static void
+__limProcessRMCEnableRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
+{
+    tSirSetRMCReq *setRmcReq = (tSirSetRMCReq *)pMsgBuf;
+    tpPESession psessionEntry;
+
+    if (!setRmcReq)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Enable:NULL message") );)
+        return;
+    }
+
+    pMac->rmcContext.rmcEnabled = TRUE;
+
+    /*
+     * This API relies on a single active IBSS session.
+     */
+    psessionEntry = limIsIBSSSessionActive(pMac);
+    if (NULL == psessionEntry)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC:Enable RMC request no active IBSS"));)
+        pMac->rmcContext.state = eRMC_RULER_NOT_SELECTED;
+        return;
+    }
+
+    /* Send RULER_REQ to f/w */
+    __limPostMsgRulerReq(pMac, eRMC_SUGGEST_RULER_CMD,
+                        setRmcReq->mcastTransmitter);
+
+    pMac->rmcContext.state = eRMC_RULER_ENABLE_REQUESTED;
+}
+
+static void
+__limProcessRMCDisableRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
+{
+    tpPESession psessionEntry;
+    tSirRMCInfo RMC;
+    tSirSetRMCReq *setRmcReq = (tSirSetRMCReq *)pMsgBuf;
+    tSirRetStatus status;
+    v_PVOID_t pvosGCtx;
+    VOS_STATUS vos_status;
+    v_MACADDR_t vosMcastTransmitter;
+
+    pMac->rmcContext.rmcEnabled = FALSE;
+
+    /*
+     * This API relies on a single active IBSS session.
+     */
+    psessionEntry = limIsIBSSSessionActive(pMac);
+    if (NULL == psessionEntry)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Disable:No active IBSS"));)
+        return;
+    }
+
+    if (!setRmcReq)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Disable:NULL message") );)
+        return;
+    }
+
+    /* Cancel pending timer */
+    tx_timer_deactivate(&pMac->rmcContext.gRmcRulerSelectTimer);
+
+    vosMcastTransmitter.bytes[0] = psessionEntry->selfMacAddr[0];
+    vosMcastTransmitter.bytes[1] = psessionEntry->selfMacAddr[1];
+    vosMcastTransmitter.bytes[2] = psessionEntry->selfMacAddr[2];
+    vosMcastTransmitter.bytes[3] = psessionEntry->selfMacAddr[3];
+    vosMcastTransmitter.bytes[4] = psessionEntry->selfMacAddr[4];
+    vosMcastTransmitter.bytes[5] = psessionEntry->selfMacAddr[5];
+
+    pvosGCtx = vos_get_global_context(VOS_MODULE_ID_PE, (v_VOID_t *) pMac);
+    vos_status = WLANTL_DisableRMC(pvosGCtx, &vosMcastTransmitter);
+
+    if (VOS_STATUS_SUCCESS != vos_status)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC:Disable: TL disable failed"));)
+    }
+
+    if (pMac->rmcContext.state == eRMC_RULER_ACTIVE)
+    {
+        RMC.dialogToken = 0;
+        RMC.action = SIR_MAC_RMC_RULER_INFORM_CANCELLED;
+        vos_mem_copy(&RMC.mcastRuler, &pMac->rmcContext.ruler, sizeof(tSirMacAddr));
+
+        status = limSendRMCActionFrame(pMac, pMac->rmcContext.ruler,
+                             &RMC, psessionEntry);
+        if (eSIR_FAILURE == status)
+        {
+            PELOGE(limLog(pMac, LOGE, FL("RMC:Disable: Action frame send failed"));)
+        }
+
+        pMac->rmcContext.state = eRMC_RULER_NOT_SELECTED;
+    }
+
+    __limPostMsgUpdateInd(pMac, eRMC_RULER_CANCELLED, eRMC_TRANSMITTER_ROLE,
+                         setRmcReq->mcastTransmitter, pMac->rmcContext.ruler);
+
+    vos_mem_zero(pMac->rmcContext.ruler, sizeof(tSirMacAddr));
+
+}
+
+static void
+__limProcessRMCRulerSelectResponse(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
+{
+    tSirRmcRulerSelectInd *pRmcRulerSelectInd;
+    tpPESession psessionEntry;
+    tSirRetStatus status;
+    v_PVOID_t pvosGCtx;
+    VOS_STATUS vos_status;
+    v_MACADDR_t vosMcastTransmitter;
+    tSirRMCInfo RMC;
+
+    if (NULL == pMsgBuf)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Ruler_Select_Resp:NULL message"));)
+        return;
+    }
+
+    /*
+     * This API relies on a single active IBSS session.
+     */
+    psessionEntry = limIsIBSSSessionActive(pMac);
+    if (NULL == psessionEntry)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC:Ruler_Select_Resp:No active IBSS"));)
+        pMac->rmcContext.state = eRMC_RULER_NOT_SELECTED;
+        return;
+    }
+
+    pRmcRulerSelectInd = (tSirRmcRulerSelectInd *)pMsgBuf;
+
+    if (pMac->rmcContext.state != eRMC_RULER_ENABLE_REQUESTED)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Ruler_Select_Resp:Bad state %s"),
+                        __limMcastTxStateToString(pMac->rmcContext.state) );)
+        return;
+    }
+
+    if (pRmcRulerSelectInd->status)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC:Ruler_Select_Resp:FW Status %d"),
+                        pRmcRulerSelectInd->status);)
+        pMac->rmcContext.state = eRMC_RULER_NOT_SELECTED;
+        return;
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE, FL("RMC:Ruler_Select_Resp:lock acquire failed"));
+        pMac->rmcContext.state = eRMC_RULER_NOT_SELECTED;
+        return;
+    }
+
+    vos_mem_copy(&pMac->rmcContext.ruler, &pRmcRulerSelectInd->ruler[0],
+                 sizeof(tSirMacAddr));
+
+    if (!VOS_IS_STATUS_SUCCESS
+            (vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE, FL("RMC: Ruler_Select_Resp: lock release failed"));
+    }
+
+    RMC.dialogToken = 0;
+    RMC.action = SIR_MAC_RMC_RULER_INFORM_SELECTED;
+    vos_mem_copy(&RMC.mcastRuler, &pRmcRulerSelectInd->ruler[0],
+                 sizeof(tSirMacAddr));
+
+    PELOG1(limLog(pMac, LOG1, FL("RMC: Ruler_Select :ruler " MAC_ADDRESS_STR),
+             MAC_ADDR_ARRAY(pRmcRulerSelectInd->ruler[0]));)
+
+    status = limSendRMCActionFrame(pMac,
+                          SIR_MAC_RMC_MCAST_ADDRESS,
+                          &RMC,
+                          psessionEntry);
+
+    if (eSIR_FAILURE == status)
+    {
+        PELOGE(limLog(pMac, LOGE,
+         FL("RMC: Ruler_Select_Resp: Action send failed"));)
+    }
+
+    __limPostMsgUpdateInd(pMac, eRMC_RULER_ACCEPTED, eRMC_TRANSMITTER_ROLE,
+                 psessionEntry->selfMacAddr, pMac->rmcContext.ruler);
+
+    vosMcastTransmitter.bytes[0] = psessionEntry->selfMacAddr[0];
+    vosMcastTransmitter.bytes[1] = psessionEntry->selfMacAddr[1];
+    vosMcastTransmitter.bytes[2] = psessionEntry->selfMacAddr[2];
+    vosMcastTransmitter.bytes[3] = psessionEntry->selfMacAddr[3];
+    vosMcastTransmitter.bytes[4] = psessionEntry->selfMacAddr[4];
+    vosMcastTransmitter.bytes[5] = psessionEntry->selfMacAddr[5];
+
+    /* Enable TL */
+    pvosGCtx = vos_get_global_context(VOS_MODULE_ID_PE, (v_VOID_t *) pMac);
+    vos_status = WLANTL_EnableRMC(pvosGCtx, &vosMcastTransmitter);
+
+    pMac->rmcContext.state = eRMC_RULER_ACTIVE;
+
+    if (tx_timer_activate(&pMac->rmcContext.gRmcRulerSelectTimer)!= TX_SUCCESS)
+    {
+        limLog(pMac, LOGE,
+         FL("Ruler_Select_Resp:Activate RMC Response timer failed"));
+    }
+}
+
+static void
+__limProcessRMCRulerPickNew(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
+{
+    tSirRmcUpdateInd *pRmcUpdateInd;
+    tpPESession psessionEntry;
+    tSirRetStatus status;
+    tSirRMCInfo RMC;
+    v_PVOID_t pvosGCtx;
+    VOS_STATUS vos_status;
+    v_MACADDR_t vosMcastTransmitter;
+    tSirMacAddr zeroMacAddr = { 0, 0, 0, 0, 0, 0 };
+
+    if (NULL == pMsgBuf)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Ruler_Pick_New:NULL message"));)
+        return;
+    }
+
+    /*
+     * This API relies on a single active IBSS session.
+     */
+    psessionEntry = limIsIBSSSessionActive(pMac);
+    if (NULL == psessionEntry)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Ruler_Pick_New:No active IBSS"));)
+        return;
+    }
+
+    pvosGCtx = vos_get_global_context(VOS_MODULE_ID_PE, (v_VOID_t *) pMac);
+
+    pRmcUpdateInd = (tSirRmcUpdateInd *)pMsgBuf;
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE, FL("RMC:Ruler_Pick_New:lock acquire failed"));
+        return;
+    }
+
+
+    /* Fill out Action frame parameters */
+    RMC.dialogToken = 0;
+
+    if (VOS_FALSE == vos_mem_compare(&zeroMacAddr,
+                        &pRmcUpdateInd->mcastRuler,
+                        sizeof(tSirMacAddr)))
+    {
+
+        vos_mem_copy(&RMC.mcastRuler, &pRmcUpdateInd->mcastRuler,
+                     sizeof(tSirMacAddr));
+
+        RMC.action = SIR_MAC_RMC_RULER_INFORM_CANCELLED;
+        status = limSendRMCActionFrame(pMac,
+                         pRmcUpdateInd->mcastRuler,
+                         &RMC, psessionEntry);
+        if (eSIR_FAILURE == status)
+        {
+            PELOGE(limLog(pMac, LOGE,
+                FL("RMC:Ruler_Pick_New: Inform_Cancel Action send failed"));)
+            goto done;
+        }
+
+        vosMcastTransmitter.bytes[0] = psessionEntry->selfMacAddr[0];
+        vosMcastTransmitter.bytes[1] = psessionEntry->selfMacAddr[1];
+        vosMcastTransmitter.bytes[2] = psessionEntry->selfMacAddr[2];
+        vosMcastTransmitter.bytes[3] = psessionEntry->selfMacAddr[3];
+        vosMcastTransmitter.bytes[4] = psessionEntry->selfMacAddr[4];
+        vosMcastTransmitter.bytes[5] = psessionEntry->selfMacAddr[5];
+
+        vos_status = WLANTL_DisableRMC(pvosGCtx, &vosMcastTransmitter);
+
+        if (VOS_STATUS_SUCCESS != vos_status)
+        {
+            PELOGE(limLog(pMac, LOGE,
+                 FL("RMC:Ruler_Pick_New: TL disable failed"));)
+        }
+    }
+
+    vos_mem_copy(pMac->rmcContext.ruler, pRmcUpdateInd->ruler[0],
+                 sizeof(tSirMacAddr));
+
+    pMac->rmcContext.state = eRMC_RULER_NOT_SELECTED;
+
+    if (VOS_TRUE == vos_mem_compare(&zeroMacAddr,
+                        pMac->rmcContext.ruler,
+                        sizeof(tSirMacAddr)))
+    {
+        PELOGE(limLog(pMac, LOGE,
+           FL("RMC:Ruler_Pick_New: No candidate rulers available"));)
+        goto done;
+    }
+
+
+    RMC.action = SIR_MAC_RMC_RULER_INFORM_SELECTED;
+    vos_mem_copy(&RMC.mcastRuler, &pMac->rmcContext.ruler,
+                     sizeof(tSirMacAddr));
+    status = limSendRMCActionFrame(pMac, SIR_MAC_RMC_MCAST_ADDRESS,
+                         &RMC, psessionEntry);
+    if (eSIR_FAILURE == status)
+    {
+        PELOGE(limLog(pMac, LOGE,
+           FL("RMC:Ruler_Pick_New: Inform_Selected Action send failed"));)
+        goto done;
+    }
+
+    __limPostMsgUpdateInd(pMac, eRMC_RULER_ACCEPTED, eRMC_TRANSMITTER_ROLE,
+                         psessionEntry->selfMacAddr, pMac->rmcContext.ruler);
+
+    vosMcastTransmitter.bytes[0] = psessionEntry->selfMacAddr[0];
+    vosMcastTransmitter.bytes[1] = psessionEntry->selfMacAddr[1];
+    vosMcastTransmitter.bytes[2] = psessionEntry->selfMacAddr[2];
+    vosMcastTransmitter.bytes[3] = psessionEntry->selfMacAddr[3];
+    vosMcastTransmitter.bytes[4] = psessionEntry->selfMacAddr[4];
+    vosMcastTransmitter.bytes[5] = psessionEntry->selfMacAddr[5];
+
+    /* Enable TL */
+    vos_status = WLANTL_EnableRMC(pvosGCtx, &vosMcastTransmitter);
+
+    if (VOS_STATUS_SUCCESS != vos_status)
+    {
+        PELOGE(limLog(pMac, LOGE,
+            FL("RMC:Ruler_Pick_New: TL enable failed"));)
+        goto done;
+    }
+
+    pMac->rmcContext.state = eRMC_RULER_ACTIVE;
+
+    if (tx_timer_activate(&pMac->rmcContext.gRmcRulerSelectTimer)!= TX_SUCCESS)
+    {
+        limLog(pMac, LOGE,
+         FL("Ruler_Pick_New:Activate RMC Response timer failed"));
+    }
+
+done:
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+            FL("RMC: Ruler_Pick_New: lock release failed"));
+    }
+}
+
+static void
+__limProcessRMCRulerInformSelected(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
+{
+    tpSirMacMgmtHdr pHdr;
+    tANI_U8 *pFrameData;
+    tANI_U32 frameLen;
+    tLimRmcGroupContext *entry;
+    tpPESession psessionEntry;
+    tSirRetStatus status;
+
+    if (!pMsgBuf)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Ruler_Inform:NULL msg"));)
+        return;
+    }
+
+    /*
+     * This API relies on a single active IBSS session.
+     */
+    psessionEntry = limIsIBSSSessionActive(pMac);
+    if (NULL == psessionEntry)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC:Become_Ruler_Resp:No active IBSS"));)
+        return;
+    }
+
+    /*
+     * Get the frame header
+     */
+    pHdr = WDA_GET_RX_MAC_HEADER((tANI_U8 *)pMsgBuf);
+
+    frameLen = WDA_GET_RX_PAYLOAD_LEN((tANI_U8 *)pMsgBuf);
+    if (frameLen < sizeof(tSirMacIbssExtNetworkFrameHdr))
+    {
+        PELOGE(limLog(pMac, LOGE,
+             FL("RMC: Ruler_Inform:Bad length %d "), frameLen);)
+        return;
+    }
+
+    pFrameData = WDA_GET_RX_MPDU_DATA((tANI_U8 *)pMsgBuf) +
+                    sizeof(tSirMacIbssExtNetworkFrameHdr);
+
+    if (!pFrameData)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Ruler_Inform:NULL data"));)
+        return;
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE, FL("RMC:Become_Ruler_Resp:lock acquire failed"));
+        return;
+    }
+
+    /*
+     * Check if this transmitter exists in our database.
+     */
+    entry = __rmcGroupLookupHashEntry(pMac, pHdr->sa);
+
+    if (VOS_FALSE == vos_mem_compare(pFrameData, psessionEntry->selfMacAddr,
+                                     sizeof(tSirMacAddr)))
+    {
+        if (entry)
+        {
+            PELOG1(limLog(pMac, LOG1,
+                 FL("RMC: Ruler_Inform: Ruler Cancelled"));)
+
+            __limPostMsgUpdateInd(pMac, eRMC_RULER_CANCELLED,
+                      eRMC_RULER_ROLE, pHdr->sa, psessionEntry->selfMacAddr);
+
+            /*
+             * Delete hash entry for this Group address.
+             */
+            status = __rmcGroupDeleteHashEntry(pMac, pHdr->sa);
+            if (eSIR_FAILURE == status)
+            {
+                PELOGE(limLog(pMac, LOGE,
+                      FL("RMC: Ruler_Inform:hash delete failed"));)
+            }
+        }
+    }
+    else
+    {
+        if (NULL == entry)
+        {
+            /* Add the transmitter address to the hash */
+            entry = __rmcGroupInsertHashEntry(pMac, pHdr->sa);
+            if (entry)
+            {
+                if (entry->isRuler != eRMC_RULER_PENDING)
+                {
+                    __limPostMsgRulerReq(pMac, eRMC_BECOME_RULER_CMD,
+                                         pHdr->sa);
+                    entry->isRuler = eRMC_RULER_PENDING;
+                }
+            }
+            else
+            {
+                PELOGE(limLog(pMac, LOGE,
+                         FL("RMC: Ruler_Inform:Hash insert failed"));)
+            }
+
+        }
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+            FL("RMC: Ruler_Inform: lock release failed"));
+    }
+
+}
+
+static void
+__limProcessRMCBecomeRulerResp(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
+{
+    tSirRmcBecomeRulerInd *pRmcBecomeRulerInd;
+    tLimRmcGroupContext *entry;
+    tSirRetStatus status = eSIR_SUCCESS;
+
+    if (NULL == pMsgBuf)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Become_Ruler_Resp:NULL message"));)
+        return;
+    }
+
+    pRmcBecomeRulerInd = (tSirRmcBecomeRulerInd *)pMsgBuf;
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE, FL("RMC:Become_Ruler_Resp:lock acquire failed"));
+        return;
+    }
+
+    /*
+     * Find the entry for this Group Address.
+     */
+    entry = __rmcGroupLookupHashEntry(pMac,
+                  pRmcBecomeRulerInd->mcastTransmitter);
+    if (NULL == entry)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Become_Ruler_Resp: No entry"));)
+        goto done;
+    }
+
+    if (pRmcBecomeRulerInd->status)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC:Become_Ruler_Resp:FW Status %d"),
+                        pRmcBecomeRulerInd->status);)
+        status = eSIR_FAILURE;
+        goto done;
+    }
+
+    if (entry->isRuler != eRMC_RULER_PENDING)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Become_Ruler_Resp:Bad state: %s"),
+                        __limRulerStateToString(entry->isRuler) );)
+        status = eSIR_FAILURE;
+        goto done;
+    }
+
+    entry->isRuler = eRMC_IS_A_RULER;
+
+done:
+    if (eSIR_FAILURE == status)
+    {
+        status = __rmcGroupDeleteHashEntry(pMac,
+                       pRmcBecomeRulerInd->mcastTransmitter);
+        if (eSIR_FAILURE == status)
+        {
+            PELOGE(limLog(pMac, LOGE,
+                      FL("RMC: Become_Ruler_Resp:hash delete failed"));)
+        }
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+            FL("RMC: Become_Ruler_Resp: lock release failed"));
+    }
+
+    return;
+}
+
+static void
+__limProcessRMCRulerInformCancelled(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
+{
+    tpSirMacMgmtHdr pHdr;
+    tANI_U8 *pFrameData;
+    tANI_U32 frameLen;
+    tSirRetStatus status;
+    tLimRmcGroupContext *entry;
+    tpPESession psessionEntry;
+
+    if (!pMsgBuf)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Ruler_Inform_Cancel:NULL msg"));)
+        return;
+    }
+
+    /*
+     * This API relies on a single active IBSS session.
+     */
+    psessionEntry = limIsIBSSSessionActive(pMac);
+    if (NULL == psessionEntry)
+    {
+        PELOGE(limLog(pMac, LOGE,
+             FL("RMC:Ruler_Inform_Cancel:No active IBSS"));)
+        return;
+    }
+
+    pHdr = WDA_GET_RX_MAC_HEADER((tANI_U8 *)pMsgBuf);
+
+    frameLen = WDA_GET_RX_PAYLOAD_LEN((tANI_U8 *)pMsgBuf);
+    if (frameLen < sizeof(tSirMacIbssExtNetworkFrameHdr))
+    {
+        PELOGE(limLog(pMac, LOGE,
+             FL("RMC: Ruler_Inform:Bad length %d "), frameLen);)
+        return;
+    }
+
+    pFrameData = WDA_GET_RX_MPDU_DATA((tANI_U8 *)pMsgBuf) +
+                    sizeof(tSirMacIbssExtNetworkFrameHdr);
+
+    if (!pFrameData)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Ruler_Inform_Cancel:NULL data"));)
+        return;
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE, FL("RMC:Ruler_Inform_Cancel lock acquire failed"));
+        return;
+    }
+
+    /*
+     * Find the entry for this Group Address.
+     */
+    entry = __rmcGroupLookupHashEntry(pMac, pHdr->sa);
+    if (NULL == entry)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Ruler_Inform_Cancel: No entry"));)
+        goto done;
+    }
+
+    __limPostMsgUpdateInd(pMac, eRMC_RULER_CANCELLED,
+                     eRMC_RULER_ROLE, pHdr->sa, psessionEntry->selfMacAddr);
+
+    /*
+     * Delete hash entry for this Group address.
+     */
+    status = __rmcGroupDeleteHashEntry(pMac, pHdr->sa);
+    if (eSIR_FAILURE == status)
+    {
+        PELOGE(limLog(pMac, LOGE,
+                  FL("RMC: Ruler_Inform_Cancel:hash delete failed"));)
+    }
+
+done:
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+            FL("RMC: Ruler_Inform_Cancel: lock release failed"));
+    }
+    return;
+}
+
+void
+limProcessRMCMessages(tpAniSirGlobal pMac, eRmcMessageType msgType,
+                      tANI_U32 *pMsgBuf)
+{
+
+    if (pMsgBuf == NULL)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: Buffer is Pointing to NULL"));)
+        return;
+    }
+
+    limLog(pMac, LOG1, FL("RMC: limProcessRMCMessages: %s"),
+                        __limRulerMessageToString(msgType));
+
+    switch (msgType)
+    {
+        case eLIM_RMC_ENABLE_REQ:
+            __limProcessRMCEnableRequest(pMac, pMsgBuf);
+            break;
+
+        case eLIM_RMC_DISABLE_REQ:
+            __limProcessRMCDisableRequest(pMac, pMsgBuf);
+            break;
+
+        case eLIM_RMC_RULER_SELECT_RESP:
+            __limProcessRMCRulerSelectResponse(pMac, pMsgBuf);
+            break;
+
+        case eLIM_RMC_RULER_PICK_NEW:
+            __limProcessRMCRulerPickNew(pMac, pMsgBuf);
+            break;
+
+        case eLIM_RMC_OTA_RULER_INFORM_SELECTED:
+            __limProcessRMCRulerInformSelected(pMac, pMsgBuf);
+            break;
+
+        case eLIM_RMC_BECOME_RULER_RESP:
+            __limProcessRMCBecomeRulerResp(pMac, pMsgBuf);
+            break;
+
+        case eLIM_RMC_OTA_RULER_INFORM_CANCELLED:
+            __limProcessRMCRulerInformCancelled(pMac, pMsgBuf);
+            break;
+
+
+        default:
+            break;
+    } // switch (msgType)
+    return;
+} /*** end limProcessRMCMessages() ***/
+
+void
+limRmcInit(tpAniSirGlobal pMac)
+{
+    tANI_U32 cfgValue;
+
+    if (wlan_cfgGetInt(pMac, WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY,
+                  &cfgValue) != eSIR_SUCCESS)
+    {
+        /**
+         * Could not get Action Period Frequency value
+         * from CFG. Log error.
+         */
+        limLog(pMac, LOGP, FL("could not retrieve ActionPeriodFrequency"));
+    }
+
+    cfgValue = SYS_MS_TO_TICKS(cfgValue);
+
+    vos_mem_zero(&pMac->rmcContext, sizeof(pMac->rmcContext));
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_init(&pMac->rmcContext.lkRmcLock)))
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC lock init failed!"));)
+    }
+
+    if (tx_timer_create(&pMac->rmcContext.gRmcRulerSelectTimer,
+                            "RMC RSP TIMEOUT",
+                            __rmcRulerSelectTimerHandler,
+                            0 /* param */,
+                            cfgValue, 0,
+                            TX_NO_ACTIVATE) != TX_SUCCESS)
+    {
+        limLog(pMac, LOGE, FL("could not create RMC response timer"));
+    }
+
+    pMac->rmcContext.rmcTimerValInTicks = cfgValue;
+}
+
+void
+limRmcCleanup(tpAniSirGlobal pMac)
+{
+    limRmcIbssDelete(pMac);
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_destroy(&pMac->rmcContext.lkRmcLock)))
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC lock destroy failed!"));)
+    }
+
+    tx_timer_delete(&pMac->rmcContext.gRmcRulerSelectTimer);
+}
+
+void
+limRmcTransmitterDelete(tpAniSirGlobal pMac, tSirMacAddr transmitter)
+{
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+             FL("RMC: limRMCTransmitterDelete lock acquire failed"));
+        return;
+    }
+
+    __rmcGroupDeleteHashEntry(pMac, transmitter);
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+            FL("RMC: limRMCTransmitterDelete lock release failed"));
+    }
+
+    limLog(pMac, LOG1, FL("RMC: limRmcTransmitterDelete complete"));
+}
+
+void
+limRmcIbssDelete(tpAniSirGlobal pMac)
+{
+    tpPESession psessionEntry;
+    tSirMacAddr zeroMacAddr = { 0, 0, 0, 0, 0, 0 };
+
+    /*
+     * This API relies on a single active IBSS session.
+     */
+    psessionEntry = limIsIBSSSessionActive(pMac);
+    if (NULL == psessionEntry)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("RMC: limRmcIbssDelete:No active IBSS"));)
+        return;
+    }
+
+    if (VOS_FALSE == vos_mem_compare(&zeroMacAddr,
+                            &pMac->rmcContext.ruler, sizeof(tSirMacAddr)))
+    {
+        __limPostMsgUpdateInd(pMac, eRMC_RULER_CANCELLED,
+                         eRMC_TRANSMITTER_ROLE, psessionEntry->selfMacAddr,
+                         pMac->rmcContext.ruler);
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+             FL("RMC: limRmcIbssDelete lock acquire failed"));
+        return;
+    }
+
+    /* Cancel pending timer */
+    tx_timer_deactivate(&pMac->rmcContext.gRmcRulerSelectTimer);
+
+    /* Delete all entries from Ruler database. */
+    __rmcGroupDeleteAllEntries(pMac);
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+            FL("RMC: limRmcIbssDelete lock release failed"));
+    }
+
+    limLog(pMac, LOG1, FL("RMC: limRmcIbssDelete complete"));
+}
+
+void
+limRmcDumpStatus(tpAniSirGlobal pMac)
+{
+    tLimRmcGroupContext *entry;
+    int index, count;
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+             FL("RMC: limRmcDumpStatus lock acquire failed"));
+        return;
+    }
+
+
+    limLog(pMac, LOGE, FL(" ----- RMC Transmitter Information ----- \n"));
+    limLog(pMac, LOGE,
+         FL("   Ruler Address   |  RMC State \n"));
+
+    if (pMac->rmcContext.state != eRMC_RULER_NOT_SELECTED)
+    {
+        limLog(pMac,LOGE, FL( MAC_ADDRESS_STR " | %s\n"),
+                         MAC_ADDR_ARRAY(pMac->rmcContext.ruler),
+                        __limMcastTxStateToString(pMac->rmcContext.state));
+    }
+
+    limLog( pMac,LOGE, FL(" ----- RMC Ruler Information ----- \n"));
+    limLog( pMac,LOGE, FL("  Transmitter Address\n"));
+
+    count = 0;
+    for (index = 0; index < RMC_MCAST_GROUPS_HASH_SIZE; index++)
+    {
+        entry = pMac->rmcContext.rmcGroupRxHashTable[index];
+
+        while (entry)
+        {
+            count++;
+            limLog( pMac,LOGE, FL("%d. " MAC_ADDRESS_STR " \n"),
+                    count, MAC_ADDR_ARRAY(entry->transmitter));
+            entry = entry->next;
+        }
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_release(&pMac->rmcContext.lkRmcLock)))
+    {
+        limLog(pMac, LOGE,
+            FL("RMC: limRmcDumpStatus lock release failed"));
+    }
+
+    return;
+
+}
+
+VOS_STATUS
+limRmcTriggerRulerSelection(tpAniSirGlobal pMac, tSirMacAddr macAddr)
+{
+    if ((TRUE == pMac->rmcContext.rmcEnabled) &&
+        (eRMC_RULER_NOT_SELECTED == pMac->rmcContext.state))
+    {
+        limLog(pMac, LOG1,
+          FL("Ruler selection trigerred in FW"));
+
+        __limPostMsgRulerReq(pMac, eRMC_SUGGEST_RULER_CMD, macAddr);
+
+        pMac->rmcContext.state = eRMC_RULER_ENABLE_REQUESTED;
+
+        return VOS_STATUS_SUCCESS;
+    }
+    else
+    {
+        limLog(pMac, LOG1,
+          FL("Could not trigger ruler selection: RMC state %d rmcEnabled %d"),
+          pMac->rmcContext.state, pMac->rmcContext.rmcEnabled);
+
+        return VOS_STATUS_E_FAILURE;
+    }
+}
+
+#endif /* WLAN_FEATURE_RMC */
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limRMC.h b/wlan/prima/CORE/MAC/src/pe/lim/limRMC.h
new file mode 100644
index 0000000..1ebf0de
--- /dev/null
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limRMC.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ *
+ * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+ *
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This file was originally distributed by Qualcomm Atheros, Inc.
+ * under proprietary terms before Copyright ownership was assigned
+ * to the Linux Foundation.
+ */
+
+/*
+ *
+ * Date:          08/15/13
+ * History:-
+ * Date           Modified by    Modification Information
+ * --------------------------------------------------------------------
+ */
+#ifndef __LIM_RMC_H
+#define __LIM_RMC_H
+
+#ifdef WLAN_FEATURE_RMC
+
+typedef enum {
+    eLIM_RMC_ENABLE_REQ = 0,
+    eLIM_RMC_DISABLE_REQ = 1,
+    eLIM_RMC_BECOME_RULER_RESP = 2,
+    eLIM_RMC_RULER_SELECT_RESP = 3,
+    eLIM_RMC_RULER_PICK_NEW = 4,
+    eLIM_RMC_OTA_RULER_INFORM_CANCELLED = 5,
+    eLIM_RMC_OTA_RULER_INFORM_ACK = 6,
+    eLIM_RMC_OTA_RULER_INFORM_SELECTED = 7,
+} eRmcMessageType;
+
+typedef enum {
+    eRMC_RULER_NOT_SELECTED     = 0,
+    eRMC_RULER_ENABLE_REQUESTED = 1,
+    eRMC_RULER_OTA_REQUEST_SENT = 2,
+    eRMC_RULER_ACTIVE           = 3,
+} eRmcMcastTxState;
+
+typedef enum {
+    eRMC_IS_NOT_A_RULER = 0,
+    eRMC_RULER_PENDING = 1,
+    eRMC_IS_A_RULER = 2,
+} eRmcRulerState;
+
+enum {
+    eRMC_SUGGEST_RULER_CMD = 0,
+    eRMC_BECOME_RULER_CMD  = 1,
+};
+
+enum {
+    eRMC_RULER_ACCEPTED  = 0,     //Host-->FW
+    eRMC_RULER_CANCELLED = 1,     //Host-->FW
+    eRMC_RULER_PICK_NEW  = 2,     //FW-->Host
+};
+
+/* tRoleType; */
+typedef enum
+{
+    eRMC_RULER_ROLE,
+    eRMC_TRANSMITTER_ROLE,
+} eRmcRole;
+
+#define RMC_MCAST_GROUPS_HASH_SIZE 32
+
+typedef struct sLimRmcGroupContext
+{
+    tSirMacAddr          transmitter;
+    eRmcRulerState      isRuler;
+    struct sLimRmcGroupContext *next;
+} tLimRmcGroupContext, *tpLimRmcGroupContext;
+
+typedef struct sLimRmcContext
+{
+    tANI_BOOLEAN         rmcEnabled;
+    tSirMacAddr          ruler;
+    eRmcMcastTxState     state;
+    TX_TIMER             gRmcRulerSelectTimer;
+    tANI_U32             rmcTimerValInTicks;
+    vos_lock_t           lkRmcLock;
+    tLimRmcGroupContext *rmcGroupRxHashTable[RMC_MCAST_GROUPS_HASH_SIZE];
+} tLimRmcContext, *tpLimRmcContext;
+
+
+void limRmcInit(tpAniSirGlobal pMac);
+void limRmcCleanup(tpAniSirGlobal pMac);
+void limRmcTransmitterDelete(tpAniSirGlobal pMac, tSirMacAddr transmitter);
+void limRmcIbssDelete(tpAniSirGlobal pMac);
+void limRmcDumpStatus(tpAniSirGlobal pMac);
+
+VOS_STATUS
+limRmcTriggerRulerSelection(tpAniSirGlobal pMac, tSirMacAddr macAddr);
+#endif /* WLAN_FEATURE_RMC */
+
+#endif /*  __LIM_RMC_H */
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limScanResultUtils.c b/wlan/prima/CORE/MAC/src/pe/lim/limScanResultUtils.c
index afcbc31..26b3b5b 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limScanResultUtils.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limScanResultUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -125,14 +125,14 @@
  * @return None
  */
 #if defined WLAN_FEATURE_VOWIFI
-eHalStatus
+void
 limCollectBssDescription(tpAniSirGlobal pMac,
                          tSirBssDescription *pBssDescr,
                          tpSirProbeRespBeacon pBPR,
                          tANI_U8  *pRxPacketInfo,
                          tANI_U8  fScanning)
 #else
-eHalStatus
+void
 limCollectBssDescription(tpAniSirGlobal pMac,
                          tSirBssDescription *pBssDescr,
                          tpSirProbeRespBeacon pBPR,
@@ -153,26 +153,15 @@
     pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
     rfBand = WDA_GET_RX_RFBAND(pRxPacketInfo);
 
-    /**
-     * Drop all the beacons and probe response without P2P IE during P2P search
-     */
-    if (NULL != pMac->lim.gpLimMlmScanReq && pMac->lim.gpLimMlmScanReq->p2pSearch)
-    {
-        if (NULL == limGetP2pIEPtr(pMac, (pBody + SIR_MAC_B_PR_SSID_OFFSET), ieLen))
-        {
-            limLog( pMac, LOG3, MAC_ADDRESS_STR, MAC_ADDR_ARRAY(pHdr->bssId));
-            return eHAL_STATUS_FAILURE;
-        }
-    }
 
     /**
      * Length of BSS desription is without length of
      * length itself and length of pointer
-     * that holds the next BSS description
+     * that holds ieFields
      */
     pBssDescr->length = (tANI_U16)(
-                    sizeof(tSirBssDescription) - sizeof(tANI_U16) -
-                    sizeof(tANI_U32) + ieLen);
+                    ((uintptr_t)OFFSET_OF(tSirBssDescription, ieFields)) -
+                    sizeof(pBssDescr->length) + ieLen);
 
     // Copy BSS Id
     vos_mem_copy((tANI_U8 *) &pBssDescr->bssId,
@@ -187,7 +176,32 @@
     pBssDescr->beaconInterval = pBPR->beaconInterval;
     pBssDescr->capabilityInfo = limGetU16((tANI_U8 *) &pBPR->capabilityInfo);
 
-     if(!pBssDescr->beaconInterval )
+    pBssDescr->HTCapsPresent = 0;
+    pBssDescr->chanWidth = eHT_CHANNEL_WIDTH_20MHZ;
+    pBssDescr->wmeInfoPresent = 0;
+    pBssDescr->vhtCapsPresent = 0;
+    pBssDescr->beacomformingCapable = 0;
+    /* HT capability */
+    if (pBPR->HTCaps.present) {
+        pBssDescr->HTCapsPresent = 1;
+        if (pBPR->HTCaps.supportedChannelWidthSet)
+            pBssDescr->chanWidth = eHT_CHANNEL_WIDTH_40MHZ;
+    }
+    if (pBPR->wmeEdcaPresent)
+        pBssDescr->wmeInfoPresent = 1;
+
+#ifdef WLAN_FEATURE_11AC
+    /* VHT Parameters */
+    if (pBPR->VHTCaps.present) {
+        pBssDescr->vhtCapsPresent = 1;
+        if (pBPR->VHTCaps.muBeamformerCap)
+            pBssDescr->beacomformingCapable = 1;
+    }
+    if (pBPR->VHTOperation.present)
+        if (pBPR->VHTOperation.chanWidth == 1)
+            pBssDescr->chanWidth = eHT_CHANNEL_WIDTH_80MHZ;
+#endif
+    if(!pBssDescr->beaconInterval )
     {
 			        limLog(pMac, LOGW,
             FL("Beacon Interval is ZERO, making it to default 100 "
@@ -243,7 +257,7 @@
     //SINR no longer reported by HW
     pBssDescr->sinr = 0;
 
-    pBssDescr->nReceivedTime = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
+    pBssDescr->nReceivedTime = vos_timer_get_system_time();
 
 #if defined WLAN_FEATURE_VOWIFI
     if( fScanning )
@@ -270,13 +284,14 @@
     }
 #endif
 
-#ifdef FEATURE_WLAN_ESE
+#if defined(FEATURE_WLAN_ESE) || defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD)
     pBssDescr->QBSSLoad_present = FALSE;
     pBssDescr->QBSSLoad_avail = 0; 
     if( pBPR->QBSSLoad.present) 
     {
         pBssDescr->QBSSLoad_present = TRUE;
         pBssDescr->QBSSLoad_avail = pBPR->QBSSLoad.avail;
+        pBssDescr->QBSS_ChanLoad = pBPR->QBSSLoad.chautil;
     }
 #endif
     // Copy IE fields
@@ -292,7 +307,7 @@
         pBssDescr->aniIndicator,
         ieLen );
 
-    return eHAL_STATUS_SUCCESS;
+    return;
 } /*** end limCollectBssDescription() ***/
 
 /**
@@ -522,19 +537,11 @@
 
     // In scan state, store scan result.
 #if defined WLAN_FEATURE_VOWIFI
-    status = limCollectBssDescription(pMac, &pBssDescr->bssDescription,
+    limCollectBssDescription(pMac, &pBssDescr->bssDescription,
                              pBPR, pRxPacketInfo, fScanning);
-    if (eHAL_STATUS_SUCCESS != status)
-    {
-        goto last;
-    }
 #else
-    status = limCollectBssDescription(pMac, &pBssDescr->bssDescription,
+    limCollectBssDescription(pMac, &pBssDescr->bssDescription,
                              pBPR, pRxPacketInfo);
-    if (eHAL_STATUS_SUCCESS != status)
-    {
-        goto last;
-    }
 #endif
     pBssDescr->bssDescription.fProbeRsp = fProbeRsp;
 
@@ -609,12 +616,10 @@
         }
     }//(eANI_BOOLEAN_TRUE == fScanning)
 
-last:
     if( eHAL_STATUS_SUCCESS != status )
     {
         vos_mem_free( pBssDescr );
     }
-    return;
 } /****** end limCheckAndAddBssDescription() ******/
 
 
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limScanResultUtils.h b/wlan/prima/CORE/MAC/src/pe/lim/limScanResultUtils.h
index f9b43a0..28ea943 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limScanResultUtils.h
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limScanResultUtils.h
@@ -61,13 +61,13 @@
 tANI_U32 limDeactivateMinChannelTimerDuringScan(tpAniSirGlobal);
 void    limCheckAndAddBssDescription(tpAniSirGlobal, tpSirProbeRespBeacon, tANI_U8 *, tANI_BOOLEAN, tANI_U8);
 #if defined WLAN_FEATURE_VOWIFI
-eHalStatus    limCollectBssDescription(tpAniSirGlobal,
+void    limCollectBssDescription(tpAniSirGlobal,
                                  tSirBssDescription *,
                                  tpSirProbeRespBeacon,
                                  tANI_U8 *,
                                  tANI_U8);
 #else
-eHalStatus    limCollectBssDescription(tpAniSirGlobal,
+void    limCollectBssDescription(tpAniSirGlobal,
                                  tSirBssDescription *,
                                  tpSirProbeRespBeacon,
                                  tANI_U8 *);
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/wlan/prima/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index 4403bda..b5a926d 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -2310,21 +2310,9 @@
      */
     else
     {
-        if(extractedExtCap.interworkingService)
-        {
+        if (extractedExtCap.interworkingService)
             extractedExtCap.qosMap = 1;
-        }
-        /* No need to merge the EXT Cap from Supplicant
-         * if interworkingService is not set, as currently
-         * driver is only interested in interworkingService
-         * capability from supplicant. if in
-         * future any other EXT Cap info is required from
-         * supplicant it needs to be handled here.
-         */
-        else
-        {
-            extractedExtCapFlag = eANI_BOOLEAN_FALSE;
-        }
+        extractedExtCapFlag = lim_is_ext_cap_ie_present(&extractedExtCap);
     }
 
     caps = pMlmAssocReq->capabilityInfo;
@@ -2657,7 +2645,10 @@
     {
         txFlag |= HAL_USE_PEER_STA_REQUESTED_MASK;
     }
-
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_ASSOC_START_EVENT, psessionEntry,
+            eSIR_SUCCESS, eSIR_SUCCESS);
+#endif
     pMacHdr = ( tpSirMacMgmtHdr ) pFrame;
     limLog( pMac, LOG1, FL("Sending Assoc req over WQ5 to "MAC_ADDRESS_STR
               " From " MAC_ADDRESS_STR),MAC_ADDR_ARRAY(pMacHdr->da),
@@ -3120,21 +3111,33 @@
         vos_mem_free(psessionEntry->assocReq);
         psessionEntry->assocReq = NULL;
     }
-
-    psessionEntry->assocReq = vos_mem_malloc(ft_ies_length);
-    if ( NULL == psessionEntry->assocReq )
+    if (ft_ies_length)
     {
-        PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc request"));)
-        psessionEntry->assocReqLen = 0;
+        psessionEntry->assocReq = vos_mem_malloc(ft_ies_length);
+        if (NULL == psessionEntry->assocReq)
+        {
+            limLog(pMac, LOGE,
+                        FL("Unable to allocate memory for FT IEs"));
+            psessionEntry->assocReqLen = 0;
+        }
+        else
+        {
+            /* Store the FT IEs. This is sent to csr/hdd in join cnf response.*/
+            vos_mem_copy(psessionEntry->assocReq,
+                    pMac->ft.ftSmeContext.reassoc_ft_ies,
+                    (ft_ies_length));
+            psessionEntry->assocReqLen = ft_ies_length;
+        }
     }
     else
     {
-       //Store the Assoc request. This is sent to csr/hdd in join cnf response. 
-       vos_mem_copy( psessionEntry->assocReq, pMac->ft.ftSmeContext.reassoc_ft_ies,
-                    (ft_ies_length));
-       psessionEntry->assocReqLen = (ft_ies_length);
+        limLog(pMac, LOG1, FL("FT IEs not present"));
+        psessionEntry->assocReqLen = 0;
     }
-
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_REASSOC_START_EVENT, psessionEntry,
+            eSIR_SUCCESS, eSIR_SUCCESS);
+#endif
     MTRACE(macTrace(pMac, TRACE_CODE_TX_MGMT,
            psessionEntry->peSessionId,
            pMacHdr->fc.subType));
@@ -3559,6 +3562,10 @@
     {
         txFlag |= HAL_USE_PEER_STA_REQUESTED_MASK;
     }
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_REASSOC_START_EVENT, psessionEntry,
+             eSIR_SUCCESS, eSIR_SUCCESS);
+#endif
 
     MTRACE(macTrace(pMac, TRACE_CODE_TX_MGMT,
            psessionEntry->peSessionId,
@@ -3639,6 +3646,11 @@
     }
     else
        pMac->authAckStatus = LIM_AUTH_ACK_RCD_FAILURE;
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_AUTH_START_EVENT, NULL,
+                       pMac->authAckStatus, eSIR_SUCCESS);
+#endif
+
     return eHAL_STATUS_SUCCESS;
 }
 
@@ -7001,3 +7013,140 @@
    return nSirStatus;
 } // End limSendSaQueryResponseFrame
 #endif
+
+#ifdef WLAN_FEATURE_RMC
+tSirRetStatus
+limSendRMCActionFrame(tpAniSirGlobal  pMac,
+                        tSirMacAddr   peerMacAddr,
+                        tSirRMCInfo  *pRMC,
+                        tpPESession   psessionEntry)
+{
+    tSirRetStatus    nSirStatus;
+    tANI_U8         *pFrame;
+    tDot11fRMC       RMC;
+    tANI_U32         nPayload, nBytes, nStatus;
+    tpSirMacMgmtHdr  pMacHdr;
+    void            *pPacket;
+    eHalStatus       halstatus;
+    tANI_U8          txFlag = 0;
+    tANI_U8 MagicCode[] = { 0x4f, 0x58, 0x59, 0x47, 0x45, 0x4e };
+
+    if (NULL == psessionEntry)
+    {
+       return eSIR_FAILURE;
+    }
+
+    vos_mem_set(( tANI_U8* )&RMC, sizeof( RMC ), 0);
+
+    RMC.Action.action     = pRMC->action;
+    RMC.RMCDialogToken.token = pRMC->dialogToken;
+    RMC.Category.category = SIR_MAC_ACTION_VENDOR_SPECIFIC_CATEGORY;
+    RMC.RMCVersion.version = SIR_MAC_RMC_VER;
+
+    vos_mem_copy(&RMC.RMCOUI.oui, SIR_MAC_RMC_OUI, SIR_MAC_RMC_OUI_SIZE);
+    vos_mem_copy(&RMC.MagicCode.magic, MagicCode, sizeof(MagicCode));
+
+    vos_mem_copy(&RMC.Ruler.mac, pRMC->mcastRuler, sizeof(tSirMacAddr));
+
+    nStatus = dot11fGetPackedRMCSize( pMac, &RMC, &nPayload );
+    if ( DOT11F_FAILED( nStatus ) )
+    {
+        limLog( pMac, LOGE, FL("Failed to calculate the packed size for "
+                               "an RMC (0x%08x)."),
+                nStatus );
+        // We'll fall back on the worst case scenario:
+        nPayload = sizeof( tDot11fRMC );
+    }
+    else if ( DOT11F_WARNED( nStatus ) )
+    {
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
+                               "the packed size for an RMC Action Frame"
+                               " (0x%08x)."), nStatus );
+    }
+
+    nBytes = nPayload + sizeof( tSirMacMgmtHdr );
+
+    halstatus = palPktAlloc( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
+                             ( tANI_U16 )nBytes, ( void** ) &pFrame,
+                             ( void** ) &pPacket );
+    if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
+    {
+        limLog( pMac, LOGP, FL("Failed to allocate %d bytes for an RMC "
+                               "Action Frame."), nBytes );
+        return eSIR_FAILURE;
+    }
+
+    // Paranoia:
+    vos_mem_set( pFrame, nBytes, 0 );
+
+    // Next, we fill out the buffer descriptor:
+    nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
+                    SIR_MAC_MGMT_ACTION, peerMacAddr,
+                    psessionEntry->selfMacAddr);
+    if ( eSIR_SUCCESS != nSirStatus )
+    {
+        limLog( pMac, LOGE, FL("Failed to populate the buffer descriptor "
+                               "for an RMC Action Frame (%d)."),
+                nSirStatus );
+        palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
+                    ( void* ) pFrame, ( void* ) pPacket );
+        return nSirStatus;
+    }
+
+    // Update A3 with the BSSID
+    pMacHdr = ( tpSirMacMgmtHdr ) pFrame;
+    sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
+
+    // That done, pack the struct:
+    nStatus = dot11fPackRMC( pMac, &RMC,
+                                      pFrame + sizeof(tSirMacMgmtHdr),
+                                      nPayload, &nPayload );
+    if ( DOT11F_FAILED( nStatus ) )
+    {
+        limLog( pMac, LOGE, FL("Failed to pack an RMC "
+                               "(0x%08x)."),
+                nStatus );
+        palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, ( void* ) pFrame,
+                     ( void* ) pPacket );
+        return eSIR_FAILURE;
+    }
+    else if ( DOT11F_WARNED( nStatus ) )
+    {
+        limLog( pMac, LOGW, FL("There were warnings while packing "
+                               "an RMC (0x%08x)."), nStatus );
+    }
+
+    limLog( pMac, LOG1, FL("Sending an RMC Action frame to "
+             MAC_ADDRESS_STR), MAC_ADDR_ARRAY(peerMacAddr));
+
+    /*
+     * With this masking, RMC action frames will be sent
+     * at self-sta rates for both 2G and 5G bands.
+     */
+    txFlag |= HAL_USE_SELF_STA_REQUESTED_MASK;
+
+    MTRACE(macTrace(pMac, TRACE_CODE_TX_MGMT,
+           psessionEntry->peSessionId,
+           pMacHdr->fc.subType));
+    // Queue RMC Action frame in high priority WQ
+    halstatus = halTxFrame( pMac, pPacket, ( tANI_U16 ) nBytes,
+                            HAL_TXRX_FRM_802_11_MGMT,
+                            ANI_TXDIR_TODS,
+                            7,//SMAC_SWBD_TX_TID_MGMT_HIGH,
+                            limTxComplete, pFrame, txFlag );
+    MTRACE(macTrace(pMac, TRACE_CODE_TX_COMPLETE,
+           psessionEntry->peSessionId,
+           halstatus));
+    if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
+    {
+        limLog( pMac, LOGE, FL( "*** Could not send an RMC Action frame"
+                                " (%X) ***" ), halstatus );
+        //Pkt will be freed up by the callback
+        return eSIR_FAILURE;
+    }
+
+    return eSIR_SUCCESS;
+
+} // End limSendRMCActionFrame.
+
+#endif /* WLAN_FEATURE_RMC */
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limSendMessages.c b/wlan/prima/CORE/MAC/src/pe/lim/limSendMessages.c
index 0b48288..91e028b 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limSendMessages.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limSendMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -798,7 +798,9 @@
     tANI_U8            *ptr;
     tANI_U32           i;
     tANI_U32           msgSize;
+    tANI_BOOLEAN       ignore_secchannel_bcn_filter = false;
     tpBeaconFilterIe   pIe;
+    tpDphHashNode      pStaDs;
 
     if( psessionEntry == NULL )
     {
@@ -844,10 +846,36 @@
     //Fill the BSSIDX
     pBeaconFilterMsg->bssIdx = psessionEntry->bssIdx;
 
+    pStaDs = dphGetHashEntry(pMac, DPH_STA_HASH_INDEX_PEER,
+                            &psessionEntry->dph.dphHashTable);
+    if((psessionEntry->currentOperChannel <= RF_CHAN_14) &&
+       ((psessionEntry->htSupportedChannelWidthSet ==
+                                eHT_CHANNEL_WIDTH_20MHZ) ||
+        (pStaDs != NULL && (pStaDs->htSupportedChannelWidthSet ==
+                                eHT_CHANNEL_WIDTH_20MHZ))))
+    {
+        ignore_secchannel_bcn_filter = true;
+    }
+
     //Fill message with info contained in the beaconFilterTable
     ptr = (tANI_U8 *)pBeaconFilterMsg + sizeof(tBeaconFilterMsg);
     for(i=0; i < (pBeaconFilterMsg->ieNum); i++)
     {
+        /*
+        *Interoperability workaround:  TP-LINK TL-WDR6300
+        *The value of Secondary Channel Offset in HT Operation element
+        *of beacon frame switching between 1 and 0, which causes dut(sta)
+        *to wake up frequently.
+        */
+        if((ignore_secchannel_bcn_filter == true) &&
+           (beaconFilterTable[i].elementId == SIR_MAC_HT_INFO_EID) &&
+           (beaconFilterTable[i].byte.offset == 1) &&
+           (beaconFilterTable[i].byte.bitMask == HT_BYTE1_FILTER_MASK))
+        {
+            limLog( pMac, LOGW,
+                FL("Skip Secondary Channel bcn filter when channel is 20Mhz"));
+            continue;
+        }
         pIe = (tpBeaconFilterIe) ptr;
         pIe->elementId = beaconFilterTable[i].elementId;
         pIe->checkIePresence = beaconFilterTable[i].checkIePresence;
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c b/wlan/prima/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
index ab22c5b..3c7b02d 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -234,16 +234,16 @@
     }
     else
     {
-        if(IS_DOT11_MODE_HT(psessionEntry->dot11mode))
+        if (IS_DOT11_MODE_HT(psessionEntry->dot11mode)
+#ifdef WLAN_FEATURE_11AC
+        || IS_DOT11_MODE_VHT(psessionEntry->dot11mode)
+        )
+#endif
         {
-            if (pStaDs->htShortGI20Mhz || pStaDs->htShortGI40Mhz )
-                rate_flags |= eHAL_TX_RATE_SGI;
-
-            if (pStaDs->htSupportedChannelWidthSet)
-                rate_flags |=eHAL_TX_RATE_HT40;
-            else
-                rate_flags |=eHAL_TX_RATE_HT20;
+           if (pStaDs->htShortGI20Mhz || pStaDs->htShortGI40Mhz)
+               rate_flags |= eHAL_TX_RATE_SGI;
         }
+
 #ifdef WLAN_FEATURE_11AC
         if(IS_DOT11_MODE_VHT(psessionEntry->dot11mode))
         {
@@ -262,7 +262,15 @@
                     rate_flags |= eHAL_TX_RATE_VHT20;
            }
         }
+        else
 #endif
+        if(IS_DOT11_MODE_HT(psessionEntry->dot11mode))
+        {
+            if (pStaDs->htSupportedChannelWidthSet)
+                rate_flags |=eHAL_TX_RATE_HT40;
+            else
+                rate_flags |=eHAL_TX_RATE_HT20;
+        }
     }
 
      return rate_flags;
@@ -823,6 +831,10 @@
     }
     else
     {
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+        limDiagEventReport(pMac, WLAN_PE_DIAG_SCAN_RES_FOUND_EVENT, NULL,
+            eSIR_SUCCESS, eSIR_SUCCESS);
+#endif
         // send last message
         pSirSmeScanRsp->statusCode  = eSIR_SME_SUCCESS;
         pSirSmeScanRsp->messageType = eWNI_SME_SCAN_RSP;
@@ -1276,6 +1288,7 @@
     tANI_U8                     *pBuf;
     tSirSmeDisassocRsp      *pSirSmeDisassocRsp;
     tSirSmeDisassocInd      *pSirSmeDisassocInd;
+    tSirSmeDisConDoneInd    *pSirSmeDisConDoneInd;
     tANI_U32 *pMsg;
     bool failure = FALSE;
 
@@ -1286,13 +1299,6 @@
     
     switch (disassocTrigger)
     {
-        case eLIM_PEER_ENTITY_DISASSOC:
-            if (reasonCode != eSIR_SME_STA_NOT_ASSOCIATED)
-            {
-                failure = TRUE;
-                goto error;
-            }
-
         case eLIM_HOST_DISASSOC:
             /**
              * Disassociation response due to
@@ -1343,6 +1349,35 @@
             pMsg = (tANI_U32*) pSirSmeDisassocRsp;
             break;
 
+        case eLIM_PEER_ENTITY_DISASSOC:
+        case eLIM_LINK_MONITORING_DISASSOC:
+            pSirSmeDisConDoneInd = vos_mem_malloc(sizeof(tSirSmeDisConDoneInd));
+            if ( NULL == pSirSmeDisConDoneInd )
+            {
+                // Log error
+                limLog(pMac, LOGP,
+                 FL("call to AllocateMemory failed for disconnect indication"));
+
+                return;
+            }
+            vos_mem_zero(pSirSmeDisConDoneInd, sizeof(tSirSmeDisConDoneInd));
+            limLog(pMac, LOG1,
+                   FL("send  eWNI_SME_DISCONNECT_DONE_IND withretCode: %d"),
+                       reasonCode);
+            pSirSmeDisConDoneInd->messageType = eWNI_SME_DISCONNECT_DONE_IND;
+            pSirSmeDisConDoneInd->length      = sizeof(tSirSmeDisConDoneInd);
+            vos_mem_copy(pSirSmeDisConDoneInd->peerMacAddr, peerMacAddr,
+                         sizeof(tSirMacAddr));
+            pSirSmeDisConDoneInd->sessionId   = smesessionId;
+
+            if (reasonCode == eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
+                pSirSmeDisConDoneInd->reasonCode = 0;
+            else
+                pSirSmeDisConDoneInd->reasonCode = reasonCode;
+
+            pMsg = (tANI_U32 *)pSirSmeDisConDoneInd;
+            break;
+
         default:
             /**
              * Disassociation indication due to Disassociation
@@ -1369,6 +1404,7 @@
             pSirSmeDisassocInd->sessionId = smesessionId;
             pSirSmeDisassocInd->transactionId = smetransactionId;
             pSirSmeDisassocInd->reasonCode = reasonCode;
+            pSirSmeDisassocInd->assocId = aid;
             pBuf = (tANI_U8 *) &pSirSmeDisassocInd->statusCode;
 
             limCopyU32(pBuf, reasonCode);
@@ -1434,6 +1470,7 @@
     pSirSmeDisassocInd->transactionId =  psessionEntry->transactionId;
     pSirSmeDisassocInd->statusCode    =  pStaDs->mlmStaContext.disassocReason;
     pSirSmeDisassocInd->reasonCode    =  pStaDs->mlmStaContext.disassocReason;
+    pSirSmeDisassocInd->assocId       =  pStaDs->assocId;
 
     vos_mem_copy( pSirSmeDisassocInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
 
@@ -1474,6 +1511,8 @@
     tSirMsgQ  mmhMsg;
     tSirSmeDeauthInd  *pSirSmeDeauthInd;
 
+    limSendTLPauseInd(pMac, pStaDs->staIndex);
+
     pSirSmeDeauthInd = vos_mem_malloc(sizeof(tSirSmeDeauthInd));
     if ( NULL == pSirSmeDeauthInd )
     {
@@ -1486,6 +1525,7 @@
 
     pSirSmeDeauthInd->sessionId = psessionEntry->smeSessionId;
     pSirSmeDeauthInd->transactionId = psessionEntry->transactionId;
+    pSirSmeDeauthInd->assocId = pStaDs->assocId;
     if(eSIR_INFRA_AP_MODE == psessionEntry->bssType)
     {
         pSirSmeDeauthInd->statusCode = (tSirResultCodes)pStaDs->mlmStaContext.cleanupTrigger;
@@ -1710,6 +1750,7 @@
     tANI_U8             *pBuf;
     tSirSmeDeauthRsp    *pSirSmeDeauthRsp;
     tSirSmeDeauthInd    *pSirSmeDeauthInd;
+    tSirSmeDisConDoneInd *pSirSmeDisConDoneInd;
     tpPESession         psessionEntry;
     tANI_U8             sessionId;
     tANI_U32            *pMsg;
@@ -1717,9 +1758,6 @@
     psessionEntry = peFindSessionByBssid(pMac,peerMacAddr,&sessionId);  
     switch (deauthTrigger)
     {
-        case eLIM_PEER_ENTITY_DEAUTH:
-            return;
-            
         case eLIM_HOST_DEAUTH:
             /**
              * Deauthentication response to host triggered
@@ -1754,6 +1792,36 @@
 
             break;
 
+        case eLIM_PEER_ENTITY_DEAUTH:
+        case eLIM_LINK_MONITORING_DEAUTH:
+            pSirSmeDisConDoneInd = vos_mem_malloc(sizeof(tSirSmeDisConDoneInd));
+            if ( NULL == pSirSmeDisConDoneInd )
+            {
+                // Log error
+                limLog(pMac, LOGP,
+                 FL("call to AllocateMemory failed for disconnect indication"));
+
+                return;
+            }
+            vos_mem_zero(pSirSmeDisConDoneInd, sizeof(tSirSmeDisConDoneInd));
+            limLog(pMac, LOG1,
+                   FL("send  eWNI_SME_DISCONNECT_DONE_IND withretCode: %d"),
+                       reasonCode);
+
+            pSirSmeDisConDoneInd->messageType = eWNI_SME_DISCONNECT_DONE_IND;
+            pSirSmeDisConDoneInd->length      = sizeof(tSirSmeDisConDoneInd);
+            vos_mem_copy(pSirSmeDisConDoneInd->peerMacAddr, peerMacAddr,
+                    sizeof(tSirMacAddr));
+            pSirSmeDisConDoneInd->sessionId   = smesessionId;
+
+            if (reasonCode == eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
+                pSirSmeDisConDoneInd->reasonCode = 0;
+            else
+                pSirSmeDisConDoneInd->reasonCode = reasonCode;
+
+            pMsg = (tANI_U32 *)pSirSmeDisConDoneInd;
+            break;
+
         default:
             /**
              * Deauthentication indication due to Deauthentication
@@ -1775,6 +1843,7 @@
             pSirSmeDeauthInd->messageType = eWNI_SME_DEAUTH_IND;
             pSirSmeDeauthInd->length      = sizeof(tSirSmeDeauthInd);
             pSirSmeDeauthInd->reasonCode = eSIR_MAC_UNSPEC_FAILURE_REASON;
+            pSirSmeDeauthInd->assocId    = aid;
 
             // sessionId
             pBuf = (tANI_U8*) &pSirSmeDeauthInd->sessionId;
@@ -2881,6 +2950,11 @@
         return;
     }
 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_ROAM_CANDIDATE_FOUND,
+                       NULL, eSIR_SUCCESS, eSIR_SUCCESS);
+#endif
+
     pSirSmeCandidateFoundInd->messageType = eWNI_SME_CANDIDATE_FOUND_IND;
     pSirSmeCandidateFoundInd->length = sizeof(tSirSmeCandidateFoundInd);
     pSirSmeCandidateFoundInd->sessionId = sessionId;
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limSerDesUtils.c b/wlan/prima/CORE/MAC/src/pe/lim/limSerDesUtils.c
index cfe9ff9..e879a07 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limSerDesUtils.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limSerDesUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -229,10 +229,16 @@
 #endif
 #endif
 
-#ifdef FEATURE_WLAN_ESE
-    pBssDescription->QBSSLoad_present = limGetU16(pBuf);
-    pBuf += sizeof(tANI_U16);
-    len  -= sizeof(tANI_U16);
+#if defined(FEATURE_WLAN_ESE) || defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD)
+    /* Extract QBSSLoad_present */
+    pBssDescription->QBSSLoad_present = *pBuf++;
+    len  -= sizeof(tANI_U8);
+    if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
+        return eSIR_FAILURE;
+
+    /* Extract QBSS_ChanLoad */
+    pBssDescription->QBSS_ChanLoad = *pBuf++;
+    len  -= sizeof(tANI_U8);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
@@ -277,9 +283,28 @@
         return eSIR_FAILURE;
     }
 
-    /* 1 reserved byte padding */
-    pBuf += (WSCIE_PROBE_RSP_LEN + 1);
-    len -= (WSCIE_PROBE_RSP_LEN + 1);
+    pBuf += (WSCIE_PROBE_RSP_LEN);
+    len -= (WSCIE_PROBE_RSP_LEN);
+
+    /* Extract HTCapsPresent */
+    pBssDescription->HTCapsPresent = *pBuf++;
+    len --;
+
+    /* Extract vhtCapsPresent */
+    pBssDescription->vhtCapsPresent = *pBuf++;
+    len --;
+
+    /* Extract wmeInfoPresent */
+    pBssDescription->wmeInfoPresent = *pBuf++;
+    len --;
+
+    /* Extract beacomformingCapable */
+    pBssDescription->beacomformingCapable = *pBuf++;
+    len --;
+
+    /* Extract chanWidth */
+    pBssDescription->chanWidth = *pBuf++;
+    len --;
 
     if (len > 0)
     {
@@ -976,6 +1001,14 @@
         return eSIR_FAILURE;
     }
 
+    pJoinReq->bWPSAssociation = *pBuf++;
+    len--;
+    if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
+    {
+         limLog(pMac, LOGE, FL("remaining len %d is too short"), len);
+         return eSIR_FAILURE;
+    }
+
     // Extract cbMode
     pJoinReq->cbMode = *pBuf++;
     len--;
@@ -1600,7 +1633,9 @@
     pBuf += sizeof(tSirMacAddr);
 
     vos_mem_copy( pDisassocCnf->peerMacAddr, pBuf, sizeof(tSirMacAddr));
+    pBuf += sizeof(tSirMacAddr);
 
+    pDisassocCnf->assocId = limGetU16(pBuf);
 
     return eSIR_SUCCESS;
 } /*** end limDisassocCnfSerDes() ***/
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limTimerUtils.c b/wlan/prima/CORE/MAC/src/pe/lim/limTimerUtils.c
index 0ff5c44..1e3d522 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limTimerUtils.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limTimerUtils.c
@@ -677,17 +677,31 @@
         goto err_timer;
     }
 
-    cfgValue = ACTIVE_TO_PASSIVE_CONVERISON_TIMEOUT;
-    cfgValue = SYS_MS_TO_TICKS(cfgValue);
-    if (tx_timer_create(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer,
+    cfgValue = WNI_CFG_ACTIVE_PASSIVE_CON_MAX;
+    if (eSIR_SUCCESS != wlan_cfgGetInt(pMac, WNI_CFG_ACTIVE_PASSIVE_CON,
+                                      &cfgValue))
+    {
+        limLog(pMac, LOGP,
+               FL("could not retrieve WNI_CFG_ACTIVE_PASSIVE_CON"));
+    }
+    if (cfgValue)
+    {
+        cfgValue = ACTIVE_TO_PASSIVE_CONVERISON_TIMEOUT;
+        cfgValue = SYS_MS_TO_TICKS(cfgValue);
+        if (tx_timer_create(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer,
                                   "ACTIVE TO PASSIVE CHANNEL", limTimerHandler,
                  SIR_LIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE, cfgValue, 0,
                  TX_NO_ACTIVATE) != TX_SUCCESS)
-    {
-        limLog(pMac, LOGW,FL("could not create timer for passive channel to active channel"));
-        goto err_timer;
+        {
+            limLog(pMac, LOGW,FL("could not create timer for passive channel to active channel"));
+            goto err_timer;
+        }
     }
-
+    else
+    {
+        limLog(pMac, LOG1,
+               FL("gLimActiveToPassiveChannelTimer not created %d"), cfgValue);
+    }
 
     return TX_SUCCESS;
 
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limTrace.c b/wlan/prima/CORE/MAC/src/pe/lim/limTrace.c
index 68ea147..662670b 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limTrace.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limTrace.c
@@ -303,6 +303,47 @@
     }
 }
 
+/**
+ * lim_state_info_dump() - print state information of lim layer
+  */
+static void lim_state_info_dump(void)
+{
+    tHalHandle hal;
+    tpAniSirGlobal mac;
+    v_CONTEXT_t vos_ctx_ptr;
+
+    /* get the global voss context */
+    vos_ctx_ptr = vos_get_global_context(VOS_MODULE_ID_VOSS, NULL);
+
+    if (NULL == vos_ctx_ptr) {
+        VOS_ASSERT(0);
+        return;
+    }
+
+    hal = vos_get_context(VOS_MODULE_ID_PE, vos_ctx_ptr);
+    if (NULL == hal) {
+        VOS_ASSERT(0);
+        return;
+    }
+
+    mac = PMAC_STRUCT(hal);
+
+    limLog(mac, LOG1, FL("SmeState: %d PrevSmeState: %d MlmState: %d"
+           "PrevMlmState: %d SystemInScanLearnMode: %d ProcessDefdMsgs: %d"
+           "gLimHalScanState: %d"), mac->lim.gLimSmeState,
+           mac->lim.gLimPrevSmeState, mac->lim.gLimMlmState,
+           mac->lim.gLimPrevMlmState, mac->lim.gLimSystemInScanLearnMode,
+           mac->lim.gLimProcessDefdMsgs, mac->lim.gLimHalScanState);
+}
+
+/**
+ * lim_register_debug_callback() - registration function for lim layer
+ * to print lim state information
+  */
+void lim_register_debug_callback()
+{
+    vos_register_debug_callback(VOS_MODULE_ID_PE, &lim_state_info_dump);
+}
 
 void macTraceMsgTx(tpAniSirGlobal pMac, tANI_U8 session, tANI_U32 data)
 {
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limTypes.h b/wlan/prima/CORE/MAC/src/pe/lim/limTypes.h
index 1ad20b5..35137b8 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limTypes.h
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limTypes.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -266,7 +266,8 @@
     tANI_U32             beaconLength;
     tANI_U8*             beaconPtr;
     tANI_U32             assocReqLength;
-    tANI_U8*             assocReqPtr;    
+    tANI_U8*             assocReqPtr;
+    uint32_t             rate_flags;
 } tLimMlmAssocInd, *tpLimMlmAssocInd;
 
 typedef struct sLimMlmReassocReq
@@ -827,6 +828,7 @@
 void limSendHalInitScanReq( tpAniSirGlobal, tLimLimHalScanState, tSirLinkTrafficCheck);
 void limSendHalStartScanReq( tpAniSirGlobal, tANI_U8, tLimLimHalScanState);
 void limSendHalEndScanReq( tpAniSirGlobal, tANI_U8, tLimLimHalScanState);
+void limSendTLPauseInd(tpAniSirGlobal pMac, uint16_t staId);
 void limSendHalFinishScanReq( tpAniSirGlobal, tLimLimHalScanState);
 
 void limContinuePostChannelScan(tpAniSirGlobal pMac);
@@ -871,6 +873,15 @@
 tSirRetStatus limSendSaQueryResponseFrame( tpAniSirGlobal pMac, 
                    tANI_U8 *transId, tSirMacAddr peer,tpPESession psessionEntry);
 #endif
+
+#ifdef WLAN_FEATURE_RMC
+void limProcessRMCMessages(tpAniSirGlobal pMac, eRmcMessageType msgType,
+                             tANI_U32 *pMsgBuf);
+tSirRetStatus limSendRMCActionFrame(tpAniSirGlobal  pMac,
+                 tSirMacAddr peerMacAddr, tSirRMCInfo  *pRMC,
+                 tpPESession psessionEntry);
+#endif /* WLAN_FEATURE_RMC */
+
 // Inline functions
 
 /**
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limUtils.c b/wlan/prima/CORE/MAC/src/pe/lim/limUtils.c
index a1c94e6..7c39022 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limUtils.c
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limUtils.c
@@ -164,53 +164,52 @@
     tpDialogueToken pCurrNode = pMac->lim.pDialogueTokenHead;
     tpDialogueToken pPrevNode = pMac->lim.pDialogueTokenHead;
 
-    //if the list is empty
+    /* if the list is empty */
     if(NULL == pCurrNode)
       return eSIR_FAILURE;
 
-    // if the matching node is the first node.
-    if(pCurrNode &&
+    /* If the matching node is the first node.*/
+    if ((token == pCurrNode->token) &&
         (assocId == pCurrNode->assocId) &&
-        (tid == pCurrNode->tid))
-    {
-        pMac->lim.pDialogueTokenHead = pCurrNode->next;        
-        //there was only one node in the list. So tail pointer also needs to be adjusted.
-        if(NULL == pMac->lim.pDialogueTokenHead)
+        (tid == pCurrNode->tid)) {
+        pMac->lim.pDialogueTokenHead = pCurrNode->next;
+        /* There was only one node in the list.
+         * So tail pointer also needs to be adjusted.
+         */
+        if (NULL == pMac->lim.pDialogueTokenHead)
             pMac->lim.pDialogueTokenTail = NULL;
         vos_mem_free(pCurrNode);
-        pMac->lim.pDialogueTokenHead = NULL;
         return eSIR_SUCCESS;
     }
 
-    //first node did not match. so move to the next one.
+    /* first node did not match. so move to the next one. */
     pCurrNode = pCurrNode->next;
-    while(NULL != pCurrNode )
-    {
-        if(token == pCurrNode->token)
-        {
-            break;
-        }
 
+    while (NULL != pCurrNode) {
+         if ((token == pCurrNode->token) &&
+           (assocId == pCurrNode->assocId) &&
+           (tid == pCurrNode->tid)) {
+           break;
+        }
         pPrevNode = pCurrNode;
         pCurrNode = pCurrNode->next;
     }
 
-    if(pCurrNode &&
-        (assocId == pCurrNode->assocId) &&
-        (tid == pCurrNode->tid))
-    {
+    if (pCurrNode) {
         pPrevNode->next = pCurrNode->next;
-        //if the node being deleted is the last one then we also need to move the tail pointer to the prevNode.
+        /* if the node being deleted is the last one
+         * then we also need to move the tail pointer
+         * to the prevNode.
+         */
         if(NULL == pCurrNode->next)
               pMac->lim.pDialogueTokenTail = pPrevNode;
         vos_mem_free(pCurrNode);
-        pMac->lim.pDialogueTokenHead = NULL;
         return eSIR_SUCCESS;
     }
 
-    PELOGW(limLog(pMac, LOGW, FL("LIM does not have matching dialogue token node"));)
+    limLog(pMac, LOGW,
+       FL("LIM does not have matching dialogue token node"));
     return eSIR_FAILURE;
-
 }
 
 
@@ -1399,9 +1398,15 @@
          **/
     if (pMac->lim.gLimDeferredMsgQ.size >= MAX_DEFERRED_QUEUE_LEN)
     {
-        if(!(pMac->lim.deferredMsgCnt & 0xF))
+        if (!(pMac->lim.deferredMsgCnt & 0xF))
         {
-            PELOGE(limLog(pMac, LOGE, FL("Deferred Message Queue is full. Msg:%d Messages Failed:%d"), limMsg->type, ++pMac->lim.deferredMsgCnt);)
+            limLog(pMac, LOGE,
+             FL("Deferred Message Queue is full. Msg:%d Messages Failed:%d"),
+                                    limMsg->type, ++pMac->lim.deferredMsgCnt);
+            vos_fatal_event_logs_req(WLAN_LOG_TYPE_NON_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_QUEUE_FULL,
+                     FALSE, TRUE);
         }
         else
         {
@@ -3422,6 +3427,11 @@
                 limSendSwitchChnlParams(pMac, newChannel, subband, (tPowerdBm)localPwrConstraint, psessionEntry->peSessionId);
 #endif
 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+       limDiagEventReport(pMac, WLAN_PE_DIAG_CHANNEL_SWITCH_ANOUNCEMENT,
+                 psessionEntry, eSIR_SUCCESS, LIM_SWITCH_CHANNEL_OPERATION);
+#endif
+
     // Store the new primary and secondary channel in session entries if different
     if (psessionEntry->currentOperChannel != newChannel)
     {
@@ -5716,9 +5726,12 @@
             if((eBA_DISABLE == pSta->tcCfg[tid].fUseBATx) &&
                  (pBaCandidate->baInfo[tid].fBaEnable))
             {
-                limLog(pMac, LOGE, FL("BA setup for staId = %d, TID: %d, SSN: %d"),
-                        pSta->staIndex, tid, pBaCandidate->baInfo[tid].startingSeqNum);
-                limPostMlmAddBAReq(pMac, pSta, tid, pBaCandidate->baInfo[tid].startingSeqNum,psessionEntry);  
+                limLog(pMac, LOG1,
+                        FL("BA setup for staId = %d, TID: %d, SSN: %d"),
+                        pSta->staIndex, tid,
+                        pBaCandidate->baInfo[tid].startingSeqNum);
+                limPostMlmAddBAReq(pMac, pSta, tid,
+                        pBaCandidate->baInfo[tid].startingSeqNum,psessionEntry);
             }
         }
     }
@@ -8540,3 +8553,56 @@
    }
    return false;
 }
+
+/**
+ * lim_is_ext_cap_ie_present - checks if ext ie is present
+ * @ext_cap: extended IEs structure
+ *
+ * Return: true if ext IEs are present else false
+ */
+bool lim_is_ext_cap_ie_present (tDot11fIEExtCap *ext_cap)
+{
+    int i, size;
+    uint8_t *tmp_buf;
+
+    tmp_buf = (uint8_t *) ext_cap;
+    size = sizeof(*ext_cap);
+
+    for (i = 0; i < size; i++)
+        if (tmp_buf[i])
+            return true;
+
+    return false;
+}
+
+/**
+ * lim_update_caps_info_for_bss - Update capability info for this BSS
+ *
+ * @mac_ctx: mac context
+ * @caps: Pointer to capability info to be updated
+ * @bss_caps: Capability info of the BSS
+ *
+ * Update the capability info in Assoc/Reassoc request frames and reset
+ * the spectrum management, short preamble, immediate block ack bits
+ * if the BSS doesnot support it
+ *
+ * Return: None
+ */
+void lim_update_caps_info_for_bss(tpAniSirGlobal mac_ctx,
+                                  uint16_t *caps, uint16_t bss_caps)
+{
+    if (!(bss_caps & LIM_SPECTRUM_MANAGEMENT_BIT_MASK)) {
+          *caps &= (~LIM_SPECTRUM_MANAGEMENT_BIT_MASK);
+          limLog(mac_ctx, LOG1, FL("Clearing spectrum management:no AP support"));
+    }
+
+    if (!(bss_caps & LIM_SHORT_PREAMBLE_BIT_MASK)) {
+          *caps &= (~LIM_SHORT_PREAMBLE_BIT_MASK);
+          limLog(mac_ctx, LOG1, FL("Clearing short preamble:no AP support"));
+    }
+
+    if (!(bss_caps & LIM_IMMEDIATE_BLOCK_ACK_MASK)) {
+          *caps &= (~LIM_IMMEDIATE_BLOCK_ACK_MASK);
+          limLog(mac_ctx, LOG1, FL("Clearing Immed Blk Ack:no AP support"));
+    }
+}
diff --git a/wlan/prima/CORE/MAC/src/pe/lim/limUtils.h b/wlan/prima/CORE/MAC/src/pe/lim/limUtils.h
index 6a2a9b2..763bf04 100644
--- a/wlan/prima/CORE/MAC/src/pe/lim/limUtils.h
+++ b/wlan/prima/CORE/MAC/src/pe/lim/limUtils.h
@@ -439,7 +439,7 @@
     WLAN_PE_DIAG_REASSOC_REQ_EVENT,
     WLAN_PE_DIAG_REASSOC_RSP_EVENT,
     WLAN_PE_DIAG_AUTH_REQ_EVENT,
-    WLAN_PE_DIAG_AUTH_RSP_EVENT,
+    WLAN_PE_DIAG_AUTH_RSP_EVENT = 10,
     WLAN_PE_DIAG_DISASSOC_REQ_EVENT,
     WLAN_PE_DIAG_DISASSOC_RSP_EVENT,
     WLAN_PE_DIAG_DISASSOC_IND_EVENT,
@@ -449,7 +449,7 @@
     WLAN_PE_DIAG_DEAUTH_IND_EVENT,
     WLAN_PE_DIAG_START_BSS_REQ_EVENT,
     WLAN_PE_DIAG_START_BSS_RSP_EVENT,
-    WLAN_PE_DIAG_AUTH_IND_EVENT,
+    WLAN_PE_DIAG_AUTH_IND_EVENT = 20,
     WLAN_PE_DIAG_ASSOC_IND_EVENT,
     WLAN_PE_DIAG_ASSOC_CNF_EVENT,
     WLAN_PE_DIAG_REASSOC_IND_EVENT,
@@ -459,7 +459,7 @@
     WLAN_PE_DIAG_STOP_BSS_RSP_EVENT,
     WLAN_PE_DIAG_DEAUTH_CNF_EVENT,
     WLAN_PE_DIAG_ADDTS_REQ_EVENT,
-    WLAN_PE_DIAG_ADDTS_RSP_EVENT,
+    WLAN_PE_DIAG_ADDTS_RSP_EVENT = 30,
     WLAN_PE_DIAG_DELTS_REQ_EVENT,
     WLAN_PE_DIAG_DELTS_RSP_EVENT,
     WLAN_PE_DIAG_DELTS_IND_EVENT,
@@ -469,7 +469,7 @@
     WLAN_PE_DIAG_EXIT_BMPS_RSP_EVENT,
     WLAN_PE_DIAG_EXIT_BMPS_IND_EVENT,
     WLAN_PE_DIAG_ENTER_IMPS_REQ_EVENT,
-    WLAN_PE_DIAG_ENTER_IMPS_RSP_EVENT,
+    WLAN_PE_DIAG_ENTER_IMPS_RSP_EVENT = 40,
     WLAN_PE_DIAG_EXIT_IMPS_REQ_EVENT,
     WLAN_PE_DIAG_EXIT_IMPS_RSP_EVENT,
     WLAN_PE_DIAG_ENTER_UAPSD_REQ_EVENT,
@@ -479,7 +479,7 @@
     WLAN_PE_DIAG_WOWL_ADD_BCAST_PTRN_EVENT,
     WLAN_PE_DIAG_WOWL_DEL_BCAST_PTRN_EVENT,
     WLAN_PE_DIAG_ENTER_WOWL_REQ_EVENT,
-    WLAN_PE_DIAG_ENTER_WOWL_RSP_EVENT,
+    WLAN_PE_DIAG_ENTER_WOWL_RSP_EVENT = 50,
     WLAN_PE_DIAG_EXIT_WOWL_REQ_EVENT,
     WLAN_PE_DIAG_EXIT_WOWL_RSP_EVENT,
     WLAN_PE_DIAG_HAL_ADDBA_REQ_EVENT,
@@ -489,8 +489,23 @@
     WLAN_PE_DIAG_PRE_AUTH_REQ_EVENT,
     WLAN_PE_DIAG_PRE_AUTH_RSP_EVENT,
     WLAN_PE_DIAG_PREAUTH_DONE,
-    WLAN_PE_DIAG_REASSOCIATING,
+    WLAN_PE_DIAG_REASSOCIATING = 60,
     WLAN_PE_DIAG_CONNECTED,
+    WLAN_PE_DIAG_ASSOC_REQ_EVENT,
+    WLAN_PE_DIAG_AUTH_COMP_EVENT,
+    WLAN_PE_DIAG_ASSOC_COMP_EVENT,
+    WLAN_PE_DIAG_AUTH_START_EVENT,
+    WLAN_PE_DIAG_ASSOC_START_EVENT,
+    WLAN_PE_DIAG_REASSOC_START_EVENT,
+    WLAN_PE_DIAG_ROAM_AUTH_START_EVENT,
+    WLAN_PE_DIAG_ROAM_AUTH_COMP_EVENT,
+    WLAN_PE_DIAG_ROAM_ASSOC_START_EVENT = 70,
+    WLAN_PE_DIAG_ROAM_ASSOC_COMP_EVENT,
+    WLAN_PE_DIAG_SCAN_COMP_EVENT,
+    WLAN_PE_DIAG_SCAN_RES_FOUND_EVENT,
+    WLAN_PE_DIAG_ROAM_REQUESTED,
+    WLAN_PE_DIAG_CHANNEL_SWITCH_ANOUNCEMENT,
+    WLAN_PE_DIAG_ROAM_CANDIDATE_FOUND,
 }WLAN_PE_DIAG_EVENT_TYPE;
 
 void limDiagEventReport(tpAniSirGlobal pMac, tANI_U16 eventType, tpPESession pSessionEntry, tANI_U16 status, tANI_U16 reasonCode);
@@ -559,5 +574,8 @@
 
 eHalStatus limTxBdComplete(tpAniSirGlobal pMac, void *pData);
 bool lim_is_robust_mgmt_action_frame(uint8 action_catagory);
+bool lim_is_ext_cap_ie_present (tDot11fIEExtCap *ext_cap);
+void lim_update_caps_info_for_bss(tpAniSirGlobal mac_ctx,
+                             uint16_t *caps, uint16_t bss_caps);
 
 #endif /* __LIM_UTILS_H */
diff --git a/wlan/prima/CORE/MAC/src/pe/pmm/pmmApi.c b/wlan/prima/CORE/MAC/src/pe/pmm/pmmApi.c
index 38beff0..21ac26c 100644
--- a/wlan/prima/CORE/MAC/src/pe/pmm/pmmApi.c
+++ b/wlan/prima/CORE/MAC/src/pe/pmm/pmmApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -275,7 +275,7 @@
        {
            if(VOS_TRUE != tx_timer_running(&pMac->lim.limTimers.gLimHeartBeatTimer))
            {
-               PELOGE(pmmLog(pMac, LOGE, FL("Unexpected heartbeat timer not running"));)
+               PELOGE(pmmLog(pMac, LOGW, FL("Unexpected heartbeat timer not running"));)
                limReactivateHeartBeatTimer(pMac, psessionEntry);
            }
        }
@@ -2699,6 +2699,7 @@
         {
             limLog(pMac, LOGW, FL("No Need to enter UAPSD since Trigger "
                  "Enabled and Delivery Enabled Mask is zero for all ACs"));
+            vos_mem_free(pUapsdParams);
             retStatus = eSIR_PMM_INVALID_REQ;
             return retStatus;
         }
diff --git a/wlan/prima/CORE/MAC/src/pe/sch/schApi.c b/wlan/prima/CORE/MAC/src/pe/sch/schApi.c
index 45b4e1c..c9c8ef4 100644
--- a/wlan/prima/CORE/MAC/src/pe/sch/schApi.c
+++ b/wlan/prima/CORE/MAC/src/pe/sch/schApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -353,6 +353,7 @@
         && (pMac->sch.schObject.fBeaconChanged)
         && ((psessionEntry->proxyProbeRspEn)
         || (IS_FEATURE_SUPPORTED_BY_FW(WPS_PRBRSP_TMPL)))
+        && vos_is_probe_rsp_offload_enabled()
       )
 
     {
diff --git a/wlan/prima/CORE/MAC/src/pe/sch/schBeaconGen.c b/wlan/prima/CORE/MAC/src/pe/sch/schBeaconGen.c
index 8def5f3..12ca744 100644
--- a/wlan/prima/CORE/MAC/src/pe/sch/schBeaconGen.c
+++ b/wlan/prima/CORE/MAC/src/pe/sch/schBeaconGen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -276,6 +276,7 @@
     if((psessionEntry->limSystemRole == eLIM_AP_ROLE) 
         && ((psessionEntry->proxyProbeRspEn)
         || (IS_FEATURE_SUPPORTED_BY_FW(WPS_PRBRSP_TMPL)))
+        && vos_is_probe_rsp_offload_enabled()
       )
     {
         /* Initialize the default IE bitmap to zero */
@@ -420,6 +421,7 @@
     if((psessionEntry->limSystemRole == eLIM_AP_ROLE) 
         && ((psessionEntry->proxyProbeRspEn)
         || (IS_FEATURE_SUPPORTED_BY_FW(WPS_PRBRSP_TMPL)))
+        && vos_is_probe_rsp_offload_enabled()
       )
     {
         /* Can be efficiently updated whenever new IE added  in Probe response in future */
diff --git a/wlan/prima/CORE/MAC/src/pe/sch/schBeaconProcess.c b/wlan/prima/CORE/MAC/src/pe/sch/schBeaconProcess.c
index 6687aec..8d3483b 100644
--- a/wlan/prima/CORE/MAC/src/pe/sch/schBeaconProcess.c
+++ b/wlan/prima/CORE/MAC/src/pe/sch/schBeaconProcess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -337,7 +337,7 @@
     tUpdateBeaconParams beaconParams;
     tANI_U8 sendProbeReq = FALSE;
     tpDphHashNode pStaDs = NULL;
-    tANI_U32   channelBondingMode;
+    tANI_U32   channelBondingMode = 0;
 #ifdef WLAN_FEATURE_11AC
     tpSirMacMgmtHdr    pMh = WDA_GET_RX_MAC_HEADER(pRxPacketInfo);
     tANI_U16  aid;
@@ -829,14 +829,43 @@
     vos_log_qos_edca_pkt_type *log_ptr = NULL;
 #endif //FEATURE_WLAN_DIAG_SUPPORT 
 
-    PELOG1(schLog(pMac, LOG1, FL("Updating parameter set count: Old %d ---> new %d"),
-           psessionEntry->gLimEdcaParamSetCount, edca->qosInfo.count);)
+    schLog(pMac, LOG2, FL("Updating parameter set count: Old %d ---> new %d"),
+           psessionEntry->gLimEdcaParamSetCount, edca->qosInfo.count);
 
     psessionEntry->gLimEdcaParamSetCount = edca->qosInfo.count;
     psessionEntry->gLimEdcaParams[EDCA_AC_BE] = edca->acbe;
     psessionEntry->gLimEdcaParams[EDCA_AC_BK] = edca->acbk;
     psessionEntry->gLimEdcaParams[EDCA_AC_VI] = edca->acvi;
     psessionEntry->gLimEdcaParams[EDCA_AC_VO] = edca->acvo;
+
+    if (pMac->roam.configParam.enable_edca_params) {
+        psessionEntry->gLimEdcaParams[EDCA_AC_VO].aci.aifsn =
+               pMac->roam.configParam.edca_vo_aifs;
+        psessionEntry->gLimEdcaParams[EDCA_AC_VI].aci.aifsn =
+               pMac->roam.configParam.edca_vi_aifs;
+        psessionEntry->gLimEdcaParams[EDCA_AC_BK].aci.aifsn =
+               pMac->roam.configParam.edca_bk_aifs;
+        psessionEntry->gLimEdcaParams[EDCA_AC_BE].aci.aifsn =
+               pMac->roam.configParam.edca_be_aifs;
+
+        psessionEntry->gLimEdcaParams[EDCA_AC_VO].cw.min =
+               pMac->roam.configParam.edca_vo_cwmin;
+        psessionEntry->gLimEdcaParams[EDCA_AC_VI].cw.min =
+               pMac->roam.configParam.edca_vi_cwmin;
+        psessionEntry->gLimEdcaParams[EDCA_AC_BK].cw.min =
+               pMac->roam.configParam.edca_bk_cwmin;
+        psessionEntry->gLimEdcaParams[EDCA_AC_BE].cw.min =
+               pMac->roam.configParam.edca_be_cwmin;
+
+        psessionEntry->gLimEdcaParams[EDCA_AC_VO].cw.max =
+               pMac->roam.configParam.edca_vo_cwmax;
+        psessionEntry->gLimEdcaParams[EDCA_AC_VI].cw.max =
+               pMac->roam.configParam.edca_vi_cwmax;
+        psessionEntry->gLimEdcaParams[EDCA_AC_BK].cw.max =
+               pMac->roam.configParam.edca_bk_cwmax;
+        psessionEntry->gLimEdcaParams[EDCA_AC_BE].cw.max =
+               pMac->roam.configParam.edca_be_cwmax;
+    }
 //log: LOG_WLAN_QOS_EDCA_C
 #ifdef FEATURE_WLAN_DIAG_SUPPORT
     WLAN_VOS_DIAG_LOG_ALLOC(log_ptr, vos_log_qos_edca_pkt_type, LOG_WLAN_QOS_EDCA_C);
@@ -861,16 +890,18 @@
     }
     WLAN_VOS_DIAG_LOG_REPORT(log_ptr);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
-    PELOG1(schLog(pMac, LOGE, FL("Updating Local EDCA Params(gLimEdcaParams) to: "));)
+    schLog(pMac, LOG1,
+           FL("edsa param enabled in ini %d. Updating Local EDCA Params(gLimEdcaParams) to: "),
+           pMac->roam.configParam.enable_edca_params);
     for(i=0; i<MAX_NUM_AC; i++)
     {
-        PELOG1(schLog(pMac, LOG1, FL("AC[%d]:  AIFSN: %d, ACM %d, CWmin %d, CWmax %d, TxOp %d"),
+        schLog(pMac, LOG1, FL("AC[%d]:  AIFSN: %d, ACM %d, CWmin %d, CWmax %d, TxOp %d"),
             i,
             psessionEntry->gLimEdcaParams[i].aci.aifsn, 
             psessionEntry->gLimEdcaParams[i].aci.acm,
             psessionEntry->gLimEdcaParams[i].cw.min,
             psessionEntry->gLimEdcaParams[i].cw.max,
-            psessionEntry->gLimEdcaParams[i].txoplimit);)
+            psessionEntry->gLimEdcaParams[i].txoplimit);
     }
 
     return eSIR_SUCCESS;
diff --git a/wlan/prima/CORE/SAP/inc/sapApi.h b/wlan/prima/CORE/SAP/inc/sapApi.h
index 1d935d0..0da7bbc 100644
--- a/wlan/prima/CORE/SAP/inc/sapApi.h
+++ b/wlan/prima/CORE/SAP/inc/sapApi.h
@@ -285,7 +285,8 @@
     tANI_U32     assocReqLength;
     tANI_U8*     assocReqPtr;
     tANI_U32     assocRespLength;
-    tANI_U8*     assocRespPtr;    
+    tANI_U8*     assocRespPtr;
+    uint32_t rate_flags;
 } tSap_StationAssocReassocCompleteEvent;
 
 typedef struct sap_StationDisassocCompleteEvent_s {
diff --git a/wlan/prima/CORE/SAP/src/sapApiLinkCntl.c b/wlan/prima/CORE/SAP/src/sapApiLinkCntl.c
index 631df4d..9d4d193 100644
--- a/wlan/prima/CORE/SAP/src/sapApiLinkCntl.c
+++ b/wlan/prima/CORE/SAP/src/sapApiLinkCntl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -99,9 +99,6 @@
 /*----------------------------------------------------------------------------
  * Externalized Function Definitions
  * -------------------------------------------------------------------------*/
-#ifdef FEATURE_WLAN_CH_AVOID
-   extern safeChannelType safeChannels[];
-#endif /* FEATURE_WLAN_CH_AVOID */
 
 /*----------------------------------------------------------------------------
  * Function Declarations and Documentation
@@ -131,6 +128,16 @@
 {
     v_U8_t i = 0;
     v_U32_t event;
+    tHalHandle hHal = NULL;
+    uint32_t operating_band = 0;
+
+    hHal = VOS_GET_HAL_CB(psapContext->pvosGCtx);
+    if (NULL == hHal)
+    {
+        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                     "hHal is NULL in %s", __func__);
+        return;
+    }
 
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
                 FL("SAP Channel : %d"), psapContext->channel);
@@ -146,7 +153,7 @@
         {
             if(psapContext->channelList != NULL)
             {
-                 psapContext->channel = SAP_DEFAULT_CHANNEL;
+                 psapContext->channel = SAP_CHANNEL_NOT_SELECTED;
                  for ( i = 0 ; i < psapContext->numofChannel ; i++)
                  {
                     if (NV_CHANNEL_ENABLE ==
@@ -157,26 +164,41 @@
                     }
                  }
             }
-            else
-            {
-                /* if the channel list is empty then there is no valid channel
-                   in the selected sub-band so select default channel in the
-                   BAND(2.4GHz) as 2.4 channels are available in all the
-                   countries*/
-                   psapContext->channel = SAP_DEFAULT_CHANNEL;
 
-#ifdef FEATURE_WLAN_CH_AVOID
-                for( i = 0; i < NUM_20MHZ_RF_CHANNELS; i++ )
+            /*
+             * In case if channel is not selected then channel
+             * to be selected based on band configured in .ini
+             */
+            if (!psapContext->channel)
+            {
+                ccmCfgGetInt(hHal, WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND,
+                             &operating_band);
+                if (operating_band == eSAP_RF_SUBBAND_5_LOW_GHZ ||
+                    operating_band == eSAP_RF_SUBBAND_5_MID_GHZ ||
+                    operating_band == eSAP_RF_SUBBAND_5_HIGH_GHZ)
                 {
-                    if((NV_CHANNEL_ENABLE ==
-                        vos_nv_getChannelEnabledState(safeChannels[i].channelNumber))
-                            && (VOS_TRUE == safeChannels[i].isSafe))
-                    {
-                        psapContext->channel = safeChannels[i].channelNumber;
-                        break;
-                    }
+                    VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                              FL("Default channel selection from band %d"),
+                              operating_band);
+
+                    (operating_band == eSAP_RF_SUBBAND_5_LOW_GHZ) ?
+                            (psapContext->channel =
+                                     SAP_DEFAULT_LOW_5GHZ_CHANNEL) :
+                    (operating_band == eSAP_RF_SUBBAND_5_MID_GHZ) ?
+                            (psapContext->channel =
+                                     SAP_DEFAULT_MID_5GHZ_CHANNEL) :
+                    (operating_band == eSAP_RF_SUBBAND_5_HIGH_GHZ) ?
+                            (psapContext->channel =
+                                     SAP_DEFAULT_HIGH_5GHZ_CHANNEL) : 0;
+
+                    VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                              FL("channel selected to start bss %d"),
+                              psapContext->channel);
                 }
-#endif
+                else
+                {
+                    psapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
+                }
             }
         }
         else
@@ -195,7 +217,7 @@
         }
     }
 #else
-       psapContext->channel = SAP_DEFAULT_CHANNEL;
+       psapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
 #endif
     else
     {
@@ -1405,6 +1427,7 @@
 #endif
             break;
 
+        case eCSR_ROAM_RESULT_DEAUTH_IND:
         case eCSR_ROAM_RESULT_DISASSOC_IND:
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                           FL("CSR roamResult = %s (%d)"),
@@ -1421,23 +1444,6 @@
             }
             break;
 
-        case eCSR_ROAM_RESULT_DEAUTH_IND:
-            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-                          FL("CSR roamResult = %s (%d)"),
-                             "eCSR_ROAM_RESULT_DEAUTH_IND",
-                              roamResult);
-#ifdef WLAN_FEATURE_AP_HT40_24G
-            sapRemoveHT40IntolerantSta(sapContext, pCsrRoamInfo);
-#endif
-            /* Fill in the event structure */
-            //TODO: we will use the same event inorder to inform HDD to disassociate the station
-            vosStatus = sapSignalHDDevent( sapContext, pCsrRoamInfo, eSAP_STA_DISASSOC_EVENT, (v_PVOID_t)eSAP_STATUS_SUCCESS);
-            if(!VOS_IS_STATUS_SUCCESS(vosStatus))
-            {
-                halStatus = eHAL_STATUS_FAILURE;
-            }
-            break;
-
         case eCSR_ROAM_RESULT_MIC_ERROR_GROUP:
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                           FL("CSR roamResult = %s (%d)"),
diff --git a/wlan/prima/CORE/SAP/src/sapChSelect.h b/wlan/prima/CORE/SAP/src/sapChSelect.h
index fcb9fe0..eb74218 100644
--- a/wlan/prima/CORE/SAP/src/sapChSelect.h
+++ b/wlan/prima/CORE/SAP/src/sapChSelect.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -84,8 +84,10 @@
 #define SOFTAP_RSSI_WEIGHT      (20)
 #define SOFTAP_COUNT_WEIGHT     (20)
 
-#define SAP_DEFAULT_CHANNEL     (6)
-#define SAP_DEFAULT_5GHZ_CHANNEL      (40)
+#define SAP_DEFAULT_24GHZ_CHANNEL     (6)
+#define SAP_DEFAULT_LOW_5GHZ_CHANNEL      (40)
+#define SAP_DEFAULT_MID_5GHZ_CHANNEL      (100)
+#define SAP_DEFAULT_HIGH_5GHZ_CHANNEL      (149)
 #define SAP_CHANNEL_NOT_SELECTED (0)
 
 #define SOFTAP_HT20_CHANNELWIDTH 0
diff --git a/wlan/prima/CORE/SAP/src/sapFsm.c b/wlan/prima/CORE/SAP/src/sapFsm.c
index 6381bb1..4ebbae5 100644
--- a/wlan/prima/CORE/SAP/src/sapFsm.c
+++ b/wlan/prima/CORE/SAP/src/sapFsm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -260,10 +260,7 @@
 #endif
     tHalHandle hHal;
     tANI_U8   channel;
-
-#ifdef FEATURE_WLAN_CH_AVOID
-    v_U8_t i;
-#endif
+    uint32_t operating_band = 0;
 
     hHal = (tHalHandle)vos_get_context( VOS_MODULE_ID_SME, sapContext->pvosGCtx);
     if (NULL == hHal)
@@ -349,35 +346,44 @@
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                   FL("SoftAP Configuring for default channel, Ch= %d"),
                   sapContext->channel);
-            /* In case of error, switch to default channel */
-            sapContext->channel = SAP_DEFAULT_CHANNEL;
+            /*
+             * In case of error, select channel based on band
+             * configured in .ini
+             */
+            ccmCfgGetInt(hHal, WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND,
+                         &operating_band);
+            if (operating_band == eSAP_RF_SUBBAND_5_LOW_GHZ ||
+                operating_band == eSAP_RF_SUBBAND_5_MID_GHZ ||
+                operating_band == eSAP_RF_SUBBAND_5_HIGH_GHZ)
+            {
+                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                          FL("Default channel selection from band %d"),
+                          operating_band);
+
+                (operating_band == eSAP_RF_SUBBAND_5_LOW_GHZ) ?
+                        (sapContext->channel = SAP_DEFAULT_LOW_5GHZ_CHANNEL) :
+                (operating_band == eSAP_RF_SUBBAND_5_MID_GHZ) ?
+                        (sapContext->channel = SAP_DEFAULT_MID_5GHZ_CHANNEL) :
+                (operating_band == eSAP_RF_SUBBAND_5_HIGH_GHZ) ?
+                        (sapContext->channel =
+                                     SAP_DEFAULT_HIGH_5GHZ_CHANNEL) : 0;
+
+                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                          FL("channel selected to start bss %d"),
+                          sapContext->channel);
+            }
+            else
+            {
+                sapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
+            }
+
 #ifdef SOFTAP_CHANNEL_RANGE
             if(sapContext->channelList != NULL)
             {
-                for ( i = 0 ; i < sapContext->numofChannel ; i++)
-                    if (NV_CHANNEL_ENABLE ==
-                        vos_nv_getChannelEnabledState(sapContext->channelList[i]))
-                    {
-                        sapContext->channel = sapContext->channelList[i];
-                    }
-                    vos_mem_free(sapContext->channelList);
-                    sapContext->channelList = NULL;
+                sapContext->channel = sapContext->channelList[0];
+                vos_mem_free(sapContext->channelList);
+                sapContext->channelList = NULL;
             }
-#ifdef FEATURE_WLAN_CH_AVOID
-            else
-            {
-                for( i = 0; i < NUM_20MHZ_RF_CHANNELS; i++ )
-                {
-                    if((NV_CHANNEL_ENABLE ==
-                        vos_nv_getChannelEnabledState(safeChannels[i].channelNumber))
-                            && (VOS_TRUE == safeChannels[i].isSafe))
-                    {
-                        sapContext->channel = safeChannels[i].channelNumber;
-                        break;
-                    }
-                }
-            }
-#endif
 #endif
             /* Fill in the event structure */
             sapEventInit(sapEvent);
@@ -821,6 +827,8 @@
                             pCsrRoamInfo->addIELen);
             }
 
+            sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.rate_flags = pCsrRoamInfo->maxRateFlags;
+
             sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.wmmEnabled = pCsrRoamInfo->wmmEnabledSta;
             sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.status = (eSapStatus )context;
             //TODO: Need to fill sapAuthType
@@ -1099,20 +1107,8 @@
                                "In %s, Failed to Init HT20/40 timer", __func__);
 #endif
              }
-             else if (msg == eSAP_MAC_START_FAILS)
-             {
-                 /*Transition from STARTING to DISCONNECTED (both without substates)*/
-                 VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR, "In %s, from state %s => %s",
-                            __func__, "eSAP_STARTING", "eSAP_DISCONNECTED");
-
-                 /*Action code for transition */
-                 vosStatus = sapSignalHDDevent( sapContext, NULL, eSAP_START_BSS_EVENT,(v_PVOID_t) eSAP_STATUS_FAILURE);
-                 vosStatus =  sapGotoDisconnected(sapContext);
-
-                 /*Advance outer statevar */
-                 sapContext->sapsMachine = eSAP_DISCONNECTED;
-             }
-             else if (msg == eSAP_HDD_STOP_INFRA_BSS)
+             else if ((msg == eSAP_HDD_STOP_INFRA_BSS) ||
+                      (msg == eSAP_MAC_START_FAILS))
              {
                  /*Transition from eSAP_STARTING to eSAP_DISCONNECTING (both without substates)*/
                  VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, from state %s => %s",
@@ -1151,7 +1147,8 @@
                     }
                     else if (eHAL_STATUS_SUCCESS ==
                          sme_CloseSession(hHal,
-                                         sapContext->sessionId, VOS_TRUE, NULL, NULL))
+                                         sapContext->sessionId, FALSE,
+                                         VOS_TRUE, NULL, NULL))
                      {
                          sapContext->isSapSessionOpen = eSAP_FALSE;
                      }
@@ -1231,15 +1228,13 @@
                     else
                     {
                         sapContext->isSapSessionOpen = eSAP_FALSE;
-                        if (!HAL_STATUS_SUCCESS(
-                            sme_CloseSession(hHal,
-                                     sapContext->sessionId, VOS_TRUE,
-                                     sapRoamSessionCloseCallback, sapContext)))
-                        {
-                            vosStatus = sapSignalHDDevent(sapContext, NULL,
-                                              eSAP_STOP_BSS_EVENT,
-                                              (v_PVOID_t) eSAP_STATUS_SUCCESS);
-                        }
+                        sme_CloseSession(hHal,
+                                sapContext->sessionId,  TRUE, VOS_TRUE,
+                                NULL, sapContext);
+
+                        vosStatus = sapSignalHDDevent(sapContext, NULL,
+                                eSAP_STOP_BSS_EVENT,
+                                (v_PVOID_t) eSAP_STATUS_SUCCESS);
                     }
                 }
             }
diff --git a/wlan/prima/CORE/SAP/src/sapInternal.h b/wlan/prima/CORE/SAP/src/sapInternal.h
index b818e48..dd94138 100644
--- a/wlan/prima/CORE/SAP/src/sapInternal.h
+++ b/wlan/prima/CORE/SAP/src/sapInternal.h
@@ -183,6 +183,10 @@
    /** Track HT40 Intolerant station */
    v_BOOL_t isHT40IntolerantSet;
 #endif
+
+  /** Rate Flags for this connection */
+  uint32_t  rate_flags;
+
 } hdd_station_info_t;
 
 typedef struct sSapContext {
diff --git a/wlan/prima/CORE/SME/inc/csrApi.h b/wlan/prima/CORE/SME/inc/csrApi.h
index c2320b1..292aada 100644
--- a/wlan/prima/CORE/SME/inc/csrApi.h
+++ b/wlan/prima/CORE/SME/inc/csrApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -402,6 +402,9 @@
     tANI_U8 MFPRequired;
     tANI_U8 MFPCapable;
 #endif
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    tANI_BOOLEAN isPERRoamScan;
+#endif
 }tCsrScanResultFilter;
 
 
@@ -499,6 +502,10 @@
     eCSR_ROAM_UNPROT_MGMT_FRAME_IND,
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+    eCSR_ROAM_IBSS_PEER_INFO_COMPLETE,
+#endif
+
 #ifdef WLAN_FEATURE_AP_HT40_24G
     eCSR_ROAM_2040_COEX_INFO_IND,
 #endif
@@ -511,6 +518,7 @@
 #endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
     eCSR_ROAM_UPDATE_MAX_RATE_IND,
     eCSR_ROAM_LOST_LINK_PARAMS_IND,
+    eCSR_ROAM_UPDATE_SCAN_RESULT,
 }eRoamCmdStatus;
 
 
@@ -598,8 +606,15 @@
     eCSR_ROAM_RESULT_TEARDOWN_TDLS_PEER_IND,
     eCSR_ROAM_RESULT_DELETE_ALL_TDLS_PEER_IND,
     eCSR_ROAM_RESULT_LINK_ESTABLISH_REQ_RSP,
+    eCSR_ROAM_RESULT_CHANNEL_SWITCH_REQ_RSP,
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+    eCSR_ROAM_RESULT_IBSS_PEER_INFO_SUCCESS,
+    eCSR_ROAM_RESULT_IBSS_PEER_INFO_FAILED,
+#endif
+    /* If Scan for SSID failed to found proper BSS */
+    eCSR_ROAM_RESULT_SCAN_FOR_SSID_FAILURE,
 }eCsrRoamResult;
 
 
@@ -650,6 +665,8 @@
     eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTED,
     // Participating in a Infra network and connected to a peer
     eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED,
+    /* Disconnecting with AP or stop connecting process */
+    eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTING,
 
 }eCsrConnectState;
 
@@ -1169,6 +1186,13 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
     tANI_BOOLEAN isRoamOffloadScanEnabled;
     tANI_BOOLEAN bFastRoamInConIniFeatureEnabled;
+    v_BOOL_t isPERRoamEnabled;
+    v_BOOL_t isPERRoamCCAEnabled;
+    v_U32_t rateUpThreshold;
+    v_U32_t rateDownThreshold;
+    v_U32_t waitPeriodForNextPERScan;
+    v_U32_t PERtimerThreshold;
+    v_U32_t PERroamTriggerPercent;
 #endif
 #endif
 
@@ -1194,6 +1218,21 @@
     tANI_U8 roamDelayStatsEnabled;
     tANI_BOOLEAN ignorePeerHTopMode;
     tANI_BOOLEAN disableP2PMacSpoofing;
+    tANI_BOOLEAN enableFatalEvent;
+    tANI_U8 max_chan_for_dwell_time_cfg;
+    uint32_t enable_edca_params;
+    uint32_t edca_vo_cwmin;
+    uint32_t edca_vi_cwmin;
+    uint32_t edca_bk_cwmin;
+    uint32_t edca_be_cwmin;
+    uint32_t edca_vo_cwmax;
+    uint32_t edca_vi_cwmax;
+    uint32_t edca_bk_cwmax;
+    uint32_t edca_be_cwmax;
+    uint32_t edca_vo_aifs;
+    uint32_t edca_vi_aifs;
+    uint32_t edca_bk_aifs;
+    uint32_t edca_be_aifs;
 }tCsrConfigParam;
 
 //Tush
@@ -1313,6 +1352,7 @@
 #ifdef WLAN_FEATURE_AP_HT40_24G
     tANI_U8              HT40MHzIntoEnabledSta; //set to true if 40 MHz Intolerant enabled STA
 #endif
+    uint32_t             rate_flags;
 } tSirSmeAssocIndToUpperLayerCnf, *tpSirSmeAssocIndToUpperLayerCnf;
 
 typedef struct tagCsrSummaryStatsInfo
@@ -1474,9 +1514,17 @@
 {
     tCsrBssid bssid;
     tANI_U8 channel;
+    /* To check if its a REASSOC or a FASTREASSOC IOCTL */
+    tANI_U8 src;
 }tCsrHandoffRequest;
 #endif
 
+typedef enum {
+    REASSOC     = 0,
+    FASTREASSOC = 1,
+    CONNECT_CMD_USERSPACE = 2,
+} handoff_src;
+
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 typedef struct tagCsrEseBeaconReqParams
 {
@@ -1666,6 +1714,18 @@
 ---------------------------------------------------------------------------*/
 typedef void (*tCsrSnrCallback) (v_S7_t snr, tANI_U32 staId, void *pContext);
 
+/*---------------------------------------------------------------------------
+  This is the type for a get current antenna callback to be registered with SME
+  for getting cuurently used antenna index
+
+  \param antennaId to be filled by firmware.
+  \param pContext - any user data given at callback registration.
+  \return None
+
+---------------------------------------------------------------------------*/
+typedef void ( *tCsrAntennaIndexCallback) (int antennaId, void *pContext);
+
+
 #ifdef WLAN_FEATURE_VOWIFI_11R
 eHalStatus csrRoamIssueFTPreauthReq(tHalHandle hHal, tANI_U32 sessionId, tpSirBssDescription pBssDescription);
 #endif
diff --git a/wlan/prima/CORE/SME/inc/csrInternal.h b/wlan/prima/CORE/SME/inc/csrInternal.h
index 5f0a66c..cb13a47 100644
--- a/wlan/prima/CORE/SME/inc/csrInternal.h
+++ b/wlan/prima/CORE/SME/inc/csrInternal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,6 +40,8 @@
 #define CSRINTERNAL_H__
 
 #include "vos_status.h"
+#include "vos_utils.h"
+
 #include "vos_lock.h"
 
 #include "palTimer.h"
@@ -276,6 +278,7 @@
    eCsrGlobalClassCStats,
    eCsrGlobalClassDStats,
    eCsrPerStaStats,
+   eCsrPerPktStats,
    eCsrMaxStats
 }eCsrRoamStatsClassTypes;
 
@@ -620,6 +623,13 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
     tANI_U8      isRoamOffloadScanEnabled;
     tANI_BOOLEAN bFastRoamInConIniFeatureEnabled;
+    v_BOOL_t     isPERRoamEnabled;
+    v_BOOL_t     isPERRoamCCAEnabled;
+    tANI_U32     rateUpThreshold;
+    tANI_U32     rateDownThreshold;
+    tANI_U32     waitPeriodForNextPERScan;
+    tANI_U32     PERtimerThreshold;
+    tANI_U32     PERroamTriggerPercent;
 #endif
 #endif
 
@@ -682,6 +692,21 @@
     tANI_U8 roamDelayStatsEnabled;
     tANI_BOOLEAN ignorePeerHTopMode;
     tANI_BOOLEAN disableP2PMacSpoofing;
+    tANI_BOOLEAN enableFatalEvent;
+    tANI_U8 max_chan_for_dwell_time_cfg;
+    uint32_t enable_edca_params;
+    uint32_t edca_vo_cwmin;
+    uint32_t edca_vi_cwmin;
+    uint32_t edca_bk_cwmin;
+    uint32_t edca_be_cwmin;
+    uint32_t edca_vo_cwmax;
+    uint32_t edca_vi_cwmax;
+    uint32_t edca_bk_cwmax;
+    uint32_t edca_be_cwmax;
+    uint32_t edca_vo_aifs;
+    uint32_t edca_vi_aifs;
+    uint32_t edca_bk_aifs;
+    uint32_t edca_be_aifs;
 }tCsrConfig;
 
 typedef struct tagCsrChannelPowerInfo
@@ -727,7 +752,6 @@
     vos_timer_t hTimerStaApConcTimer;
 #endif
     vos_timer_t hTimerIdleScan;
-    vos_timer_t hTimerResultCfgAging;
     tPalTimerHandle hTimerBgScan;
     //changes on every scan, it is used as a flag for whether 11d info is found on every scan
     tANI_U8 channelOf11dInfo;
@@ -809,6 +833,8 @@
     csrScanCompleteCallback callback11dScanDone;
     eCsrBand  scanBandPreference;  //This defines the band perference for scan
     bool fcc_constraint;
+    /* flag to defer updated chanel list */
+    bool defer_update_channel_list;
 }tCsrScanStruct;
 
 
@@ -965,6 +991,7 @@
     * it is needed by the HS 2.0 passpoint certification 5.2.a and b testcases */
     tANI_BOOLEAN fIgnorePMKIDCache;
     tANI_BOOLEAN abortConnection;
+    bool dhcp_done;
 } tCsrRoamSession;
 
 typedef struct tagCsrRoamStruct
@@ -992,6 +1019,7 @@
     tCsrGlobalClassCStatsInfo  classCStatsInfo;
     tCsrGlobalClassDStatsInfo  classDStatsInfo;
     tCsrPerStaStatsInfo        perStaStatsInfo[CSR_MAX_STA];
+    tPerTxPacketFrmFw          perPktStatsInfo;
     tDblLinkList  statsClientReqList;
     tDblLinkList  peStatsReqList;
     tCsrTlStatsReqInfo  tlStatsReqInfo;
@@ -1446,3 +1474,8 @@
 #endif
 
 void csrDisableDfsChannel(tpAniSirGlobal pMac);
+
+#ifdef WLAN_FEATURE_RMC
+eHalStatus csrEnableRMC(tpAniSirGlobal pMac, tANI_U32 sessionId);
+eHalStatus csrDisableRMC(tpAniSirGlobal pMac, tANI_U32 sessionId);
+#endif /* WLAN_FEATURE_RMC */
diff --git a/wlan/prima/CORE/SME/inc/csrNeighborRoam.h b/wlan/prima/CORE/SME/inc/csrNeighborRoam.h
index 6a0d812..5df4eee 100644
--- a/wlan/prima/CORE/SME/inc/csrNeighborRoam.h
+++ b/wlan/prima/CORE/SME/inc/csrNeighborRoam.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -172,7 +172,7 @@
     tCsrNeighborRoamChannelInfo roamChannelInfo;
     tANI_U8                     currentNeighborLookupThreshold;
     tANI_BOOLEAN                scanRspPending;
-    tANI_TIMESTAMP              scanRequestTimeStamp;
+    v_TIME_t                    scanRequestTimeStamp;
     tDblLinkList                roamableAPList;    // List of current FT candidates
     tANI_U32                    csrSessionId;
     tCsrRoamProfile             csrNeighborRoamProfile;
diff --git a/wlan/prima/CORE/SME/inc/oemDataApi.h b/wlan/prima/CORE/SME/inc/oemDataApi.h
index 2ae978b..fa8dccc 100644
--- a/wlan/prima/CORE/SME/inc/oemDataApi.h
+++ b/wlan/prima/CORE/SME/inc/oemDataApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -54,6 +54,14 @@
 #define OEM_DATA_RSP_SIZE 1968
 #endif
 
+#ifndef NEW_OEM_DATA_REQ_SIZE
+#define NEW_OEM_DATA_REQ_SIZE 292
+#endif
+
+#ifndef NEW_OEM_DATA_RSP_SIZE
+#define NEW_OEM_DATA_RSP_SIZE 2100
+#endif
+
 /*************************************************************************************************************
   OEM DATA REQ/RSP - DATA STRUCTURES
 *************************************************************************************************************/
@@ -133,6 +141,30 @@
   -------------------------------------------------------------------------------*/
 eHalStatus oemData_IsOemDataReqAllowed(tHalHandle hHal);
 
+
+/* ---------------------------------------------------------------------------
+  OEM DATA REQ NEW - DATA STRUCTURES
+  -------------------------------------------------------------------------------*/
+/* Structure for defining req sent to the PE */
+typedef struct tagOemDataReqNew
+{
+    tSirMacAddr selfMacAddr;
+    tANI_U8 reserved[2];
+    tANI_U8   oemDataReqNew[NEW_OEM_DATA_REQ_SIZE];
+} tOemDataReqNew, tOemDataReqNewConfig;
+
+/* ---------------------------------------------------------------------------
+  OEM DATA RESPONSE - DATA STRUCTURES
+  -------------------------------------------------------------------------------*/
+typedef struct tagOemDataRspNew
+{
+    tANI_U8   oemDataRspNew[NEW_OEM_DATA_RSP_SIZE];
+} tOemDataRspNew;
+
+/*************************************************************************************************************/
+
+void send_oem_data_rsp_msg(tANI_U32 length, tANI_U8 *oemDataRsp);
+
 #endif //_OEM_DATA_API_H__
 
 #endif //FEATURE_OEM_DATA_SUPPORT
diff --git a/wlan/prima/CORE/SME/inc/smeInside.h b/wlan/prima/CORE/SME/inc/smeInside.h
index 8bde263..bb947dc 100644
--- a/wlan/prima/CORE/SME/inc/smeInside.h
+++ b/wlan/prima/CORE/SME/inc/smeInside.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -223,7 +223,8 @@
 void smeProcessPendingQueue( tpAniSirGlobal pMac );
 void smeReleaseCommand(tpAniSirGlobal pMac, tSmeCmd *pCmd);
 void purgeSmeSessionCmdList(tpAniSirGlobal pMac, tANI_U32 sessionId,
-        tDblLinkList *pList);
+        tDblLinkList *pList, bool flush_all);
+tANI_U32 sme_get_sessionid_from_activeList(tpAniSirGlobal pMac);
 tANI_BOOLEAN smeCommandPending(tpAniSirGlobal pMac);
 tANI_BOOLEAN pmcProcessCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand );
 //this function is used to abort a command where the normal processing of the command
@@ -249,6 +250,7 @@
                                          tCsrRoamRemoveKey *pRemoveKey, tANI_U32 roamId );
 eHalStatus csrIsFullPowerNeeded( tpAniSirGlobal pMac, tSmeCmd *pCommand, tRequestFullPowerReason *pReason,
                                  tANI_BOOLEAN *pfNeedPower);
+bool csr_is_disconnect_full_power_cmd(tSmeCmd *command);
 void csrAbortCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand, tANI_BOOLEAN fStopping );
 
 eHalStatus sme_AcquireGlobalLock( tSmeStruct *psSme);
@@ -324,7 +326,7 @@
                                 tCsrStaParams *pstaParams);
 eHalStatus csrTdlsDelPeerSta(tHalHandle hHal, tANI_U8 sessionId,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0))
-                            const tSirMacAddr peerMac
+                             const tSirMacAddr peerMac
 #else
                              tSirMacAddr peerMac
 #endif
diff --git a/wlan/prima/CORE/SME/inc/smeInternal.h b/wlan/prima/CORE/SME/inc/smeInternal.h
index 53b2c0d..3280a92 100644
--- a/wlan/prima/CORE/SME/inc/smeInternal.h
+++ b/wlan/prima/CORE/SME/inc/smeInternal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -119,6 +119,19 @@
 #define SME_IS_START(pMac)  (SME_STATE_STOP != (pMac)->sme.state)
 #define SME_IS_READY(pMac)  (SME_STATE_READY == (pMac)->sme.state)
 
+#ifdef WLAN_FEATURE_RMC
+
+/* HDD Callback function */
+typedef void(*pIbssPeerInfoCb)(void *pUserData, void *infoParam);
+
+/* Peer info */
+typedef struct tagSmePeerInfoHddCbkInfo
+{
+   void *pUserData;
+   pIbssPeerInfoCb peerInfoCbk;
+}tSmePeerInfoHddCbkInfo;
+#endif /* WLAN_FEATURE_RMC */
+
 /* HDD Callback function */
 typedef void(*pEncryptMsgRSPCb)(void *pUserData, void *infoParam);
 
@@ -147,6 +160,9 @@
     tDblLinkList smeScanCmdPendingList;
     //active scan command list
     tDblLinkList smeScanCmdActiveList;
+#ifdef WLAN_FEATURE_RMC
+    tSmePeerInfoHddCbkInfo peerInfoParams;
+#endif /* WLAN_FEATURE_RMC */
 #ifdef FEATURE_WLAN_CH_AVOID
     void (*pChAvoidNotificationCb) (void *pAdapter, void *indParam);
 #endif /* FEATURE_WLAN_CH_AVOID */
@@ -166,6 +182,11 @@
    tSmeEncMsgHddCbkInfo pEncMsgInfoParams;
    void (*pBtCoexTDLSNotification) (void *pAdapter, int);
    void (*nanCallback) (void*, tSirNanEvent*);
+   void (*rssiThresholdBreachedCb)(void *, struct rssi_breach_event *);
+#ifdef FEATURE_OEM_DATA_SUPPORT
+   void (*pOemDataIndCb) (void *, const tANI_U16, void *, tANI_U32);
+   void *pOemDataCallbackContext;
+#endif /* FEATURE_OEM_DATA_SUPPORT */
 
 } tSmeStruct, *tpSmeStruct;
 
diff --git a/wlan/prima/CORE/SME/inc/sme_Api.h b/wlan/prima/CORE/SME/inc/sme_Api.h
index 6159207..842f998 100644
--- a/wlan/prima/CORE/SME/inc/sme_Api.h
+++ b/wlan/prima/CORE/SME/inc/sme_Api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -57,7 +57,9 @@
 #include "btcApi.h"
 #include "vos_nvitem.h"
 #include "p2p_Api.h"
+#ifdef WLAN_FEATURE_RMC
 #include "smeInternal.h"
+#endif
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
 #include "oemDataApi.h"
@@ -78,6 +80,7 @@
 #define SME_GLOBAL_CLASSC_STATS   8
 #define SME_GLOBAL_CLASSD_STATS  16
 #define SME_PER_STA_STATS        32
+#define SME_PER_PKT_STATS        64
 
 #define SME_INVALID_COUNTRY_CODE "XX"
 
@@ -87,6 +90,56 @@
 //Macro to indicate invalid no of tspecs
 #define INVALID_TSPEC 100
 
+#define SME_SET_CHANNEL_REG_POWER(reg_info_1, val) do { \
+    reg_info_1 &= 0xff00ffff;             \
+    reg_info_1 |= ((val & 0xff) << 16);   \
+} while(0)
+
+#define SME_SET_CHANNEL_MAX_TX_POWER(reg_info_2, val) do { \
+    reg_info_2 &= 0xffff00ff;             \
+    reg_info_2 |= ((val & 0xff) << 8);   \
+} while(0)
+
+/**
+ * ALLOWED_ACTION_FRAMES_BITMAP
+ *
+ * Bitmask is based on the below.The frames with 0's
+ * set to their corresponding bit can be dropped in FW.
+ *
+ * -----------------------------+-----+-------+
+ *         Type                 | Bit | Allow |
+ * -----------------------------+-----+-------+
+ * SIR_MAC_ACTION_SPECTRUM_MGMT    0      1
+ * SIR_MAC_ACTION_QOS_MGMT         1      1
+ * SIR_MAC_ACTION_DLP              2      0
+ * SIR_MAC_ACTION_BLKACK           3      1
+ * SIR_MAC_ACTION_PUBLIC_USAGE     4      1
+ * SIR_MAC_ACTION_RRM              5      1
+ * SIR_MAC_ACTION_FAST_BSS_TRNST   6      0
+ * SIR_MAC_ACTION_HT               7      0
+ * SIR_MAC_ACTION_SA_QUERY         8      1
+ * SIR_MAC_ACTION_PROT_DUAL_PUB    9      0
+ * SIR_MAC_ACTION_WNM             10      1
+ * SIR_MAC_ACTION_UNPROT_WNM      11      0
+ * SIR_MAC_ACTION_TDLS            12      0
+ * SIR_MAC_ACITON_MESH            13      0
+ * SIR_MAC_ACTION_MHF             14      0
+ * SIR_MAC_SELF_PROTECTED         15      0
+ * SIR_MAC_ACTION_WME             17      1
+ * SIR_MAC_ACTION_FST             18      0
+ * SIR_MAC_ACTION_VHT             21      1
+ * ----------------------------+------+-------+
+ */
+#define ALLOWED_ACTION_FRAMES_BITMAP \
+             ((1 << SIR_MAC_ACTION_SPECTRUM_MGMT) | \
+              (1 << SIR_MAC_ACTION_QOS_MGMT) | \
+              (1 << SIR_MAC_ACTION_BLKACK) | \
+              (1 << SIR_MAC_ACTION_PUBLIC_USAGE) | \
+              (1 << SIR_MAC_ACTION_RRM) | \
+              (1 << SIR_MAC_ACTION_SA_QUERY) | \
+              (1 << SIR_MAC_ACTION_WNM) | \
+              (1 << SIR_MAC_ACTION_WME) | \
+              (1 << SIR_MAC_ACTION_VHT))
 /*-------------------------------------------------------------------------- 
   Type declarations
   ------------------------------------------------------------------------*/
@@ -240,26 +293,26 @@
 eHalStatus sme_ResetBssHotlist (tHalHandle hHal,
                               tSirEXTScanResetBssidHotlistReqParams *pResetReq);
 
-/* ---------------------------------------------------------------------------
-    \fn sme_SetSignificantChange
-    \brief  SME API to set significant change
-    \param  hHal
-    \param  pSetSignificantChangeReq: Extented Scan set significant
-            change structure
-    \- return eHalStatus
-    -------------------------------------------------------------------------*/
-eHalStatus sme_SetSignificantChange (tHalHandle hHal,
-            tSirEXTScanSetSignificantChangeReqParams* pSetSignificantChangeReq);
+/**
+ * sme_set_ssid_hotlist() - Set the SSID hotlist
+ * @hal: SME handle
+ * @request: set ssid hotlist request
+ *
+ * Return: eHalStatus
+ */
+eHalStatus sme_set_ssid_hotlist(tHalHandle hal,
+             tSirEXTScanSetSsidHotListReqParams *request);
 
 /* ---------------------------------------------------------------------------
-    \fn sme_ResetSignificantChange
-    \brief  SME API to reset significant change
+    \fn sme_ResetBssHotlist
+    \brief  SME API to reset BSSID hotlist
     \param  hHal
-    \param  pResetReq: Extented Scan reset significant change structure
+    \param  pSetHotListReq: Extented Scan set hotlist structure
     \- return eHalStatus
     -------------------------------------------------------------------------*/
-eHalStatus sme_ResetSignificantChange (tHalHandle hHal,
-              tSirEXTScanResetSignificantChangeReqParams *pResetReq);
+eHalStatus sme_reset_ssid_hotlist (tHalHandle hHal,
+                              tSirEXTScanResetSsidHotlistReqParams *pResetReq);
+
 
 /* ---------------------------------------------------------------------------
     \fn sme_getCachedResults
@@ -282,6 +335,13 @@
                           void *);
 
 #endif /* WLAN_FEATURE_EXTSCAN */
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+eHalStatus sme_OemDataRegisterCallback (tHalHandle hHal,
+               void (*pOemDataIndCb)(void *, const tANI_U16, void *, tANI_U32),
+               void *callbackContext);
+#endif
+
 /* ---------------------------------------------------------------------------
     \fn sme_SpoofMacAddrReq
     \brief  SME API to send Spoof Mac Addr req to HAL
@@ -451,23 +511,10 @@
 
   --------------------------------------------------------------------------*/
 eHalStatus sme_CloseSession(tHalHandle hHal, tANI_U8 sessionId,
+                            tANI_BOOLEAN fSync,
                             tANI_U8 bPurgeSmeCmdList,
                             csrRoamSessionCloseCallback callback,
                             void *pContext);
-/*--------------------------------------------------------------------------
-
-  \brief sme_PurgeCmdList() - Purge all the sme cmd list
-
-  This is a synchronous API.
-
-
-  \param hHal - The handle returned by macOpen.
-
-  \param sessionId - A previous opened session's ID.
-
---------------------------------------------------------------------------*/
-
-eHalStatus sme_PurgeCmdList(tHalHandle hHal, tANI_U8 sessionId);
 
 /*--------------------------------------------------------------------------
   
@@ -825,6 +872,13 @@
 void sme_abortConnection(tHalHandle hHal, tANI_U8 sessionId);
 
 /* ---------------------------------------------------------------------------
+    \fn.sme_dhcp_done_ind
+    \brief a wrapper function to set dhcp done ind  in sme session
+    \retun void.
+---------------------------------------------------------------------------*/
+void sme_dhcp_done_ind(tHalHandle hal, uint8_t session_id);
+
+/* ---------------------------------------------------------------------------
     \fn sme_RoamStopBss
     \brief a wrapper function to request CSR to stop bss
     \param sessionId    - sessionId of SoftAP
@@ -1828,6 +1882,40 @@
                                          tANI_U8 *pCountry,
                                          v_REGDOMAIN_t reg_domain);
 
+#ifdef WLAN_FEATURE_RMC
+/* ---------------------------------------------------------------------------
+
+    \fn sme_TXFailMonitorStartStopInd
+
+    \brief Indicate FW about TX Fail Monitor Indication`
+
+    \param hHal - The handle returned by macOpen.
+
+    \param tx_fail_count number of failures after which the firmware sends
+                         an indication to host
+
+    \param txFailIndCallback function to be called after receiving TX Fail
+                             indication
+    \return eHalStatus  SUCCESS.
+
+                         FAILURE or RESOURCES  The API finished and failed.
+
+  -------------------------------------------------------------------------------*/
+eHalStatus sme_TXFailMonitorStartStopInd(tHalHandle hHal,
+                                         tANI_U8 tx_fail_count,
+                                         void * txFailIndCallback);
+#endif /* WLAN_FEATURE_RMC */
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+VOS_STATUS sme_set_per_roam_rxconfig (tHalHandle hHal, v_U8_t sessionId,
+                  v_U16_t minRate, v_U16_t maxRate, v_U8_t minPercentage,
+                  v_U16_t minPktRequired, v_U64_t waitPeriodForNextPERScan);
+
+VOS_STATUS sme_unset_per_roam_rxconfig (tHalHandle hHal);
+
+void sme_PERRoamScanStartStop(void *hHal, tANI_U8 start);
+#endif
+
 /* ---------------------------------------------------------------------------
 
     \fn sme_DHCPStartInd
@@ -2069,6 +2157,14 @@
 eHalStatus sme_getOemDataRsp(tHalHandle hHal, 
                                          tOemDataRsp **pOemDataRsp);
 
+/* ---------------------------------------------------------------------------
+    \fn sme_OemDataReqNew
+    \brief a wrapper function for OEM DATA REQ NEW
+    \param pOemDataReqNewConfig - Data to be passed to FW
+  ---------------------------------------------------------------------------*/
+void sme_OemDataReqNew(tHalHandle hHal,
+        tOemDataReqNewConfig *pOemDataReqNewConfig);
+
 #endif /*FEATURE_OEM_DATA_SUPPORT*/
 
 
@@ -2219,6 +2315,48 @@
 eHalStatus sme_InitMgmtFrameLogging( tHalHandle hHal,
                             tpSirFWLoggingInitParam wlanFWLoggingInitParam);
 
+
+/* ---------------------------------------------------------------------------
+
+  \fn    sme_StopRssiMonitoring
+
+  \brief
+    SME will pass this request to lower mac to stop monitoring rssi range on
+    a bssid.
+
+  \param
+
+    hHal - The handle returned by macOpen.
+
+    tSirRssiMonitorReq req- depict the monitor req params.
+
+  \return eHalStatus
+
+--------------------------------------------------------------------------- */
+eHalStatus sme_StopRssiMonitoring(tHalHandle hHal,
+                            tSirRssiMonitorReq *req);
+
+/* ---------------------------------------------------------------------------
+
+  \fn    sme_StartRssiMonitoring
+
+  \brief
+    SME will pass this request to lower mac to start monitoring rssi range on
+    a bssid.
+
+  \param
+
+    hHal - The handle returned by macOpen.
+
+    tSirRssiMonitorReq req- depict the monitor req params.
+
+  \return eHalStatus
+
+--------------------------------------------------------------------------- */
+eHalStatus sme_StartRssiMonitoring(tHalHandle hHal,
+                            tSirRssiMonitorReq *req);
+
+
 /* ---------------------------------------------------------------------------
 
   \fn    sme_ConfigureRxpFilter
@@ -3217,6 +3355,8 @@
 eHalStatus sme_UpdateRoamScanOffloadEnabled(tHalHandle hHal, v_BOOL_t nRoamScanOffloadEnabled);
 #endif
 
+eHalStatus sme_FwMemDumpReq(tHalHandle hHal, tAniFwrDumpReq *recv_req);
+
 
 /* ---------------------------------------------------------------------------
     \fn sme_IsFeatureSupportedByFW
@@ -3518,6 +3658,28 @@
 void sme_enable_disable_split_scan (tHalHandle hHal, tANI_U8 nNumStaChan,
                                     tANI_U8 nNumP2PChan);
 
+#ifdef WLAN_FEATURE_RMC
+/* ---------------------------------------------------------------------------
+    \fn sme_EnableRMC
+    \brief  Used to enable RMC
+    setting will not persist over reboots
+    \param  hHal
+    \param  sessionId
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_EnableRMC(tHalHandle hHal, tANI_U32 sessionId);
+
+/* ---------------------------------------------------------------------------
+    \fn sme_DisableRMC
+    \brief  Used to disable RMC
+    setting will not persist over reboots
+    \param  hHal
+    \param  sessionId
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_DisableRMC(tHalHandle hHal, tANI_U32 sessionId);
+#endif /* WLAN_FEATURE_RMC */
+
 /* ---------------------------------------------------------------------------
     \fn sme_SendRateUpdateInd
     \brief  API to Update rate
@@ -3527,6 +3689,21 @@
   ---------------------------------------------------------------------------*/
 eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateParams);
 
+#ifdef WLAN_FEATURE_RMC
+/* ---------------------------------------------------------------------------
+    \fn sme_GetIBSSPeerInfo
+    \brief  Used to disable RMC
+    setting will not persist over reboots
+    \param  hHal
+    \param  ibssPeerInfoReq  multicast Group IP address
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_RequestIBSSPeerInfo(tHalHandle hHal, void *pUserData,
+                                            pIbssPeerInfoCb peerInfoCbk,
+                                            tANI_BOOLEAN allPeerInfoReqd,
+                                            tANI_U8 staIdx);
+#endif /* WLAN_FEATURE_RMC */
+
 /*
  * sme API to trigger fast BSS roam to a given BSSID independent of RSSI
  * triggers
@@ -3658,6 +3835,9 @@
                    tANI_U8 sessionId, tANI_U8 cbMode);
 #endif
 
+eHalStatus sme_set_rssi_threshold_breached_cb(tHalHandle hal,
+                        void (*cb)(void *, struct rssi_breach_event *));
+
 void sme_disable_dfs_channel(tHalHandle hHal, bool disable_dfs);
 
 /* HDD Callback function */
@@ -3747,13 +3927,37 @@
 eHalStatus sme_SetRtsCtsHtVht(tHalHandle hHal, tANI_U32 set_value);
 
 tANI_BOOLEAN sme_handleSetFccChannel(tHalHandle hHal,
-                                      tANI_U8 fcc_constraint);
+                                      tANI_U8 fcc_constraint,
+                                      v_U32_t scan_pending);
 
 eHalStatus sme_DeleteAllTDLSPeers(tHalHandle hHal, uint8_t sessionId);
 eHalStatus sme_fatal_event_logs_req(tHalHandle hHal, tANI_U32 is_fatal,
-                               tANI_U32 indicator, tANI_U32 reason_code);
+                               tANI_U32 indicator, tANI_U32 reason_code,
+                               tANI_BOOLEAN dump_vos_trace);
 
 eHalStatus sme_enableDisableChanAvoidIndEvent(tHalHandle hHal,
                                               tANI_U8 set_value);
 
+/* ---------------------------------------------------------------------------
+    \fn sme_set_wificonfig_params
+    \brief  API to set WifiConfiguration Parameters.
+
+    \param  wifi_config_param - Wificonfig parameter 1.Averaging factor 2. Guard time
+    \- return VOS_STATUS_SUCCES if INdication is posted to
+       WDA else return eHAL_STATUS_FAILURE
+    -------------------------------------------------------------------------*/
+
+eHalStatus sme_set_wificonfig_params(tHalHandle hHal, tSetWifiConfigParams *req);
+eHalStatus sme_getRegInfo(tHalHandle hHal, tANI_U8 chanId,
+                          tANI_U32 *regInfo1, tANI_U32 *regInfo2);
+eHalStatus sme_GetCurrentAntennaIndex(tHalHandle hHal,
+                                      tCsrAntennaIndexCallback callback,
+                                      void *pContext, tANI_U8 sessionId);
+
+eHalStatus sme_setBcnMissPenaltyCount(tHalHandle hHal,
+                                      tModifyRoamParamsReqParams *params);
+eHalStatus sme_remove_bssid_from_scan_list(tHalHandle hal,
+	tSirMacAddr bssid);
+void sme_set_mgmt_frm_via_wq5(tHalHandle hHal,
+        tANI_BOOLEAN sendMgmtPktViaWQ5);
 #endif //#if !defined( __SME_API_H )
diff --git a/wlan/prima/CORE/SME/inc/sme_Trace.h b/wlan/prima/CORE/SME/inc/sme_Trace.h
index abb49e5..9967cac 100644
--- a/wlan/prima/CORE/SME/inc/sme_Trace.h
+++ b/wlan/prima/CORE/SME/inc/sme_Trace.h
@@ -41,16 +41,9 @@
 #include "macTrace.h"
 
 #define NO_SESSION 0xFF
+
 enum {
-     TRACE_CODE_SME_COMMAND,
-     TRACE_CODE_SME_TX_WDA_MSG,
-     TRACE_CODE_SME_RX_WDA_MSG,
-};
-enum {
-    /* Starts enums from 3 onwards, because unknown code captures for first
-     * three enums in smeTraceDump()
-     */
-    TRACE_CODE_SME_RX_HDD_MSG_SCAN_REQ = 3,
+    TRACE_CODE_SME_RX_HDD_MSG_SCAN_REQ,
     TRACE_CODE_SME_RX_HDD_MSG_SCAN_GET_RESULTS,
     TRACE_CODE_SME_RX_HDD_MSG_CONNECT,
     TRACE_CODE_SME_RX_HDD_MSG_SET_11DINFO,
@@ -69,7 +62,6 @@
     TRACE_CODE_SME_RX_HDD_ROAM_GET_CONNECTPROFILE,
     TRACE_CODE_SME_RX_HDD_ROAM_FREE_CONNECTPROFILE,
     TRACE_CODE_SME_RX_HDD_ROAM_SET_PMKIDCACHE,
-    TRACE_CODE_SME_RX_HDD_ROAM_DEL_PMKIDCACHE,
     TRACE_CODE_SME_RX_HDD_GET_CONFIGPARAM,
     TRACE_CODE_SME_RX_HDD_GET_MODPROFFIELDS,
     TRACE_CODE_SME_RX_HDD_SET_CONFIG_PWRSAVE,
@@ -133,14 +125,13 @@
     TRACE_CODE_SME_RX_HDD_UPDATE_FTENABLED,
     TRACE_CODE_SME_RX_HDD_UPDATE_WESMODE,
     TRACE_CODE_SME_RX_HDD_SET_SCANCTRL,
-    TRACE_CODE_SME_RX_HDD_EXTSCAN_GET_CAPABILITIES,
     TRACE_CODE_SME_RX_HDD_EXTSCAN_START,
     TRACE_CODE_SME_RX_HDD_EXTSCAN_STOP,
     TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_BSS_HOTLIST,
     TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_BSS_HOTLIST,
-    TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_SIGNF_CHANGE,
-    TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_SIGNF_CHANGE,
     TRACE_CODE_SME_RX_HDD_EXTSCAN_GET_CACHED_RESULTS,
+    TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_SSID_HOTLIST,
+    TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_SSID_HOTLIST,
     TRACE_CODE_SME_RX_HDD_MSG_DEAUTH_STA,
 #ifdef FEATURE_WLAN_TDLS
     TRACE_CODE_SME_RX_HDD_TDLS_LINK_ESTABLISH_PARAM,
@@ -154,7 +145,14 @@
 #ifdef FEATURE_WLAN_LPHB
     TRACE_CODE_SME_RX_HDD_LPHB_CONFIG_REQ,
 #endif /* FEATURE_WLAN_LPHB */
+    TRACE_CODE_SME_RX_HDD_ROAM_DEL_PMKIDCACHE,
+    /* New trace commands to be added before this comment not at the end */
+    /* Trace codes for SME commands */
+    TRACE_CODE_SME_COMMAND = 250,
+    TRACE_CODE_SME_TX_WDA_MSG,
+    TRACE_CODE_SME_RX_WDA_MSG,
 };
 
 void smeTraceInit(tpAniSirGlobal pMac);
+void sme_register_debug_callback(void);
 #endif //__SME_TRACE_H__
diff --git a/wlan/prima/CORE/SME/src/csr/csrApiRoam.c b/wlan/prima/CORE/SME/src/csr/csrApiRoam.c
index fc8456d..83fde40 100644
--- a/wlan/prima/CORE/SME/src/csr/csrApiRoam.c
+++ b/wlan/prima/CORE/SME/src/csr/csrApiRoam.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -108,6 +108,9 @@
 static tANI_BOOLEAN bRoamScanOffloadStarted = VOS_FALSE;
 #endif
 
+#define MAX_PWR_FCC_CHAN_12 8
+#define MAX_PWR_FCC_CHAN_13 2
+
 /*-------------------------------------------------------------------------- 
   Static Type declarations
   ------------------------------------------------------------------------*/
@@ -599,6 +602,22 @@
         pChanList->chanParam[num_channel].pwr =
           cfgGetRegulatoryMaxTransmitPower(pMac,
                                            pScan->defaultPowerTable[i].chanId);
+        if (pMac->scan.fcc_constraint)
+        {
+            if (pChanList->chanParam[num_channel].chanId == 12)
+            {
+                pChanList->chanParam[num_channel].pwr = MAX_PWR_FCC_CHAN_12;
+                smsLog(pMac, LOG1,
+                      "fcc_constraint is set, txpower for channel 12 is 8db ");
+            }
+            if (pChanList->chanParam[num_channel].chanId == 13)
+            {
+                pChanList->chanParam[num_channel].pwr = MAX_PWR_FCC_CHAN_13;
+                smsLog(pMac, LOG1,
+                      "fcc_constraint is set, txpower for channel 13 is 2db ");
+            }
+        }
+
         if (!pChanList->chanParam[num_channel].pwr)
         {
             smsLog(pMac, LOGE, FL("Power level is zero for channel %d "
@@ -802,7 +821,7 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tANI_U32 i;
-    tCsrRoamSession *pSession;
+    tCsrRoamSession *pSession = NULL;
     do
     {
         for( i = 0; i < CSR_ROAM_SESSION_MAX; i++ )
@@ -1047,6 +1066,33 @@
     csrReinitRemoveKeyCmd(pMac, pCommand);
     csrReleaseCommand( pMac, pCommand );
 }
+
+/**
+ * csr_is_disconnect_full_power_cmd() - Check if command is for
+ * disconnect or for fullpower
+ * @command: command to check
+ *
+ * Return: true if disconnect or full power command else false
+ */
+bool csr_is_disconnect_full_power_cmd(tSmeCmd *command)
+{
+    switch (command->command) {
+    case eSmeCommandRoam:
+        if (CSR_IS_DISCONNECT_COMMAND(command))
+            return true;
+        break;
+    case eSmeCommandWmStatusChange:
+    case eSmeCommandExitImps:
+    case eSmeCommandExitBmps:
+    case eSmeCommandExitUapsd:
+    case eSmeCommandExitWowl:
+        return true;
+    default:
+        return false;
+    }
+    return false;
+}
+
 void csrAbortCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand, tANI_BOOLEAN fStopping )
 {
 
@@ -1886,8 +1932,21 @@
         pMac->roam.configParam.nRoamScanHomeAwayTime = pParam->nRoamScanHomeAwayTime;
 #endif
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-        pMac->roam.configParam.isRoamOffloadScanEnabled = pParam->isRoamOffloadScanEnabled;
-        pMac->roam.configParam.bFastRoamInConIniFeatureEnabled = pParam->bFastRoamInConIniFeatureEnabled;
+        pMac->roam.configParam.isRoamOffloadScanEnabled =
+                pParam->isRoamOffloadScanEnabled;
+        pMac->roam.configParam.bFastRoamInConIniFeatureEnabled =
+                pParam->bFastRoamInConIniFeatureEnabled;
+        pMac->roam.configParam.isPERRoamEnabled =
+                pParam->isPERRoamEnabled;
+        pMac->roam.configParam.rateUpThreshold = pParam->rateUpThreshold;
+        pMac->roam.configParam.rateDownThreshold = pParam->rateDownThreshold;
+        pMac->roam.configParam.waitPeriodForNextPERScan =
+                pParam->waitPeriodForNextPERScan;
+        pMac->roam.configParam.PERtimerThreshold = pParam->PERtimerThreshold;
+        pMac->roam.configParam.isPERRoamCCAEnabled =
+                pParam->isPERRoamCCAEnabled;
+        pMac->roam.configParam.PERroamTriggerPercent =
+                pParam->PERroamTriggerPercent;
 #endif
 #ifdef FEATURE_WLAN_LFR
         pMac->roam.configParam.isFastRoamIniFeatureEnabled = pParam->isFastRoamIniFeatureEnabled;
@@ -1955,6 +2014,8 @@
         pMac->roam.configParam.ignorePeerHTopMode = pParam->ignorePeerHTopMode;
         pMac->roam.configParam.disableP2PMacSpoofing =
                                         pParam->disableP2PMacSpoofing;
+        pMac->roam.configParam.enableFatalEvent =
+                                        pParam->enableFatalEvent;
         pMac->roam.configParam.isCoalesingInIBSSAllowed =
                                pParam->isCoalesingInIBSSAllowed;
         pMac->roam.configParam.allowDFSChannelRoam = pParam->allowDFSChannelRoam;
@@ -1963,6 +2024,24 @@
         pMac->roam.configParam.apHT40_24GEnabled = pParam->apHT40_24GEnabled;
 #endif
         pMac->roam.configParam.roamDelayStatsEnabled = pParam->roamDelayStatsEnabled;
+        pMac->roam.configParam.max_chan_for_dwell_time_cfg =
+                               pParam->max_chan_for_dwell_time_cfg;
+
+        pMac->roam.configParam.enable_edca_params = pParam->enable_edca_params;
+        pMac->roam.configParam.edca_vo_cwmin = pParam->edca_vo_cwmin;
+        pMac->roam.configParam.edca_vi_cwmin = pParam->edca_vi_cwmin;
+        pMac->roam.configParam.edca_bk_cwmin = pParam->edca_bk_cwmin;
+        pMac->roam.configParam.edca_be_cwmin = pParam->edca_be_cwmin;
+
+        pMac->roam.configParam.edca_vo_cwmax = pParam->edca_vo_cwmax;
+        pMac->roam.configParam.edca_vi_cwmax = pParam->edca_vi_cwmax;
+        pMac->roam.configParam.edca_bk_cwmax = pParam->edca_bk_cwmax;
+        pMac->roam.configParam.edca_be_cwmax = pParam->edca_be_cwmax;
+
+        pMac->roam.configParam.edca_vo_aifs = pParam->edca_vo_aifs;
+        pMac->roam.configParam.edca_vi_aifs = pParam->edca_vi_aifs;
+        pMac->roam.configParam.edca_bk_aifs = pParam->edca_bk_aifs;
+        pMac->roam.configParam.edca_be_aifs = pParam->edca_be_aifs;
     }
     
     return status;
@@ -2075,6 +2154,17 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
         pParam->isRoamOffloadScanEnabled = pMac->roam.configParam.isRoamOffloadScanEnabled;
         pParam->bFastRoamInConIniFeatureEnabled = pMac->roam.configParam.bFastRoamInConIniFeatureEnabled;
+        pParam->isPERRoamEnabled =
+                pMac->roam.configParam.isPERRoamEnabled;
+        pParam->rateUpThreshold = pMac->roam.configParam.rateUpThreshold;
+        pParam->rateDownThreshold = pMac->roam.configParam.rateDownThreshold;
+        pParam->waitPeriodForNextPERScan =
+                pMac->roam.configParam.waitPeriodForNextPERScan;
+        pParam->PERtimerThreshold = pMac->roam.configParam.PERtimerThreshold;
+        pParam->isPERRoamCCAEnabled =
+                pMac->roam.configParam.isPERRoamCCAEnabled;
+        pParam->PERroamTriggerPercent =
+                pMac->roam.configParam.PERroamTriggerPercent;
 #endif
 #ifdef FEATURE_WLAN_LFR
         pParam->isFastRoamIniFeatureEnabled = pMac->roam.configParam.isFastRoamIniFeatureEnabled;
@@ -2105,6 +2195,7 @@
         pParam->ignorePeerHTopMode = pMac->roam.configParam.ignorePeerHTopMode;
         pParam->disableP2PMacSpoofing =
                                 pMac->roam.configParam.disableP2PMacSpoofing;
+        pParam->enableFatalEvent = pMac->roam.configParam.enableFatalEvent;
 
         pParam->isCoalesingInIBSSAllowed =
                                 pMac->roam.configParam.isCoalesingInIBSSAllowed;
@@ -2115,6 +2206,24 @@
 #ifdef WLAN_FEATURE_AP_HT40_24G
         pParam->apHT40_24GEnabled = pMac->roam.configParam.apHT40_24GEnabled;
 #endif
+        pParam->max_chan_for_dwell_time_cfg =
+                            pMac->roam.configParam.max_chan_for_dwell_time_cfg;
+
+        pParam->enable_edca_params = pMac->roam.configParam.enable_edca_params;
+        pParam->edca_vo_cwmin = pMac->roam.configParam.edca_vo_cwmin;
+        pParam->edca_vi_cwmin = pMac->roam.configParam.edca_vi_cwmin;
+        pParam->edca_bk_cwmin = pMac->roam.configParam.edca_bk_cwmin;
+        pParam->edca_be_cwmin = pMac->roam.configParam.edca_be_cwmin;
+
+        pParam->edca_vo_cwmax = pMac->roam.configParam.edca_vo_cwmax;
+        pParam->edca_vi_cwmax = pMac->roam.configParam.edca_vi_cwmax;
+        pParam->edca_bk_cwmax = pMac->roam.configParam.edca_bk_cwmax;
+        pParam->edca_be_cwmax = pMac->roam.configParam.edca_be_cwmax;
+
+        pParam->edca_vo_aifs = pMac->roam.configParam.edca_vo_aifs;
+        pParam->edca_vi_aifs = pMac->roam.configParam.edca_vi_aifs;
+        pParam->edca_bk_aifs = pMac->roam.configParam.edca_bk_aifs;
+        pParam->edca_be_aifs = pMac->roam.configParam.edca_be_aifs;
 
         status = eHAL_STATUS_SUCCESS;
     }
@@ -2641,7 +2750,7 @@
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
     WLAN_VOS_DIAG_EVENT_DEF(connectionStatus, vos_event_wlan_status_payload_type);
 #endif
-    tCsrRoamSession *pSession;
+    tCsrRoamSession *pSession = NULL;
     if( CSR_IS_SESSION_VALID( pMac, sessionId) )
     {
         pSession = CSR_GET_SESSION( pMac, sessionId );
@@ -2696,8 +2805,8 @@
         status = pSession->callback(pSession->pContext, pRoamInfo, roamId, u1, u2);
         // TODO: revisit: sme_AcquireGlobalLock( &pMac->sme );
     }
-    //EVENT_WLAN_STATUS: eCSR_ROAM_ASSOCIATION_COMPLETION, 
-    //                   eCSR_ROAM_LOSTLINK, eCSR_ROAM_DISASSOCIATED, 
+    //EVENT_WLAN_STATUS_V2: eCSR_ROAM_ASSOCIATION_COMPLETION,
+    //                   eCSR_ROAM_LOSTLINK, eCSR_ROAM_DISASSOCIATED,
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR    
     vos_mem_set(&connectionStatus,
                 sizeof(vos_event_wlan_status_payload_type), 0);
@@ -2715,34 +2824,35 @@
        connectionStatus.authType = (v_U8_t)diagAuthTypeFromCSRType(pRoamInfo->u.pConnectedProfile->AuthType);
        connectionStatus.encryptionType = (v_U8_t)diagEncTypeFromCSRType(pRoamInfo->u.pConnectedProfile->EncryptionType);
        vos_mem_copy(connectionStatus.ssid,
-                    pRoamInfo->u.pConnectedProfile->SSID.ssId, 6);
+                    pRoamInfo->u.pConnectedProfile->SSID.ssId,
+                    pRoamInfo->u.pConnectedProfile->SSID.length);
 
        connectionStatus.reason = eCSR_REASON_UNSPECIFIED;
-       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
+       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS_V2);
     }
     if((eCSR_ROAM_MIC_ERROR_IND == u1) || (eCSR_ROAM_RESULT_MIC_FAILURE == u2))
     {
        connectionStatus.eventId = eCSR_WLAN_STATUS_DISCONNECT;
        connectionStatus.reason = eCSR_REASON_MIC_ERROR;
-       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
+       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS_V2);
     }
     if(eCSR_ROAM_RESULT_FORCED == u2)
     {
        connectionStatus.eventId = eCSR_WLAN_STATUS_DISCONNECT;
        connectionStatus.reason = eCSR_REASON_USER_REQUESTED;
-       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
+       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS_V2);
     }
     if(eCSR_ROAM_RESULT_DISASSOC_IND == u2)
     {
        connectionStatus.eventId = eCSR_WLAN_STATUS_DISCONNECT;
        connectionStatus.reason = eCSR_REASON_DISASSOC;
-       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
+       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS_V2);
     }
     if(eCSR_ROAM_RESULT_DEAUTH_IND == u2)
     {
        connectionStatus.eventId = eCSR_WLAN_STATUS_DISCONNECT;
        connectionStatus.reason = eCSR_REASON_DEAUTH;
-       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
+       WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS_V2);
     }
 #endif //FEATURE_WLAN_DIAG_SUPPORT_CSR
     
@@ -4765,7 +4875,7 @@
 eHalStatus csrProcessFTReassocRoamCommand ( tpAniSirGlobal pMac, tSmeCmd *pCommand )
 {
     tANI_U32 sessionId;
-    tCsrRoamSession *pSession;
+    tCsrRoamSession *pSession = NULL;
     tCsrScanResult *pScanResult = NULL;
     tSirBssDescription *pBssDesc = NULL;
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -5604,7 +5714,7 @@
                                                pSirBssDesc, &BroadcastMac,
                                                FALSE, FALSE, eSIR_TX_RX, 0, 0, NULL, 0 ); // NO keys... these key parameters don't matter.
                 }
-                else
+                else if (!pSession->abortConnection)
                 {
                     //Need to wait for supplicant authtication
                     roamInfo.fAuthRequired = eANI_BOOLEAN_TRUE;
@@ -6809,6 +6919,7 @@
     }
     /* Reset abortConnection for the fresh connection */
     pSession->abortConnection = FALSE;
+    pSession->dhcp_done = false;
     csrRoamCancelRoaming(pMac, sessionId);
     csrScanRemoveFreshScanCommand(pMac, sessionId);
     csrScanCancelIdleScan(pMac);
@@ -6834,6 +6945,19 @@
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
     pSession->maxRetryCount = CSR_JOIN_MAX_RETRY_COUNT; 
 #endif
+    /*
+     * If roamSession.connectState is disconnecting that mean
+     * disconnect/stop adapter was received with scan for ssid
+     * in progress and dropped. This state will ensure that
+     * connect will not be issued from scan for ssid completion.
+     * Thus if this fresh connect also issue scan for ssid the connect
+     * command will be dropped assuming disconnect is in progress.
+     * Thus reset connectState here
+     */
+    if (eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTING ==
+         pMac->roam.roamSession[sessionId].connectState)
+        pMac->roam.roamSession[sessionId].connectState =
+                       eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED;
     if(CSR_INVALID_SCANRESULT_HANDLE != hBssListIn)
     {
         smsLog(pMac, LOG1, FL("is called with BSSList"));
@@ -7425,10 +7549,12 @@
     }
     else
     {
+        pMac->roam.roamSession[sessionId].connectState =
+            eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTING;
         csrScanAbortScanForSSID(pMac, sessionId);
         status = eHAL_STATUS_CMD_NOT_QUEUED;
-        smsLog( pMac, LOG1, FL(" Disconnect cmd not queued, Roam command is not present"
-                               " return with status %d"), status);
+        smsLog(pMac, LOGE,
+             FL("Disconnect not queued, Abort Scan for SSID"));
     }
     return (status);
 }
@@ -7730,7 +7856,7 @@
     tSmeCmd *pCommand;
     tCsrRoamInfo roamInfo;
     tANI_U32 sessionId;
-    tCsrRoamSession *pSession;
+    tCsrRoamSession *pSession = NULL;
             
     pEntry = csrLLPeekHead(&pMac->sme.smeCmdActiveList, LL_ACCESS_LOCK);
     if(pEntry)
@@ -7967,7 +8093,7 @@
     tSirBssDescription *pBssDesc = NULL;
     tSmeCmd *pCommand = NULL;
     tANI_U32 sessionId;
-    tCsrRoamSession *pSession;
+    tCsrRoamSession *pSession = NULL;
     if(NULL == pEntry)
     {
         smsLog(pMac, LOGE, "   CFG_CNF with active list empty");
@@ -8185,8 +8311,11 @@
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     tCsrRoamInfo roamInfo;
     tANI_U32 roamId = 0;
-    
-    if ( eSIR_SME_SUCCESS == pSmeJoinRsp->statusCode ) 
+    tANI_U32 current_timestamp, max_time = -1;
+    tANI_U32 candidateApCnt, oldestIndex;
+    tANI_U8 nilMac[6] = {0};
+
+    if (eSIR_SME_SUCCESS == pSmeJoinRsp->statusCode)
     {
         smsLog( pMac, LOGW, "CSR SmeReassocReq Successful" );
         result = eCsrReassocSuccess;
@@ -8199,6 +8328,73 @@
             /* Need to dig more on indicating events to SME QoS module */
             sme_QosCsrEventInd(pMac, pSmeJoinRsp->sessionId, SME_QOS_CSR_HANDOFF_COMPLETE, NULL);
             csrRoamComplete( pMac, result, pSmeJoinRsp);
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            /* Add previous BSSID to blacklist ; this will be in blacklised for
+             * some period and score of this AP will be reduced if black listed
+             * to avoid ping pong */
+            if (pMac->PERroamCandidatesCnt)
+            {
+              current_timestamp = jiffies_to_msecs(jiffies);
+              for (candidateApCnt = 0; candidateApCnt <
+                   SIR_PER_ROAM_MAX_CANDIDATE_CNT; candidateApCnt++)
+              {
+                  /* Find one blank entry */
+                  if (sirCompareMacAddr(nilMac,
+                          pMac->previousRoamApInfo[candidateApCnt].bssAddr))
+                  {
+                      vos_mem_copy(pMac->previousRoamApInfo[candidateApCnt].
+                                   bssAddr,
+                                   pNeighborRoamInfo->prevConnProfile.bssid,
+                                   sizeof(tSirMacAddr));
+                      pMac->previousRoamApInfo[candidateApCnt].timeStamp =
+                          current_timestamp;
+                      smsLog(pMac, LOG1, FL("added bssid=" MAC_ADDRESS_STR " at index %d"),
+                             MAC_ADDR_ARRAY(
+                                 pNeighborRoamInfo->prevConnProfile.bssid),
+                             candidateApCnt);
+                      break;
+                  }
+                  /* if already in the list */
+                  if (sirCompareMacAddr(pMac->previousRoamApInfo
+                      [candidateApCnt].bssAddr,
+                      pNeighborRoamInfo->prevConnProfile.bssid) &&
+                      ((current_timestamp -
+                          pMac->previousRoamApInfo[candidateApCnt].timeStamp) >
+                          pMac->PERroamTimeout))
+                  {
+                      vos_mem_copy(pMac->previousRoamApInfo[candidateApCnt].
+                                   bssAddr,
+                                   pNeighborRoamInfo->prevConnProfile.bssid,
+                                   sizeof(tSirMacAddr));
+                      pMac->previousRoamApInfo[candidateApCnt].timeStamp =
+                          current_timestamp;
+                      break;
+                  } else
+                  {
+                      /* find oldest BSSID entry in the blacklist */
+                      if (max_time <
+                             pMac->previousRoamApInfo[candidateApCnt].timeStamp)
+                      {
+                          max_time =
+                             pMac->previousRoamApInfo[candidateApCnt].timeStamp;
+                          oldestIndex = candidateApCnt;
+                      }
+                  }
+              }
+              if (candidateApCnt == SIR_PER_ROAM_MAX_CANDIDATE_CNT)
+              {
+                 smsLog(pMac, LOGW,
+                        "%s: Clearing out oldest roam results bssid="
+                        MAC_ADDRESS_STR,
+                        __func__,
+                        MAC_ADDR_ARRAY(pMac->previousRoamApInfo[oldestIndex].bssAddr));
+                  pMac->previousRoamApInfo[oldestIndex].timeStamp = current_timestamp;
+                  vos_mem_copy(pMac->previousRoamApInfo[oldestIndex].bssAddr,
+                       pNeighborRoamInfo->prevConnProfile.bssid,
+                       sizeof(tSirMacAddr));
+              }
+            }
+#endif
         }
         else
 #endif
@@ -8212,6 +8408,10 @@
     {
         smsLog( pMac, LOGW, "CSR SmeReassocReq failed with statusCode= 0x%08X [%d]", pSmeJoinRsp->statusCode, pSmeJoinRsp->statusCode );
         result = eCsrReassocFailure;
+        vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                          WLAN_LOG_INDICATOR_HOST_DRIVER,
+                          WLAN_LOG_REASON_ROAM_FAIL,
+                          FALSE, TRUE);
 #ifdef WLAN_FEATURE_VOWIFI_11R
         if ((eSIR_SME_FT_REASSOC_TIMEOUT_FAILURE == pSmeJoinRsp->statusCode) ||
             (eSIR_SME_FT_REASSOC_FAILURE == pSmeJoinRsp->statusCode) ||
@@ -8293,7 +8493,7 @@
     tSmeCmd *pCommand = NULL;
 #endif
     tANI_U32 sessionId;
-    tCsrRoamSession *pSession;
+    tCsrRoamSession *pSession = NULL;
 
     tSirSmeDisassocRsp SmeDisassocRsp;
 
@@ -8705,7 +8905,7 @@
           break;
         case eWNI_SME_UPPER_LAYER_ASSOC_CNF:
         {
-            tCsrRoamSession  *pSession;
+            tCsrRoamSession *pSession = NULL;
             tSirSmeAssocIndToUpperLayerCnf *pUpperLayerAssocCnf;
             tCsrRoamInfo roamInfo;
             tCsrRoamInfo *pRoamInfo = NULL;
@@ -8742,6 +8942,7 @@
             smsLog( pMac, LOGW, FL("HT40MHzIntoEnabledSta: %d \n"),
                                     pRoamInfo->HT40MHzIntoEnabledSta);
 #endif
+            pRoamInfo->maxRateFlags = pUpperLayerAssocCnf->rate_flags;
             if(CSR_IS_INFRA_AP(pRoamInfo->u.pConnectedProfile) )
             {
                 pMac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED;
@@ -9025,13 +9226,13 @@
                     sizeof(vos_event_wlan_security_payload_type), 0);
         if( *(( tANI_U8 *)&pCommand->u.setKeyCmd.peerMac) & 0x01 )
         {
-            setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_GTK_REQ;
+            setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_BCAST_REQ;
             setKeyEvent.encryptionModeMulticast = (v_U8_t)diagEncTypeFromCSRType(pCommand->u.setKeyCmd.encType);
             setKeyEvent.encryptionModeUnicast = (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.EncryptionType);
         }
         else
         {
-            setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_PTK_REQ;
+            setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_UNICAST_REQ;
             setKeyEvent.encryptionModeUnicast = (v_U8_t)diagEncTypeFromCSRType(pCommand->u.setKeyCmd.encType);
             setKeyEvent.encryptionModeMulticast = (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.mcEncryptionType);
         }
@@ -9077,11 +9278,11 @@
         {
             if( *(( tANI_U8 *)&pCommand->u.setKeyCmd.peerMac) & 0x01 )
             {
-                setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_GTK_RSP;
+                setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_BCAST_RSP;
             }
             else
             {
-                setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_PTK_RSP;
+                setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_UNICAST_RSP;
             }
             setKeyEvent.status = WLAN_SECURITY_STATUS_FAILURE;
             WLAN_VOS_DIAG_EVENT_REPORT(&setKeyEvent, EVENT_WLAN_SECURITY);
@@ -9632,6 +9833,7 @@
     tSirSmeAssocInd *pAssocInd;
     tSirSmeDisassocInd *pDisassocInd;
     tSirSmeDeauthInd *pDeauthInd;
+    tSirSmeDisConDoneInd *pDisConDoneInd;
     tSirSmeWmStatusChangeNtf *pStatusChangeMsg;
     tSirSmeNewBssInfo *pNewBss;
     tSmeIbssPeerInd *pIbssPeerInd;
@@ -9657,7 +9859,7 @@
     {
         case eWNI_SME_ASSOC_IND:
             {
-                tCsrRoamSession  *pSession;
+                tCsrRoamSession *pSession = NULL;
                 smsLog( pMac, LOG1, FL("Receive WNI_SME_ASSOC_IND from SME"));
                 pAssocInd = (tSirSmeAssocInd *)pSirMsg;
                 status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pAssocInd->bssId, &sessionId );
@@ -9693,6 +9895,7 @@
                     vos_mem_copy(&pRoamInfo->bssid, pAssocInd->bssId,
                                  sizeof(tCsrBssid));
                     pRoamInfo->wmmEnabledSta = pAssocInd->wmmEnabledSta;
+                    pRoamInfo->maxRateFlags =  pAssocInd->rate_flags;
 #ifdef WLAN_FEATURE_AP_HT40_24G
                     pRoamInfo->HT40MHzIntoEnabledSta =
                                pAssocInd->HT40MHzIntoEnabledSta;
@@ -9798,19 +10001,6 @@
                     csrRoamIssueWmStatusChange( pMac, sessionId, eCsrDisassociated, pSirMsg );
                     if (CSR_IS_INFRA_AP(&pSession->connectedProfile))
                     {
-                        pRoamInfo = &roamInfo;
-                        pRoamInfo->statusCode = pDisassocInd->statusCode;
-                        pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
-                        pRoamInfo->staId = (tANI_U8)pDisassocInd->staId;
-
-                        vos_mem_copy(pRoamInfo->peerMac, pDisassocInd->peerMacAddr,
-                                     sizeof(tSirMacAddr));
-                        vos_mem_copy(&pRoamInfo->bssid, pDisassocInd->bssId,
-                                     sizeof(tCsrBssid));
-
-                        status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0,
-                                        eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_DISASSOC_IND);
-
                         /*
                          *  STA/P2P client got  disassociated so remove any pending deauth
                          *  commands in sme pending list
@@ -9885,26 +10075,33 @@
 #endif
                 csrRoamLinkDown(pMac, sessionId);
                 csrRoamIssueWmStatusChange( pMac, sessionId, eCsrDeauthenticated, pSirMsg );
-                if(CSR_IS_INFRA_AP(&pSession->connectedProfile))
-                {
-
-                    pRoamInfo = &roamInfo;
-
-                    pRoamInfo->statusCode = pDeauthInd->statusCode;
-                    pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
-
-                    pRoamInfo->staId = (tANI_U8)pDeauthInd->staId;
-
-                    vos_mem_copy(pRoamInfo->peerMac, pDeauthInd->peerMacAddr,
-                                 sizeof(tSirMacAddr));
-                    vos_mem_copy(&pRoamInfo->bssid, pDeauthInd->bssId,
-                                 sizeof(tCsrBssid));
-
-                    status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_DEAUTH_IND);
-                }
             }
             break;
-        
+
+        case eWNI_SME_DISCONNECT_DONE_IND:
+            pDisConDoneInd = (tSirSmeDisConDoneInd *)(pSirMsg);
+            smsLog( pMac, LOG1,
+                    FL("eWNI_SME_DISCONNECT_DONE_IND RC:%d"),
+                        pDisConDoneInd->reasonCode);
+            if( CSR_IS_SESSION_VALID(pMac, pDisConDoneInd->sessionId))
+            {
+                roamInfo.reasonCode = pDisConDoneInd->reasonCode;
+                roamInfo.statusCode = eSIR_SME_STA_DISASSOCIATED;
+                vos_mem_copy(roamInfo.peerMac, pDisConDoneInd->peerMacAddr,
+                             sizeof(tSirMacAddr));
+                status = csrRoamCallCallback(pMac,
+                                     pDisConDoneInd->sessionId,
+                                     &roamInfo, 0,
+                                     eCSR_ROAM_LOSTLINK,
+                                     eCSR_ROAM_RESULT_DISASSOC_IND);
+            }
+            else
+            {
+                smsLog(pMac, LOGE, FL("Inactive session %d"),
+                        pDisConDoneInd->sessionId);
+            }
+            break;
+
         case eWNI_SME_SWITCH_CHL_REQ:        // in case of STA, the SWITCH_CHANNEL originates from its AP
             smsLog( pMac, LOGW, FL("eWNI_SME_SWITCH_CHL_REQ from SME"));
             pSwitchChnInd = (tpSirSmeSwitchChannelInd)pSirMsg;
@@ -10378,11 +10575,13 @@
                                         sizeof(vos_event_wlan_security_payload_type), 0);
                             if( pRsp->peerMacAddr[0] & 0x01 )
                             {
-                                setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_GTK_RSP;
+                                setKeyEvent.eventId =
+                                           WLAN_SECURITY_EVENT_SET_BCAST_RSP;
                             }
                             else
                             {
-                                setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_PTK_RSP;
+                                setKeyEvent.eventId =
+                                           WLAN_SECURITY_EVENT_SET_UNICAST_RSP;
                             }
                             if( pRsp->peerMacAddr[0] & 0x01 )
                             {
@@ -10433,8 +10632,12 @@
                                        tpSirSetActiveModeSetBncFilterReq pMsg;
                                        pMsg = vos_mem_malloc(sizeof(tSirSetActiveModeSetBncFilterReq));
                                        pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_SET_BCN_FILTER_REQ);
-                                       pMsg->length = pal_cpu_to_be16(sizeof( tANI_U8));
+                                       pMsg->length = pal_cpu_to_be16(sizeof(
+                                           tSirSetActiveModeSetBncFilterReq));
                                        pMsg->seesionId = sessionId;
+                                       vos_mem_copy(pMsg->bssid,
+                                           pSession->connectedProfile.bssid,
+                                           sizeof(tSirMacAddr));
                                        status = palSendMBMessage(pMac->hHdd, pMsg ); 
                                     }
 #endif
@@ -10490,6 +10693,7 @@
                                    "command failed(%d) PeerMac "MAC_ADDRESS_STR,
                                    pRsp->statusCode, MAC_ADDR_ARRAY(pRsp->peerMacAddr));
                         }
+                        roamInfo.is11rAssoc = csrRoamIs11rAssoc(pMac);
                         csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.setKeyCmd.roamId, 
                                             eCSR_ROAM_SET_KEY_COMPLETE, result);
                         // Indicate SME_QOS that the SET_KEY is completed, so that SME_QOS
@@ -10843,7 +11047,7 @@
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, pInfo->sessionId );
     eHalStatus status = eHAL_STATUS_FAILURE;
 
-    smsLog(pMac, LOGW, FL("WaitForKey timer expired in state=%s sub-state=%s"),
+    smsLog(pMac, LOGE, FL("WaitForKey timer expired in state=%s sub-state=%s"),
            macTraceGetNeighbourRoamState(
            pMac->roam.neighborRoamInfo.neighborRoamState),
            macTraceGetcsrRoamSubState(
@@ -10866,7 +11070,7 @@
                     NULL, eANI_BOOLEAN_FALSE);
         }
 #endif
-        smsLog(pMac, LOGW, " SME pre-auth state timeout. ");
+        smsLog(pMac, LOGE, " SME pre-auth state timeout. ");
 
         //Change the substate so command queue is unblocked.
         if (CSR_ROAM_SESSION_MAX > pInfo->sessionId)
@@ -10881,26 +11085,18 @@
             {
                 csrRoamLinkUp(pMac, pSession->connectedProfile.bssid);
                 smeProcessPendingQueue(pMac);
-                if( (pSession->connectedProfile.AuthType ==
-                                           eCSR_AUTH_TYPE_SHARED_KEY) &&
-                    ( (pSession->connectedProfile.EncryptionType ==
-                                           eCSR_ENCRYPT_TYPE_WEP40) ||
-                      (pSession->connectedProfile.EncryptionType ==
-                                           eCSR_ENCRYPT_TYPE_WEP104) ))
+                status = sme_AcquireGlobalLock(&pMac->sme);
+                if (HAL_STATUS_SUCCESS(status))
                 {
-                    status = sme_AcquireGlobalLock( &pMac->sme );
-                    if ( HAL_STATUS_SUCCESS( status ) )
-                    {
-                        csrRoamDisconnect( pMac, pInfo->sessionId,
-                                      eCSR_DISCONNECT_REASON_UNSPECIFIED );
-                        sme_ReleaseGlobalLock( &pMac->sme );
-                    }
+                    csrRoamDisconnect(pMac, pInfo->sessionId,
+                            eCSR_DISCONNECT_REASON_UNSPECIFIED);
+                    sme_ReleaseGlobalLock(&pMac->sme);
                 }
             }
             else
             {
-                smsLog(pMac, LOGW, "%s: could not post link up",
-                        __func__);
+                smsLog(pMac, LOGE, FL("Session id %d is disconnected"),
+                        pInfo->sessionId);
             }
         }
         else
@@ -11020,17 +11216,7 @@
         result = eCSR_ROAM_RESULT_DEAUTH_IND;
         pDeauthIndMsg = (tSirSmeDeauthInd *)pSirMsg;
         pSession->roamingStatusCode = pDeauthIndMsg->statusCode;
-        /* Convert into proper reason code */
-        if ((pDeauthIndMsg->reasonCode == eSIR_BEACON_MISSED) ||
-                (pDeauthIndMsg->reasonCode ==
-                 eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON))
-            pSession->joinFailStatusCode.reasonCode = 0;
-        else
-            pSession->joinFailStatusCode.reasonCode = pDeauthIndMsg->reasonCode;
-
-       /* cfg layer expects 0 as reason code if
-          the driver dosent know the reason code
-          eSIR_BEACON_MISSED is defined as locally */
+        pSession->joinFailStatusCode.reasonCode = pDeauthIndMsg->reasonCode;
     }
     else
     {
@@ -11125,16 +11311,6 @@
     }
     if(!fToRoam)
     {
-        //Tell HDD about the lost link
-        if(!CSR_IS_INFRA_AP(&pSession->connectedProfile))
-        {
-            /* Don't call csrRoamCallCallback for GO/SoftAp case as this indication
-             * was already given as part of eWNI_SME_DISASSOC_IND msg handling in
-             * csrRoamCheckForLinkStatusChange API.
-             */
-            csrRoamCallCallback(pMac, sessionId, &roamInfo, 0, eCSR_ROAM_LOSTLINK, result);
-        }
-
        /*No need to start idle scan in case of IBSS/SAP 
          Still enable idle scan for polling in case concurrent sessions are running */
         if(CSR_IS_INFRASTRUCTURE(&pSession->connectedProfile))
@@ -12398,7 +12574,7 @@
                                  tANI_U32 numItems )
 {
    eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
-   tCsrRoamSession *pSession;
+   tCsrRoamSession *pSession = NULL;
    if(!CSR_IS_SESSION_VALID( pMac, sessionId ))
    {
        smsLog(pMac, LOGE, FL("  Invalid session ID"));
@@ -12424,7 +12600,7 @@
                                 tBkidCacheInfo *pBkidCache)
 {
    eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
-   tCsrRoamSession *pSession;
+   tCsrRoamSession *pSession = NULL;
    if(!CSR_IS_SESSION_VALID( pMac, sessionId ))
    {
        smsLog(pMac, LOGE, FL("  Invalid session ID"));
@@ -13176,6 +13352,8 @@
         pBuf++;
         *pBuf = (tANI_U8)pProfile->bOSENAssociation;
         pBuf++;
+        *pBuf = (tANI_U8)pProfile->bWPSAssociation;
+        pBuf++;
         //CBMode
         *pBuf = (tANI_U8)pSession->bssParams.cbMode;
         pBuf++;
@@ -14125,6 +14303,7 @@
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_DISASSOC_CNF);
         pMsg->statusCode = (tSirResultCodes)pal_cpu_to_be32(eSIR_SME_SUCCESS);
         pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeDisassocCnf ));
+        pMsg->assocId = pal_cpu_to_be16((tANI_U16)pDisassocInd->assocId);
         vos_mem_copy(pMsg->peerMacAddr, pDisassocInd->peerMacAddr,
                      sizeof(pMsg->peerMacAddr));
         status = eHAL_STATUS_SUCCESS;
@@ -14162,6 +14341,7 @@
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_DEAUTH_CNF);
         pMsg->statusCode = (tSirResultCodes)pal_cpu_to_be32(eSIR_SME_SUCCESS);
         pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeDeauthCnf ));
+        pMsg->assocId = pal_cpu_to_be16((tANI_U16)pDeauthInd->assocId);
         vos_mem_copy(pMsg->bssId, pDeauthInd->bssId, sizeof(pMsg->bssId));
         status = eHAL_STATUS_SUCCESS;
         if(!HAL_STATUS_SUCCESS(status))
@@ -14299,6 +14479,8 @@
         *pBuf = pAssocInd->HT40MHzIntoEnabledSta;
         pBuf += sizeof (tANI_U8);
 #endif
+        *pBuf = pAssocInd->rate_flags;
+        pBuf += sizeof (uint32_t);
         msgQ.type = eWNI_SME_UPPER_LAYER_ASSOC_CNF;
         msgQ.bodyptr = pMsg;
         msgQ.bodyval = 0;
@@ -14801,7 +14983,7 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tANI_U32 i;
-    tCsrRoamSession *pSession;
+    tCsrRoamSession *pSession = NULL;
     *pbSessionId = CSR_SESSION_ID_INVALID;
     for( i = 0; i < CSR_ROAM_SESSION_MAX; i++ )
     {
@@ -14970,7 +15152,8 @@
    return csrSendMBDelSelfStaReqMsg( pMac, 
          pCommand->u.delStaSessionCmd.selfMacAddr );
 }
-static void purgeCsrSessionCmdList(tpAniSirGlobal pMac, tANI_U32 sessionId)
+static void purgeCsrSessionCmdList(tpAniSirGlobal pMac, tANI_U32 sessionId,
+   bool flush_all)
 {
     tDblLinkList *pList = &pMac->roam.roamCmdPendingList;
     tListElem *pEntry, *pNext;
@@ -14989,6 +15172,13 @@
     {
         pNext = csrLLNext(pList, pEntry, LL_ACCESS_NOLOCK);
         pCommand = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
+
+        if (!flush_all &&
+            csr_is_disconnect_full_power_cmd(pCommand)) {
+            smsLog(pMac, LOGW, FL(" Ignore disconnect"));
+            pEntry = pNext;
+            continue;
+        }
         if(pCommand->sessionId == sessionId)
         {
             if(csrLLRemoveEntry(pList, pEntry, LL_ACCESS_NOLOCK))
@@ -15021,28 +15211,25 @@
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
         vos_timer_destroy(&pSession->hTimerJoinRetry);
 #endif
-        purgeSmeSessionCmdList(pMac, sessionId, &pMac->sme.smeCmdPendingList);
-        if (pMac->fScanOffload)
-        {
-            purgeSmeSessionCmdList(pMac, sessionId,
-                    &pMac->sme.smeScanCmdPendingList);
-        }
-
-        purgeCsrSessionCmdList(pMac, sessionId);
+        csrPurgeSmeCmdList(pMac, sessionId, true);
         csrInitSession(pMac, sessionId);
     }
 }
 
-void csrPurgeSmeCmdList(tpAniSirGlobal pMac, tANI_U32 sessionId)
+void csrPurgeSmeCmdList(tpAniSirGlobal pMac, tANI_U32 sessionId,
+     bool flush_all)
 {
     purgeSmeSessionCmdList(pMac, sessionId,
-            &pMac->sme.smeCmdPendingList);
+            &pMac->sme.smeCmdPendingList,
+            flush_all);
     if (pMac->fScanOffload)
     {
         purgeSmeSessionCmdList(pMac, sessionId,
-                &pMac->sme.smeScanCmdPendingList);
+                &pMac->sme.smeScanCmdPendingList,
+                flush_all);
     }
-    purgeCsrSessionCmdList(pMac, sessionId);
+    purgeCsrSessionCmdList(pMac, sessionId,
+                           flush_all);
 }
 
 eHalStatus csrRoamCloseSession( tpAniSirGlobal pMac, tANI_U32 sessionId,
@@ -15060,8 +15247,7 @@
         }
         else
         {
-            if(bPurgeList)
-                csrPurgeSmeCmdList(pMac, sessionId);
+            csrPurgeSmeCmdList(pMac, sessionId, bPurgeList);
            /*  If bPurgeList is FALSE, it means HDD already free all the
             *  cmd and later queue few essential cmd. Now sme should process
             *  the cmd in  pending queue order only.Hence we should
@@ -15458,6 +15644,7 @@
    v_PVOID_t  pvosGCtx;
    v_S7_t     rssi = 0, snr = 0;
    tANI_U32   *pRssi = NULL, *pSnr = NULL;
+   tAniPerTxPktStatsInfo * txPacketInfo;
    tANI_U32   linkCapacity;
    pSmeStatsRsp = (tAniGetPEStatsRsp *)pSirMsg;
    if(pSmeStatsRsp->rc)
@@ -15511,6 +15698,7 @@
             smsLog( pMac, LOG2, FL("csrRoamStatsRspProcessor:PerSta stats"));
             if( CSR_MAX_STA > pSmeStatsRsp->staId )
             {
+               status = eHAL_STATUS_SUCCESS;
                vos_mem_copy((tANI_U8 *)&pMac->roam.perStaStatsInfo[pSmeStatsRsp->staId],
                             pStats, sizeof(tCsrPerStaStatsInfo));
             }
@@ -15527,6 +15715,19 @@
             pStats += sizeof(tCsrPerStaStatsInfo);
             length -= sizeof(tCsrPerStaStatsInfo);
             break;
+         case eCsrPerPktStats:
+            smsLog( pMac, LOG2, FL("csrRoamStatsRspProcessor:PerPkt stats"));
+            vos_mem_zero(&pMac->roam.perPktStatsInfo, sizeof(tPerTxPacketFrmFw));
+            if (IS_FEATURE_SUPPORTED_BY_FW(PER_PKT_STATS_SUPPORTED))
+            {
+                txPacketInfo = (tAniPerTxPktStatsInfo *)pStats;
+                pMac->roam.perPktStatsInfo.lastTxRate = txPacketInfo->lastTxRate;
+                pMac->roam.perPktStatsInfo.txAvgRetry = txPacketInfo->txAvgRetry;
+                /* for reserved bytes */
+                pStats += (sizeof(tAniPerTxPktStatsInfo) + 2*sizeof(tANI_U32));
+                length -= (sizeof(tAniPerTxPktStatsInfo) + 2*sizeof(tANI_U32));
+            }
+            break;
          default:
             smsLog( pMac, LOGW, FL("csrRoamStatsRspProcessor:unknown stats type"));
             break;
@@ -15548,7 +15749,9 @@
        /* If riva is not sending rssi, continue to use the hack */
        rssi = RSSI_HACK_BMPS;
    }
-
+   /* send positive value of rssi to wifi_hal */
+   pMac->roam.perPktStatsInfo.avgRssi = (-1)*rssi;
+   vos_updatePktStatsInfo(&pMac->roam.perPktStatsInfo);
    WDA_UpdateRssiBmps(pvosGCtx, pSmeStatsRsp->staId, rssi);
 
    if (length != 0)
@@ -16107,12 +16310,15 @@
             pMac->roam.tlStatsReqInfo.periodicity = 0;
             pMac->roam.tlStatsReqInfo.timerRunning = FALSE;
          }
-         vos_timer_stop( &pStaEntry->timer );
-         // Destroy the vos timer...      
-         vosStatus = vos_timer_destroy( &pStaEntry->timer );
-         if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
+         if (periodicity)
          {
-            smsLog(pMac, LOGE, FL("csrGetStatistics:failed to destroy Client req timer"));
+            vos_timer_stop(&pStaEntry->timer);
+            // Destroy the vos timer
+            vosStatus = vos_timer_destroy(&pStaEntry->timer);
+            if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+            {
+                smsLog(pMac, LOGE, FL("Failed to destroy Client req timer"));
+            }
          }
          csrRoamRemoveStatListEntry(pMac, pEntry);
          pStaEntry = NULL;
@@ -16482,9 +16688,11 @@
 eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 command, tANI_U8 reason)
 {
    vos_msg_t msg;
+   vos_msg_t PERroamScanConfigMsg = {0};
    tSirRoamOffloadScanReq *pRequestBuf;
+   tSirPERRoamOffloadScanReq *PERRoamReqBuf;
    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
-   tCsrRoamSession *pSession;
+   tCsrRoamSession *pSession = NULL;
    tANI_U8 i,j,num_channels = 0, ucDot11Mode;
    tANI_U8 *ChannelList = NULL;
    tANI_U32 sessionId = 0;
@@ -16576,6 +16784,11 @@
       return eHAL_STATUS_FAILED_ALLOC;
    }
 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+   limDiagEventReport(pMac, WLAN_PE_DIAG_ROAM_REQUESTED, NULL,
+                      eSIR_SUCCESS, eSIR_SUCCESS);
+#endif
+
    vos_mem_zero(pRequestBuf, sizeof(tSirRoamOffloadScanReq));
    /* If command is STOP, then pass down ScanOffloadEnabled as Zero.This will handle the case of
     * host driver reloads, but Riva still up and running*/
@@ -16763,6 +16976,7 @@
     /* MAWC feature */
     pRequestBuf->MAWCEnabled =
             pMac->roam.configParam.MAWCEnabled;
+
 #ifdef FEATURE_WLAN_ESE
     pRequestBuf->IsESEEnabled = pMac->roam.configParam.isEseIniFeatureEnabled;
 #endif
@@ -16961,6 +17175,53 @@
     }
 
    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG, "Roam Scan Offload Command %d, Reason %d", command, reason);
+
+   if (sme_IsFeatureSupportedByFW(PER_BASED_ROAMING) &&
+      (command != ROAM_SCAN_OFFLOAD_STOP) &&
+      pMac->roam.configParam.isPERRoamEnabled)
+   {
+
+      /* PER ROAM SCAN */
+      PERRoamReqBuf = vos_mem_malloc(sizeof(*PERRoamReqBuf));
+      if (!PERRoamReqBuf)
+      {
+          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                 "%s: Not able to allocate mem for PERRoamReqBuf", __func__);
+          return eHAL_STATUS_FAILURE;
+      }
+      /* PER Roam Config */
+      PERRoamReqBuf->rateUpThreshold =
+              pMac->roam.configParam.rateUpThreshold;
+      PERRoamReqBuf->rateDownThreshold =
+              pMac->roam.configParam.rateDownThreshold;
+      PERRoamReqBuf->waitPeriodForNextPERScan =
+              pMac->roam.configParam.waitPeriodForNextPERScan;
+      PERRoamReqBuf->PERtimerThreshold =
+              pMac->roam.configParam.PERtimerThreshold;
+      PERRoamReqBuf->isPERRoamCCAEnabled =
+              pMac->roam.configParam.isPERRoamCCAEnabled;
+      PERRoamReqBuf->PERroamTriggerPercent =
+              pMac->roam.configParam.PERroamTriggerPercent;
+      PERRoamReqBuf->sessionId = sessionId;
+
+      PERroamScanConfigMsg.type = WDA_PER_ROAM_SCAN_OFFLOAD_REQ;
+      PERroamScanConfigMsg.reserved = 0;
+      PERroamScanConfigMsg.bodyptr = PERRoamReqBuf;
+      if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA,
+                                     &PERroamScanConfigMsg))) {
+          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+               FL("Not able to post WDA_PER_ROAM_SCAN_OFFLOAD_REQ msg to WDA"));
+          vos_mem_free(PERRoamReqBuf);
+          return eHAL_STATUS_FAILURE;
+      }
+      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                FL("rateUpThreshold =%x rateDownThreshold =%x waitPeriodForNextPERScan=%u PERtimerThreshold=%u"),
+                PERRoamReqBuf->rateUpThreshold,
+                PERRoamReqBuf->rateDownThreshold,
+                PERRoamReqBuf->waitPeriodForNextPERScan,
+                PERRoamReqBuf->PERtimerThreshold);
+   }
+
    return status;
 }
 
@@ -17251,6 +17512,12 @@
                          sizeof(tCsrPerStaStatsInfo));
             pStats += sizeof(tCsrPerStaStatsInfo);
             break;
+         case eCsrPerPktStats:
+            smsLog( pMac, LOG2, FL("PerPkt stats"));
+            vos_mem_copy( pStats, (tANI_U8 *)&pMac->roam.perPktStatsInfo,
+                         sizeof(tPerTxPacketFrmFw));
+            pStats += sizeof(tPerTxPacketFrmFw);
+            break;
          default:
             smsLog( pMac, LOGE, FL("Unknown stats type and counter %d"), counter);
             break;
@@ -18066,8 +18333,11 @@
        }
        vos_mem_zero((void *)pMsg, sizeof(tSirSmeHT40OBSSStopScanInd));
        pMsg->messageType     = eWNI_SME_HT40_STOP_OBSS_SCAN_IND;
-       pMsg->length          = sizeof(tANI_U8);
+       pMsg->length          =
+           pal_cpu_to_be16(sizeof(tSirSmeHT40OBSSStopScanInd));
        pMsg->seesionId       = sessionId;
+       vos_mem_copy(pMsg->bssid, pSession->connectedProfile.bssid,
+           sizeof(tSirMacAddr));
        status = palSendMBMessage(pMac->hHdd, pMsg);
        if (!HAL_STATUS_SUCCESS(status))
        {
@@ -18122,6 +18392,27 @@
   return eANI_BOOLEAN_FALSE;
 }
 
+/**
+ * csr_set_src_handoff_request() - Set handoff source to
+ *                                   SME handoff request
+ * @pHandoffInfo: Pointer to Handoff info
+ * @pMsg: Pointer to SME handoff request message
+ *
+ * Return: None
+ */
+#ifndef QCA_WIFI_ISOC
+static inline void csr_set_src_handoff_request(tAniHandoffReq *pMsg,
+					tCsrHandoffRequest *pHandoffInfo)
+{
+	pMsg->handoff_src = pHandoffInfo->src;
+}
+#else
+static inline void csr_set_src_handoff_request(tAniHandoffReq *pMsg,
+					tCsrHandoffRequest *pHandoffInfo)
+{
+}
+#endif
+
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 eHalStatus csrHandoffRequest(tpAniSirGlobal pMac,
                              tCsrHandoffRequest *pHandoffInfo)
@@ -18140,6 +18431,7 @@
    pMsg->msgLen = (tANI_U16)sizeof(tAniHandoffReq);
    pMsg->sessionId = pMac->roam.neighborRoamInfo.csrSessionId;
    pMsg->channel = pHandoffInfo->channel;
+   csr_set_src_handoff_request(pMsg, pHandoffInfo);
    vos_mem_copy(pMsg->bssid,
                        pHandoffInfo->bssid,
                        6);
@@ -18156,6 +18448,79 @@
 }
 #endif /* WLAN_FEATURE_ROAM_SCAN_OFFLOAD */
 
+#ifdef WLAN_FEATURE_RMC
+eHalStatus csrEnableRMC(tpAniSirGlobal pMac, tANI_U32 sessionId)
+{
+   tSirSetRMCReq *pMsg = NULL;
+   eHalStatus status = eHAL_STATUS_SUCCESS;
+   tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
+
+   if (!pSession)
+   {
+       smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+       return eHAL_STATUS_FAILURE;
+   }
+
+   pMsg = vos_mem_malloc(sizeof(tSirSetRMCReq));
+   if (NULL != pMsg)
+   {
+       vos_mem_set((void *)pMsg, sizeof(tSirSetRMCReq), 0);
+       pMsg->msgType = eWNI_SME_ENABLE_RMC_REQ;
+       pMsg->msgLen  = sizeof(tSirSetRMCReq);
+       vos_mem_copy((v_U8_t *)pMsg->mcastTransmitter,
+             &pSession->selfMacAddr, sizeof(tSirMacAddr));
+
+       status = palSendMBMessage(pMac->hHdd, pMsg);
+       if (!HAL_STATUS_SUCCESS(status))
+       {
+           smsLog(pMac, LOGE, FL(" csr enable RMC Post MSG Fail %d "), status);
+           //pMsg is freed by palSendMBMessage
+       }
+   }
+   else
+   {
+       return eHAL_STATUS_FAILURE;
+   }
+   return status;
+}
+
+eHalStatus csrDisableRMC(tpAniSirGlobal pMac, tANI_U32 sessionId)
+{
+   tSirSetRMCReq *pMsg = NULL;
+   eHalStatus status = eHAL_STATUS_SUCCESS;
+   tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
+
+   if (!pSession)
+   {
+       smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+       return eHAL_STATUS_FAILURE;
+   }
+
+   pMsg = vos_mem_malloc(sizeof(tSirSetRMCReq));
+   if (NULL != pMsg)
+   {
+       vos_mem_set((void *)pMsg, sizeof(tSirSetRMCReq), 0);
+       pMsg->msgType = eWNI_SME_DISABLE_RMC_REQ;
+       pMsg->msgLen  = sizeof(tSirSetRMCReq);
+       vos_mem_copy((v_U8_t *)pMsg->mcastTransmitter,
+             &pSession->selfMacAddr, sizeof(tSirMacAddr));
+
+       status = palSendMBMessage(pMac->hHdd, pMsg);
+       if (!HAL_STATUS_SUCCESS(status))
+       {
+           smsLog(pMac, LOGE, FL(" csr disable RMC Post MSG Fail %d "), status);
+           //pMsg is freed by palSendMBMessage
+       }
+   }
+   else
+   {
+       return eHAL_STATUS_FAILURE;
+   }
+   return status;
+}
+
+#endif /* WLAN_FEATURE_RMC */
+
 
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 /* ---------------------------------------------------------------------------
diff --git a/wlan/prima/CORE/SME/src/csr/csrApiScan.c b/wlan/prima/CORE/SME/src/csr/csrApiScan.c
index d02a59c..623ff6d 100644
--- a/wlan/prima/CORE/SME/src/csr/csrApiScan.c
+++ b/wlan/prima/CORE/SME/src/csr/csrApiScan.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -90,6 +90,12 @@
 #define CSR_SCAN_HANDOFF_DELTA 10
 #define MAX_ACTIVE_SCAN_FOR_ONE_CHANNEL 140
 #define MIN_ACTIVE_SCAN_FOR_ONE_CHANNEL 120
+
+#ifndef QCA_WIFI_ISOC
+#define MAX_ACTIVE_SCAN_FOR_ONE_CHANNEL_FASTREASSOC 30
+#define MIN_ACTIVE_SCAN_FOR_ONE_CHANNEL_FASTREASSOC 20
+#endif
+
 #define CSR_SCAN_OVERALL_SCORE( rssi )                          \
     (( rssi < CSR_SCAN_MAX_SCORE_VAL )                          \
      ? (CSR_SCAN_MAX_SCORE_VAL-rssi) : CSR_SCAN_MIN_SCORE_VAL)
@@ -119,7 +125,7 @@
 extern tSirRetStatus wlan_cfgGetStr(tpAniSirGlobal, tANI_U16, tANI_U8*, tANI_U32*);
 
 void csrScanGetResultTimerHandler(void *);
-static void csrScanResultCfgAgingTimerHandler(void *pv);
+static void csrPurgeScanResultByAge(void *pv);
 void csrScanIdleScanTimerHandler(void *);
 static void csrSetDefaultScanTiming( tpAniSirGlobal pMac, tSirScanType scanType, tCsrScanRequest *pScanRequest);
 #ifdef WLAN_AP_STA_CONCURRENCY
@@ -142,6 +148,7 @@
 void csrReleaseCmdSingle(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 tANI_BOOLEAN csrRoamIsValidChannel( tpAniSirGlobal pMac, tANI_U8 channel );
 void csrPruneChannelListForMode( tpAniSirGlobal pMac, tCsrChannel *pChannelList );
+void csrPurgeOldScanResults(tpAniSirGlobal pMac);
 
 
 
@@ -229,13 +236,6 @@
             smsLog(pMac, LOGE, FL("cannot allocate memory for idleScan timer"));
             break;
         }
-        status = vos_timer_init(&pMac->scan.hTimerResultCfgAging, VOS_TIMER_TYPE_SW,
-                                csrScanResultCfgAgingTimerHandler, pMac);
-        if (!HAL_STATUS_SUCCESS(status))
-        {
-            smsLog(pMac, LOGE, FL("cannot allocate memory for CFG ResultAging timer"));
-            break;
-        }
     }while(0);
     
     return (status);
@@ -259,7 +259,6 @@
     csrLLClose(&pMac->scan.channelPowerInfoList24);
     csrLLClose(&pMac->scan.channelPowerInfoList5G);
     csrScanDisable(pMac);
-    vos_timer_destroy(&pMac->scan.hTimerResultCfgAging);
     vos_timer_destroy(&pMac->scan.hTimerGetResult);
 #ifdef WLAN_AP_STA_CONCURRENCY
     vos_timer_destroy(&pMac->scan.hTimerStaApConcTimer);
@@ -613,7 +612,7 @@
     eHalStatus status = eHAL_STATUS_FAILURE;
     tSmeCmd *pScanCmd = NULL;
     eCsrConnectState ConnectState;
-    
+
     if(pScanRequest == NULL)
     {
         smsLog( pMac, LOGE, FL(" pScanRequest is NULL"));
@@ -803,6 +802,24 @@
                                    "dwell time for first scan %u"),
                                     scanReq.maxChnTime);
                         }
+                        if ((pScanCmd->u.scanCmd.reason == eCsrScanUserRequest)
+                           && !(pScanRequest->p2pSearch)
+                           &&(pScanRequest->ChannelInfo.numOfChannels
+                           < pMac->roam.configParam.
+                                 max_chan_for_dwell_time_cfg))
+                        {
+                            pScanRequest->maxChnTime =
+                                    pScanRequest->maxChnTime << 1;
+                            pScanRequest->minChnTime =
+                                    pScanRequest->minChnTime << 1;
+                            smsLog(pMac, LOG1,
+                                    FL("Double ChnTime (Max=%d Min=%d) numOfChannels=%d max_chan_for_dwell_time_cfg=%d"),
+                                    pScanRequest->maxChnTime,
+                                    pScanRequest->minChnTime,
+                                    pScanRequest->ChannelInfo.numOfChannels,
+                                    pMac->roam.configParam.
+                                        max_chan_for_dwell_time_cfg);
+                        }
 
                         status = csrScanCopyRequest(pMac, &p11dScanCmd->u.scanCmd.u.scanRequest, &scanReq);
                         //Free the channel list
@@ -863,6 +880,20 @@
                                  pScanRequest->maxChnTime);
                 }
 
+                if ((pScanCmd->u.scanCmd.reason == eCsrScanUserRequest)
+                         && !(pScanRequest->p2pSearch)
+                         && (pScanRequest->ChannelInfo.numOfChannels
+                         < pMac->roam.configParam.max_chan_for_dwell_time_cfg))
+                {
+                    pScanRequest->maxChnTime = pScanRequest->maxChnTime << 1;
+                    pScanRequest->minChnTime = pScanRequest->minChnTime << 1;
+                    smsLog(pMac, LOG1,
+                            FL("Double ChnTime (Max=%d Min=%d) numOfChannels=%d max_chan_for_dwell_time_cfg=%d"),
+                            pScanRequest->maxChnTime,
+                            pScanRequest->minChnTime,
+                            pScanRequest->ChannelInfo.numOfChannels,
+                            pMac->roam.configParam.max_chan_for_dwell_time_cfg);
+                }
                 status = csrScanCopyRequest(pMac, &pScanCmd->u.scanCmd.u.scanRequest, pScanRequest);
                 if(HAL_STATUS_SUCCESS(status))
                 {
@@ -1645,9 +1676,8 @@
     tCsrScanResultFilter *pScanFilter = NULL;
     tCsrRoamProfile *pProfile = pCommand->u.scanCmd.pToRoamProfile;
     tANI_U32 sessionId = pCommand->sessionId;
-#ifdef FEATURE_WLAN_BTAMP_UT_RF
-    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-#endif
+    tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
+
     do
     {
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
@@ -1663,6 +1693,23 @@
             break;
         }
 #endif
+        if (!pSession)
+        {
+            smsLog(pMac, LOGE, FL("session %d not found"), sessionId);
+            break;
+        }
+        /* If Disconnect is already issued from HDD no need to issue connect
+         * pSession->abortConnection will not be set in case of try
+         * disconnect or hdd stop adaptor use connectState for these cases.
+         */
+        if (pSession->abortConnection ||
+            (pMac->roam.roamSession[sessionId].connectState ==
+            eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTING))
+        {
+           smsLog(pMac, LOGE,
+              FL("Disconnect in progress, no need to issue connect"));
+           break;
+        }
         //If there is roam command waiting, ignore this roam because the newer roam command is the one to execute
         if(csrIsRoamCommandWaitingForSession(pMac, sessionId))
         {
@@ -1699,8 +1746,10 @@
             csrScanResultPurge(pMac, hBSSList);
         }
         //We haven't done anything to this profile
-        csrRoamCallCallback(pMac, sessionId, NULL, pCommand->u.scanCmd.roamId,
-                     eCSR_ROAM_ASSOCIATION_FAILURE, eCSR_ROAM_RESULT_FAILURE);
+        csrRoamCallCallback(pMac, sessionId, NULL,
+                     pCommand->u.scanCmd.roamId,
+                     eCSR_ROAM_ASSOCIATION_FAILURE,
+                     eCSR_ROAM_RESULT_SCAN_FOR_SSID_FAILURE);
         //In case we have nothing else to do, restart idle scan
         if(csrIsConnStateDisconnected(pMac, sessionId) && !csrIsRoamCommandWaiting(pMac))
         {
@@ -1808,14 +1857,14 @@
                 csrRoamCallCallback(pMac, sessionId, pRoamInfo,
                                     pCommand->u.scanCmd.roamId,
                                     eCSR_ROAM_ASSOCIATION_COMPLETION,
-                                    eCSR_ROAM_RESULT_FAILURE);
+                                    eCSR_ROAM_RESULT_SCAN_FOR_SSID_FAILURE);
             }
             else
             {
                 csrRoamCallCallback(pMac, sessionId, NULL,
                                     pCommand->u.scanCmd.roamId,
                                     eCSR_ROAM_ASSOCIATION_FAILURE,
-                                    eCSR_ROAM_RESULT_FAILURE);
+                                    eCSR_ROAM_RESULT_SCAN_FOR_SSID_FAILURE);
             }
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
             //In case of WDS station, let it retry.
@@ -1996,6 +2045,259 @@
     return (ret);
 }
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+
+/* Calculate channel weight based on other APs RSSI and count for
+ * PER based roaming */
+static tANI_U32 GetPERRoamRssiCountWeight(tANI_S32 rssi, tANI_S32 count)
+{
+    tANI_S32 rssiWeight=0;
+    tANI_S32 countWeight=0;
+    tANI_S32 rssicountWeight=0;
+
+    rssiWeight = ROAMING_RSSI_WEIGHT * (rssi - MIN_RSSI)
+                 /(MAX_RSSI - MIN_RSSI);
+
+    if(rssiWeight > ROAMING_RSSI_WEIGHT)
+        rssiWeight = ROAMING_RSSI_WEIGHT;
+    else if (rssiWeight < 0)
+        rssiWeight = 0;
+
+    countWeight = ROAM_AP_COUNT_WEIGHT * (count + ROAM_MIN_COUNT)
+                  /(ROAM_MAX_COUNT + ROAM_MIN_COUNT);
+
+    if(countWeight > ROAM_AP_COUNT_WEIGHT)
+        countWeight = ROAM_AP_COUNT_WEIGHT;
+
+    rssicountWeight =  ROAM_MAX_WEIGHT - (rssiWeight + countWeight);
+
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
+       FL("rssiWeight=%d, countWeight=%d, rssicountWeight=%d rssi=%d count=%d"),
+       rssiWeight, countWeight, rssicountWeight, rssi, count);
+
+    return rssicountWeight;
+}
+
+/* Calculate BSS score based on AP capabilty and channel condition
+ * for PER based roaming */
+static tANI_U32 calculateBssScore(tSirBssDescription *bssInfo,
+                             tANI_S32 best_rssi, tANI_S32 ap_cnt, tANI_S32 cca)
+{
+    tANI_S32 score = 0;
+    tANI_S32 ap_load = 0;
+    tANI_S32 normalised_width = PER_ROAM_20MHZ;
+    tANI_S32 normalised_rssi;
+    tANI_S32 channel_weight;
+    if (bssInfo->rssi) {
+        /* Calculate % of rssi we are getting
+         * max = 100
+         * min = 0
+         * less than -40 = 100%
+         * -40 - -55 = 80%
+         * -55 - -65 = 60%
+         * below that = 100 - value
+         * TODO: a linear decrement function after PER_ROAM_GOOD_RSSI_WEIGHT
+         * since throughput decrements linearly after PER_ROAM_GOOD_RSSI_WEIGHT
+         **/
+        if (bssInfo->rssi >= PER_EXCELENT_RSSI)
+            normalised_rssi = PER_ROAM_EXCELLENT_RSSI_WEIGHT;
+        else if (bssInfo->rssi >= PER_GOOD_RSSI)
+            normalised_rssi = PER_ROAM_GOOD_RSSI_WEIGHT;
+        else if (bssInfo->rssi >= PER_POOR_RSSI)
+            normalised_rssi = PER_ROAM_BAD_RSSI_WEIGHT;
+        else
+            normalised_rssi = bssInfo->rssi - MIN_RSSI;
+
+        /* Calculate score part for rssi */
+        score += (normalised_rssi * RSSI_WEIGHTAGE);
+    }
+
+    if (bssInfo->HTCapsPresent) {
+        score += PER_ROAM_MAX_WEIGHT * HT_CAPABILITY_WEIGHTAGE;
+    }
+    /* VHT caps are available */
+    if (bssInfo->vhtCapsPresent) {
+        score += PER_ROAM_MAX_WEIGHT * VHT_CAP_WEIGHTAGE;
+    }
+
+    if (bssInfo->beacomformingCapable)
+        score += PER_ROAM_MAX_WEIGHT * BEAMFORMING_CAP_WEIGHTAGE;
+
+    /* Channel width  20Mhz=30, 40Mhz=70, 80Mhz=100 */
+    if (bssInfo->chanWidth == eHT_CHANNEL_WIDTH_80MHZ)
+        normalised_width = PER_ROAM_80MHZ;
+    else if (bssInfo->chanWidth == eHT_CHANNEL_WIDTH_40MHZ)
+        normalised_width = PER_ROAM_40MHZ;
+    else
+        normalised_width = PER_ROAM_20MHZ;
+    score += normalised_width * CHAN_WIDTH_WEIGHTAGE;
+
+    /* Channel Band, Channel Number */
+    if (GetRFBand(bssInfo->channelId) == SIR_BAND_5_GHZ)
+        score += PER_ROAM_MAX_WEIGHT * CHAN_BAND_WEIGHTAGE;
+
+    /* WMM emabled */
+    if (bssInfo->wmeInfoPresent)
+        score += PER_ROAM_MAX_WEIGHT * WMM_WEIGHTAGE;
+
+#if defined(FEATURE_WLAN_ESE) || defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD)
+    /* AP load Ie */
+    if (bssInfo->QBSSLoad_present) {
+        /* calculate value in % */
+        ap_load = (bssInfo->QBSS_ChanLoad * PER_ROAM_MAX_WEIGHT) / MAX_AP_LOAD;
+    }
+#endif
+    //TODO we don't have this info for current AP, need to check
+    /* if CCA consideration is off in configuration, FW will send 50% for
+       every channel which should be considered as it is */
+    if (ap_load)
+        score += (100 - ap_load) * CCA_WEIGHTAGE;
+    else
+        score +=  (100 - cca) * CCA_WEIGHTAGE;
+
+    channel_weight = GetPERRoamRssiCountWeight(best_rssi, ap_cnt);
+
+    score += channel_weight * OTHER_AP_WEIGHT;
+
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_LOW,
+        FL("rssi=%d normalized_rssi=%d htcaps=%d vht=%d bw=%d channel=%d wmm=%d beamforming=%d ap_load=%d channel_weight=%d"),
+                 bssInfo->rssi, normalised_rssi, bssInfo->HTCapsPresent,
+                 bssInfo->vhtCapsPresent, bssInfo->chanWidth,
+                 bssInfo->channelId, bssInfo->wmeInfoPresent,
+                 bssInfo->beacomformingCapable, ap_load, channel_weight);
+    return score;
+}
+
+/* Calculate candidate AP score for PER based roaming */
+static tANI_S32 csrFindCongestionScore (tpAniSirGlobal pMac, tCsrScanResult *pBss)
+{
+    tANI_S32 score = 0;
+    tANI_S32 i;
+    tANI_S32 candidateApCnt, best_rssi, other_ap_cnt;
+    tANI_U32 current_timestamp;
+    tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
+        &pMac->roam.neighborRoamInfo;
+
+    tSirBssDescription *bssInfo = &(pBss->Result.BssDescriptor);
+    pBss->congestionScore = 0;
+    for (i = 0; i < pMac->PERroamCandidatesCnt; i++)
+        if (pMac->candidateChannelInfo[i].channelNumber ==
+            pBss->Result.BssDescriptor.channelId)
+            break;
+
+    if (i == SIR_PER_ROAM_MAX_CANDIDATE_CNT) {
+        smsLog(pMac, LOGE,
+               FL("candidate chan info not found for channel %d bssid "
+               MAC_ADDRESS_STR), pBss->Result.BssDescriptor.channelId,
+               MAC_ADDR_ARRAY(pBss->Result.BssDescriptor.bssId));
+        return -1;
+    }
+
+    /* find best RSSI of other AP in this channel */
+    best_rssi = MIN_RSSI;
+    for (other_ap_cnt = 0; other_ap_cnt <
+             pMac->candidateChannelInfo[i].otherApCount; other_ap_cnt++) {
+        if (pMac->candidateChannelInfo[i].otherApRssi[other_ap_cnt] > best_rssi)
+            best_rssi = pMac->candidateChannelInfo[i].otherApRssi[other_ap_cnt];
+    }
+
+    score = calculateBssScore(bssInfo, best_rssi,
+                              pMac->candidateChannelInfo[i].otherApCount,
+                              pMac->candidateChannelInfo[i].channelCCA);
+    current_timestamp = jiffies_to_msecs(jiffies);
+
+    /* penalty logic */
+
+    /* In the previous list */
+    for (candidateApCnt = 0; candidateApCnt <
+             SIR_PER_ROAM_MAX_CANDIDATE_CNT; candidateApCnt++) {
+        if (sirCompareMacAddr(pMac->previousRoamApInfo[candidateApCnt].bssAddr,
+                pBss->Result.BssDescriptor.bssId) &&
+           ((current_timestamp - pMac->previousRoamApInfo[candidateApCnt].timeStamp) <
+                PENALTY_TIMEOUT)) {
+            score = (score * PENALTY_REMAINING_SCORE)/PENALTY_TOTAL_SCORE;
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                 FL("AP BSSID " MAC_ADDRESS_STR "adding penalty(in previous list)new score %d"),
+                 MAC_ADDR_ARRAY(pBss->Result.BssDescriptor.bssId),
+                 score);
+            break;
+        }
+    }
+    /* preauth failed last time */
+    for (candidateApCnt = 0; candidateApCnt <
+             MAX_NUM_PREAUTH_FAIL_LIST_ADDRESS; candidateApCnt++) {
+        if (sirCompareMacAddr(pNeighborRoamInfo->FTRoamInfo.
+                preAuthFailList.macAddress[candidateApCnt],
+                pBss->Result.BssDescriptor.bssId)) {
+            score = (score * PENALTY_REMAINING_SCORE)/PENALTY_TOTAL_SCORE;
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                 FL("AP BSSID " MAC_ADDRESS_STR "adding penalty(previously auth failed)new score %d"),
+                 MAC_ADDR_ARRAY(pBss->Result.BssDescriptor.bssId),
+                 score);
+            break;
+        }
+    }
+    pBss->congestionScore = score;
+
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                 FL("AP BSSID " MAC_ADDRESS_STR " score  %d channel %d"),
+                 MAC_ADDR_ARRAY(pBss->Result.BssDescriptor.bssId),
+                 score, pBss->Result.BssDescriptor.channelId);
+    return 0;
+}
+
+/* Calculate current AP score for PER based roaming */
+static tANI_S32 csrFindSelfCongestionScore(tpAniSirGlobal pMac,
+                                      tSirBssDescription *bssInfo)
+{
+    tANI_S32 i, best_rssi, other_ap_cnt;
+    tANI_S32 score = 0;
+
+    for (i = 0; i <= pMac->PERroamCandidatesCnt; i++)
+        if (pMac->candidateChannelInfo[i].channelNumber == bssInfo->channelId)
+            break;
+    if (i > pMac->PERroamCandidatesCnt) {
+        /* home channel info is not present, no need to roam */
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                  FL("home channel %d congestion info not present"),
+                  bssInfo->channelId);
+        pMac->currentBssScore = PER_ROAM_MAX_BSS_SCORE;
+        return -1;
+    }
+
+    /* find best RSSI of other AP in this channel */
+    best_rssi = MIN_RSSI;
+    for (other_ap_cnt = 0; other_ap_cnt <
+             pMac->candidateChannelInfo[i].otherApCount; other_ap_cnt++) {
+        if (pMac->candidateChannelInfo[i].otherApRssi[other_ap_cnt] > best_rssi)
+            best_rssi = pMac->candidateChannelInfo[i].otherApRssi[other_ap_cnt];
+    }
+
+    score = calculateBssScore(bssInfo, best_rssi,
+                              pMac->candidateChannelInfo[i].otherApCount,
+                              pMac->candidateChannelInfo[i].channelCCA);
+    pMac->currentBssScore = score;
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                 FL("PER Roam Current AP score  %d channel %d"),
+                 score, bssInfo->channelId);
+    return 0;
+}
+
+
+static tANI_BOOLEAN csrIsBetterBssInCongestion(tCsrScanResult *pBss1,
+                                               tCsrScanResult *pBss2)
+{
+    tANI_BOOLEAN ret;
+
+    if(CSR_IS_BETTER_PREFER_VALUE(pBss1->congestionScore,
+                                  pBss2->congestionScore))
+        ret = eANI_BOOLEAN_TRUE;
+    else
+        ret = eANI_BOOLEAN_FALSE;
+
+    return (ret);
+}
+#endif
 
 //To check whther pBss1 is better than pBss2
 static tANI_BOOLEAN csrIsBetterBss(tCsrScanResult *pBss1, tCsrScanResult *pBss2)
@@ -2121,7 +2423,9 @@
     tDot11fBeaconIEs *pIes, *pNewIes;
     tANI_BOOLEAN fMatch;
     tANI_U16 i = 0;
-    
+    tCsrRoamSession *pSession = CSR_GET_SESSION(pMac,
+                                    pMac->roam.roamSession->sessionId);
+
     if(phResult)
     {
         *phResult = CSR_INVALID_SCANRESULT_HANDLE;
@@ -2238,7 +2542,13 @@
         vos_mem_set(pRetList, sizeof(tScanResultList), 0);
         csrLLOpen(pMac->hHdd, &pRetList->List);
         pRetList->pCurEntry = NULL;
-        
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+        if (pFilter && pFilter->isPERRoamScan)
+            if (pSession && pSession->pConnectBssDesc)
+               csrFindSelfCongestionScore(pMac,
+                                          pSession->pConnectBssDesc);
+#endif
+
         csrLLLock(&pMac->scan.scanResultList);
         pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_NOLOCK );
         while( pEntry ) 
@@ -2321,7 +2631,7 @@
                 pResult->mcEncryptionType = mc;
                 pResult->authType = auth;
                 pResult->Result.ssId = pBssDesc->Result.ssId;
-                pResult->Result.timer = 0;
+                pResult->Result.timer = pBssDesc->Result.timer;
                 //save the pIes for later use
                 pResult->Result.pvIes = pNewIes;
                 //save bss description
@@ -2330,7 +2640,22 @@
                 //No need to lock pRetList because it is locally allocated and no outside can access it at this time
                 if(csrLLIsListEmpty(&pRetList->List, LL_ACCESS_NOLOCK))
                 {
-                    csrLLInsertTail(&pRetList->List, &pResult->Link, LL_ACCESS_NOLOCK);
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+                    if (pFilter && pFilter->isPERRoamScan) {
+                         csrFindCongestionScore(pMac, pResult);
+                         if (pResult->congestionScore > pMac->currentBssScore) {
+                             csrLLInsertTail(&pRetList->List, &pResult->Link,
+                                             LL_ACCESS_NOLOCK);
+                             smsLog(pMac, LOGW,
+                                  FL("added one entry in LL in PER Roam list"));
+                         }
+                    }
+                    else
+#endif
+                    {
+                        csrLLInsertTail(&pRetList->List, &pResult->Link,
+                                        LL_ACCESS_NOLOCK);
+                    }
                 }
                 else
                 {
@@ -2342,20 +2667,48 @@
                     while(pTmpEntry)
                     {
                         pTmpResult = GET_BASE_ADDR( pTmpEntry, tCsrScanResult, Link );
-                        if(csrIsBetterBss(pResult, pTmpResult))
-                        {
-                            csrLLInsertEntry(&pRetList->List, pTmpEntry, &pResult->Link, LL_ACCESS_NOLOCK);
-                            //To indicate we are done
-                            pResult = NULL;
-                            break;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+                        if (pFilter && pFilter->isPERRoamScan) {
+                            csrFindCongestionScore(pMac, pResult);
+                            if(csrIsBetterBssInCongestion(pResult, pTmpResult)&&
+                             (pResult->congestionScore > pMac->currentBssScore))
+                            {
+                                csrLLInsertEntry(&pRetList->List, pTmpEntry,
+                                              &pResult->Link, LL_ACCESS_NOLOCK);
+                                smsLog(pMac, LOGW,
+                                    FL("added another entry in LL in PER Roam list"));
+                                pResult = NULL;
+                                break;
+                            }
+                            pTmpEntry = csrLLNext(&pRetList->List,
+                                                  pTmpEntry, LL_ACCESS_NOLOCK);
                         }
-                        pTmpEntry = csrLLNext(&pRetList->List, pTmpEntry, LL_ACCESS_NOLOCK);
+                        else
+#endif
+                        {
+                            if(csrIsBetterBss(pResult, pTmpResult))
+                            {
+                                csrLLInsertEntry(&pRetList->List, pTmpEntry,
+                                              &pResult->Link, LL_ACCESS_NOLOCK);
+                                //To indicate we are done
+                                pResult = NULL;
+                                break;
+                            }
+                            pTmpEntry = csrLLNext(&pRetList->List,
+                                                  pTmpEntry, LL_ACCESS_NOLOCK);
+                       }
                     }
                     if(pResult != NULL)
-                    {
-                        //This one is not better than any one
-                        csrLLInsertTail(&pRetList->List, &pResult->Link, LL_ACCESS_NOLOCK);
-                    }
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+                        if ((pFilter && !pFilter->isPERRoamScan) ||
+                            (pFilter == NULL) ||
+                            (pResult->congestionScore > pMac->currentBssScore))
+#endif
+                        {
+                            //This one is not better than any one
+                            csrLLInsertTail(&pRetList->List,
+                                            &pResult->Link, LL_ACCESS_NOLOCK);
+                        }
                 }
                 count++;
             }
@@ -2378,6 +2731,8 @@
                 csrLLClose(&pRetList->List);
                 vos_mem_free(pRetList);
                 status = eHAL_STATUS_E_NULL_VALUE;
+                smsLog(pMac, LOGW,
+                       FL("Nil scan results or no matching AP found"));
             }
             else if(phResult)
             {
@@ -2784,74 +3139,121 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSirMbMsg *pMsg = (tSirMbMsg *)pMsgBuf;
+    tSirSmeDisConDoneInd *pDisConDoneInd;
+    tCsrRoamInfo roamInfo = {0};
 
-    if((eWNI_SME_SCAN_RSP == pMsg->type) || (eWNI_SME_GET_SCANNED_CHANNEL_RSP == pMsg->type))
+    if((eWNI_SME_SCAN_RSP == pMsg->type) ||
+       (eWNI_SME_GET_SCANNED_CHANNEL_RSP == pMsg->type))
     {
         status = csrScanSmeScanResponse( pMac, pMsgBuf );
     }
     else
     {
-        if(pMsg->type == eWNI_SME_UPPER_LAYER_ASSOC_CNF) 
+        switch (pMsg->type)
         {
-            tCsrRoamSession  *pSession;
-            tSirSmeAssocIndToUpperLayerCnf *pUpperLayerAssocCnf;
-            tCsrRoamInfo roamInfo;
-            tCsrRoamInfo *pRoamInfo = NULL;
-            tANI_U32 sessionId;
-            eHalStatus status;
-            smsLog( pMac, LOG1, FL("Scanning : ASSOCIATION confirmation can be given to upper layer "));
-            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
-            pRoamInfo = &roamInfo;
-            pUpperLayerAssocCnf = (tSirSmeAssocIndToUpperLayerCnf *)pMsgBuf;
-            status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pUpperLayerAssocCnf->bssId, &sessionId );
-            pSession = CSR_GET_SESSION(pMac, sessionId);
-
-            if(!pSession)
+            case eWNI_SME_UPPER_LAYER_ASSOC_CNF:
             {
-                smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
-                return eHAL_STATUS_FAILURE;
-            }
+                tCsrRoamSession  *pSession;
+                tSirSmeAssocIndToUpperLayerCnf *pUpperLayerAssocCnf;
+                tCsrRoamInfo *pRoamInfo = NULL;
+                tANI_U32 sessionId;
+                eHalStatus status;
 
-            pRoamInfo->statusCode = eSIR_SME_SUCCESS; //send the status code as Success 
-            pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
-            pRoamInfo->staId = (tANI_U8)pUpperLayerAssocCnf->aid;
-            pRoamInfo->rsnIELen = (tANI_U8)pUpperLayerAssocCnf->rsnIE.length;
-            pRoamInfo->prsnIE = pUpperLayerAssocCnf->rsnIE.rsnIEdata;
-            pRoamInfo->addIELen = (tANI_U8)pUpperLayerAssocCnf->addIE.length;
-            pRoamInfo->paddIE = pUpperLayerAssocCnf->addIE.addIEdata;           
-            vos_mem_copy(pRoamInfo->peerMac, pUpperLayerAssocCnf->peerMacAddr, sizeof(tSirMacAddr));
-            vos_mem_copy(&pRoamInfo->bssid, pUpperLayerAssocCnf->bssId, sizeof(tCsrBssid));
-            pRoamInfo->wmmEnabledSta = pUpperLayerAssocCnf->wmmEnabledSta;
+                smsLog( pMac, LOG1,
+                        FL("Scanning : ASSOCIATION confirmation can be given to upper layer "));
+                pRoamInfo = &roamInfo;
+                pUpperLayerAssocCnf = (tSirSmeAssocIndToUpperLayerCnf *)pMsgBuf;
+                status = csrRoamGetSessionIdFromBSSID( pMac,
+                                      (tCsrBssid *)pUpperLayerAssocCnf->bssId,
+                                      &sessionId );
+                pSession = CSR_GET_SESSION(pMac, sessionId);
+
+                if(!pSession)
+                {
+                    smsLog(pMac, LOGE, FL("session %d not found "), sessionId);
+                    return eHAL_STATUS_FAILURE;
+                }
+
+                //send the status code as Success
+                pRoamInfo->statusCode = eSIR_SME_SUCCESS;
+                pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
+                pRoamInfo->staId = (tANI_U8)pUpperLayerAssocCnf->aid;
+                pRoamInfo->rsnIELen =
+                            (tANI_U8)pUpperLayerAssocCnf->rsnIE.length;
+                pRoamInfo->prsnIE = pUpperLayerAssocCnf->rsnIE.rsnIEdata;
+                pRoamInfo->addIELen =
+                            (tANI_U8)pUpperLayerAssocCnf->addIE.length;
+                pRoamInfo->paddIE = pUpperLayerAssocCnf->addIE.addIEdata;
+                vos_mem_copy(pRoamInfo->peerMac,
+                             pUpperLayerAssocCnf->peerMacAddr,
+                             sizeof(tSirMacAddr));
+                vos_mem_copy(&pRoamInfo->bssid,
+                             pUpperLayerAssocCnf->bssId,
+                             sizeof(tCsrBssid));
+                pRoamInfo->wmmEnabledSta = pUpperLayerAssocCnf->wmmEnabledSta;
 #ifdef WLAN_FEATURE_AP_HT40_24G
-            pRoamInfo->HT40MHzIntoEnabledSta =
-                       pUpperLayerAssocCnf->HT40MHzIntoEnabledSta;
+                pRoamInfo->HT40MHzIntoEnabledSta =
+                           pUpperLayerAssocCnf->HT40MHzIntoEnabledSta;
 #endif
-            if(CSR_IS_INFRA_AP(pRoamInfo->u.pConnectedProfile) )
-            {
-                pMac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED;
-                pRoamInfo->fReassocReq = pUpperLayerAssocCnf->reassocReq;
-                status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_INFRA_ASSOCIATION_CNF);
-            }
-            if(CSR_IS_WDS_AP( pRoamInfo->u.pConnectedProfile))
-            {
-                vos_sleep( 100 );
-                pMac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_WDS_CONNECTED;//Sta
-                status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_WDS_IND, eCSR_ROAM_RESULT_WDS_ASSOCIATION_IND);//Sta
-            }
-
+                if(CSR_IS_INFRA_AP(pRoamInfo->u.pConnectedProfile) )
+                {
+                    pMac->roam.roamSession[sessionId].connectState =
+                                        eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED;
+                    pRoamInfo->fReassocReq = pUpperLayerAssocCnf->reassocReq;
+                    status = csrRoamCallCallback(pMac, sessionId, pRoamInfo,
+                                       0, eCSR_ROAM_INFRA_IND,
+                                       eCSR_ROAM_RESULT_INFRA_ASSOCIATION_CNF);
+                }
+                if(CSR_IS_WDS_AP( pRoamInfo->u.pConnectedProfile))
+                {
+                    vos_sleep( 100 );
+                    pMac->roam.roamSession[sessionId].connectState =
+                                    eCSR_ASSOC_STATE_TYPE_WDS_CONNECTED;//Sta
+                    status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0,
+                                    eCSR_ROAM_WDS_IND,
+                                    eCSR_ROAM_RESULT_WDS_ASSOCIATION_IND);//Sta
+                }
+                break;
         }
-        else
-        {
+        case eWNI_SME_DISCONNECT_DONE_IND:
+            pDisConDoneInd = (tSirSmeDisConDoneInd *)(pMsg);
 
-            if( csrIsAnySessionInConnectState( pMac ) )
+            smsLog( pMac, LOG1,
+                FL("eWNI_SME_DISCONNECT_DONE_IND RC:%d"),
+                    pDisConDoneInd->reasonCode);
+            if( CSR_IS_SESSION_VALID(pMac, pDisConDoneInd->sessionId))
             {
-                //In case of we are connected, we need to check whether connect status changes
-                //because scan may also run while connected.
-                csrRoamCheckForLinkStatusChange( pMac, ( tSirSmeRsp * )pMsgBuf );
+                roamInfo.reasonCode = pDisConDoneInd->reasonCode;
+                roamInfo.statusCode = eSIR_SME_STA_DISASSOCIATED;
+                vos_mem_copy(roamInfo.peerMac, pDisConDoneInd->peerMacAddr,
+                             sizeof(tSirMacAddr));
+                status = csrRoamCallCallback(pMac,
+                                 pDisConDoneInd->sessionId,
+                                &roamInfo, 0,
+                                 eCSR_ROAM_LOSTLINK,
+                                 eCSR_ROAM_RESULT_DISASSOC_IND);
             }
             else
             {
-                smsLog( pMac, LOGW, "Message [0x%04x] received in state, when expecting Scan Response", pMsg->type );
+                smsLog(pMac, LOGE, FL("Inactive session %d"),
+                        pDisConDoneInd->sessionId);
+                status = eHAL_STATUS_FAILURE;
+            }
+            break;
+
+        default :
+            if( csrIsAnySessionInConnectState( pMac ) )
+            {
+                /*In case of we are connected, we need to check whether connect
+                 * status changes because scan may also run while connected.
+                 */
+                csrRoamCheckForLinkStatusChange( pMac, (tSirSmeRsp *)pMsgBuf );
+            }
+            else
+            {
+                smsLog( pMac, LOGW,
+                        "Message [0x%04x] received in state, when expecting Scan Response",
+                         pMsg->type );
             }
         }
     }
@@ -3188,16 +3590,8 @@
 #endif
           )
         {
-            //Limit reach
-            smsLog(pMac, LOGW, FL("  BSS limit reached"));
-            //Free the resources
-            if( (pBssDescription->Result.pvIes == NULL) && pIesLocal )
-            {
-                vos_mem_free(pIesLocal);
-            }
-            csrFreeScanResultEntry(pMac, pBssDescription);
-            //Continue because there may be duplicated BSS
-            continue;
+            smsLog(pMac, LOG1, FL("########## BSS Limit reached ###########"));
+            csrPurgeOldScanResults(pMac);
         }
         // check for duplicate scan results
         if ( !fDupBss )
@@ -3256,8 +3650,6 @@
     }
 
     pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_LOCK );
-    if (pEntry && 0 != pMac->scan.scanResultCfgAgingTime)
-        csrScanStartResultCfgAgingTimer(pMac);
     //we don't need to update CC while connected to an AP which is advertising CC already
     if (csrIs11dSupported(pMac))
     {
@@ -3277,8 +3669,9 @@
                 }
             }
         }
-        csrElectedCountryInfo(pMac);
-        csrLearnCountryInformation( pMac, NULL, NULL, eANI_BOOLEAN_TRUE );
+        if (csrElectedCountryInfo(pMac))
+            csrLearnCountryInformation(pMac, NULL, NULL,
+                    eANI_BOOLEAN_TRUE);
     }
 
 end:
@@ -3304,6 +3697,43 @@
     return;
 }
 
+void csrPurgeOldScanResults(tpAniSirGlobal pMac)
+{
+    tListElem *pEntry, *tmpEntry;
+    tCsrScanResult *pResult, *oldest_bss = NULL;
+    v_TIME_t oldest_entry = 0;
+    v_TIME_t curTime = vos_timer_get_system_time();
+
+    csrLLLock(&pMac->scan.scanResultList);
+    pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_NOLOCK );
+    while( pEntry )
+    {
+        tmpEntry = csrLLNext(&pMac->scan.scanResultList, pEntry,
+                LL_ACCESS_NOLOCK);
+        pResult = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
+        if((curTime -
+                 pResult->Result.BssDescriptor.nReceivedTime) > oldest_entry)
+        {
+            oldest_entry =  curTime -
+                                pResult->Result.BssDescriptor.nReceivedTime;
+            oldest_bss = pResult;
+        }
+        pEntry = tmpEntry;
+    }
+    if (oldest_bss)
+    {
+        //Free the old BSS Entries
+        if( csrLLRemoveEntry(&pMac->scan.scanResultList,
+                               &oldest_bss->Link, LL_ACCESS_NOLOCK) )
+        {
+            smsLog(pMac, LOG1, FL(" Current time delta (%lu) of BSSID to be removed" MAC_ADDRESS_STR ),
+                    (curTime - oldest_bss->Result.BssDescriptor.nReceivedTime),
+                    MAC_ADDR_ARRAY(oldest_bss->Result.BssDescriptor.bssId));
+            csrFreeScanResultEntry(pMac, oldest_bss);
+        }
+    }
+    csrLLUnlock(&pMac->scan.scanResultList);
+}
 
 static tCsrScanResult *csrScanSaveBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pBSSDescription,
                                                   tDot11fBeaconIEs *pIes)
@@ -3330,9 +3760,6 @@
 #endif
         csrScanAddResult(pMac, pCsrBssDescription, pIes);
         pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_LOCK );
-        if (pEntry && 0 != pMac->scan.scanResultCfgAgingTime)
-            csrScanStartResultCfgAgingTimer(pMac);
-
     }
 
     return( pCsrBssDescription );
@@ -3582,31 +4009,6 @@
     csrSetCfgCountryCode(pMac, countryCode);
 }
 
-void csrUpdateFCCChannelList(tpAniSirGlobal pMac)
-{
-    tCsrChannel ChannelList;
-    tANI_U8 chnlIndx = 0;
-    int i;
-
-    for ( i = 0; i < pMac->scan.base20MHzChannels.numChannels; i++ )
-    {
-        if (pMac->scan.fcc_constraint &&
-                    ((pMac->scan.base20MHzChannels.channelList[i] == 12) ||
-                    (pMac->scan.base20MHzChannels.channelList[i] == 13)))
-        {
-            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                          FL("removing channel %d"),
-                          pMac->scan.base20MHzChannels.channelList[i]);
-            continue;
-        }
-        ChannelList.channelList[chnlIndx] =
-                    pMac->scan.base20MHzChannels.channelList[i];
-        chnlIndx++;
-    }
-    csrSetCfgValidChannelList(pMac, ChannelList.channelList, chnlIndx);
-
-}
-
 void csrResetCountryInformation( tpAniSirGlobal pMac, tANI_BOOLEAN fForce, tANI_BOOLEAN updateRiva )
 {
     if( fForce || (csrIs11dSupported( pMac ) && (!pMac->scan.f11dInfoReset)))
@@ -3769,6 +4171,8 @@
 
     if (!pMac->scan.countryCodeCount)
     {
+        VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_WARN,
+                "No AP with 11d Country code is present in scan list");
         return fRet;
     }
     maxVotes = pMac->scan.votes11d[0].votes;
@@ -4610,6 +5014,12 @@
             }
             csrSaveScanResults(pMac, pCommand->u.scanCmd.reason);
 
+            /* filter scan result based on valid channel list number */
+            if (pMac->scan.fcc_constraint)
+            {
+                smsLog(pMac, LOG1, FL("Clear BSS from invalid channels"));
+                csrScanFilterResults(pMac);
+            }
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
             {
                 vos_log_scan_pkt_type *pScanLog = NULL;
@@ -5048,6 +5458,7 @@
     tANI_U32 cbParsed;
     tSirBssDescription *pSirBssDescription;
     tANI_U32 cbBssDesc;
+    eHalStatus status;
     tANI_U32 cbScanResult = GET_FIELD_OFFSET( tSirSmeScanRsp, bssDescription ) 
                             + sizeof(tSirBssDescription);    //We need at least one CB
 
@@ -5181,6 +5592,22 @@
         *pfRemoveCommand = fRemoveCommand;
     }
 
+    /*
+     * Currently SET_FCC_CHANNEL issues updated channel list to fw.
+     * At the time of driver load, if scan is issued followed with
+     * SET_FCC_CHANNEL, driver will send update channel list to fw.
+     * Fw will stop ongoing scan because of that GUI will have very less
+     * scan list.
+     * Update channel list should be sent to fw once scan is done
+     */
+    if (pMac->scan.defer_update_channel_list) {
+        status = csrUpdateChannelList(pMac);
+        if (eHAL_STATUS_SUCCESS != status)
+            smsLog(pMac, LOGE,
+                   FL( "failed to update the supported channel list"));
+            pMac->scan.defer_update_channel_list = false;
+    }
+
 #ifdef WLAN_AP_STA_CONCURRENCY
     if (pMac->fScanOffload)
         return fRet;
@@ -5243,7 +5670,7 @@
     tListElem *pEntry;
     tSmeCmd *pCommand;
     eCsrScanStatus scanStatus;
-    tSirSmeScanRsp *pScanRsp = (tSirSmeScanRsp *)pMsgBuf;
+    tSirSmeScanRsp *pScanRsp;
     tSmeGetScanChnRsp *pScanChnInfo;
     tANI_BOOLEAN fRemoveCommand = eANI_BOOLEAN_TRUE;
     eCsrScanReason reason = eCsrScanOther;
@@ -5259,7 +5686,9 @@
         pCommand = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
         if ( eSmeCommandScan == pCommand->command )
         {
-            scanStatus = (eSIR_SME_SUCCESS == pScanRsp->statusCode) ? eCSR_SCAN_SUCCESS : eCSR_SCAN_FAILURE;
+            /* Purge the scan results based on Aging */
+            if (pEntry && pMac->scan.scanResultCfgAgingTime)
+                csrPurgeScanResultByAge(pMac);
             reason = pCommand->u.scanCmd.reason;
             switch(pCommand->u.scanCmd.reason)
             {
@@ -5267,6 +5696,9 @@
             case eCsrScanAbortNormalScan:
             case eCsrScanBGScanAbort:
             case eCsrScanBGScanEnable:
+                pScanRsp = (tSirSmeScanRsp *)pMsgBuf;
+                scanStatus = (eSIR_SME_SUCCESS == pScanRsp->statusCode) ?
+                              eCSR_SCAN_SUCCESS : eCSR_SCAN_FAILURE;
                 break;
             case eCsrScanGetScanChnInfo:
                 pScanChnInfo = (tSmeGetScanChnRsp *)pMsgBuf;
@@ -5278,14 +5710,22 @@
                 csrScanAgeResults(pMac, pScanChnInfo);
                 break;
             case eCsrScanForCapsChange:
+                pScanRsp = (tSirSmeScanRsp *)pMsgBuf;
+                scanStatus = (eSIR_SME_SUCCESS == pScanRsp->statusCode) ?
+                              eCSR_SCAN_SUCCESS : eCSR_SCAN_FAILURE;
                 csrScanProcessScanResults( pMac, pCommand, pScanRsp, &fRemoveCommand );
                 break;
             case eCsrScanP2PFindPeer:
-              scanStatus = ((eSIR_SME_SUCCESS == pScanRsp->statusCode) && (pScanRsp->length > 50)) ? eCSR_SCAN_FOUND_PEER : eCSR_SCAN_FAILURE;
-              csrScanProcessScanResults( pMac, pCommand, pScanRsp, NULL );
-              break;
+                pScanRsp = (tSirSmeScanRsp *)pMsgBuf;
+                scanStatus = ((eSIR_SME_SUCCESS == pScanRsp->statusCode) &&
+                             (pScanRsp->length > 50)) ? eCSR_SCAN_FOUND_PEER : eCSR_SCAN_FAILURE;
+                csrScanProcessScanResults( pMac, pCommand, pScanRsp, NULL );
+                break;
             case eCsrScanSetBGScanParam:
             default:
+                pScanRsp = (tSirSmeScanRsp *)pMsgBuf;
+                scanStatus = (eSIR_SME_SUCCESS == pScanRsp->statusCode) ?
+                              eCSR_SCAN_SUCCESS : eCSR_SCAN_FAILURE;
                 if(csrScanProcessScanResults( pMac, pCommand, pScanRsp, &fRemoveCommand ))
                 {
                     //Not to get channel info if the scan is not a wildcard scan because
@@ -5307,7 +5747,7 @@
 
                 csrReleaseScanCommand(pMac, pCommand, scanStatus);
 
-                }
+            }
             smeProcessPendingQueue( pMac );
         }
         else
@@ -5445,7 +5885,8 @@
     {
         //Reset the counter so that aging out of connected BSS won't hapeen too soon
         pResult->AgingCount = (tANI_S32)pMac->roam.configParam.agingCount;
-        pResult->Result.BssDescriptor.nReceivedTime = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
+        pResult->Result.BssDescriptor.nReceivedTime =
+                                        vos_timer_get_system_time();
 
         return (fRet);
     }
@@ -5534,6 +5975,42 @@
     return (status);
 }
 
+/**
+ * csr_remove_bssid_from_scan_list() - remove the bssid from
+ * scan list
+ * @pMac: mac context.
+ * @bssid: bssid to be removed
+ *
+ * This function remove the given bssid from scan list.
+ *
+ * Return: void.
+ */
+void csr_remove_bssid_from_scan_list(tpAniSirGlobal pMac,
+     tSirMacAddr bssid)
+{
+    tListElem *entry,*free_elem;
+    tCsrScanResult *bss_desc;
+    tDblLinkList *list = &pMac->scan.scanResultList;
+
+    csrLLLock(list);
+    entry = csrLLPeekHead(list, LL_ACCESS_NOLOCK);
+    while (entry != NULL) {
+        bss_desc = GET_BASE_ADDR( entry, tCsrScanResult, Link);
+        if (vos_mem_compare(bss_desc->Result.BssDescriptor.bssId,
+           bssid, sizeof(tSirMacAddr))) {
+            free_elem = entry;
+            entry = csrLLNext(list, entry, LL_ACCESS_NOLOCK);
+            csrLLRemoveEntry(list, free_elem, LL_ACCESS_NOLOCK);
+            csrFreeScanResultEntry(pMac, bss_desc);
+            smsLog(pMac, LOGW, FL("Removed BSS entry:%pM"),
+                   bssid);
+            continue;
+        }
+        entry = csrLLNext(list, entry, LL_ACCESS_NOLOCK);
+    }
+    csrLLUnlock(list);
+}
+
 eHalStatus csrSendMBScanReq( tpAniSirGlobal pMac, tANI_U16 sessionId, 
                     tCsrScanRequest *pScanReq, tScanReqParam *pScanReqParam )
 {
@@ -6282,10 +6759,15 @@
                      /* Since in CsrScanRequest,value of pMac->scan.nextScanID
                       * is incremented before calling CsrScanCopyRequest, as a
                       * result pMac->scan.nextScanID is equal to ONE for the
-                      * first scan.
+                      * first scan. If number of channels is less than
+                      * max chan for dwell time no need to skip dfs
+                      * in first scan as anyway few channels will be scanned and
+                      * it will not take much time to display results on GUI.
                       */
-                     if ((pMac->roam.configParam.initialScanSkipDFSCh &&
-                              1 == pMac->scan.nextScanID) ||(pMac->miracast_mode))
+                     if (((pSrcReq->ChannelInfo.numOfChannels >=
+                          pMac->roam.configParam.max_chan_for_dwell_time_cfg) &&
+                         (pMac->roam.configParam.initialScanSkipDFSCh &&
+                           1 == pMac->scan.nextScanID)) ||(pMac->miracast_mode))
                      {
                        smsLog(pMac, LOG1,
                               FL("Initial scan, scan only non-DFS channels"));
@@ -6489,11 +6971,6 @@
 {
     csrScanStopIdleScanTimer(pMac);
     csrScanStopGetResultTimer(pMac);
-    if(0 != pMac->scan.scanResultCfgAgingTime )
-    {
-        csrScanStopResultCfgAgingTimer(pMac);
-    }
-
 }
 
 
@@ -6668,22 +7145,6 @@
 }
 #endif
 
-eHalStatus csrScanStartResultCfgAgingTimer(tpAniSirGlobal pMac)
-{
-    eHalStatus status = eHAL_STATUS_FAILURE;
-
-    if(pMac->scan.fScanEnable)
-    {
-        status = vos_timer_start(&pMac->scan.hTimerResultCfgAging, CSR_SCAN_RESULT_CFG_AGING_INTERVAL/PAL_TIMER_TO_MS_UNIT);
-    }
-    return (status);
-}
-
-eHalStatus csrScanStopResultCfgAgingTimer(tpAniSirGlobal pMac)
-{
-    return (vos_timer_stop(&pMac->scan.hTimerResultCfgAging));
-}
-
 //This function returns the maximum time a BSS is allowed in the scan result.
 //The time varies base on connection and power saving factors.
 //Not connected, No PS
@@ -6747,30 +7208,31 @@
     return (nRet);
 }
 
-static void csrScanResultCfgAgingTimerHandler(void *pv)
+static void csrPurgeScanResultByAge(void *pv)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( pv );
     tListElem *pEntry, *tmpEntry;
     tCsrScanResult *pResult;
-    tANI_TIMESTAMP ageOutTime =  pMac->scan.scanResultCfgAgingTime * PAL_TICKS_PER_SECOND;
-    tANI_TIMESTAMP curTime = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
+    v_TIME_t ageOutTime =
+       (v_TIME_t)(pMac->scan.scanResultCfgAgingTime * SYSTEM_TIME_SEC_TO_MSEC);
+    v_TIME_t curTime = vos_timer_get_system_time();
   
     csrLLLock(&pMac->scan.scanResultList);
     pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_NOLOCK );
+    smsLog(pMac, LOG1, FL("Ageout time=%lu"),ageOutTime);
     while( pEntry ) 
     {
         tmpEntry = csrLLNext(&pMac->scan.scanResultList, pEntry, LL_ACCESS_NOLOCK);
         pResult = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
         if((curTime - pResult->Result.BssDescriptor.nReceivedTime) > ageOutTime)
         {
-            smsLog(pMac, LOGW, " age out due to time out");
+            smsLog(pMac, LOG1, FL("age out due to time out for BSSID" MAC_ADDRESS_STR),
+                             MAC_ADDR_ARRAY(pResult->Result.BssDescriptor.bssId));
             csrScanAgeOutBss(pMac, pResult);
         }
         pEntry = tmpEntry;
     }
     csrLLUnlock(&pMac->scan.scanResultList);
-    if (pEntry)
-        vos_timer_start(&pMac->scan.hTimerResultCfgAging, CSR_SCAN_RESULT_CFG_AGING_INTERVAL/PAL_TIMER_TO_MS_UNIT);
 }
 
 eHalStatus csrScanStartIdleScanTimer(tpAniSirGlobal pMac, tANI_U32 interval)
@@ -7351,7 +7813,42 @@
 }
 #endif /* FEATURE_WLAN_WAPI */
 
-
+/**
+ * csr_scan_request_set_chan_time() - Populate max and min
+ *                            channel time in Scan request
+ * @pMac - pointer to mac context
+ * @pScanCmd - pointer to the Scan command
+ *
+ * Return - None
+ */
+#ifndef QCA_WIFI_ISOC
+static void csr_scan_request_set_chan_time(tpAniSirGlobal pMac,
+						tSmeCmd *pScanCmd)
+{
+	if (pMac->roam.neighborRoamInfo.handoffReqInfo.src
+							== FASTREASSOC) {
+		pScanCmd->u.scanCmd.u.scanRequest.maxChnTime
+			= MAX_ACTIVE_SCAN_FOR_ONE_CHANNEL_FASTREASSOC;
+		pScanCmd->u.scanCmd.u.scanRequest.minChnTime
+			= MIN_ACTIVE_SCAN_FOR_ONE_CHANNEL_FASTREASSOC;
+		pMac->roam.neighborRoamInfo.handoffReqInfo.src = 0;
+	} else {
+		pScanCmd->u.scanCmd.u.scanRequest.maxChnTime
+			= MAX_ACTIVE_SCAN_FOR_ONE_CHANNEL;
+		pScanCmd->u.scanCmd.u.scanRequest.minChnTime
+			= MIN_ACTIVE_SCAN_FOR_ONE_CHANNEL;
+	}
+}
+#else
+static void csr_scan_request_set_chan_time(tpAniSirGlobal pMac,
+						tSmeCmd *pScanCmd)
+{
+	pScanCmd->u.scanCmd.u.scanRequest.maxChnTime
+			= MAX_ACTIVE_SCAN_FOR_ONE_CHANNEL;
+	pScanCmd->u.scanCmd.u.scanRequest.minChnTime
+			= MIN_ACTIVE_SCAN_FOR_ONE_CHANNEL;
+}
+#endif
 
 //This function is usually used for BSSs that suppresses SSID so the profile 
 //shall have one and only one SSID
@@ -7434,11 +7931,8 @@
             /* For one channel be good enpugh time to receive beacon atleast */
             if(  1 == pProfile->ChannelInfo.numOfChannels )
             {
-                 pScanCmd->u.scanCmd.u.scanRequest.maxChnTime = MAX_ACTIVE_SCAN_FOR_ONE_CHANNEL;
-                 pScanCmd->u.scanCmd.u.scanRequest.minChnTime = MIN_ACTIVE_SCAN_FOR_ONE_CHANNEL;
-            }
-            else
-            {
+                 csr_scan_request_set_chan_time(pMac, pScanCmd);
+            } else {
                  pScanCmd->u.scanCmd.u.scanRequest.maxChnTime =
                                    pMac->roam.configParam.nActiveMaxChnTime;
                  pScanCmd->u.scanCmd.u.scanRequest.minChnTime =
@@ -8554,7 +9048,7 @@
    pBssDescr->timeStamp[1]   = pParsedFrame->timeStamp[1];
    pBssDescr->capabilityInfo = *((tANI_U16 *)&pParsedFrame->capabilityInfo);
    vos_mem_copy((tANI_U8 *) &pBssDescr->bssId, (tANI_U8 *) macHeader->bssId, sizeof(tSirMacAddr));
-   pBssDescr->nReceivedTime = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
+   pBssDescr->nReceivedTime = vos_timer_get_system_time();
 
    smsLog( pMac, LOG1, FL("Bssid= "MAC_ADDRESS_STR
                        " chan= %d, rssi = %d "),
@@ -8606,9 +9100,6 @@
    //Add to scan cache
    csrScanAddResult(pMac, pScanResult, pIesLocal);
    pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_LOCK );
-   if (pEntry && 0 != pMac->scan.scanResultCfgAgingTime)
-       csrScanStartResultCfgAgingTimer(pMac);
-
    if( (pScanResult->Result.pvIes == NULL) && pIesLocal )
    {
        vos_mem_free(pIesLocal);
diff --git a/wlan/prima/CORE/SME/src/csr/csrInsideApi.h b/wlan/prima/CORE/SME/src/csr/csrInsideApi.h
index 885fc33..f9a38bf 100644
--- a/wlan/prima/CORE/SME/src/csr/csrInsideApi.h
+++ b/wlan/prima/CORE/SME/src/csr/csrInsideApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -68,8 +68,9 @@
 
 #define CSR_MAX_2_4_GHZ_SUPPORTED_CHANNELS 14
 
-#define CSR_MAX_BSS_SUPPORT            250
+#define CSR_MAX_BSS_SUPPORT            512
 #define SYSTEM_TIME_MSEC_TO_USEC      1000
+#define SYSTEM_TIME_SEC_TO_MSEC       1000
 
 //This number minus 1 means the number of times a channel is scanned before a BSS is remvoed from
 //cache scan result
@@ -85,7 +86,6 @@
 #define CSR_MIC_ERROR_TIMEOUT  (60 * PAL_TIMER_TO_SEC_UNIT)     //60 seconds
 #define CSR_TKIP_COUNTER_MEASURE_TIMEOUT  (60 * PAL_TIMER_TO_SEC_UNIT)     //60 seconds
 #define CSR_SCAN_RESULT_AGING_INTERVAL    (5 * PAL_TIMER_TO_SEC_UNIT)     //5 seconds
-#define CSR_SCAN_RESULT_CFG_AGING_INTERVAL    (PAL_TIMER_TO_SEC_UNIT)     // 1  second
 //the following defines are NOT used by palTimer
 #define CSR_SCAN_AGING_TIME_NOT_CONNECT_NO_PS 50     //50 seconds
 #define CSR_SCAN_AGING_TIME_NOT_CONNECT_W_PS 300     //300 seconds
@@ -112,6 +112,43 @@
 #define CSR_JOIN_RETRY_TIMEOUT_PERIOD        ( 1 *  PAL_TIMER_TO_SEC_UNIT )  // 1 second
 #endif
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+#define ROAMING_RSSI_WEIGHT 50
+#define MIN_RSSI (-100)
+#define MAX_RSSI 0
+#define ROAM_AP_COUNT_WEIGHT 50
+#define ROAM_MAX_COUNT 30
+#define ROAM_MIN_COUNT 0
+#define ROAM_MAX_WEIGHT 100
+
+#define RSSI_WEIGHTAGE 25
+#define HT_CAPABILITY_WEIGHTAGE 10
+#define VHT_CAP_WEIGHTAGE 6
+#define BEAMFORMING_CAP_WEIGHTAGE 2
+#define CHAN_WIDTH_WEIGHTAGE 10
+#define CHAN_BAND_WEIGHTAGE 5
+#define WMM_WEIGHTAGE 2
+#define CCA_WEIGHTAGE 10
+#define OTHER_AP_WEIGHT 30
+
+#define MAX_AP_LOAD 255
+#define PENALTY_TIMEOUT (30 * 60 * 1000)
+#define PENALTY_REMAINING_SCORE (7)
+#define PENALTY_TOTAL_SCORE (10)
+#define PER_EXCELENT_RSSI -40
+#define PER_GOOD_RSSI -55
+#define PER_POOR_RSSI -65
+#define PER_ROAM_EXCELLENT_RSSI_WEIGHT 100
+#define PER_ROAM_GOOD_RSSI_WEIGHT 80
+#define PER_ROAM_BAD_RSSI_WEIGHT 60
+#define PER_ROAM_MAX_WEIGHT 100
+#define PER_ROAM_80MHZ 100
+#define PER_ROAM_40MHZ 70
+#define PER_ROAM_20MHZ 30
+#define PER_ROAM_PENALTY (3/10)
+#define PER_ROAM_MAX_BSS_SCORE 10000
+#endif
+
 typedef enum 
 {
     eCsrNextScanNothing,
@@ -170,7 +207,9 @@
     eCsrEncryptionType ucEncryptionType; //Preferred Encryption type that matched with profile.
     eCsrEncryptionType mcEncryptionType; 
     eCsrAuthType authType; //Preferred auth type that matched with the profile.
-
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    int congestionScore;
+#endif
     tCsrScanResultInfo Result;
 }tCsrScanResult;
 
@@ -256,8 +295,6 @@
 eHalStatus csrScanForCapabilityChange(tpAniSirGlobal pMac, tSirSmeApNewCaps *pNewCaps);
 eHalStatus csrScanStartGetResultTimer(tpAniSirGlobal pMac);
 eHalStatus csrScanStopGetResultTimer(tpAniSirGlobal pMac);
-eHalStatus csrScanStartResultCfgAgingTimer(tpAniSirGlobal pMac);
-eHalStatus csrScanStopResultCfgAgingTimer(tpAniSirGlobal pMac);
 eHalStatus csrScanBGScanEnable(tpAniSirGlobal pMac);
 eHalStatus csrScanStartIdleScanTimer(tpAniSirGlobal pMac, tANI_U32 interval);
 eHalStatus csrScanStopIdleScanTimer(tpAniSirGlobal pMac);
@@ -385,7 +422,6 @@
 tANI_U32 csrTranslateToWNICfgDot11Mode(tpAniSirGlobal pMac, eCsrCfgDot11Mode csrDot11Mode);
 void csrSaveChannelPowerForBand( tpAniSirGlobal pMac, tANI_BOOLEAN fPopulate5GBand );
 void csrApplyChannelPowerCountryInfo( tpAniSirGlobal pMac, tCsrChannel *pChannelList, tANI_U8 *countryCode, tANI_BOOLEAN updateRiva);
-void csrUpdateFCCChannelList(tpAniSirGlobal pMac);
 void csrApplyPower2Current( tpAniSirGlobal pMac );
 void csrAssignRssiForCategory(tpAniSirGlobal pMac, tANI_S8 bestApRssi, tANI_U8 catOffset);
 tANI_BOOLEAN csrIsMacAddressZero( tpAniSirGlobal pMac, tCsrBssid *pMacAddr );
@@ -423,7 +459,8 @@
                                 tANI_BOOLEAN fSync, tANI_U8 bPurgeList,
                                 csrRoamSessionCloseCallback callback,
                                 void *pContext );
-void csrPurgeSmeCmdList(tpAniSirGlobal pMac, tANI_U32 sessionId);
+void csrPurgeSmeCmdList(tpAniSirGlobal pMac, tANI_U32 sessionId,
+                        bool flush_all);
 void csrCleanupSession(tpAniSirGlobal pMac, tANI_U32 sessionId);
 eHalStatus csrRoamGetSessionIdFromBSSID( tpAniSirGlobal pMac, tCsrBssid *bssid, tANI_U32 *pSessionId );
 eCsrCfgDot11Mode csrFindBestPhyMode( tpAniSirGlobal pMac, tANI_U32 phyMode );
@@ -645,6 +682,11 @@
 #define WLAN_SECURITY_EVENT_PMKID_CANDIDATE_FOUND  7
 #define WLAN_SECURITY_EVENT_PMKID_UPDATE    8
 #define WLAN_SECURITY_EVENT_MIC_ERROR       9   
+#define WLAN_SECURITY_EVENT_SET_UNICAST_REQ  10
+#define WLAN_SECURITY_EVENT_SET_UNICAST_RSP  11
+#define WLAN_SECURITY_EVENT_SET_BCAST_REQ    12
+#define WLAN_SECURITY_EVENT_SET_BCAST_RSP    13
+
 
 #define AUTH_OPEN       0
 #define AUTH_SHARED     1
@@ -1040,6 +1082,9 @@
 tANI_BOOLEAN csrElectedCountryInfo(tpAniSirGlobal pMac);
 void csrAddVoteForCountryInfo(tpAniSirGlobal pMac, tANI_U8 *pCountryCode);
 void csrClearVotesForCountryInfo(tpAniSirGlobal pMac);
+void csr_remove_bssid_from_scan_list(tpAniSirGlobal pMac,
+       tSirMacAddr bssid);
+
 #ifdef WLAN_FEATURE_AP_HT40_24G
 eHalStatus csrSetHT2040Mode(tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U8 cbMode);
 #endif
diff --git a/wlan/prima/CORE/SME/src/csr/csrNeighborRoam.c b/wlan/prima/CORE/SME/src/csr/csrNeighborRoam.c
index 19bd0de..14f6756 100644
--- a/wlan/prima/CORE/SME/src/csr/csrNeighborRoam.c
+++ b/wlan/prima/CORE/SME/src/csr/csrNeighborRoam.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1307,6 +1307,8 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
     if (pNeighborRoamInfo->uOsRequestedHandoff)
     {
+
+        smsLog(pMac, LOG1, FL("OS Requested Handoff"));
         pScanFilter->BSSIDs.numOfBSSIDs = 1;
         pScanFilter->BSSIDs.bssid = vos_mem_malloc(sizeof(tSirMacAddr) * pScanFilter->BSSIDs.numOfBSSIDs);
         if (NULL == pScanFilter->BSSIDs.bssid)
@@ -1379,6 +1381,10 @@
        pScanFilter->ChannelInfo.numOfChannels = 0;
        pScanFilter->ChannelInfo.ChannelList = NULL;
     }
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    if (pMac->PERroamCandidatesCnt)
+       pScanFilter->isPERRoamScan = true;
+#endif
 #ifdef WLAN_FEATURE_VOWIFI_11R
     if (pNeighborRoamInfo->is11rAssoc)
     {
@@ -1496,6 +1502,15 @@
             continue;
         }
 
+       if (vos_concurrent_open_sessions_running() &&
+          !pMac->roam.configParam.fenableMCCMode &&
+            (pScanResult->BssDescriptor.channelId !=
+            csrGetConcurrentOperationChannel(pMac))) {
+          smsLog(pMac, LOG1, FL("MCC not supported so Ignore AP on channel %d"),
+                    pScanResult->BssDescriptor.channelId);
+          continue;
+       }
+
 #ifdef FEATURE_WLAN_LFR
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
        /* In case of reassoc requested by upper layer, look for exact match of bssid & channel;
@@ -2201,10 +2216,15 @@
 
                     else
                     {
-                        /* There is no candidate or We are not roaming Now.
-                         * Inform the FW to restart Roam Offload Scan  */
-                        csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_RESTART,
-                            REASON_NO_CAND_FOUND_OR_NOT_ROAMING_NOW);
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+                        if (pMac->PERroamCandidatesCnt == 0)
+#endif
+                        {
+                            /* There is no candidate or We are not roaming Now.
+                             * Inform the FW to restart Roam Offload Scan  */
+                            csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_RESTART,
+                                REASON_NO_CAND_FOUND_OR_NOT_ROAMING_NOW);
+                        }
                     }
                 }
                 CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_CONNECTED);
@@ -3080,7 +3100,7 @@
         return;
     }
 
-    pNeighborRoamInfo->scanRequestTimeStamp = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
+    pNeighborRoamInfo->scanRequestTimeStamp = vos_timer_get_system_time();
     /*
      * We are about to start a fresh scan cycle for all valid channles for 5Ghz
      * purge non-P2P results from the past for 5Ghz band
@@ -3452,7 +3472,8 @@
                 }
 
                 /* We are gonna scan now. Remember the time stamp to filter out results only after this timestamp */
-                pNeighborRoamInfo->scanRequestTimeStamp = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
+                pNeighborRoamInfo->scanRequestTimeStamp =
+                                              vos_timer_get_system_time();
                 
                 /* Now ready for neighbor scan based on the channel list created */
                 /* Start Neighbor scan timer now. Multiplication by PAL_TIMER_TO_MS_UNIT is to convert ms to us which is 
@@ -3854,7 +3875,8 @@
                 pNeighborRoamInfo->lookupDOWNRssi,
                 pNeighborRoamInfo->cfgParams.neighborReassocThreshold*(-1));
 
-            pNeighborRoamInfo->scanRequestTimeStamp = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
+            pNeighborRoamInfo->scanRequestTimeStamp =
+                                          vos_timer_get_system_time();
 
             vos_timer_stop(&pNeighborRoamInfo->neighborScanTimer);
 
@@ -4039,7 +4061,7 @@
     }
 
     /* We are gonna scan now. Remember the time stamp to filter out results only after this timestamp */
-    pNeighborRoamInfo->scanRequestTimeStamp = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
+    pNeighborRoamInfo->scanRequestTimeStamp = vos_timer_get_system_time();
     
     vos_timer_stop(&pNeighborRoamInfo->neighborScanTimer);
     /* Start Neighbor scan timer now. Multiplication by PAL_TIMER_TO_MS_UNIT is to convert ms to us which is 
@@ -4904,7 +4926,7 @@
     }
 #endif
     /* Initialize this with the current tick count */
-    pNeighborRoamInfo->scanRequestTimeStamp = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
+    pNeighborRoamInfo->scanRequestTimeStamp = vos_timer_get_system_time();
 
     CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT)
     pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
@@ -5329,6 +5351,10 @@
     tCsrRoamProfile *pProfile = NULL;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, pNeighborRoamInfo->csrSessionId );
     tANI_U8 i = 0;
+    uint8_t roam_now = 0;
+    uint8_t roamable_ap_count = 0;
+    tCsrScanResultFilter    scan_filter;
+    tScanResultHandle       scan_result;
 
     if (NULL == pSession)
     {
@@ -5384,13 +5410,30 @@
         }
         pProfile->ChannelInfo.ChannelList[0] = pNeighborRoamInfo->handoffReqInfo.channel;
 
-        //clean up csr cache first
-        //csrScanFlushSelectiveResult(pMac, VOS_FALSE);
-        //do a SSID scan
-        status = csrScanForSSID(pMac, pNeighborRoamInfo->csrSessionId, pProfile, roamId, FALSE);
-        if(!HAL_STATUS_SUCCESS(status))
-        {
-            smsLog(pMac, LOGE, FL("SSID scan failed"));
+        /*
+         * For User space connect requests, the scan has already been done.
+         * So, check if the BSS descriptor exists in the scan cache and
+         * proceed with the handoff instead of a redundant scan again.
+         */
+        if (pNeighborRoamInfo->handoffReqInfo.src == CONNECT_CMD_USERSPACE) {
+            smsLog(pMac, LOG1, FL("Connect cmd with bssid within same ESS"));
+            status = csrNeighborRoamPrepareScanProfileFilter(
+                                               pMac, &scan_filter);
+            smsLog(pMac, LOG1, FL("Filter creation status = %d"), status);
+            status = csrScanGetResult(pMac, &scan_filter, &scan_result);
+            roam_now = csrNeighborRoamProcessScanResults(pMac, &scan_result);
+            roamable_ap_count = csrLLCount(&pNeighborRoamInfo->roamableAPList);
+            csrFreeScanFilter(pMac, &scan_filter);
+            smsLog(pMac, LOG1, FL("roam_now=%d, roamable_ap_count=%d"),
+                   roam_now, roamable_ap_count);
+        }
+        if (roam_now && roamable_ap_count) {
+            csrNeighborRoamTriggerHandoff(pMac, pNeighborRoamInfo);
+        } else {
+            status = csrScanForSSID(pMac, pSession->sessionId,
+                                           pProfile, roamId, FALSE);
+            if(!HAL_STATUS_SUCCESS(status))
+               smsLog(pMac, LOGE, FL("SSID scan failed"));
         }
     }while(0);
 
@@ -5455,6 +5498,30 @@
     return eHAL_STATUS_SUCCESS;
 }
 
+/**
+ * csr_neighbor_roam_handler_assign_handoff_src() - Assign source of
+ *							roam handoff
+ * @pNeighborRoamInfo: Pointer to csr neighbor roam control info
+ * @pHandoffReqInfo: Pointer to the Handoff request
+ *
+ * Return: None
+ */
+#ifndef QCA_WIFI_ISOC
+static inline void csr_neighbor_roam_handler_assign_handoff_src(
+			tpCsrNeighborRoamControlInfo  pNeighborRoamInfo,
+			tAniHandoffReq *pHandoffReqInfo)
+{
+	pNeighborRoamInfo->handoffReqInfo.src
+		= pHandoffReqInfo->handoff_src;
+}
+#else
+static inline void csr_neighbor_roam_handler_assign_handoff_src(
+			tpCsrNeighborRoamControlInfo  pNeighborRoamInfo,
+			tAniHandoffReq *pHandoffReqInfo)
+{
+}
+#endif
+
 /* ---------------------------------------------------------------------------
 
     \fn csrNeighborRoamHandoffReqHdlr
@@ -5492,6 +5559,8 @@
             {
 
                 pNeighborRoamInfo->handoffReqInfo.channel = pHandoffReqInfo->channel;
+                csr_neighbor_roam_handler_assign_handoff_src(pNeighborRoamInfo,
+                                                               pHandoffReqInfo);
                 vos_mem_copy(pNeighborRoamInfo->handoffReqInfo.bssid,
                              pHandoffReqInfo->bssid,
                              6);
diff --git a/wlan/prima/CORE/SME/src/csr/csrTdlsProcess.c b/wlan/prima/CORE/SME/src/csr/csrTdlsProcess.c
index a5504d3..77a084d 100644
--- a/wlan/prima/CORE/SME/src/csr/csrTdlsProcess.c
+++ b/wlan/prima/CORE/SME/src/csr/csrTdlsProcess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -664,61 +664,29 @@
 eHalStatus csrTdlsProcessCmd(tpAniSirGlobal pMac, tSmeCmd *cmd)
 {
     eSmeCommandType  cmdType = cmd->command ;
-    tANI_BOOLEAN status = eANI_BOOLEAN_TRUE;
+    eHalStatus status = eHAL_STATUS_SUCCESS;
     switch(cmdType)
     {
         case eSmeCommandTdlsSendMgmt:
-        {
-            status = csrTdlsProcessSendMgmt( pMac, cmd );
-            if(HAL_STATUS_SUCCESS( status ) )
-            {
-               status = eANI_BOOLEAN_FALSE ;
-            }
-        }
+            status = csrTdlsProcessSendMgmt(pMac, cmd);
         break ;
         case eSmeCommandTdlsAddPeer:
-        {
-            status = csrTdlsProcessAddSta( pMac, cmd );
-            if(HAL_STATUS_SUCCESS( status ) )
-            {
-               status = eANI_BOOLEAN_FALSE ;
-            }
-        }
+            status = csrTdlsProcessAddSta(pMac, cmd);
         break;
         case eSmeCommandTdlsDelPeer: 
-        {
-            status = csrTdlsProcessDelSta( pMac, cmd );
-            if(HAL_STATUS_SUCCESS( status ) )
-            {
-               status = eANI_BOOLEAN_FALSE ;
-            }
-        }
+            status = csrTdlsProcessDelSta(pMac, cmd);
         break;
         case eSmeCommandTdlsLinkEstablish:
-        {
-            status = csrTdlsProcessLinkEstablish( pMac, cmd );
-            if(HAL_STATUS_SUCCESS( status ) )
-            {
-               status = eANI_BOOLEAN_FALSE ;
-            }
-        }
+            status = csrTdlsProcessLinkEstablish(pMac, cmd);
         break;
 // tdlsoffchan
         case eSmeCommandTdlsChannelSwitch:
-        {
-             status = csrTdlsProcessChanSwitchReq( pMac, cmd );
-             if(HAL_STATUS_SUCCESS( status ) )
-             {
-               status = eANI_BOOLEAN_FALSE ;
-             }
-        }
+            status = csrTdlsProcessChanSwitchReq(pMac, cmd);
         break;
        default:
-       {
+           status = eHAL_STATUS_FAILURE;
             /* TODO: Add defualt handling */  
            break ;
-       } 
-             
     }
     return status ; 
 }
@@ -945,6 +913,11 @@
             roamInfo.staId = delStaRsp->staId ;
             roamInfo.statusCode = delStaRsp->statusCode ;
 #endif
+            vos_mem_copy(&roamInfo.peerMac, linkEstablishReqRsp->peerMac,
+                                         sizeof(tSirMacAddr)) ;
+            roamInfo.staId  = (tANI_U8)linkEstablishReqRsp->sta_idx;
+            roamInfo.statusCode = linkEstablishReqRsp->statusCode;
+
             csrRoamCallCallback(pMac, linkEstablishReqRsp->sessionId, &roamInfo, 0,
                          eCSR_ROAM_TDLS_STATUS_UPDATE,
                                eCSR_ROAM_RESULT_LINK_ESTABLISH_REQ_RSP);
@@ -966,6 +939,19 @@
                                 eCSR_ROAM_TDLS_STATUS_UPDATE,
                                 eCSR_ROAM_RESULT_LINK_ESTABLISH_REQ_RSP);
 #endif
+            tSirTdlsChanSwitchReqRsp *ChanSwitchReqRsp =
+                            (tSirTdlsChanSwitchReqRsp *) pMsgBuf ;
+            tCsrRoamInfo roamInfo = {0} ;
+
+            vos_mem_copy(&roamInfo.peerMac, ChanSwitchReqRsp->peerMac,
+                         sizeof(tSirMacAddr));
+            roamInfo.staId  = (tANI_U8)ChanSwitchReqRsp->sta_idx;
+            roamInfo.statusCode = ChanSwitchReqRsp->statusCode;
+
+            csrRoamCallCallback(pMac, ChanSwitchReqRsp->sessionId, &roamInfo, 0,
+                                eCSR_ROAM_TDLS_STATUS_UPDATE,
+                                eCSR_ROAM_RESULT_CHANNEL_SWITCH_REQ_RSP);
+
             /* remove pending eSmeCommandTdlsChanSwitch command */
             csrTdlsRemoveSmeCmd(pMac, eSmeCommandTdlsChannelSwitch);
             break;
diff --git a/wlan/prima/CORE/SME/src/pmc/pmc.c b/wlan/prima/CORE/SME/src/pmc/pmc.c
index 6aa3b8b..66474d7 100644
--- a/wlan/prima/CORE/SME/src/pmc/pmc.c
+++ b/wlan/prima/CORE/SME/src/pmc/pmc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -663,7 +663,7 @@
         {
             if (!checkRoutine(pPowerSaveCheckEntry->checkContext))
             {
-                pmcLog(pMac, LOGE, FL("pmcPowerSaveCheck fail!"));
+                pmcLog(pMac, LOG1, FL("pmcPowerSaveCheck fail!"));
                 bResult = FALSE;
                 break;
             }
@@ -1037,8 +1037,11 @@
     }
     else
     {
-        /*Some module voted against Power Save. So timer should be restarted again to retry BMPS */
-        pmcLog(pMac, LOGE, FL("Power Save check failed. Retry BMPS again later"));
+        /*Some module voted against Power Save.
+         * So timer should be restarted again to retry BMPS
+         */
+        pmcLog(pMac, LOGW,
+             FL("Power Save check failed. Retry BMPS again later"));
         //Since hTrafficTimer is a vos_timer now, we need to restart the timer here
         vosStatus = vos_timer_start(&pMac->pmc.hTrafficTimer, pMac->pmc.bmpsConfig.trafficMeasurePeriod);
         if ( !VOS_IS_STATUS_SUCCESS(vosStatus) && (VOS_STATUS_E_ALREADY != vosStatus) )
diff --git a/wlan/prima/CORE/SME/src/pmc/pmcApi.c b/wlan/prima/CORE/SME/src/pmc/pmcApi.c
index 160c991..3d520c4 100644
--- a/wlan/prima/CORE/SME/src/pmc/pmcApi.c
+++ b/wlan/prima/CORE/SME/src/pmc/pmcApi.c
@@ -2203,18 +2203,12 @@
     if(pattern == NULL)
     {
         pmcLog(pMac, LOGE, FL("Null broadcast pattern being passed"));
-#ifdef FEATURE_WLAN_DIAG_SUPPORT
-        WLAN_VOS_DIAG_LOG_FREE(log_ptr);
-#endif
         return eHAL_STATUS_FAILURE;
     }
 
     if( pSession == NULL)
     {
         pmcLog(pMac, LOGE, FL("Session not found "));
-#ifdef FEATURE_WLAN_DIAG_SUPPORT
-        WLAN_VOS_DIAG_LOG_FREE(log_ptr);
-#endif
         return eHAL_STATUS_FAILURE;
     }
 
diff --git a/wlan/prima/CORE/SME/src/rrm/sme_rrm.c b/wlan/prima/CORE/SME/src/rrm/sme_rrm.c
index 5988d67..af18b4f 100644
--- a/wlan/prima/CORE/SME/src/rrm/sme_rrm.c
+++ b/wlan/prima/CORE/SME/src/rrm/sme_rrm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -75,6 +75,9 @@
 #ifdef FEATURE_WLAN_ESE
 #define RRM_ROAM_SCORE_NEIGHBOR_IAPP_LIST                       30
 #endif
+
+v_TIME_t RRM_scan_timer;
+
 /**---------------------------------------------------------------------------
   
   \brief rrmLLPurgeNeighborCache() - 
@@ -467,6 +470,7 @@
    tANI_U8 counter=0;
    tpRrmSMEContext pSmeRrmContext = &pMac->rrm.rrmSmeContext;
    tANI_U32 sessionId;
+   tCsrRoamInfo *roam_info;
 
 #if defined WLAN_VOWIFI_DEBUG
    smsLog( pMac, LOGE, "Send scan result to PE ");
@@ -517,6 +521,8 @@
 #endif
    }
 
+   smsLog(pMac, LOG1, FL("RRM Measurement Done %d"), measurementDone);
+
    if (NULL == pResult)
    {
       // no scan results
@@ -572,32 +578,59 @@
    while (pScanResult)
    {
       pNextResult = sme_ScanResultGetNext(pMac, pResult);
-      pScanResultsArr[counter++] = pScanResult;
+      smsLog(pMac, LOG1, "Scan res timer:%lu, rrm scan timer:%lu",
+             pScanResult->timer, RRM_scan_timer);
+      if (pScanResult->timer >= RRM_scan_timer) {
+          roam_info = vos_mem_malloc(sizeof(*roam_info));
+          if (NULL == roam_info) {
+              smsLog(pMac, LOGW, FL("vos_mem_malloc failed:"));
+              status =  eHAL_STATUS_FAILED_ALLOC;
+              goto rrm_send_scan_results_done;
+          }
+          vos_mem_zero(roam_info, sizeof(*roam_info));
+          roam_info->pBssDesc = &pScanResult->BssDescriptor;
+          csrRoamCallCallback(pMac, sessionId, roam_info, 0,
+                           eCSR_ROAM_UPDATE_SCAN_RESULT, eCSR_ROAM_RESULT_NONE);
+          vos_mem_free(roam_info);
+          pScanResultsArr[counter++] = pScanResult;
+      }
       pScanResult = pNextResult; //sme_ScanResultGetNext(hHal, pResult);
       if (counter >= SIR_BCN_REPORT_MAX_BSS_DESC)
          break;
       }
 
-   if (counter)
-   {
-          smsLog(pMac, LOG1, " Number of BSS Desc with RRM Scan %d ", counter);
+   smsLog(pMac, LOG1, " Number of BSS Desc with RRM Scan %d ", counter);
+   /*
+    * The beacon report should be sent whether the counter is zero or non-zero.
+    * There might be a few scan results in the cache but not actually are a
+    * result of this scan. During that scenario, the counter will be zero.
+    * The report should be sent and LIM will further cleanup the RRM to
+    * accept the further incoming requests
+    * In case the counter is Zero, the pScanResultsArr will be NULL.
+    * The next level routine does a check for the measurementDone to determine
+    * whether to send a report or not.
+    */
+
+   if (counter || measurementDone) {
 #if defined(FEATURE_WLAN_ESE_UPLOAD)
-         if (eRRM_MSG_SOURCE_ESE_UPLOAD == pSmeRrmContext->msgSource)
-         {
-             status = sme_EseSendBeaconReqScanResults(pMac,
+       if (eRRM_MSG_SOURCE_ESE_UPLOAD == pSmeRrmContext->msgSource)
+       {
+           status = sme_EseSendBeaconReqScanResults(pMac,
                                                 sessionId,
                                                 chanList[0],
                                                 pScanResultsArr,
                                                 measurementDone,
                                                 counter);
-         }
-         else
+       }
+       else
 #endif /*FEATURE_WLAN_ESE_UPLOAD*/
-             status = sme_RrmSendBeaconReportXmitInd( pMac,
+           status = sme_RrmSendBeaconReportXmitInd( pMac,
                                                 pScanResultsArr,
                                                 measurementDone,
                                                 counter);
    }
+
+rrm_send_scan_results_done:
    sme_ScanResultPurge(pMac, pResult); 
 
    return status;
@@ -738,6 +771,8 @@
                scanRequest.scanType,
                scanRequest.maxChnTime );
 
+       RRM_scan_timer = vos_timer_get_system_time();
+
 #if defined WLAN_VOWIFI_DEBUG
        smsLog( pMac, LOGE, "For Duration %d ", scanRequest.maxChnTime );
 #endif
@@ -769,6 +804,11 @@
    }
    else if (2 == scanType)  /* beacon table */
    {
+       /*In beacon table mode, scan results are taken directly from scan cache
+         without issuing any scan request. So, it is not proper to update
+         RRM_scan_timer with latest time and hence made it to zero to satisfy
+         pScanResult->timer >= RRM_scan_timer */
+       RRM_scan_timer = 0;
        if ((pSmeRrmContext->currentIndex + 1) < pSmeRrmContext->channelList.numOfChannels)
        {
            sme_RrmSendScanResult( pMac, 1, &pSmeRrmContext->channelList.ChannelList[pSmeRrmContext->currentIndex], false );
diff --git a/wlan/prima/CORE/SME/src/sme_common/sme_Api.c b/wlan/prima/CORE/SME/src/sme_common/sme_Api.c
index 9006254..182040c 100644
--- a/wlan/prima/CORE/SME/src/sme_common/sme_Api.c
+++ b/wlan/prima/CORE/SME/src/sme_common/sme_Api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -270,7 +270,7 @@
 }
 
 void purgeSmeSessionCmdList(tpAniSirGlobal pMac, tANI_U32 sessionId,
-        tDblLinkList *pList)
+        tDblLinkList *pList, bool flush_all)
 {
     //release any out standing commands back to free command list
     tListElem *pEntry, *pNext;
@@ -290,6 +290,12 @@
     {
         pNext = csrLLNext(pList, pEntry, LL_ACCESS_NOLOCK);
         pCommand = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
+        if (!flush_all &&
+            csr_is_disconnect_full_power_cmd(pCommand)) {
+            smsLog(pMac, LOGW, FL(" Ignore disconnect"));
+            pEntry = pNext;
+            continue;
+        }
         if(pCommand->sessionId == sessionId)
         {
             if(csrLLRemoveEntry(pList, pEntry, LL_ACCESS_NOLOCK))
@@ -464,8 +470,20 @@
         smeCommandQueueFull++;
         csrLLUnlock(&pMac->roam.roamCmdPendingList);
 
-       /* panic with out-of-command */
-        VOS_BUG(0);
+        vos_state_info_dump_all();
+
+        if (pMac->roam.configParam.enableFatalEvent)
+        {
+            vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                    WLAN_LOG_INDICATOR_HOST_DRIVER,
+                    WLAN_LOG_REASON_SME_OUT_OF_CMD_BUF,
+                    FALSE, FALSE);
+        }
+        else
+        {
+           /* Trigger SSR */
+           vos_wlanRestart();
+        }
     }
 
     if( pRetCmd )
@@ -1210,12 +1228,16 @@
                         case eSmeCommandTdlsDelPeer:
                         case eSmeCommandTdlsLinkEstablish:
                         case eSmeCommandTdlsChannelSwitch: // tdlsoffchan
+                            smsLog(pMac, LOG1,
+                                  FL("sending TDLS Command 0x%x to PE"),
+                                  pCommand->command);
+                            csrLLUnlock(&pMac->sme.smeCmdActiveList);
+                            status = csrTdlsProcessCmd(pMac, pCommand);
+                            if(!HAL_STATUS_SUCCESS(status))
                             {
-                                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                                        "sending TDLS Command 0x%x to PE", pCommand->command);
-
-                                csrLLUnlock( &pMac->sme.smeCmdActiveList );
-                                status = csrTdlsProcessCmd( pMac, pCommand );
+                                if(csrLLRemoveEntry(&pMac->sme.smeCmdActiveList,
+                                        &pCommand->Link, LL_ACCESS_LOCK))
+                                 csrReleaseCommand(pMac, pCommand);
                             }
                             break ;
 #endif
@@ -1417,6 +1439,7 @@
 #endif
       sme_p2pOpen(pMac);
       smeTraceInit(pMac);
+      sme_register_debug_callback();
 
    }while (0);
 
@@ -1813,6 +1836,61 @@
    return status;
 }
 
+/**
+ * sme_set_allowed_action_frames() - Set allowed action frames to FW
+ *
+ * @hal: Handler to HAL
+ *
+ * This function conveys the list of action frames that needs to be forwarded
+ * to driver by FW. Rest of the action frames can be dropped in FW.Bitmask is
+ * set with ALLOWED_ACTION_FRAMES_BITMAP
+ *
+ * Return: None
+ */
+static void sme_set_allowed_action_frames(tHalHandle hal)
+{
+    eHalStatus status;
+    tpAniSirGlobal mac = PMAC_STRUCT(hal);
+    vos_msg_t vos_message;
+    VOS_STATUS vos_status;
+    struct sir_allowed_action_frames *sir_allowed_action_frames;
+
+    sir_allowed_action_frames =
+                         vos_mem_malloc(sizeof(*sir_allowed_action_frames));
+    if (!sir_allowed_action_frames) {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                    "Not able to allocate memory for WDA_SET_ALLOWED_ACTION_FRAMES_IND");
+        return;
+    }
+
+    vos_mem_zero(sir_allowed_action_frames, sizeof(*sir_allowed_action_frames));
+    sir_allowed_action_frames->bitmask = ALLOWED_ACTION_FRAMES_BITMAP;
+    sir_allowed_action_frames->reserved = 0;
+
+    status = sme_AcquireGlobalLock(&mac->sme);
+    if (status == eHAL_STATUS_SUCCESS) {
+           /* serialize the req through MC thread */
+        vos_message.bodyptr = sir_allowed_action_frames;
+        vos_message.type = WDA_SET_ALLOWED_ACTION_FRAMES_IND;
+        MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                    TRACE_CODE_SME_TX_WDA_MSG,
+                    NO_SESSION, vos_message.type));
+        vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_message);
+        if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+              VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                         "Not able to post WDA_SET_ALLOWED_ACTION_FRAMES_IND message to HAL");
+              vos_mem_free(sir_allowed_action_frames);
+        }
+
+        sme_ReleaseGlobalLock( &mac->sme );
+    } else {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s: "
+                    "sme_AcquireGlobalLock error", __func__);
+        vos_mem_free(sir_allowed_action_frames);
+    }
+    return;
+}
+
 /*--------------------------------------------------------------------------
 
   \brief sme_Start() - Put all SME modules at ready state.
@@ -1858,6 +1936,8 @@
       pMac->sme.state = SME_STATE_START;
    }while (0);
 
+   sme_set_allowed_action_frames(hHal);
+
    return status;
 }
 
@@ -2077,6 +2157,31 @@
 #endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 
 
+#ifdef WLAN_FEATURE_RMC
+eHalStatus sme_IbssPeerInfoResponseHandleer( tHalHandle hHal,
+                                      tpSirIbssGetPeerInfoRspParams pIbssPeerInfoParams)
+{
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+
+   if (NULL == pMac)
+   {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL,
+           "%s: pMac is null", __func__);
+       return eHAL_STATUS_FAILURE;
+   }
+   if (pMac->sme.peerInfoParams.peerInfoCbk == NULL)
+   {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+           "%s: HDD callback is null", __func__);
+       return eHAL_STATUS_FAILURE;
+   }
+   pMac->sme.peerInfoParams.peerInfoCbk(pMac->sme.peerInfoParams.pUserData,
+                                        &pIbssPeerInfoParams->ibssPeerInfoRspParams);
+   return eHAL_STATUS_SUCCESS;
+}
+#endif /* WLAN_FEATURE_RMC */
+
+
 /* ---------------------------------------------------------------------------
     \fn sme_getBcnMissRate
     \brief function sends 'WDA_GET_BCN_MISS_RATE_REQ' to WDA layer,
@@ -2580,6 +2685,25 @@
                 break;
 #endif /* FEATURE_WLAN_LPHB */
 
+#ifdef WLAN_FEATURE_RMC
+          case eWNI_SME_IBSS_PEER_INFO_RSP:
+              MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                       TRACE_CODE_SME_RX_WDA_MSG, NO_SESSION, pMsg->type));
+              if (pMsg->bodyptr)
+              {
+                  sme_IbssPeerInfoResponseHandleer(pMac, pMsg->bodyptr);
+                  vos_mem_free(pMsg->bodyptr);
+              }
+              else
+              {
+                  smsLog(pMac, LOGE,
+                         "Empty rsp message for (eWNI_SME_IBSS_PEER_INFO_RSP),"
+                         " nothing to process");
+              }
+              break ;
+
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_CH_AVOID
           /* LPHB timeout indication arrived, send IND to client */
           case eWNI_SME_CH_AVOID_IND:
@@ -3613,6 +3737,29 @@
    return;
 }
 
+/* sme_dhcp_done_ind() - send dhcp done ind
+ * @hal: hal context
+ * @session_id: session id
+ *
+ * Return: void.
+ */
+void sme_dhcp_done_ind(tHalHandle hal, uint8_t session_id)
+{
+   tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
+   tCsrRoamSession *session;
+
+   if (!mac_ctx)
+      return;
+
+   session = CSR_GET_SESSION(mac_ctx, session_id);
+   if(!session)
+   {
+   smsLog(mac_ctx, LOGE, FL(" session %d not found "), session_id);
+   return;
+   }
+   session->dhcp_done = true;
+}
+
 /* ---------------------------------------------------------------------------
     \fn sme_RoamStopBss
     \brief To stop BSS for Soft AP. This is an asynchronous API.
@@ -5973,7 +6120,6 @@
 
        MTRACE(vos_trace(VOS_MODULE_ID_SME,
                  TRACE_CODE_SME_TX_WDA_MSG, sessionId, vosMessage.type));
-
        vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage );
        if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
        {
@@ -5988,6 +6134,149 @@
     return (status);
 }
 
+#ifdef WLAN_FEATURE_RMC
+/*---------------------------------------------------------------------------
+
+    \fn sme_TXFailMonitorStopInd
+
+    \brief API to signal the FW to start monitoring TX failures
+
+    \return eHalStatus  SUCCESS.
+
+                         FAILURE or RESOURCES  The API finished and failed.
+ --------------------------------------------------------------------------*/
+eHalStatus sme_TXFailMonitorStartStopInd(tHalHandle hHal, tANI_U8 tx_fail_count,
+                                         void * txFailIndCallback)
+{
+    eHalStatus            status;
+    VOS_STATUS            vosStatus;
+    tpAniSirGlobal        pMac = PMAC_STRUCT(hHal);
+    vos_msg_t             vosMessage;
+    tAniTXFailMonitorInd  *pMsg;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if ( eHAL_STATUS_SUCCESS == status)
+    {
+        pMsg = (tAniTXFailMonitorInd*)
+                   vos_mem_malloc(sizeof(tAniTXFailMonitorInd));
+        if (NULL == pMsg)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                   "%s: Failed to allocate memory", __func__);
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_FAILURE;
+        }
+
+        pMsg->msgType = WDA_TX_FAIL_MONITOR_IND;
+        pMsg->msgLen = (tANI_U16)sizeof(tAniTXFailMonitorInd);
+
+        //tx_fail_count = 0 should disable the Monitoring in FW
+        pMsg->tx_fail_count = tx_fail_count;
+        pMsg->txFailIndCallback = txFailIndCallback;
+
+        vosMessage.type = WDA_TX_FAIL_MONITOR_IND;
+        vosMessage.bodyptr = pMsg;
+        vosMessage.reserved = 0;
+
+        MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
+        vosStatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage );
+        if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
+        {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                         "%s: Post TX Fail monitor Start MSG fail", __func__);
+           vos_mem_free(pMsg);
+           status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    return (status);
+}
+#endif /* WLAN_FEATURE_RMC */
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+void sme_PERRoamScanStartStop(void *hHal, tANI_U8 start)
+{
+    eHalStatus            status;
+    VOS_STATUS            vosStatus;
+    tpAniSirGlobal        pMac = PMAC_STRUCT(hHal);
+    vos_msg_t             vosMessage;
+    tPERRoamScanStart     *pMsg;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if ( eHAL_STATUS_SUCCESS == status)
+    {
+        pMsg = (tPERRoamScanStart *)
+                   vos_mem_malloc(sizeof(tPERRoamScanStart));
+        if (NULL == pMsg)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                   "%s: Failed to allocate memory", __func__);
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return;
+        }
+
+        pMsg->msgType = WDA_PER_ROAM_SCAN_TRIGGER_REQ;
+        pMsg->msgLen = (tANI_U16)sizeof(*pMsg);
+
+        pMsg->start = start;
+
+        vosMessage.type = WDA_PER_ROAM_SCAN_TRIGGER_REQ;
+        vosMessage.bodyptr = pMsg;
+        vosMessage.reserved = 0;
+
+        MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
+        vosStatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage );
+        if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
+        {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                         "%s: Post TX Fail monitor Start MSG fail", __func__);
+           vos_mem_free(pMsg);
+           status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+}
+
+/* sme_set_per_roam_rxconfig : set PER config for Rx monitoring
+ * @hHal: hal pointer
+ * @staId: station id
+ * @minRate : rate at which to start monitoring
+ * @maxRate : Rate at which to stop monitoring
+ * @minPercentage: minimum % of packets required in minRate to trigger a scan
+ * @minPktRequired: minimum number of packets required to trigger a scan
+ * @waitPeriodForNextPERScan: time to wait before start monitoring again once
+ * roam scan is triggered
+ * */
+
+VOS_STATUS sme_set_per_roam_rxconfig (tHalHandle hHal, v_U8_t staId,
+                             v_U16_t minRate, v_U16_t maxRate,
+                             v_U8_t minPercentage, v_U16_t minPktRequired,
+                             v_U64_t waitPeriodForNextPERScan)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    v_VOID_t * pVosContext = vos_get_global_context(VOS_MODULE_ID_SME, NULL);
+    WLANTL_StartRxRateMonitor(pVosContext, staId, minRate, maxRate,
+                    minPercentage, minPktRequired,
+                    (void *) hHal, waitPeriodForNextPERScan,
+                    sme_PERRoamScanStartStop);
+    pMac->PERroamCandidatesCnt = 0;
+    return eHAL_STATUS_SUCCESS;
+}
+
+/* sme_unset_per_roam_rxconfig : unset PER config for Rx monitoring
+ * */
+VOS_STATUS sme_unset_per_roam_rxconfig (tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    v_VOID_t * pVosContext = vos_get_global_context(VOS_MODULE_ID_SME, NULL);
+    vos_mem_set(pMac->previousRoamApInfo,
+                sizeof(tSirRoamAPInfo) * SIR_PER_ROAM_MAX_CANDIDATE_CNT, 0);
+    WLANTL_StopRxRateMonitor(pVosContext);
+    return eHAL_STATUS_SUCCESS;
+}
+#endif
 
 /* ---------------------------------------------------------------------------
     \fn sme_BtcSignalBtEvent
@@ -6774,6 +7063,57 @@
     return(status);
 }
 
+/* ---------------------------------------------------------------------------
+    \fn sme_OemDataReqNew
+    \brief a wrapper function for OEM DATA REQ NEW
+    \param pOemDataReqNewConfig - Data to be passed to FW
+  ---------------------------------------------------------------------------*/
+void sme_OemDataReqNew(tHalHandle hHal,
+        tOemDataReqNewConfig *pOemDataReqNewConfig)
+{
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    tOemDataReqNewConfig *pLocalOemDataReqNewConfig;
+    vos_msg_t vosMessage = {0};
+
+    pLocalOemDataReqNewConfig =
+            vos_mem_malloc(sizeof(*pLocalOemDataReqNewConfig));
+
+    if (!pLocalOemDataReqNewConfig)
+    {
+        smsLog(pMac, LOGE,
+        "Failed to allocate memory for WDA_START_OEM_DATA_REQ_IND_NEW");
+        return;
+    }
+
+    vos_mem_zero(pLocalOemDataReqNewConfig, sizeof(tOemDataReqNewConfig));
+    vos_mem_copy(pLocalOemDataReqNewConfig, pOemDataReqNewConfig,
+                                            sizeof(tOemDataReqNewConfig));
+
+    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme))) {
+        /* Serialize the req through MC thread */
+        vosMessage.bodyptr = pLocalOemDataReqNewConfig;
+        vosMessage.type    = WDA_START_OEM_DATA_REQ_IND_NEW;
+        MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
+
+        if(VOS_STATUS_SUCCESS !=
+                          vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage)) {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s:"
+                 "Failed to post WDA_START_OEM_DATA_REQ_IND_NEW msg to WDA",
+                __func__);
+           vos_mem_free(pLocalOemDataReqNewConfig);
+        }
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    else
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s: "
+                "sme_AcquireGlobalLock error", __func__);
+        vos_mem_free(pLocalOemDataReqNewConfig);
+    }
+}
+
 #endif /*FEATURE_OEM_DATA_SUPPORT*/
 
 /*--------------------------------------------------------------------------
@@ -6845,6 +7185,7 @@
 
   --------------------------------------------------------------------------*/
 eHalStatus sme_CloseSession(tHalHandle hHal, tANI_U8 sessionId,
+                            tANI_BOOLEAN fSync,
                             tANI_U8 bPurgeSmeCmdList,
                             csrRoamSessionCloseCallback callback,
                             void *pContext)
@@ -6854,11 +7195,11 @@
 
    MTRACE(vos_trace(VOS_MODULE_ID_SME,
                  TRACE_CODE_SME_RX_HDD_CLOSE_SESSION, sessionId, 0));
-   status = sme_AcquireGlobalLock( &pMac->sme );
-   if ( HAL_STATUS_SUCCESS( status ) )
+   status = sme_AcquireGlobalLock(&pMac->sme);
+   if (HAL_STATUS_SUCCESS(status))
    {
-      status = csrRoamCloseSession( pMac, sessionId, FALSE, bPurgeSmeCmdList,
-                                    callback, pContext );
+      status = csrRoamCloseSession(pMac, sessionId, fSync, bPurgeSmeCmdList,
+                                    callback, pContext);
 
       sme_ReleaseGlobalLock( &pMac->sme );
    }
@@ -6866,19 +7207,6 @@
    return ( status );
 }
 
-eHalStatus sme_PurgeCmdList(tHalHandle hHal, tANI_U8 sessionId)
-{
-   eHalStatus status;
-   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-   status = sme_AcquireGlobalLock( &pMac->sme );
-   if ( HAL_STATUS_SUCCESS( status ) )
-   {
-      csrPurgeSmeCmdList( pMac, sessionId );
-      sme_ReleaseGlobalLock( &pMac->sme );
-   }
-   return ( status );
-}
-
 /* ---------------------------------------------------------------------------
 
     \fn sme_RoamUpdateAPWPSIE
@@ -7718,18 +8046,120 @@
     VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     vos_msg_t       vosMessage;
+    tpSirFWLoggingInitParam msg;
+
+    msg = vos_mem_malloc(sizeof(tSirFWLoggingInitParam));
+
+    if (NULL == msg)
+    {
+        smsLog(pMac, LOGE, FL("Failed to alloc mem of size %zu for msg"),
+            sizeof(*msg));
+        return eHAL_STATUS_FAILED_ALLOC;
+    }
+    *msg = *wlanFWLoggingInitParam;
 
     if ( eHAL_STATUS_SUCCESS == ( status =
                                         sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         /* serialize the req through MC thread */
-        vosMessage.bodyptr = wlanFWLoggingInitParam;
+        vosMessage.bodyptr = msg;
         vosMessage.type         = WDA_MGMT_LOGGING_INIT_REQ;
         MTRACE(vos_trace(VOS_MODULE_ID_SME,
                  TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
         vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage );
         if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
         {
+           vos_mem_free(msg);
+           status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    else
+    {
+        smsLog(pMac, LOGE, FL("sme_AcquireGlobalLock error"));
+        vos_mem_free(msg);
+    }
+    return(status);
+}
+/* ---------------------------------------------------------------------------
+
+  \fn    sme_StartRssiMonitoring
+
+  \brief
+    SME will pass this request to lower mac to start monitoring rssi range on
+    a bssid.
+
+  \param
+
+    hHal - The handle returned by macOpen.
+
+    tSirRssiMonitorReq req- depict the monitor req params.
+
+  \return eHalStatus
+
+--------------------------------------------------------------------------- */
+eHalStatus sme_StartRssiMonitoring( tHalHandle hHal,
+                            tSirRssiMonitorReq *req)
+{
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    vos_msg_t       vosMessage;
+
+    if ( eHAL_STATUS_SUCCESS == ( status =
+                                        sme_AcquireGlobalLock( &pMac->sme ) ) )
+    {
+        /* serialize the req through MC thread */
+        vosMessage.bodyptr = req;
+        vosMessage.type    = WDA_START_RSSI_MONITOR_REQ;
+        MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
+        vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage );
+        if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
+        {
+           status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    return(status);
+}
+
+/* ---------------------------------------------------------------------------
+
+  \fn    sme_StopRssiMonitoring
+
+  \brief
+    SME will pass this request to lower mac to stop monitoring rssi range on
+    a bssid.
+
+  \param
+
+    hHal - The handle returned by macOpen.
+
+    tSirRssiMonitorReq req- depict the monitor req params.
+
+  \return eHalStatus
+
+--------------------------------------------------------------------------- */
+eHalStatus sme_StopRssiMonitoring(tHalHandle hHal,
+                            tSirRssiMonitorReq *req)
+{
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    vos_msg_t       vosMessage;
+
+    if ( eHAL_STATUS_SUCCESS == ( status =
+                                        sme_AcquireGlobalLock( &pMac->sme ) ) )
+    {
+        /* serialize the req through MC thread */
+        vosMessage.bodyptr = req;
+        vosMessage.type    = WDA_STOP_RSSI_MONITOR_REQ;
+        MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
+        vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage );
+        if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
+        {
            status = eHAL_STATUS_FAILURE;
         }
         sme_ReleaseGlobalLock( &pMac->sme );
@@ -7911,6 +8341,21 @@
    return (sessionid);
 }
 
+tANI_U32 sme_get_sessionid_from_activeList(tpAniSirGlobal mac)
+{
+    tListElem *entry = NULL;
+    tSmeCmd *command = NULL;
+    tANI_U32  session_id = 0;
+
+    entry = csrLLPeekHead( &mac->sme.smeCmdActiveList, LL_ACCESS_LOCK );
+    if ( entry ) {
+        command = GET_BASE_ADDR( entry, tSmeCmd, Link );
+        session_id = command->sessionId;
+    }
+
+    return (session_id);
+}
+
 /* ---------------------------------------------------------------------------
 
     \fn sme_GetInfraOperationChannel
@@ -10598,13 +11043,12 @@
 #endif
 }
 
+
 /* ---------------------------------------------------------------------------
     \fn sme_IsFeatureSupportedByFW
-
     \brief  Check if a feature is enabled by FW
 
     \param  featEnumValue - Enumeration value from placeHolderInCapBitmap
-
     \- return 1/0 (TRUE/FALSE)
     -------------------------------------------------------------------------*/
 tANI_U8 sme_IsFeatureSupportedByFW(tANI_U8 featEnumValue)
@@ -11009,9 +11453,16 @@
     eHalStatus status    = eHAL_STATUS_SUCCESS;
     tCsrChannel ChannelList;
 
-    /* Flag to block driver scan type conversion from active to passive
-       and vice versa  */
-    pMac->fActiveScanOnDFSChannels = 1;
+    /*
+     * Set Flag to block driver scan type conversion from active to passive
+     * and vice versa in case if fEnableDFSChnlScan is
+     * DFS_CHNL_SCAN_ENABLED_ACTIVE
+     */
+    if (DFS_CHNL_SCAN_ENABLED_ACTIVE ==
+            pMac->scan.fEnableDFSChnlScan)
+        pMac->fActiveScanOnDFSChannels = 1;
+    else
+        pMac->fActiveScanOnDFSChannels = 0;
 
     ChannelList.numChannels = sizeof(ChannelList.channelList);
     status = sme_GetCfgValidChannels(hHal, (tANI_U8 *)ChannelList.channelList,
@@ -11594,15 +12045,173 @@
 
 }
 
+/**
+ * sme_AddPeriodicTxPtrn() - Add Periodic TX Pattern
+ * @hal: global hal handle
+ * @addPeriodicTxPtrnParams: request message
+ *
+ * Return: eHalStatus enumeration
+ */
+eHalStatus
+sme_AddPeriodicTxPtrn(tHalHandle hal,
+        struct sSirAddPeriodicTxPtrn *addPeriodicTxPtrnParams)
+{
+    eHalStatus status     = eHAL_STATUS_SUCCESS;
+    VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+    tpAniSirGlobal mac   = PMAC_STRUCT(hal);
+    struct sSirAddPeriodicTxPtrn *req_msg;
+    vos_msg_t msg;
+
+    smsLog(mac, LOG1, FL("enter"));
+
+    req_msg = vos_mem_malloc(sizeof(*req_msg));
+    if (!req_msg)
+    {
+        smsLog(mac, LOGE, FL("vos_mem_malloc failed"));
+        return eHAL_STATUS_FAILED_ALLOC;
+    }
+
+    *req_msg = *addPeriodicTxPtrnParams;
+
+    status = sme_AcquireGlobalLock(&mac->sme);
+    if (status != eHAL_STATUS_SUCCESS)
+    {
+        smsLog(mac, LOGE,
+                FL("sme_AcquireGlobalLock failed!(status=%d)"),
+                status);
+        vos_mem_free(req_msg);
+        return status;
+    }
+
+    /* Serialize the req through MC thread */
+    msg.bodyptr = req_msg;
+    msg.type    = WDA_ADD_PERIODIC_TX_PTRN_IND;
+    vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &msg);
+    if (!VOS_IS_STATUS_SUCCESS(vos_status))
+    {
+        smsLog(mac, LOGE,
+                FL("vos_mq_post_message failed!(err=%d)"),
+                vos_status);
+        vos_mem_free(req_msg);
+        status = eHAL_STATUS_FAILURE;
+    }
+    sme_ReleaseGlobalLock(&mac->sme);
+    return status;
+}
+
+
+/**
+ * sme_DelPeriodicTxPtrn() - Delete Periodic TX Pattern
+ * @hal: global hal handle
+ * @delPeriodicTxPtrnParams: request message
+ *
+ * Return: eHalStatus enumeration
+ */
+eHalStatus
+sme_DelPeriodicTxPtrn(tHalHandle hal,
+        struct sSirDelPeriodicTxPtrn *delPeriodicTxPtrnParams)
+{
+
+    eHalStatus status     = eHAL_STATUS_SUCCESS;
+    VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+    tpAniSirGlobal mac   = PMAC_STRUCT(hal);
+    struct sSirDelPeriodicTxPtrn *req_msg;
+    vos_msg_t msg;
+
+    smsLog(mac, LOG1, FL("enter"));
+
+    req_msg = vos_mem_malloc(sizeof(*req_msg));
+
+    if (!req_msg)
+    {
+        smsLog(mac, LOGE, FL("vos_mem_malloc failed"));
+        return eHAL_STATUS_FAILED_ALLOC;
+    }
+
+    *req_msg = *delPeriodicTxPtrnParams;
+
+    status = sme_AcquireGlobalLock(&mac->sme);
+    if (status != eHAL_STATUS_SUCCESS)
+    {
+        smsLog(mac, LOGE,
+                FL("sme_AcquireGlobalLock failed!(status=%d)"),
+                status);
+        vos_mem_free(req_msg);
+        return status;
+    }
+
+    /* Serialize the req through MC thread */
+    msg.bodyptr = req_msg;
+    msg.type    = WDA_DEL_PERIODIC_TX_PTRN_IND;
+    vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &msg);
+    if (!VOS_IS_STATUS_SUCCESS(vos_status))
+    {
+        smsLog(mac, LOGE,
+                FL("vos_mq_post_message failed!(err=%d)"),
+                vos_status);
+        vos_mem_free(req_msg);
+        status = eHAL_STATUS_FAILURE;
+    }
+    sme_ReleaseGlobalLock(&mac->sme);
+    return status;
+}
+
+#ifdef WLAN_FEATURE_RMC
 /* ---------------------------------------------------------------------------
-    \fn sme_AddPeriodicTxPtrn
-    \brief  API to Periodic TX Pattern Offload feature
+    \fn sme_EnableRMC
+    \brief  Used to enable RMC
+    setting will not persist over reboots
+    \param  hHal
+    \param  sessionId
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_EnableRMC(tHalHandle hHal, tANI_U32 sessionId)
+{
+    eHalStatus status = eHAL_STATUS_FAILURE;
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+
+    smsLog(pMac, LOG1, FL("enable RMC"));
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if (HAL_STATUS_SUCCESS(status))
+    {
+        status = csrEnableRMC(pMac, sessionId);
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    return status;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_DisableRMC
+    \brief  Used to disable RMC
+    setting will not persist over reboots
+    \param  hHal
+    \param  sessionId
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_DisableRMC(tHalHandle hHal, tANI_U32 sessionId)
+{
+   eHalStatus status = eHAL_STATUS_FAILURE;
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+
+   smsLog(pMac, LOG1, FL("disable RMC"));
+   status = sme_AcquireGlobalLock(&pMac->sme);
+   if (HAL_STATUS_SUCCESS(status))
+   {
+      status = csrDisableRMC(pMac, sessionId);
+      sme_ReleaseGlobalLock(&pMac->sme);
+   }
+   return status;
+}
+#endif /* WLAN_FEATURE_RMC */
+
+/* ---------------------------------------------------------------------------
+    \fn sme_SendRateUpdateInd
+    \brief  API to Update rate
     \param  hHal - The handle returned by macOpen
-    \param  addPeriodicTxPtrnParams - Pointer to the add pattern structure
+    \param  rateUpdateParams - Pointer to rate update params
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus sme_AddPeriodicTxPtrn(tHalHandle hHal, tSirAddPeriodicTxPtrn
-                                 *addPeriodicTxPtrnParams)
+eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateParams)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     eHalStatus status;
@@ -11610,15 +12219,15 @@
 
     if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme)))
     {
-        msg.type     = WDA_ADD_PERIODIC_TX_PTRN_IND;
-        msg.bodyptr  = addPeriodicTxPtrnParams;
+        msg.type     = WDA_RATE_UPDATE_IND;
+        msg.bodyptr  = rateUpdateParams;
 
         MTRACE(vos_trace(VOS_MODULE_ID_SME,
                  TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, msg.type));
         if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
         {
             VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,"%s: Not able "
-                       "to post WDA_ADD_PERIODIC_TX_PTRN_IND to WDA!",
+                       "to post WDA_SET_RMC_RATE_IND to WDA!",
                        __func__);
 
             sme_ReleaseGlobalLock(&pMac->sme);
@@ -11632,43 +12241,64 @@
     return status;
 }
 
+#ifdef WLAN_FEATURE_RMC
 /* ---------------------------------------------------------------------------
-    \fn sme_DelPeriodicTxPtrn
-    \brief  API to Periodic TX Pattern Offload feature
-    \param  hHal - The handle returned by macOpen
-    \param  delPeriodicTxPtrnParams - Pointer to the delete pattern structure
-    \return eHalStatus
-  ---------------------------------------------------------------------------*/
-eHalStatus sme_DelPeriodicTxPtrn(tHalHandle hHal, tSirDelPeriodicTxPtrn
-                                 *delPeriodicTxPtrnParams)
+    \fn sme_GetIBSSPeerInfo
+    \brief  Used to disable RMC
+    setting will not persist over reboots
+    \param  hHal
+    \param  ibssPeerInfoReq  multicast Group IP address
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_RequestIBSSPeerInfo(tHalHandle hHal, void *pUserData,
+                                            pIbssPeerInfoCb peerInfoCbk,
+                                            tANI_BOOLEAN allPeerInfoReqd,
+                                            tANI_U8 staIdx)
 {
-    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-    eHalStatus status;
-    vos_msg_t msg;
+   eHalStatus status = eHAL_STATUS_FAILURE;
+   VOS_STATUS vosStatus = VOS_STATUS_E_FAILURE;
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+   vos_msg_t vosMessage;
+   tSirIbssGetPeerInfoReqParams *pIbssInfoReqParams;
 
-    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme)))
-    {
-        msg.type     = WDA_DEL_PERIODIC_TX_PTRN_IND;
-        msg.bodyptr  = delPeriodicTxPtrnParams;
+   status = sme_AcquireGlobalLock(&pMac->sme);
+   if ( eHAL_STATUS_SUCCESS == status)
+   {
+       pMac->sme.peerInfoParams.peerInfoCbk = peerInfoCbk;
+       pMac->sme.peerInfoParams.pUserData = pUserData;
 
-        MTRACE(vos_trace(VOS_MODULE_ID_SME,
-                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, msg.type));
-        if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
-        {
-            VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,"%s: Not able "
-                       "to post WDA_DEL_PERIODIC_TX_PTRN_IND to WDA!",
-                       __func__);
+       pIbssInfoReqParams = (tSirIbssGetPeerInfoReqParams *)
+                        vos_mem_malloc(sizeof(tSirIbssGetPeerInfoReqParams));
+       if (NULL == pIbssInfoReqParams)
+       {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Not able to allocate memory for dhcp start", __func__);
+           sme_ReleaseGlobalLock( &pMac->sme );
+           return eHAL_STATUS_FAILURE;
+       }
+       pIbssInfoReqParams->allPeerInfoReqd = allPeerInfoReqd;
+       pIbssInfoReqParams->staIdx = staIdx;
 
-            sme_ReleaseGlobalLock(&pMac->sme);
-            return eHAL_STATUS_FAILURE;
-        }
+       vosMessage.type = WDA_GET_IBSS_PEER_INFO_REQ;
+       vosMessage.bodyptr = pIbssInfoReqParams;
+       vosMessage.reserved = 0;
 
-        sme_ReleaseGlobalLock(&pMac->sme);
-        return eHAL_STATUS_SUCCESS;
-    }
+       MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
+       vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage );
+       if ( VOS_STATUS_SUCCESS != vosStatus )
+       {
+          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                        "%s: Post WDA_GET_IBSS_PEER_INFO_REQ MSG failed", __func__);
+          vos_mem_free(pIbssInfoReqParams);
+          vosStatus = eHAL_STATUS_FAILURE;
+       }
+       sme_ReleaseGlobalLock( &pMac->sme );
+   }
 
-    return status;
+   return (vosStatus);
 }
+#endif
 
 void smeGetCommandQStatus( tHalHandle hHal )
 {
@@ -11746,43 +12376,6 @@
 }
 
 /* ---------------------------------------------------------------------------
-    \fn sme_SendRateUpdateInd
-    \brief  API to Update rate
-    \param  hHal - The handle returned by macOpen
-    \param  rateUpdateParams - Pointer to rate update params
-    \return eHalStatus
-  ---------------------------------------------------------------------------*/
-eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateParams)
-{
-    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-    eHalStatus status;
-    vos_msg_t msg;
-
-    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme)))
-    {
-        msg.type     = WDA_RATE_UPDATE_IND;
-        msg.bodyptr  = rateUpdateParams;
-
-        MTRACE(vos_trace(VOS_MODULE_ID_SME,
-                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, msg.type));
-        if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
-        {
-            VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,"%s: Not able "
-                       "to post WDA_SET_RMC_RATE_IND to WDA!",
-                       __func__);
-
-            sme_ReleaseGlobalLock(&pMac->sme);
-            return eHAL_STATUS_FAILURE;
-        }
-
-        sme_ReleaseGlobalLock(&pMac->sme);
-        return eHAL_STATUS_SUCCESS;
-    }
-
-    return status;
-}
-
-/* ---------------------------------------------------------------------------
     \fn sme_TriggerBatchScanResultInd
     \brief  API to trigger batch scan result indications from FW
     \param  hHal - The handle returned by macOpen.
@@ -11844,7 +12437,7 @@
 void activeListCmdTimeoutHandle(void *userData)
 {
     tHalHandle hHal= (tHalHandle) userData;
-    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     tListElem *pEntry;
     tSmeCmd *pTempCmd = NULL;
 
@@ -11865,6 +12458,9 @@
         csrLLCount(&pMac->sme.smeCmdActiveList) );
     smeGetCommandQStatus(hHal);
 
+    vos_state_info_dump_all();
+
+
     pEntry = csrLLPeekHead(&pMac->sme.smeCmdActiveList, LL_ACCESS_LOCK);
     if (pEntry) {
         pTempCmd = GET_BASE_ADDR(pEntry, tSmeCmd, Link);
@@ -11877,13 +12473,26 @@
         sme_AbortMacScan(hHal, pTempCmd->sessionId,
                                  eCSR_SCAN_ABORT_DEFAULT);
         return;
+    } else if (pTempCmd &&
+         (eSmeCommandRemainOnChannel == pTempCmd->command)) {
+         /* Ignore if ROC took more than 120 sec */
+         return;
     }
-
-    /* Initiate SSR to recover */
-    if (!(vos_isLoadUnloadInProgress() ||
-        vos_is_logp_in_progress(VOS_MODULE_ID_SME, NULL)))
+    if (pMac->roam.configParam.enableFatalEvent)
     {
-       vos_wlanRestart();
+       vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                  WLAN_LOG_INDICATOR_HOST_DRIVER,
+                  WLAN_LOG_REASON_SME_COMMAND_STUCK,
+                  FALSE, FALSE);
+    }
+    else
+    {
+       /* Initiate SSR to recover */
+       if (!(vos_isLoadUnloadInProgress() ||
+           vos_is_logp_in_progress(VOS_MODULE_ID_SME, NULL)))
+       {
+          vos_wlanRestart();
+       }
     }
 }
 
@@ -11923,6 +12532,35 @@
 }
 #endif /* FEATURE_WLAN_CH_AVOID */
 
+
+/**
+ * sme_set_rssi_threshold_breached_cb() - set rssi threshold breached callback
+ * @hal: global hal handle
+ * @cb: callback function pointer
+ *
+ * This function stores the rssi threshold breached callback function.
+ *
+ * Return: eHalStatus enumeration.
+ */
+eHalStatus sme_set_rssi_threshold_breached_cb(tHalHandle hal,
+                                void (*cb)(void *, struct rssi_breach_event *))
+{
+        eHalStatus status  = eHAL_STATUS_SUCCESS;
+        tpAniSirGlobal mac = PMAC_STRUCT(hal);
+
+        status = sme_AcquireGlobalLock(&mac->sme);
+        if (status != eHAL_STATUS_SUCCESS) {
+                smsLog(mac, LOGE,
+                        FL("sme_AcquireGlobalLock failed!(status=%d)"),
+                        status);
+                return status;
+        }
+
+        mac->sme.rssiThresholdBreachedCb = cb;
+        sme_ReleaseGlobalLock(&mac->sme);
+        return status;
+}
+
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
 
 /* ---------------------------------------------------------------------------
@@ -12156,13 +12794,6 @@
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
-        if (!CSR_IS_SESSION_VALID( pMac, sessionId ))
-        {
-            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                     "%s: Invalid session Id %u", __func__, sessionId);
-            sme_ReleaseGlobalLock( &pMac->sme);
-            return eHAL_STATUS_FAILURE;
-        }
         pCsrSession = CSR_GET_SESSION( pMac, sessionId );
 
         if (pCsrSession == NULL)
@@ -12173,6 +12804,14 @@
             return eHAL_STATUS_FAILURE;
         }
 
+        if (!CSR_IS_SESSION_VALID( pMac, sessionId ))
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                     "%s: Invalid session Id %u", __func__, sessionId);
+            sme_ReleaseGlobalLock( &pMac->sme);
+            return eHAL_STATUS_FAILURE;
+        }
+
         pSession = peFindSessionByBssid( pMac,
             pCsrSession->connectedProfile.bssid, &peSessionId );
 
@@ -12201,10 +12840,9 @@
                    if ((pSession->QosMapSet.dscp_range[i][0] == 255) &&
                                 (pSession->QosMapSet.dscp_range[i][1] == 255))
                    {
-                       dscpmapping[j]= 0;
                        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                       "%s: User Priority %d is not used in mapping",
-                                                             __func__, i);
+                               "%s: User Priority %d is not used in mapping",
+                                __func__, i);
                        break;
                    }
                    else
@@ -12260,11 +12898,11 @@
            vos_mem_copy(pMacSpoofCmd->u.macAddrSpoofCmd.macAddr,
                                                macaddr->bytes, VOS_MAC_ADDRESS_LEN);
 
-           status = csrQueueSmeCommand(pMac, pMacSpoofCmd, eANI_BOOLEAN_TRUE);
+           status = csrQueueSmeCommand(pMac, pMacSpoofCmd, false);
            if ( !HAL_STATUS_SUCCESS( status ) )
            {
                smsLog( pMac, LOGE, FL("fail to send msg status = %d\n"), status );
-               csrReleaseCommandScan(pMac, pMacSpoofCmd);
+               csrReleaseCommand(pMac, pMacSpoofCmd);
            }
        }
        else
@@ -12424,8 +13062,6 @@
 
     *pGetEXTScanCapabilitiesReq = *pReq;
 
-    MTRACE(vos_trace(VOS_MODULE_ID_SME,
-               TRACE_CODE_SME_RX_HDD_EXTSCAN_GET_CAPABILITIES, NO_SESSION, 0));
     if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme))) {
         /* Serialize the req through MC thread */
         vosMessage.bodyptr = pGetEXTScanCapabilitiesReq;
@@ -12679,99 +13315,117 @@
     return(status);
 }
 
-/* ---------------------------------------------------------------------------
-    \fn sme_SetSignificantChange
-    \brief  SME API to set significant change
-    \param  hHal
-    \param  pSetSignificantChangeReq: Extended Scan set significant change structure
-    \- return eHalStatus
-    -------------------------------------------------------------------------*/
-eHalStatus sme_SetSignificantChange (tHalHandle hHal,
-         tSirEXTScanSetSignificantChangeReqParams *pSetSignificantChangeReq)
+/**
+ * sme_set_ssid_hotlist() - Set the SSID hotlist
+ * @hal: SME handle
+ * @request: set ssid hotlist request
+ *
+ * Return: eHalStatus
+ */
+eHalStatus
+sme_set_ssid_hotlist(tHalHandle hal,
+             tSirEXTScanSetSsidHotListReqParams *request)
 {
-    eHalStatus status    = eHAL_STATUS_SUCCESS;
-    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
-    tpAniSirGlobal pMac  = PMAC_STRUCT(hHal);
-    vos_msg_t vosMessage;
-    tSirEXTScanSetSignificantChangeReqParams *pEXTScanSetSignificantReq;
+    eHalStatus status;
+    VOS_STATUS vstatus;
+    tpAniSirGlobal mac = PMAC_STRUCT(hal);
+    vos_msg_t vos_message;
+    tSirEXTScanSetSsidHotListReqParams *set_req;
+    int i;
 
-    pEXTScanSetSignificantReq = vos_mem_malloc(sizeof(*pEXTScanSetSignificantReq));
-    if ( !pEXTScanSetSignificantReq)
-    {
+    set_req = vos_mem_malloc(sizeof(*set_req));
+    if (!set_req) {
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                "%s: Not able to allocate memory for "
-                "WDA_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ",
+              "%s: Not able to allocate memory for WDA_EXTSCAN_SET_SSID_HOTLIST_REQ",
+              __func__);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    *set_req = *request;
+
+
+
+   for( i = 0; i < set_req->ssid_count; i++){
+
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+         "%s: SSID %s \n length: %d",
+              __func__, set_req->ssid[i].ssid.ssId, set_req->ssid[i].ssid.length);
+  }
+
+     MTRACE(vos_trace(VOS_MODULE_ID_SME,
+            TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_SSID_HOTLIST, NO_SESSION, 0));
+
+    status = sme_AcquireGlobalLock(&mac->sme);
+    if (eHAL_STATUS_SUCCESS == status) {
+        /* Serialize the req through MC thread */
+        vos_message.bodyptr = set_req;
+        vos_message.type    = WDA_EXTSCAN_SET_SSID_HOTLIST_REQ;
+        vstatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_message);
+        sme_ReleaseGlobalLock(&mac->sme);
+        if (!VOS_IS_STATUS_SUCCESS(vstatus)) {
+            vos_mem_free(set_req);
+            status = eHAL_STATUS_FAILURE;
+        }
+    } else {
+      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+            "%s: sme_AcquireGlobalLock error", __func__);
+        vos_mem_free(set_req);
+        status = eHAL_STATUS_FAILURE;
+    }
+    return status;
+}
+
+/**
+ * sme_reset_ssid_hotlist() - Set the SSID hotlist
+ * @hal: SME handle
+ * @request: reset ssid hotlist request
+ *
+ * Return: eHalStatus
+ */
+eHalStatus
+sme_reset_ssid_hotlist(tHalHandle hal,
+        tSirEXTScanResetSsidHotlistReqParams *request)
+{
+    eHalStatus status;
+    VOS_STATUS vstatus;
+    tpAniSirGlobal mac = PMAC_STRUCT(hal);
+    vos_msg_t vos_message;
+    tSirEXTScanResetSsidHotlistReqParams *set_req;
+
+    set_req = vos_mem_malloc(sizeof(*set_req));
+    if (!set_req) {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                "%s: Not able to allocate memory for WDA_EXTSCAN_SET_SSID_HOTLIST_REQ",
                 __func__);
         return eHAL_STATUS_FAILURE;
     }
 
-    *pEXTScanSetSignificantReq = *pSetSignificantChangeReq;
-
-
+    *set_req = *request;
 
     MTRACE(vos_trace(VOS_MODULE_ID_SME,
-           TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_SIGNF_CHANGE, NO_SESSION, 0));
-    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme))) {
+            TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_SSID_HOTLIST, NO_SESSION, 0));
+
+    status = sme_AcquireGlobalLock(&mac->sme);
+    if (eHAL_STATUS_SUCCESS == status) {
         /* Serialize the req through MC thread */
-        vosMessage.bodyptr = pEXTScanSetSignificantReq;
-        vosMessage.type    = WDA_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ;
-        MTRACE(vos_trace(VOS_MODULE_ID_SME,
-                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
-        vosStatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage);
-        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
-           status = eHAL_STATUS_FAILURE;
-
-        sme_ReleaseGlobalLock(&pMac->sme);
-    }
-    return(status);
-}
-
-/* ---------------------------------------------------------------------------
-    \fn sme_ResetSignificantChange
-    \brief  SME API to reset significant change
-    \param  hHal
-    \param  pResetReq: Extended Scan reset significant change structure
-    \- return eHalStatus
-    -------------------------------------------------------------------------*/
-eHalStatus sme_ResetSignificantChange (tHalHandle hHal,
-                          tSirEXTScanResetSignificantChangeReqParams *pResetReq)
-{
-    eHalStatus status    = eHAL_STATUS_SUCCESS;
-    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
-    tpAniSirGlobal pMac  = PMAC_STRUCT(hHal);
-    vos_msg_t vosMessage;
-    tSirEXTScanResetSignificantChangeReqParams *pEXTScanResetSignificantReq;
-
-    pEXTScanResetSignificantReq =
-        vos_mem_malloc(sizeof(*pEXTScanResetSignificantReq));
-    if ( !pEXTScanResetSignificantReq)
-    {
+        vos_message.bodyptr = set_req;
+        vos_message.type    = WDA_EXTSCAN_RESET_SSID_HOTLIST_REQ;
+        vstatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_message);
+        sme_ReleaseGlobalLock(&mac->sme);
+        if (!VOS_IS_STATUS_SUCCESS(vstatus)) {
+            vos_mem_free(set_req);
+            status = eHAL_STATUS_FAILURE;
+        }
+    } else {
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                "%s: Not able to allocate memory for "
-                "WDA_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ",
-                __func__);
-        return eHAL_STATUS_FAILURE;
+                 "%s: sme_AcquireGlobalLock error", __func__);
+        vos_mem_free(set_req);
+        status = eHAL_STATUS_FAILURE;
     }
-
-    *pEXTScanResetSignificantReq = *pResetReq;
-
-    MTRACE(vos_trace(VOS_MODULE_ID_SME,
-           TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_SIGNF_CHANGE, NO_SESSION, 0));
-    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme))) {
-        /* Serialize the req through MC thread */
-        vosMessage.bodyptr = pEXTScanResetSignificantReq;
-        vosMessage.type    = WDA_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ;
-        MTRACE(vos_trace(VOS_MODULE_ID_SME,
-                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
-        vosStatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage);
-        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
-           status = eHAL_STATUS_FAILURE;
-
-        sme_ReleaseGlobalLock(&pMac->sme);
-    }
-    return(status);
+    return status;
 }
 
+
 /* ---------------------------------------------------------------------------
     \fn sme_getCachedResults
     \brief  SME API to get cached results
@@ -12845,11 +13499,72 @@
     return(status);
 }
 
+#ifdef FEATURE_OEM_DATA_SUPPORT
+eHalStatus sme_OemDataRegisterCallback (tHalHandle hHal,
+                void (*pOemDataIndCb)(void *, const tANI_U16, void *, tANI_U32),
+                          void *callbackContext)
+{
+    eHalStatus status    = eHAL_STATUS_SUCCESS;
+    tpAniSirGlobal pMac  = PMAC_STRUCT(hHal);
+
+    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme))) {
+        pMac->sme.pOemDataIndCb = pOemDataIndCb;
+        pMac->sme.pOemDataCallbackContext = callbackContext;
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    return(status);
+}
+#endif
+
 void sme_SetMiracastMode (tHalHandle hHal,tANI_U8 mode)
 {
     tpAniSirGlobal pMac  = PMAC_STRUCT(hHal);
+    eHalStatus status    = eHAL_STATUS_SUCCESS;
+    vos_msg_t vosMessage = {0};
+    tSirHighPriorityDataInfoInd *phighPriorityDataInfo;
 
     pMac->miracast_mode = mode;
+
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+              "%s: miracast_mode: %d", __func__, mode);
+
+    phighPriorityDataInfo =
+            vos_mem_malloc(sizeof(*phighPriorityDataInfo));
+    if ( !phighPriorityDataInfo)
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s:"
+        "Failed to allocate memory for WDA_HIGH_PRIORITY_DATA_INFO_IND",
+                  __func__);
+        return;
+    }
+
+    if (mode)
+        phighPriorityDataInfo->pause = TRUE;
+    else
+        phighPriorityDataInfo->pause = FALSE;
+
+    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme))) {
+        /* Serialize the req through MC thread */
+        vosMessage.bodyptr = phighPriorityDataInfo;
+        vosMessage.type    = WDA_HIGH_PRIORITY_DATA_INFO_IND;
+        MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, vosMessage.type));
+
+        if(VOS_STATUS_SUCCESS !=
+                          vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage)) {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s:"
+                 "Failed to post WDA_HIGH_PRIORITY_DATA_INFO_IND msg to WDA",
+                __func__);
+            vos_mem_free(phighPriorityDataInfo);
+        }
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    else
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s: "
+                "sme_AcquireGlobalLock error", __func__);
+        vos_mem_free(phighPriorityDataInfo);
+    }
 }
 #endif /* WLAN_FEATURE_EXTSCAN */
 
@@ -13238,7 +13953,8 @@
        WDA else return eHAL_STATUS_FAILURE
     -------------------------------------------------------------------------*/
 eHalStatus sme_fatal_event_logs_req(tHalHandle hHal, tANI_U32 is_fatal,
-                               tANI_U32 indicator, tANI_U32 reason_code)
+                               tANI_U32 indicator, tANI_U32 reason_code,
+                               tANI_BOOLEAN dump_vos_trace)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     vos_msg_t msg;
@@ -13246,16 +13962,28 @@
     VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
     tpSirFatalEventLogsReqParam pFatalEventLogsReqParams;
 
+    /* Dump last 500 VosTrace */
+    if (dump_vos_trace)
+       vosTraceDumpAll(pMac, 0, 0, 500, 0);
+
+    if (WLAN_LOG_INDICATOR_HOST_ONLY == indicator)
+    {
+      vos_flush_host_logs_for_fatal();
+      return VOS_STATUS_SUCCESS;
+    }
+
     if ( eHAL_STATUS_SUCCESS ==  sme_AcquireGlobalLock( &pMac->sme ))
     {
-        pFatalEventLogsReqParams = vos_mem_malloc(sizeof(tSirFatalEventLogsReqParam));
+        pFatalEventLogsReqParams =
+                            vos_mem_malloc(sizeof(*pFatalEventLogsReqParams));
         if(NULL == pFatalEventLogsReqParams)
         {
             smsLog(pMac, LOGE,
                  FL("vos_mem_alloc failed "));
             return eHAL_STATUS_FAILED_ALLOC;
         }
-        vos_mem_set(pFatalEventLogsReqParams, sizeof(pFatalEventLogsReqParams), 0);
+        vos_mem_set(pFatalEventLogsReqParams,
+                    sizeof(*pFatalEventLogsReqParams), 0);
         pFatalEventLogsReqParams->reason_code = reason_code;
 
         vos_mem_zero(&msg, sizeof(vos_msg_t));
@@ -13284,7 +14012,8 @@
  *
  * Return: tANI_BOOLEAN.
  */
-tANI_BOOLEAN sme_handleSetFccChannel(tHalHandle hHal, tANI_U8 fcc_constraint)
+tANI_BOOLEAN sme_handleSetFccChannel(tHalHandle hHal, tANI_U8 fcc_constraint,
+                                     v_U32_t scan_pending)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
@@ -13294,10 +14023,14 @@
     if (eHAL_STATUS_SUCCESS == status &&
                  (!sme_Is11dSupported(hHal)) )
     {
-           pMac->scan.fcc_constraint = !fcc_constraint;
-           /* update the channel list to the firmware */
-           csrUpdateFCCChannelList(pMac);
+        pMac->scan.fcc_constraint = !fcc_constraint;
 
+        if (scan_pending == TRUE) {
+            pMac->scan.defer_update_channel_list = true;
+        } else {
+            /* update the channel list to the firmware */
+            csrUpdateChannelList(pMac);
+        }
     }
 
         sme_ReleaseGlobalLock(&pMac->sme);
@@ -13352,3 +14085,273 @@
     status = palSendMBMessage( pMac->hHdd, pMsg );
     return status;
 }
+
+
+/**
+ * sme_FwMemDumpReq() - Send Fwr mem Dump Request
+ * @hal: HAL pointer
+ *
+ * Return: eHalStatus
+ */
+
+eHalStatus sme_FwMemDumpReq(tHalHandle hHal, tAniFwrDumpReq *recv_req)
+{
+
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    vos_msg_t msg;
+    tAniFwrDumpReq * send_req;
+
+    send_req = vos_mem_malloc(sizeof(*send_req));
+    if(!send_req) {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+            FL("Mem allo failed for FW_MEM_DUMP"));
+        return eHAL_STATUS_FAILURE;
+    }
+
+    send_req->fwMemDumpReqCallback = recv_req->fwMemDumpReqCallback;
+    send_req->fwMemDumpReqContext = recv_req->fwMemDumpReqContext;
+
+    if (eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock(&pMac->sme))
+    {
+        msg.bodyptr = send_req;
+        msg.type = WDA_FW_MEM_DUMP_REQ;
+        msg.reserved = 0;
+
+        if (VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MODULE_ID_WDA, &msg))
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+            FL("Not able to post WDA_FW_MEM_DUMP"));
+            vos_mem_free(send_req);
+            status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    else
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+        FL("Failed to acquire SME Global Lock"));
+        vos_mem_free(send_req);
+        status = eHAL_STATUS_FAILURE;
+    }
+
+    return status;
+}
+
+eHalStatus sme_set_wificonfig_params(tHalHandle hHal, tSetWifiConfigParams *req)
+{
+   eHalStatus status = eHAL_STATUS_SUCCESS;
+   tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+   vos_msg_t    msg;
+
+   status = sme_AcquireGlobalLock(&pMac->sme);
+
+   if (eHAL_STATUS_SUCCESS == status){
+
+       /* serialize the req through MC thread */
+       msg.type = WDA_WIFI_CONFIG_REQ;
+       msg.reserved = 0;
+       msg.bodyptr = req;
+
+       MTRACE(vos_trace(VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, msg.type));
+
+       if(VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MODULE_ID_WDA, &msg))
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s: "
+                   "Not able to post SIR_HAL_WIFI_CONFIG_PARAMS message to HAL", __func__);
+            status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+   }
+   else
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s: "
+                "sme_AcquireGlobalLock error", __func__);
+    }
+    return status;
+}
+
+eHalStatus sme_getRegInfo(tHalHandle hHal, tANI_U8 chanId,
+                         tANI_U32  *regInfo1, tANI_U32  *regInfo2)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    eHalStatus status;
+    tANI_U8 i;
+    eAniBoolean found = false;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    *regInfo1 = 0;
+    *regInfo2 = 0;
+    if (HAL_STATUS_SUCCESS(status))
+    {
+        for (i = 0 ; i < WNI_CFG_VALID_CHANNEL_LIST_LEN; i++)
+        {
+            if (pMac->scan.defaultPowerTable[i].chanId == chanId)
+            {
+                SME_SET_CHANNEL_REG_POWER(*regInfo1,
+                                          pMac->scan.defaultPowerTable[i].pwr);
+
+                SME_SET_CHANNEL_MAX_TX_POWER(*regInfo2,
+                                          pMac->scan.defaultPowerTable[i].pwr);
+
+
+                found = true;
+                break;
+            }
+        }
+
+        if (!found)
+            status = eHAL_STATUS_FAILURE;
+
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    return status;
+}
+
+eHalStatus sme_GetCurrentAntennaIndex(tHalHandle hHal,
+                                     tCsrAntennaIndexCallback callback,
+                                     void *pContext, tANI_U8 sessionId)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tSirAntennaDiversitySelectionReq *pMsg;
+    tCsrRoamSession *pSession;
+    VOS_STATUS vosStatus = VOS_STATUS_E_FAILURE;
+    vos_msg_t vosMessage;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if (HAL_STATUS_SUCCESS(status))
+    {
+        pSession = CSR_GET_SESSION( pMac, sessionId );
+        if (!pSession)
+        {
+            smsLog(pMac, LOGE, FL("session %d not found"), sessionId);
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_FAILURE;
+        }
+
+        pMsg = (tSirAntennaDiversitySelectionReq*)vos_mem_malloc(sizeof(*pMsg));
+        if (NULL == pMsg)
+        {
+            smsLog(pMac, LOGE, FL("failed to allocated memory"));
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_FAILURE;
+        }
+        pMsg->callback = callback;
+        pMsg->data = pContext;
+
+        vosMessage.type = WDA_ANTENNA_DIVERSITY_SELECTION_REQ;
+        vosMessage.bodyptr = pMsg;
+        vosMessage.reserved = 0;
+
+        vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage );
+        if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
+        {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                     "%s: Failed to post message to WDA", __func__);
+           vos_mem_free(pMsg);
+           sme_ReleaseGlobalLock( &pMac->sme );
+           return eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme);
+        return eHAL_STATUS_SUCCESS;
+    }
+    return eHAL_STATUS_FAILURE;
+}
+
+eHalStatus sme_setBcnMissPenaltyCount(tHalHandle hHal,
+                            tModifyRoamParamsReqParams *pModifyRoamReqParams)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    VOS_STATUS vosStatus;
+    tModifyRoamParamsReqParams *pMsg;
+    vos_msg_t msg;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if (HAL_STATUS_SUCCESS(status))
+    {
+        pMsg = (tModifyRoamParamsReqParams*)vos_mem_malloc(sizeof(*pMsg));
+        if (NULL == pMsg)
+        {
+            smsLog(pMac, LOGE, FL("failed to allocated memory"));
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_FAILURE;
+        }
+        if (NULL == pModifyRoamReqParams)
+        {
+            smsLog(pMac, LOGE, FL("Invalid memory"));
+            vos_mem_free(pMsg);
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_FAILURE;
+        }
+        pMsg->param = pModifyRoamReqParams->param;
+        pMsg->value = pModifyRoamReqParams->value;
+        vos_mem_zero(&msg, sizeof(vos_msg_t));
+        msg.type = WDA_MODIFY_ROAM_PARAMS_IND;
+        msg.reserved = 0;
+        msg.bodyptr = pMsg;
+        vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &msg);
+        if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
+        {
+           status = eHAL_STATUS_FAILURE;
+           vos_mem_free(pMsg);
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+        return status;
+    }
+
+    return eHAL_STATUS_FAILURE;
+}
+
+/**
+ * sme_remove_bssid_from_scan_list() - wrapper to remove the bssid from
+ * scan list
+ * @hal: hal context.
+ * @bssid: bssid to be removed
+ *
+ * This function remove the given bssid from scan list.
+ *
+ * Return: hal status.
+ */
+eHalStatus sme_remove_bssid_from_scan_list(tHalHandle hal,
+    tSirMacAddr bssid)
+{
+    eHalStatus status = eHAL_STATUS_FAILURE;
+    tpAniSirGlobal pMac = PMAC_STRUCT(hal);
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if (HAL_STATUS_SUCCESS(status)) {
+        csr_remove_bssid_from_scan_list(pMac, bssid);
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+
+    return status;
+}
+
+/**
+ * sme_set_mgmt_frm_via_wq5() - Set INI params sendMgmtPktViaWQ5 to WDA.
+ * @hal: HAL pointer
+ * @sendMgmtPktViaWQ5: INI params to enable/disable sending mgmt pkt via WQ5.
+ *
+ * Return: void
+ */
+void sme_set_mgmt_frm_via_wq5(tHalHandle hHal, tANI_BOOLEAN sendMgmtPktViaWQ5)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    eHalStatus     status = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if (HAL_STATUS_SUCCESS(status))
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                "sendMgmtPktViaWQ5 is %d", sendMgmtPktViaWQ5);
+        /* not serializing this messsage, as this is only going
+         * to set a variable in WDA/WDI
+         */
+        WDA_SetMgmtPktViaWQ5(sendMgmtPktViaWQ5);
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    return;
+}
diff --git a/wlan/prima/CORE/SME/src/sme_common/sme_Trace.c b/wlan/prima/CORE/SME/src/sme_common/sme_Trace.c
index e36cf89..ab2f2bf 100644
--- a/wlan/prima/CORE/SME/src/sme_common/sme_Trace.c
+++ b/wlan/prima/CORE/SME/src/sme_common/sme_Trace.c
@@ -38,6 +38,8 @@
 #include "macTrace.h"
 #include "sme_Trace.h"
 #include "smeInternal.h"
+#include "smeInside.h"
+
 #ifndef SME_TRACE_RECORD
 void smeTraceInit(tpAniSirGlobal pMac)
 {
@@ -147,13 +149,10 @@
 #ifdef FEATURE_WLAN_LPHB
         CASE_RETURN_STRING(TRACE_CODE_SME_RX_HDD_LPHB_CONFIG_REQ);
 #endif /* FEATURE_WLAN_LPHB */
-        CASE_RETURN_STRING(TRACE_CODE_SME_RX_HDD_EXTSCAN_GET_CAPABILITIES);
         CASE_RETURN_STRING(TRACE_CODE_SME_RX_HDD_EXTSCAN_START);
         CASE_RETURN_STRING(TRACE_CODE_SME_RX_HDD_EXTSCAN_STOP);
         CASE_RETURN_STRING(TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_BSS_HOTLIST);
         CASE_RETURN_STRING(TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_BSS_HOTLIST);
-        CASE_RETURN_STRING(TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_SIGNF_CHANGE);
-        CASE_RETURN_STRING(TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_SIGNF_CHANGE);
         CASE_RETURN_STRING(TRACE_CODE_SME_RX_HDD_EXTSCAN_GET_CACHED_RESULTS);
         default:
             return( "UNKNOWN" );
@@ -218,7 +217,7 @@
                  smeTraceGetCommandString(pRecord->data), pRecord->data);
             break;
         case TRACE_CODE_SME_TX_WDA_MSG:
-           smsLog(pMac, LOG1, "%04d %012u S%d %-14s %-30s(0x%x)",
+            smsLog(pMac, LOG1, "%04d %012u S%d %-14s %-30s(0x%x)",
                 recIndex, pRecord->time, pRecord->session, "TX WDA Msg:",
                 macTraceGetWdaMsgString((tANI_U16)pRecord->data),
                                               pRecord->data);
@@ -241,4 +240,50 @@
 {
     vosTraceRegister(VOS_MODULE_ID_SME, (tpvosTraceCb)&smeTraceDump);
 }
+
+/**
+ * sme_state_info_dump() - prints state information of sme layer
+ */
+static void sme_state_info_dump(void)
+{
+    tANI_U32  session_id = 0;
+    tHalHandle hal;
+    tpAniSirGlobal mac;
+    v_CONTEXT_t vos_ctx_ptr;
+
+    /* get the global voss context */
+    vos_ctx_ptr = vos_get_global_context(VOS_MODULE_ID_VOSS, NULL);
+
+    if (NULL == vos_ctx_ptr) {
+        VOS_ASSERT(0);
+        return;
+    }
+
+    hal = vos_get_context(VOS_MODULE_ID_SME, vos_ctx_ptr);
+    if (NULL == hal) {
+        VOS_ASSERT(0);
+        return;
+    }
+
+    mac = PMAC_STRUCT(hal);
+
+    session_id = sme_get_sessionid_from_activeList(mac);
+    smsLog( mac, LOG1, FL(" SessionId %d for active command"), session_id);
+
+    smsLog(mac, LOG1, FL("NeighborRoamState: %d RoamState: %d"
+           "RoamSubState: %d ConnectState: %d pmcState: %d PmmState: %d"),
+           mac->roam.neighborRoamInfo.neighborRoamState,
+           mac->roam.curState[session_id], mac->roam.curSubState[session_id],
+           mac->roam.roamSession[session_id].connectState, mac->pmc.pmcState,
+           mac->pmm.gPmmState);
+}
+
+/**
+ * sme_register_debug_callback() - registration function sme layer
+ * to print sme state information
+ */
+void sme_register_debug_callback()
+{
+    vos_register_debug_callback(VOS_MODULE_ID_SME, &sme_state_info_dump);
+}
 #endif
diff --git a/wlan/prima/CORE/SVC/external/wlan_nlink_common.h b/wlan/prima/CORE/SVC/external/wlan_nlink_common.h
index 4bd5698..6ffcee6 100644
--- a/wlan/prima/CORE/SVC/external/wlan_nlink_common.h
+++ b/wlan/prima/CORE/SVC/external/wlan_nlink_common.h
@@ -89,6 +89,7 @@
 #define WLAN_SVC_IFACE_NUM_QUEUES      6
 
 #define WLAN_SVC_SAP_RESTART_IND 0x108
+#define WLAN_SVC_WLAN_TP_IND     0x109
 // Event data for WLAN_BTC_QUERY_STATE_RSP & WLAN_STA_ASSOC_DONE_IND
 typedef struct
 {
@@ -101,6 +102,7 @@
    ANI_NL_MSG_PUMAC = ANI_NL_MSG_BASE + 0x01,// PTT Socket App
    ANI_NL_MSG_PTT   = ANI_NL_MSG_BASE + 0x07,// Quarky GUI
    WLAN_NL_MSG_BTC,
+   WLAN_NL_MSG_OEM,
    WLAN_NL_MSG_SVC  = ANI_NL_MSG_BASE + 0x0A,
    ANI_NL_MSG_LOG   = ANI_NL_MSG_BASE + 0x0C,
    ANI_NL_MSG_MAX  
diff --git a/wlan/prima/CORE/SVC/inc/wlan_logging_sock_svc.h b/wlan/prima/CORE/SVC/inc/wlan_logging_sock_svc.h
index 52d1959..4ddd24b 100644
--- a/wlan/prima/CORE/SVC/inc/wlan_logging_sock_svc.h
+++ b/wlan/prima/CORE/SVC/inc/wlan_logging_sock_svc.h
@@ -42,20 +42,23 @@
 
 int wlan_logging_sock_init_svc(void);
 int wlan_logging_sock_deinit_svc(void);
-int wlan_logging_sock_activate_svc(int log_fe_to_console, int num_buf);
 int wlan_logging_flush_pkt_queue(void);
 int wlan_logging_sock_deactivate_svc(void);
 int wlan_log_to_user(VOS_TRACE_LEVEL log_level, char *to_be_sent, int length);
 int wlan_queue_logpkt_for_app(vos_pkt_t *pPacket, uint32 pkt_type);
 void wlan_process_done_indication(uint8 type, uint32 reason_code);
+int wlan_logging_sock_activate_svc(int log_fe_to_console, int num_buf,
+                             int pkt_stats_enabled, int pkt_stats_buff);
+void wlan_flush_host_logs_for_fatal(void);
 
 void wlan_init_log_completion(void);
 int wlan_set_log_completion(uint32 is_fatal,
                             uint32 indicator,
                             uint32 reason_code);
-void wlan_get_log_completion(uint32 *is_fatal,
+void wlan_get_log_and_reset_completion(uint32 *is_fatal,
                              uint32 *indicator,
-                             uint32 *reason_code);
+                             uint32 *reason_code,
+                             bool reset);
 bool wlan_is_log_report_in_progress(void);
 void wlan_reset_log_report_in_progress(void);
 
@@ -63,5 +66,42 @@
 
 void wlan_logging_set_log_level(void);
 
+#define FW_MEM_DUMP_MAGIC 0x3C3A2D44
+
+enum FW_MEM_DUMP_STATE{
+       FW_MEM_DUMP_IDLE,
+       FW_MEM_DUMP_READ_IN_PROGRESS,
+       FW_MEM_DUMP_WRITE_IN_PROGRESS,
+       FW_MEM_DUMP_WRITE_DONE,
+};
+int wlan_fwr_mem_dump_buffer_allocation(void);
+bool wlan_fwr_mem_dump_test_and_set_write_allowed_bit(void);
+bool wlan_fwr_mem_dump_test_and_set_read_allowed_bit(void);
+void wlan_set_fwr_mem_dump_state(enum FW_MEM_DUMP_STATE fw_mem_dump_state);
+void wlan_set_svc_fw_mem_dump_req_cb(void*,void*);
+size_t wlan_fwr_mem_dump_fsread_handler(char __user *buf, size_t count, loff_t *pos,loff_t* bytes_left);
+void wlan_indicate_mem_dump_complete(bool );
+void wlan_store_fwr_mem_dump_size(uint32 dump_size);
+void wlan_free_fwr_mem_dump_buffer(void);
+
 bool wlan_is_logger_thread(int threadId);
+int wlan_pkt_stats_to_user(void *perPktStat);
+void wlan_disable_and_flush_pkt_stats(void);
+ void wlan_fillTxStruct(void *pktStat);
+ bool wlan_isPktStatsEnabled(void);
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+void wlan_report_log_completion(uint32 is_fatal,
+      uint32 indicator,
+      uint32 reason_code);
+#else
+static inline void wlan_report_log_completion(uint32 is_fatal,
+        uint32 indicator,
+        uint32 reason_code)
+{
+    return;
+}
+
+#endif
+
+
 #endif /* WLAN_LOGGING_SOCK_SVC_H */
diff --git a/wlan/prima/CORE/SVC/inc/wlan_ptt_sock_svc.h b/wlan/prima/CORE/SVC/inc/wlan_ptt_sock_svc.h
index f5eddb5..2f2bac6 100644
--- a/wlan/prima/CORE/SVC/inc/wlan_ptt_sock_svc.h
+++ b/wlan/prima/CORE/SVC/inc/wlan_ptt_sock_svc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -61,6 +61,12 @@
 #define ANI_DRIVER_MSG_START         0x0001
 #define ANI_MSG_APP_REG_REQ         (ANI_DRIVER_MSG_START + 0)
 #define ANI_MSG_APP_REG_RSP         (ANI_DRIVER_MSG_START + 1)
+#define ANI_MSG_OEM_DATA_REQ        (ANI_DRIVER_MSG_START + 2)
+#define ANI_MSG_OEM_DATA_RSP        (ANI_DRIVER_MSG_START + 3)
+#define ANI_MSG_CHANNEL_INFO_REQ    (ANI_DRIVER_MSG_START + 4)
+#define ANI_MSG_CHANNEL_INFO_RSP    (ANI_DRIVER_MSG_START + 5)
+#define ANI_MSG_OEM_ERROR           (ANI_DRIVER_MSG_START + 6)
+
 #define ANI_MAX_RADIOS      3
 #define ANI_NL_MSG_OK       0
 #define ANI_NL_MSG_ERROR    -1
@@ -89,6 +95,7 @@
  * Payload     : LEN_PAYLOAD bytes
 */
 int ptt_sock_activate_svc(void *pAdapter);
+int ptt_sock_deactivate_svc(hdd_context_t *pHddCtx);
 int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid, int flag);
 
 /*
diff --git a/wlan/prima/CORE/SVC/src/logging/wlan_logging_sock_svc.c b/wlan/prima/CORE/SVC/src/logging/wlan_logging_sock_svc.c
index cdfeade..b19bd42 100644
--- a/wlan/prima/CORE/SVC/src/logging/wlan_logging_sock_svc.c
+++ b/wlan/prima/CORE/SVC/src/logging/wlan_logging_sock_svc.c
@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+* Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
 *
 * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
 *
@@ -44,6 +44,7 @@
 #include <asm/arch_timer.h>
 #include <vos_utils.h>
 
+
 #define LOGGING_TRACE(level, args...) \
 		VOS_TRACE(VOS_MODULE_ID_SVC, level, ## args)
 
@@ -55,17 +56,30 @@
 #define ANI_NL_MSG_FW_LOG_PKT_TYPE 92
 #define INVALID_PID -1
 
+#define MAX_PKTSTATS_LOG_LENGTH 2048
 #define MAX_LOGMSG_LENGTH 4096
 #define LOGGER_MGMT_DATA_PKT_POST        0x001
 #define HOST_LOG_POST                    0x002
 #define LOGGER_FW_LOG_PKT_POST           0x003
 #define LOGGER_FATAL_EVENT_POST          0x004
+#define LOGGER_FW_MEM_DUMP_PKT_POST      0x005
+#define LOGGER_FW_MEM_DUMP_PKT_POST_DONE 0x006
+#define HOST_PKT_STATS_POST              0x008
+
 
 #define LOGGER_MAX_DATA_MGMT_PKT_Q_LEN   (8)
 #define LOGGER_MAX_FW_LOG_PKT_Q_LEN   (16)
+#define LOGGER_MAX_FW_MEM_DUMP_PKT_Q_LEN   (32)
+
 
 #define NL_BDCAST_RATELIMIT_INTERVAL (5*HZ)
 #define NL_BDCAST_RATELIMIT_BURST    1
+#define PTT_MSG_DIAG_CMDS_TYPE   0x5050
+#define DIAG_TYPE_LOGS   1
+
+/* Limit FW initiated fatal event to ms */
+#define LIMIT_FW_FATAL_EVENT_MS   10000
+
 
 /* Qtimer Frequency */
 #define QTIMER_FREQ      19200000
@@ -93,6 +107,41 @@
 	uint32_t reason_code;
 	bool is_report_in_progress;
 	bool is_flush_complete;
+	uint32_t last_fw_bug_reason;
+	unsigned long last_fw_bug_timestamp;
+};
+
+struct fw_mem_dump_logging{
+	//It will hold the starting point of mem dump buffer
+	uint8 *fw_dump_start_loc;
+	//It will hold the current loc to tell how much data filled
+	uint8 *fw_dump_current_loc;
+	uint32 fw_dump_max_size;
+	vos_pkt_t *fw_mem_dump_queue;
+	/* Holds number of pkts in fw log vos pkt queue */
+	unsigned int fw_mem_dump_pkt_qcnt;
+	/* Number of dropped pkts for fw dump */
+	unsigned int fw_mem_dump_pkt_drop_cnt;
+	/* Lock to synchronize of queue/dequeue of pkts in fw log pkt queue */
+	spinlock_t fw_mem_dump_lock;
+	/* Fw memory dump status */
+	enum FW_MEM_DUMP_STATE fw_mem_dump_status;
+	/* storage for HDD callback which completes fw mem dump request */
+	void * svc_fw_mem_dump_req_cb;
+	/* storage for HDD callback which completes fw mem dump request arg */
+	void * svc_fw_mem_dump_req_cb_arg;
+};
+
+struct pkt_stats_msg {
+	struct list_head node;
+	/* indicates the current filled log length in pktlogbuf */
+	struct sk_buff *skb;
+};
+
+struct perPktStatsInfo{
+    v_U32_t lastTxRate;           // 802.11 data rate at which the last data frame is transmitted.
+    v_U32_t  txAvgRetry;           // Average number of retries per 10 packets.
+    v_S7_t  avgRssi;              // Average of the Beacon RSSI.
 };
 
 struct wlan_logging {
@@ -141,10 +190,22 @@
 	/* data structure for log complete event*/
 	struct logger_log_complete log_complete;
 	spinlock_t bug_report_lock;
+	struct fw_mem_dump_logging fw_mem_dump_ctx;
+        int pkt_stat_num_buf;
+	unsigned int pkt_stat_drop_cnt;
+	struct list_head pkt_stat_free_list;
+	struct list_head pkt_stat_filled_list;
+	struct pkt_stats_msg *pkt_stats_pcur_node;
+	/* Index of the messages sent to userspace */
+	unsigned int pkt_stats_msg_idx;
+	bool pkt_stats_enabled;
+	spinlock_t pkt_stats_lock;
+	struct perPktStatsInfo txPktStatsInfo;
 };
 
 static struct wlan_logging gwlan_logging;
 static struct log_msg *gplog_msg;
+static struct pkt_stats_msg *pkt_stats_buffers;
 
 /* PID of the APP to log the message */
 static int gapp_pid = INVALID_PID;
@@ -228,7 +289,7 @@
 		return -EINVAL;
 	}
 
-	payload_len = wmsg_length + sizeof(wnl->radio);
+	payload_len = wmsg_length + sizeof(wnl->radio) + sizeof(tAniHdr);
 	tot_msg_len = NLMSG_SPACE(payload_len);
 	skb = dev_alloc_skb(tot_msg_len);
 	if (skb == NULL) {
@@ -330,6 +391,177 @@
 	return ret;
 }
 
+void wlan_fillTxStruct(void *pktStat)
+{
+	vos_mem_copy(&gwlan_logging.txPktStatsInfo,
+		(struct perPktStatsInfo *)pktStat,
+		sizeof(struct perPktStatsInfo));
+}
+
+bool wlan_isPktStatsEnabled(void)
+{
+	return gwlan_logging.pkt_stats_enabled;
+}
+
+
+
+/* Need to call this with spin_lock acquired */
+static int wlan_queue_pkt_stats_for_app(void)
+{
+	int ret = 0;
+
+	list_add_tail(&gwlan_logging.pkt_stats_pcur_node->node,
+			&gwlan_logging.pkt_stat_filled_list);
+
+	if (!list_empty(&gwlan_logging.pkt_stat_free_list)) {
+		/* Get buffer from free list */
+		gwlan_logging.pkt_stats_pcur_node =
+			(struct pkt_stats_msg *)(gwlan_logging.pkt_stat_free_list.next);
+		list_del_init(gwlan_logging.pkt_stat_free_list.next);
+	} else if (!list_empty(&gwlan_logging.pkt_stat_filled_list)) {
+		/* Get buffer from filled list */
+		/* This condition will drop the packet from being
+		 * indicated to app
+		 */
+		gwlan_logging.pkt_stats_pcur_node =
+			(struct pkt_stats_msg *)(gwlan_logging.pkt_stat_filled_list.next);
+		++gwlan_logging.pkt_stat_drop_cnt;
+		/* print every 64th drop count */
+		if (vos_is_multicast_logging() &&
+			(!(gwlan_logging.pkt_stat_drop_cnt % 0x40))) {
+			pr_err("%s: drop_count = %u  filled_length = %d\n",
+				__func__, gwlan_logging.pkt_stat_drop_cnt,
+				gwlan_logging.pkt_stats_pcur_node->skb->len);
+		}
+		list_del_init(gwlan_logging.pkt_stat_filled_list.next);
+		ret = 1;
+	}
+
+	/* Reset the current node values */
+	gwlan_logging.pkt_stats_pcur_node-> skb->len = 0;
+	return ret;
+}
+
+int wlan_pkt_stats_to_user(void *perPktStat)
+{
+	bool wake_up_thread = false;
+	tPerPacketStats *pktstats = perPktStat;
+	unsigned long flags;
+	tx_rx_pkt_stats rx_tx_stats;
+	int total_log_len = 0;
+	struct sk_buff *ptr;
+	tpSirMacMgmtHdr hdr;
+	uint32 rateIdx;
+
+	if (!vos_is_multicast_logging())
+	{
+		return -EIO;
+	}
+	if (vos_is_multicast_logging()) {
+
+	vos_mem_zero(&rx_tx_stats, sizeof(tx_rx_pkt_stats));
+
+	if (pktstats->is_rx){
+		rx_tx_stats.ps_hdr.flags = (1 << PKTLOG_FLG_FRM_TYPE_REMOTE_S);
+	}else{
+		rx_tx_stats.ps_hdr.flags = (1 << PKTLOG_FLG_FRM_TYPE_LOCAL_S);
+
+	}
+	/*Send log type as PKTLOG_TYPE_PKT_STAT (9)*/
+	rx_tx_stats.ps_hdr.log_type = PKTLOG_TYPE_PKT_STAT;
+	rx_tx_stats.ps_hdr.timestamp = vos_timer_get_system_ticks();
+	rx_tx_stats.ps_hdr.missed_cnt = 0;
+	rx_tx_stats.ps_hdr.size = sizeof(tx_rx_pkt_stats) -
+				sizeof(pkt_stats_hdr) + pktstats->data_len-
+				MAX_PKT_STAT_DATA_LEN;
+
+	rx_tx_stats.stats.flags |= PER_PACKET_ENTRY_FLAGS_TX_SUCCESS;
+	rx_tx_stats.stats.flags |= PER_PACKET_ENTRY_FLAGS_80211_HEADER;
+	if (pktstats->is_rx)
+		rx_tx_stats.stats.flags |= PER_PACKET_ENTRY_FLAGS_DIRECTION_TX;
+
+	hdr = (tpSirMacMgmtHdr)pktstats->data;
+	if (hdr->fc.wep) {
+		rx_tx_stats.stats.flags |= PER_PACKET_ENTRY_FLAGS_PROTECTED;
+		/* Reset wep bit to parse frame properly */
+		hdr->fc.wep = 0;
+	}
+
+	rx_tx_stats.stats.tid = pktstats->tid;
+	rx_tx_stats.stats.dxe_timestamp = pktstats->dxe_timestamp;
+
+	if (!pktstats->is_rx)
+	{
+		rx_tx_stats.stats.rssi = gwlan_logging.txPktStatsInfo.avgRssi;
+		rx_tx_stats.stats.num_retries = gwlan_logging.txPktStatsInfo.txAvgRetry;
+		rateIdx = gwlan_logging.txPktStatsInfo.lastTxRate;
+	}
+	else
+	{
+		rx_tx_stats.stats.rssi = pktstats->rssi;
+		rx_tx_stats.stats.num_retries = pktstats->num_retries;
+		rateIdx = pktstats->rate_idx;
+
+	}
+	rx_tx_stats.stats.link_layer_transmit_sequence = pktstats->seq_num;
+
+	/* Calculate rate and MCS from rate index */
+	if( rateIdx >= 210 && rateIdx <= 217)
+		rateIdx-=202;
+	if( rateIdx >= 218 && rateIdx <= 225 )
+		rateIdx-=210;
+	get_rate_and_MCS(&rx_tx_stats.stats, rateIdx);
+
+	vos_mem_copy(rx_tx_stats.stats.data,pktstats->data, pktstats->data_len);
+
+	/* 1+1 indicate '\n'+'\0' */
+	total_log_len = sizeof(tx_rx_pkt_stats) + pktstats->data_len -
+						 MAX_PKT_STAT_DATA_LEN;
+	spin_lock_irqsave(&gwlan_logging.pkt_stats_lock, flags);
+	// wlan logging svc resources are not yet initialized
+	if (!gwlan_logging.pkt_stats_pcur_node) {
+		pr_err("%s, logging svc not initialized", __func__);
+		spin_unlock_irqrestore(&gwlan_logging.pkt_stats_lock, flags);
+		return -EIO;
+	}
+
+	;
+
+	 /* Check if we can accomodate more log into current node/buffer */
+	if (total_log_len + sizeof(vos_log_pktlog_info) + sizeof(tAniNlHdr) >=
+		skb_tailroom(gwlan_logging.pkt_stats_pcur_node->skb)) {
+		wake_up_thread = true;
+		wlan_queue_pkt_stats_for_app();
+	}
+	ptr = gwlan_logging.pkt_stats_pcur_node->skb;
+
+
+	vos_mem_copy(skb_put(ptr, total_log_len), &rx_tx_stats, total_log_len);
+	spin_unlock_irqrestore(&gwlan_logging.pkt_stats_lock, flags);
+	/* Wakeup logger thread */
+	if ((true == wake_up_thread)) {
+			/* If there is logger app registered wakeup the logging
+			* thread
+			*/
+			set_bit(HOST_PKT_STATS_POST, &gwlan_logging.event_flag);
+			wake_up_interruptible(&gwlan_logging.wait_queue);
+		}
+	}
+	return 0;
+}
+
+void wlan_disable_and_flush_pkt_stats()
+{
+	unsigned long flags;
+	spin_lock_irqsave(&gwlan_logging.pkt_stats_lock, flags);
+	if(gwlan_logging.pkt_stats_pcur_node->skb->len){
+		wlan_queue_pkt_stats_for_app();
+	}
+	spin_unlock_irqrestore(&gwlan_logging.pkt_stats_lock, flags);
+	set_bit(HOST_PKT_STATS_POST, &gwlan_logging.event_flag);
+	wake_up_interruptible(&gwlan_logging.wait_queue);
+}
+
 int wlan_log_to_user(VOS_TRACE_LEVEL log_level, char *to_be_sent, int length)
 {
 	/* Add the current time stamp */
@@ -492,10 +724,10 @@
 		vos_pkt_return_packet(current_pkt);
 
 		extra_header_len = sizeof(msg_header.radio) + sizeof(tAniHdr);
-		nl_payload_len = NLMSG_ALIGN(extra_header_len + skb->len);
+		nl_payload_len = extra_header_len + skb->len;
 
 		msg_header.nlh.nlmsg_type = ANI_NL_MSG_LOG;
-		msg_header.nlh.nlmsg_len = nl_payload_len;
+		msg_header.nlh.nlmsg_len = nlmsg_msg_size(nl_payload_len);
 		msg_header.nlh.nlmsg_flags = NLM_F_REQUEST;
 		msg_header.nlh.nlmsg_pid = gapp_pid;
 		msg_header.nlh.nlmsg_seq = nlmsg_seq++;
@@ -516,7 +748,7 @@
 							sizeof(msg_header));
 
 		ret = nl_srv_bcast(skb);
-		if (ret < 0) {
+		if ((ret < 0) && (ret != -ESRCH)) {
 			pr_info("%s: Send Failed %d drop_count = %u\n",
 				__func__, ret, ++gwlan_logging.fw_log_pkt_drop_cnt);
 		} else {
@@ -586,10 +818,10 @@
 
 		extra_header_len = sizeof(msg_header.radio) + sizeof(tAniHdr) +
 						sizeof(msg_header.frameSize);
-		nl_payload_len = NLMSG_ALIGN(extra_header_len + skb->len);
+		nl_payload_len = extra_header_len + skb->len;
 
 		msg_header.nlh.nlmsg_type = ANI_NL_MSG_LOG;
-		msg_header.nlh.nlmsg_len = nl_payload_len;
+		msg_header.nlh.nlmsg_len = nlmsg_msg_size(nl_payload_len);
 		msg_header.nlh.nlmsg_flags = NLM_F_REQUEST;
 		msg_header.nlh.nlmsg_pid = 0;
 		msg_header.nlh.nlmsg_seq = nlmsg_seq++;
@@ -624,6 +856,80 @@
 	return ret;
 }
 
+static int fill_fw_mem_dump_buffer(void)
+{
+	struct sk_buff *skb = NULL;
+	vos_pkt_t *current_pkt;
+	vos_pkt_t *next_pkt;
+	VOS_STATUS status = VOS_STATUS_E_FAILURE;
+	unsigned long flags;
+	int  byte_left = 0;
+	do {
+		spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+
+		if (!gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue) {
+			spin_unlock_irqrestore(
+				&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+			return -EIO;
+		}
+
+		/* pick first pkt from queued chain */
+		current_pkt = gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue;
+
+		/* get the pointer to the next packet in the chain */
+		status = vos_pkt_walk_packet_chain(current_pkt, &next_pkt,
+							TRUE);
+
+		/* both "success" and "empty" are acceptable results */
+		if (!((status == VOS_STATUS_SUCCESS) ||
+					(status == VOS_STATUS_E_EMPTY))) {
+			spin_unlock_irqrestore(
+				&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+			pr_err("%s: Failure walking packet chain", __func__);
+			return -EIO;
+		}
+
+		/* update queue head with next pkt ptr which could be NULL */
+		gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue = next_pkt;
+		--gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_pkt_qcnt;
+		spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+
+		status = vos_pkt_get_os_packet(current_pkt, (v_VOID_t **)&skb,
+						VOS_FALSE);
+		if (!VOS_IS_STATUS_SUCCESS(status)) {
+			pr_err("%s: Failure extracting skb from vos pkt",
+				__func__);
+			return -EIO;
+		}
+
+		//Copy data from SKB to mem dump buffer
+		spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+		if((skb) && (skb->len != 0))
+		{
+			// Prevent buffer overflow
+			byte_left = ((int)gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size -
+					(int)(gwlan_logging.fw_mem_dump_ctx.fw_dump_current_loc - gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc));
+			if(skb->len > byte_left)
+			{
+				vos_mem_copy(gwlan_logging.fw_mem_dump_ctx.fw_dump_current_loc, skb->data, byte_left);
+				//Update the current location ptr
+				gwlan_logging.fw_mem_dump_ctx.fw_dump_current_loc +=  byte_left;
+			}
+			else
+			{
+				vos_mem_copy(gwlan_logging.fw_mem_dump_ctx.fw_dump_current_loc, skb->data, skb->len);
+				//Update the current location ptr
+				gwlan_logging.fw_mem_dump_ctx.fw_dump_current_loc +=  skb->len;
+			}
+		}
+		spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+		/*return vos pkt since skb is already detached */
+		vos_pkt_return_packet(current_pkt);
+	} while (next_pkt);
+
+	return 0;
+}
+
 static int send_filled_buffers_to_user(void)
 {
 	int ret = -1;
@@ -638,7 +944,7 @@
 	static int rate_limit;
 
 	while (!list_empty(&gwlan_logging.filled_list)
-		&& !gwlan_logging.exit) {
+			&& !gwlan_logging.exit) {
 
 		skb = dev_alloc_skb(MAX_LOGMSG_LENGTH);
 		if (skb == NULL) {
@@ -713,6 +1019,126 @@
 	return ret;
 }
 
+
+static int send_per_pkt_stats_to_user(void)
+{
+	int ret = -1;
+	struct pkt_stats_msg *plog_msg;
+	unsigned long flags;
+	struct sk_buff *skb_new = NULL;
+	vos_log_pktlog_info pktlog;
+	tAniNlHdr msg_header;
+	int extra_header_len, nl_payload_len;
+	static int nlmsg_seq;
+	static int rate_limit;
+	int diag_type;
+	bool free_old_skb = false;
+
+	while (!list_empty(&gwlan_logging.pkt_stat_filled_list)
+		&& !gwlan_logging.exit) {
+		skb_new= dev_alloc_skb(MAX_PKTSTATS_LOG_LENGTH);
+		if (skb_new == NULL) {
+			if (!rate_limit) {
+				pr_err("%s: dev_alloc_skb() failed for msg size[%d] drop count = %u\n",
+					__func__, MAX_LOGMSG_LENGTH,
+					gwlan_logging.drop_count);
+			}
+			rate_limit = 1;
+			ret = -ENOMEM;
+			break;
+		}
+
+		spin_lock_irqsave(&gwlan_logging.pkt_stats_lock, flags);
+
+		plog_msg = (struct pkt_stats_msg *)
+			(gwlan_logging.pkt_stat_filled_list.next);
+		list_del_init(gwlan_logging.pkt_stat_filled_list.next);
+		spin_unlock_irqrestore(&gwlan_logging.pkt_stats_lock, flags);
+
+		vos_mem_zero(&pktlog, sizeof(vos_log_pktlog_info));
+		vos_log_set_code(&pktlog, LOG_WLAN_PKT_LOG_INFO_C);
+
+		pktlog.version = VERSION_LOG_WLAN_PKT_LOG_INFO_C;
+		pktlog.buf_len = plog_msg->skb->len;
+		vos_log_set_length(&pktlog.log_hdr, plog_msg->skb->len +
+					sizeof(vos_log_pktlog_info));
+		pktlog.seq_no = gwlan_logging.pkt_stats_msg_idx++;
+
+		if (unlikely(skb_headroom(plog_msg->skb) < sizeof(vos_log_pktlog_info))) {
+			pr_err("VPKT [%d]: Insufficient headroom, head[%p],"
+				" data[%p], req[%zu]", __LINE__, plog_msg->skb->head,
+				plog_msg->skb->data, sizeof(msg_header));
+			ret = -EIO;
+			free_old_skb = true;
+			goto err;
+		}
+		vos_mem_copy(skb_push(plog_msg->skb, sizeof(vos_log_pktlog_info)), &pktlog,
+							sizeof(vos_log_pktlog_info));
+
+		if (unlikely(skb_headroom(plog_msg->skb) < sizeof(int))) {
+			pr_err("VPKT [%d]: Insufficient headroom, head[%p],"
+				" data[%p], req[%zu]", __LINE__, plog_msg->skb->head,
+				plog_msg->skb->data, sizeof(int));
+			ret = -EIO;
+			free_old_skb = true;
+			goto err;
+		}
+
+		diag_type = DIAG_TYPE_LOGS;
+		vos_mem_copy(skb_push(plog_msg->skb, sizeof(int)), &diag_type,
+									 sizeof(int));
+
+		extra_header_len = sizeof(msg_header.radio) + sizeof(tAniHdr);
+		nl_payload_len = extra_header_len + plog_msg->skb->len;
+
+		msg_header.nlh.nlmsg_type = ANI_NL_MSG_PUMAC;
+		msg_header.nlh.nlmsg_len = nlmsg_msg_size(nl_payload_len);
+		msg_header.nlh.nlmsg_flags = NLM_F_REQUEST;
+		msg_header.nlh.nlmsg_pid = 0;
+		msg_header.nlh.nlmsg_seq = nlmsg_seq++;
+
+		msg_header.radio = 0;
+
+		msg_header.wmsg.type = PTT_MSG_DIAG_CMDS_TYPE;
+		msg_header.wmsg.length = cpu_to_be16(plog_msg->skb->len);
+
+		if (unlikely(skb_headroom(plog_msg->skb) < sizeof(msg_header))) {
+			pr_err("VPKT [%d]: Insufficient headroom, head[%p],"
+				" data[%p], req[%zu]", __LINE__, plog_msg->skb->head,
+				plog_msg->skb->data, sizeof(msg_header));
+			ret = -EIO;
+			free_old_skb = true;
+			goto err;
+		}
+
+		vos_mem_copy(skb_push(plog_msg->skb, sizeof(msg_header)), &msg_header,
+							sizeof(msg_header));
+
+		ret = nl_srv_bcast(plog_msg->skb);
+		if (ret < 0) {
+			pr_info("%s: Send Failed %d drop_count = %u\n",
+				__func__, ret, ++gwlan_logging.fw_log_pkt_drop_cnt);
+		} else {
+			ret = 0;
+		}
+err:
+		/*
+		 * Free old skb in case or error before assigning new skb
+		 * to the free list.
+		 */
+		if (free_old_skb)
+			dev_kfree_skb(plog_msg->skb);
+		spin_lock_irqsave(&gwlan_logging.pkt_stats_lock, flags);
+		plog_msg->skb = skb_new;
+		list_add_tail(&plog_msg->node,
+				&gwlan_logging.pkt_stat_free_list);
+		spin_unlock_irqrestore(&gwlan_logging.pkt_stats_lock, flags);
+		ret = 0;
+	}
+
+	return ret;
+}
+
 /**
  * wlan_logging_thread() - The WLAN Logger thread
  * @Arg - pointer to the HDD context
@@ -723,7 +1149,7 @@
 {
 	int ret_wait_status = 0;
 	int ret = 0;
-
+	unsigned long flags;
 	set_user_nice(current, -2);
 
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
@@ -739,7 +1165,11 @@
 		   test_bit(LOGGER_FW_LOG_PKT_POST,
 						&gwlan_logging.event_flag) ||
 		   test_bit(LOGGER_FATAL_EVENT_POST,
-						&gwlan_logging.event_flag)));
+						&gwlan_logging.event_flag) ||
+		   test_bit(LOGGER_FW_MEM_DUMP_PKT_POST, &gwlan_logging.event_flag) ||
+		   test_bit(LOGGER_FW_MEM_DUMP_PKT_POST_DONE, &gwlan_logging.event_flag)||
+		   test_bit(HOST_PKT_STATS_POST,
+						 &gwlan_logging.event_flag)));
 
 		if (ret_wait_status == -ERESTARTSYS) {
 			pr_err("%s: wait_event return -ERESTARTSYS", __func__);
@@ -756,6 +1186,11 @@
 			if (-ENOMEM == ret) {
 				msleep(200);
 			}
+			if (WLAN_LOG_INDICATOR_HOST_ONLY ==
+				gwlan_logging.log_complete.indicator)
+			{
+				vos_send_fatal_event_done();
+			}
 		}
 
 		if (test_and_clear_bit(LOGGER_FW_LOG_PKT_POST,
@@ -776,12 +1211,55 @@
 			}
 			else {
 				gwlan_logging.log_complete.is_flush_complete = true;
-				set_bit(HOST_LOG_POST, &gwlan_logging.event_flag);
-				set_bit(LOGGER_FW_LOG_PKT_POST,&gwlan_logging.event_flag);
+
+				spin_lock_irqsave(&gwlan_logging.spin_lock, flags);
+				/* Flush all current host logs*/
+				wlan_queue_logmsg_for_app();
+				spin_unlock_irqrestore(&gwlan_logging.spin_lock, flags);
+
+				set_bit(HOST_LOG_POST,&gwlan_logging.event_flag);
+				set_bit(LOGGER_FW_LOG_PKT_POST, &gwlan_logging.event_flag);
 				set_bit(LOGGER_FATAL_EVENT_POST, &gwlan_logging.event_flag);
 				wake_up_interruptible(&gwlan_logging.wait_queue);
 			}
 		}
+
+		if (test_and_clear_bit(LOGGER_FW_MEM_DUMP_PKT_POST,
+			&gwlan_logging.event_flag)) {
+			fill_fw_mem_dump_buffer();
+		}
+		if(test_and_clear_bit(LOGGER_FW_MEM_DUMP_PKT_POST_DONE, &gwlan_logging.event_flag)){
+				spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock,flags);
+				/*Chnage fw memory dump to indicate write done*/
+				gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status = FW_MEM_DUMP_WRITE_DONE;
+				/*reset dropped packet count upon completion of this request*/
+				gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_pkt_drop_cnt = 0;
+				spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock,flags);
+				fill_fw_mem_dump_buffer();
+				/*
+				 * Call the registered HDD callback for indicating
+				 * memdump complete. If it's null,then something is
+				 * not right.
+				 */
+				if (gwlan_logging.fw_mem_dump_ctx.svc_fw_mem_dump_req_cb &&
+				    gwlan_logging.fw_mem_dump_ctx.svc_fw_mem_dump_req_cb_arg) {
+					((hdd_fw_mem_dump_req_cb)
+					gwlan_logging.fw_mem_dump_ctx.svc_fw_mem_dump_req_cb)(
+					(struct hdd_fw_mem_dump_req_ctx*)
+					gwlan_logging.fw_mem_dump_ctx.svc_fw_mem_dump_req_cb_arg);
+
+					/*invalidate the callback pointers*/
+					spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock,flags);
+					gwlan_logging.fw_mem_dump_ctx.svc_fw_mem_dump_req_cb = NULL;
+					gwlan_logging.fw_mem_dump_ctx.svc_fw_mem_dump_req_cb_arg = NULL;
+					spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock,flags);
+				}
+		}
+
+		if (test_and_clear_bit(HOST_PKT_STATS_POST,
+			&gwlan_logging.event_flag)) {
+			send_per_pkt_stats_to_user();
+		}
 	}
 
 	complete_and_exit(&gwlan_logging.shutdown_comp, 0);
@@ -798,6 +1276,7 @@
 	int radio;
 	int type;
 	int ret;
+	unsigned long flags;
 
         if (TRUE == vos_isUnloadInProgress())
         {
@@ -815,16 +1294,24 @@
 		return -EINVAL;
 	}
 
+	if (wnl->wmsg.length > skb->data_len)
+	{
+		pr_err("%s: invalid length msgLen:%x skb data_len:%x \n",
+		       __func__, wnl->wmsg.length, skb->data_len);
+		return -EINVAL;
+	}
+
 	if (gapp_pid != INVALID_PID) {
 		if (wnl->nlh.nlmsg_pid > gapp_pid) {
 			gapp_pid = wnl->nlh.nlmsg_pid;
 		}
 
-		spin_lock_bh(&gwlan_logging.spin_lock);
+		spin_lock_irqsave(&gwlan_logging.spin_lock, flags);
 		if (gwlan_logging.pcur_node->filled_length) {
 			wlan_queue_logmsg_for_app();
 		}
-		spin_unlock_bh(&gwlan_logging.spin_lock);
+		spin_unlock_irqrestore(&gwlan_logging.spin_lock, flags);
+
 		set_bit(HOST_LOG_POST, &gwlan_logging.event_flag);
 		wake_up_interruptible(&gwlan_logging.wait_queue);
 	} else {
@@ -846,10 +1333,12 @@
 
 void wlan_init_log_completion(void)
 {
-	gwlan_logging.log_complete.indicator = WLAN_LOG_TYPE_NON_FATAL;
-	gwlan_logging.log_complete.is_fatal = WLAN_LOG_INDICATOR_UNUSED;
+	gwlan_logging.log_complete.indicator = WLAN_LOG_INDICATOR_UNUSED;
+	gwlan_logging.log_complete.is_fatal = WLAN_LOG_TYPE_NON_FATAL;
 	gwlan_logging.log_complete.is_report_in_progress = false;
 	gwlan_logging.log_complete.reason_code = WLAN_LOG_REASON_CODE_UNUSED;
+	gwlan_logging.log_complete.last_fw_bug_reason = 0;
+	gwlan_logging.log_complete.last_fw_bug_timestamp = 0;
 
 	spin_lock_init(&gwlan_logging.bug_report_lock);
 }
@@ -866,12 +1355,12 @@
 	gwlan_logging.log_complete.is_report_in_progress = true;
 	gwlan_logging.log_complete.reason_code = reason_code;
 	spin_unlock_irqrestore(&gwlan_logging.bug_report_lock, flags);
-
 	return 0;
 }
-void wlan_get_log_completion(uint32 *is_fatal,
+void wlan_get_log_and_reset_completion(uint32 *is_fatal,
                              uint32 *indicator,
-                             uint32 *reason_code)
+                             uint32 *reason_code,
+                             bool reset)
 {
 	unsigned long flags;
 
@@ -879,16 +1368,23 @@
 	*indicator = gwlan_logging.log_complete.indicator;
 	*is_fatal = gwlan_logging.log_complete.is_fatal;
 	*reason_code = gwlan_logging.log_complete.reason_code;
-	gwlan_logging.log_complete.is_report_in_progress = false;
-
+	if (reset) {
+		gwlan_logging.log_complete.indicator =
+						WLAN_LOG_INDICATOR_UNUSED;
+		gwlan_logging.log_complete.is_fatal = WLAN_LOG_TYPE_NON_FATAL;
+		gwlan_logging.log_complete.is_report_in_progress = false;
+		gwlan_logging.log_complete.reason_code =
+					 WLAN_LOG_REASON_CODE_UNUSED;
+	}
 	spin_unlock_irqrestore(&gwlan_logging.bug_report_lock, flags);
-
 }
+
 bool wlan_is_log_report_in_progress(void)
 {
 	return gwlan_logging.log_complete.is_report_in_progress;
 }
 
+
 void wlan_reset_log_report_in_progress(void)
 {
 	unsigned long flags;
@@ -905,10 +1401,15 @@
 }
 
 
-int wlan_logging_sock_activate_svc(int log_fe_to_console, int num_buf)
+int wlan_logging_sock_activate_svc(int log_fe_to_console, int num_buf,
+								int pkt_stats_enabled, int pkt_stats_buff)
 {
-	int i = 0;
+	int i, j = 0;
 	unsigned long irq_flag;
+	bool failure = FALSE;
+
+	pr_info("%s: Initalizing FEConsoleLog = %d NumBuff = %d\n",
+			__func__, log_fe_to_console, num_buf);
 
 	gapp_pid = INVALID_PID;
 
@@ -936,13 +1437,60 @@
 		(gwlan_logging.free_list.next);
 	list_del_init(gwlan_logging.free_list.next);
 	spin_unlock_irqrestore(&gwlan_logging.spin_lock, irq_flag);
+	if(pkt_stats_enabled)
+	{
+		pr_info("%s: Initalizing Pkt stats pkt_stats_buff = %d\n",
+			__func__, pkt_stats_buff);
+		pkt_stats_buffers = (struct pkt_stats_msg *) kzalloc(
+			 pkt_stats_buff * sizeof(struct pkt_stats_msg), GFP_KERNEL);
+		if (!pkt_stats_buffers) {
+			pr_err("%s: Could not allocate memory for Pkt stats\n", __func__);
+			failure = TRUE;
+			goto err;
+		}
 
+		gwlan_logging.pkt_stat_num_buf = pkt_stats_buff;
+
+		gwlan_logging.pkt_stats_msg_idx = 0;
+		INIT_LIST_HEAD(&gwlan_logging.pkt_stat_free_list);
+		INIT_LIST_HEAD(&gwlan_logging.pkt_stat_filled_list);
+
+		for (i = 0; i < pkt_stats_buff; i++) {
+			pkt_stats_buffers[i].skb= dev_alloc_skb(MAX_PKTSTATS_LOG_LENGTH);
+			if (pkt_stats_buffers[i].skb == NULL)
+			{
+				pr_err("%s: Memory alloc failed for skb",__func__);
+				/* free previously allocated skb and return;*/
+				for (j = 0; j<i ; j++)
+				{
+					dev_kfree_skb(pkt_stats_buffers[j].skb);
+				}
+			spin_lock_irqsave(&gwlan_logging.spin_lock, irq_flag);
+			vos_mem_free(pkt_stats_buffers);
+			pkt_stats_buffers = NULL;
+			spin_unlock_irqrestore(&gwlan_logging.spin_lock, irq_flag);
+			failure = TRUE;
+			goto err;
+			}
+			list_add(&pkt_stats_buffers[i].node,
+								&gwlan_logging.pkt_stat_free_list);
+
+		}
+		gwlan_logging.pkt_stats_pcur_node = (struct pkt_stats_msg *)
+			(gwlan_logging.pkt_stat_free_list.next);
+		list_del_init(gwlan_logging.pkt_stat_free_list.next);
+		gwlan_logging.pkt_stats_enabled = TRUE;
+	}
+err:
+	if (failure)
+	gwlan_logging.pkt_stats_enabled = false;
 	init_waitqueue_head(&gwlan_logging.wait_queue);
 	gwlan_logging.exit = false;
 	clear_bit(HOST_LOG_POST, &gwlan_logging.event_flag);
 	clear_bit(LOGGER_MGMT_DATA_PKT_POST, &gwlan_logging.event_flag);
 	clear_bit(LOGGER_FW_LOG_PKT_POST, &gwlan_logging.event_flag);
 	clear_bit(LOGGER_FATAL_EVENT_POST, &gwlan_logging.event_flag);
+	clear_bit(HOST_PKT_STATS_POST, &gwlan_logging.event_flag);
 	init_completion(&gwlan_logging.shutdown_comp);
 	gwlan_logging.thread = kthread_create(wlan_logging_thread, NULL,
 					"wlan_logging_thread");
@@ -970,7 +1518,6 @@
 {
 	vos_pkt_t *pkt_queue_head;
 	unsigned long flags;
-
 	spin_lock_irqsave(&gwlan_logging.data_mgmt_pkt_lock, flags);
 	if (NULL != gwlan_logging.data_mgmt_pkt_queue) {
 		pkt_queue_head = gwlan_logging.data_mgmt_pkt_queue;
@@ -998,13 +1545,24 @@
 		spin_unlock_irqrestore(&gwlan_logging.fw_log_pkt_lock,
 					flags);
 	}
-
+	spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	if (NULL != gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue) {
+		pkt_queue_head = gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue;
+		spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock,
+					flags);
+		vos_pkt_return_packet(pkt_queue_head);
+		wlan_free_fwr_mem_dump_buffer();
+	} else {
+		spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock,
+					flags);
+	}
 	return 0;
 }
 
 int wlan_logging_sock_deactivate_svc(void)
 {
 	unsigned long irq_flag;
+	int i;
 
 	if (!gplog_msg)
 		return 0;
@@ -1026,6 +1584,20 @@
 	gwlan_logging.pcur_node = NULL;
 	spin_unlock_irqrestore(&gwlan_logging.spin_lock, irq_flag);
 
+	spin_lock_irqsave(&gwlan_logging.pkt_stats_lock, irq_flag);
+	/* free allocated skb */
+	for (i = 0; i < gwlan_logging.pkt_stat_num_buf; i++)
+	{
+		if (pkt_stats_buffers[i].skb)
+			dev_kfree_skb(pkt_stats_buffers[i].skb);
+	}
+	if(pkt_stats_buffers)
+		vos_mem_free(pkt_stats_buffers);
+	pkt_stats_buffers = NULL;
+	gwlan_logging.pkt_stats_pcur_node = NULL;
+	gwlan_logging.pkt_stats_enabled = false;
+	spin_unlock_irqrestore(&gwlan_logging.pkt_stats_lock, irq_flag);
+
 	wlan_logging_flush_pkt_queue();
 
 	return 0;
@@ -1036,8 +1608,11 @@
 	spin_lock_init(&gwlan_logging.spin_lock);
 	spin_lock_init(&gwlan_logging.data_mgmt_pkt_lock);
 	spin_lock_init(&gwlan_logging.fw_log_pkt_lock);
+	spin_lock_init(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock);
+	spin_lock_init(&gwlan_logging.pkt_stats_lock);
 	gapp_pid = INVALID_PID;
 	gwlan_logging.pcur_node = NULL;
+	gwlan_logging.pkt_stats_pcur_node= NULL;
 
 	wlan_init_log_completion();
 
@@ -1047,6 +1622,7 @@
 int wlan_logging_sock_deinit_svc(void)
 {
 	gwlan_logging.pcur_node = NULL;
+	gwlan_logging.pkt_stats_pcur_node = NULL;
 	gapp_pid = INVALID_PID;
 
 	wlan_deinit_log_completion();
@@ -1171,6 +1747,60 @@
 	return VOS_STATUS_SUCCESS;
 }
 
+int wlan_queue_fw_mem_dump_for_app(vos_pkt_t *pPacket)
+{
+	unsigned long flags;
+	vos_pkt_t *next_pkt;
+	vos_pkt_t *free_pkt;
+	VOS_STATUS status = VOS_STATUS_E_FAILURE;
+
+	spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	if (gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_pkt_qcnt >= LOGGER_MAX_FW_MEM_DUMP_PKT_Q_LEN) {
+		status = vos_pkt_walk_packet_chain(
+			gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue, &next_pkt, TRUE);
+		/*both "success" and "empty" are acceptable results*/
+		if (!((status == VOS_STATUS_SUCCESS) ||
+				(status == VOS_STATUS_E_EMPTY))) {
+			spin_unlock_irqrestore(
+				&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+			pr_err("%s: Failure walking packet chain", __func__);
+			/*keep returning pkts to avoid low resource cond*/
+			vos_pkt_return_packet(pPacket);
+			return VOS_STATUS_E_FAILURE;
+		}
+
+		free_pkt = gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue;
+		gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue = next_pkt;
+		/*returning head of pkt queue. latest pkts are important*/
+		--gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_pkt_qcnt;
+                ++gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_pkt_drop_cnt ;
+		spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock,
+					flags);
+                pr_info("%s : fw mem_dump pkt cnt --> %d\n" ,__func__, gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_pkt_drop_cnt);
+		vos_pkt_return_packet(free_pkt);
+	} else {
+		spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock,
+					flags);
+	}
+
+	spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+
+	if (gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue) {
+		vos_pkt_chain_packet(gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue,
+					pPacket, TRUE);
+	} else {
+		gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_queue = pPacket;
+	}
+	++gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_pkt_qcnt;
+
+	spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+
+	set_bit(LOGGER_FW_MEM_DUMP_PKT_POST, &gwlan_logging.event_flag);
+	wake_up_interruptible(&gwlan_logging.wait_queue);
+
+	return VOS_STATUS_SUCCESS;
+}
+
 int wlan_queue_logpkt_for_app(vos_pkt_t *pPacket, uint32 pkt_type)
 {
 	VOS_STATUS status = VOS_STATUS_E_FAILURE;
@@ -1191,13 +1821,16 @@
 	}
 
 	switch (pkt_type) {
-	case LOG_PKT_TYPE_DATA_MGMT:
+	case WLAN_MGMT_FRAME_LOGS:
 		status = wlan_queue_data_mgmt_pkt_for_app(pPacket);
 		break;
 
-	case LOG_PKT_TYPE_FW_LOG:
+	case WLAN_FW_LOGS:
 		status = wlan_queue_fw_log_pkt_for_app(pPacket);
 		break;
+	case WLAN_FW_MEMORY_DUMP:
+		status = wlan_queue_fw_mem_dump_for_app(pPacket);
+		break;
 
 	default:
 		pr_info("%s: Unknown pkt received %d", __func__, pkt_type);
@@ -1210,13 +1843,96 @@
 
 void wlan_process_done_indication(uint8 type, uint32 reason_code)
 {
-    if ((type == WLAN_QXDM_LOGGING) && (wlan_is_log_report_in_progress() == TRUE))
-    {
-        pr_info("%s: Setting LOGGER_FATAL_EVENT\n", __func__);
-        set_bit(LOGGER_FATAL_EVENT_POST, &gwlan_logging.event_flag);
-        wake_up_interruptible(&gwlan_logging.wait_queue);
-    }
+        if (FALSE == sme_IsFeatureSupportedByFW(MEMORY_DUMP_SUPPORTED))
+        {
+            if ((type == WLAN_FW_LOGS) &&
+                (wlan_is_log_report_in_progress() == TRUE))
+            {
+                pr_info("%s: Setting LOGGER_FATAL_EVENT %d\n",
+                         __func__, reason_code);
+                set_bit(LOGGER_FATAL_EVENT_POST, &gwlan_logging.event_flag);
+                wake_up_interruptible(&gwlan_logging.wait_queue);
+            }
+            return;
+        }
+
+	if ((type == WLAN_FW_LOGS) && reason_code &&
+				 vos_isFatalEventEnabled() &&
+				 vos_is_wlan_logging_enabled())
+	{
+		if(wlan_is_log_report_in_progress() == TRUE)
+		{
+                        pr_info("%s: Setting LOGGER_FATAL_EVENT %d\n",
+                                 __func__, reason_code);
+			set_bit(LOGGER_FATAL_EVENT_POST, &gwlan_logging.event_flag);
+			wake_up_interruptible(&gwlan_logging.wait_queue);
+		}
+		else
+		{
+			unsigned long flags;
+
+			/* Drop FW initiated fatal event for
+			 * LIMIT_FW_FATAL_EVENT_MS if received for same reason.
+			 */
+			spin_lock_irqsave(&gwlan_logging.bug_report_lock,
+									flags);
+			if ((reason_code ==
+			   gwlan_logging.log_complete.last_fw_bug_reason) &&
+			   ((vos_timer_get_system_time() -
+			    gwlan_logging.log_complete.last_fw_bug_timestamp)
+						< LIMIT_FW_FATAL_EVENT_MS)) {
+				spin_unlock_irqrestore(
+					&gwlan_logging.bug_report_lock,
+					flags);
+				pr_info("%s: Ignoring Fatal event from firmware for reason %d\n",
+					__func__, reason_code);
+				return;
+			}
+			gwlan_logging.log_complete.last_fw_bug_reason =
+								reason_code;
+			gwlan_logging.log_complete.last_fw_bug_timestamp =
+						vos_timer_get_system_time();
+			spin_unlock_irqrestore(&gwlan_logging.bug_report_lock,
+									flags);
+
+			/*Firmware Initiated*/
+			pr_info("%s : FW triggered Fatal Event, reason_code : %d\n", __func__,
+			reason_code);
+			wlan_set_log_completion(WLAN_LOG_TYPE_FATAL,
+					WLAN_LOG_INDICATOR_FIRMWARE,
+					reason_code);
+			set_bit(LOGGER_FATAL_EVENT_POST, &gwlan_logging.event_flag);
+			wake_up_interruptible(&gwlan_logging.wait_queue);
+		}
+	}
+	if(type == WLAN_FW_MEMORY_DUMP && vos_is_wlan_logging_enabled())
+	{
+		pr_info("%s: Setting FW MEM DUMP LOGGER event\n", __func__);
+		set_bit(LOGGER_FW_MEM_DUMP_PKT_POST_DONE, &gwlan_logging.event_flag);
+		wake_up_interruptible(&gwlan_logging.wait_queue);
+	}
 }
+/**
+ * wlan_flush_host_logs_for_fatal() -flush host logs and send
+ * fatal event to upper layer.
+ */
+void wlan_flush_host_logs_for_fatal()
+{
+	unsigned long flags;
+
+	if (wlan_is_log_report_in_progress()) {
+		pr_info("%s:flush all host logs Setting HOST_LOG_POST\n",
+				 __func__);
+
+		spin_lock_irqsave(&gwlan_logging.spin_lock, flags);
+		wlan_queue_logmsg_for_app();
+		spin_unlock_irqrestore(&gwlan_logging.spin_lock, flags);
+
+		set_bit(HOST_LOG_POST, &gwlan_logging.event_flag);
+		wake_up_interruptible(&gwlan_logging.wait_queue);
+	}
+}
+
 
 /**
  * wlan_is_logger_thread()- Check if threadid is
@@ -1234,4 +1950,226 @@
 	return ((gwlan_logging.thread) &&
 		(threadId == gwlan_logging.thread->pid));
 }
+
+int wlan_fwr_mem_dump_buffer_allocation(void)
+{
+	/*Allocate the dump memory as reported by fw.
+	  or if feature not supported just report to the user */
+	if(gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size <= 0)
+	{
+	   pr_err("%s: fw_mem_dump_req not supported by firmware", __func__);
+	   return -EFAULT;
+	}
+	gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc =
+		(uint8 *)vos_mem_vmalloc(gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size);
+	gwlan_logging.fw_mem_dump_ctx.fw_dump_current_loc = gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc;
+	if(NULL == gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc)
+	{
+		pr_err("%s: fw_mem_dump_req alloc failed for size %d bytes", __func__,gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size);
+		return -ENOMEM;
+	}
+	vos_mem_zero(gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc,gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size);
+
+	return 0;
+}
+
+/*set the current fw mem dump state*/
+void wlan_set_fwr_mem_dump_state(enum FW_MEM_DUMP_STATE fw_mem_dump_state)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status = fw_mem_dump_state;
+	spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+}
+/*check for new request validity and free memory if present from previous request */
+bool wlan_fwr_mem_dump_test_and_set_write_allowed_bit(){
+	unsigned long flags;
+	bool ret = false;
+	bool write_done = false;
+	spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+
+	if(gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status == FW_MEM_DUMP_IDLE){
+		ret = true;
+		gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status = FW_MEM_DUMP_WRITE_IN_PROGRESS;
+	}
+	else if(gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status == FW_MEM_DUMP_WRITE_DONE){
+		ret = true;
+		write_done =  true;
+		gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status = FW_MEM_DUMP_WRITE_IN_PROGRESS;
+	}
+	spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	pr_info("%s:fw mem dump state --> %d ", __func__,gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status);
+
+	if(write_done)
+		wlan_free_fwr_mem_dump_buffer();
+	return ret;
+}
+
+bool wlan_fwr_mem_dump_test_and_set_read_allowed_bit(){
+	unsigned long flags;
+	bool ret=false;
+	spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	if(gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status == FW_MEM_DUMP_WRITE_DONE ||
+          gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status == FW_MEM_DUMP_READ_IN_PROGRESS ){
+          ret = true;
+          gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status = FW_MEM_DUMP_READ_IN_PROGRESS;
+	}
+	spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	//pr_info("%s:fw mem dump state --> %d ", __func__,gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_status);
+
+	return ret;
+}
+size_t wlan_fwr_mem_dump_fsread_handler(char __user *buf,
+		size_t count, loff_t *pos,loff_t* bytes_left)
+{
+	if (buf == NULL || gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc == NULL)
+	{
+		pr_err("%s : start loc : %p buf : %p ",__func__,gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc,buf);
+		return 0;
+	}
+
+	if (*pos < 0) {
+		pr_err("Invalid start offset for memdump read");
+		return 0;
+	} else if (*pos >= gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size || !count) {
+		pr_err("No more data to copy");
+		return 0;
+	} else if (count > gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size - *pos) {
+		count = gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size - *pos;
+	}
+	if (copy_to_user(buf, gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc, count)) {
+		pr_err("%s copy to user space failed",__func__);
+		return 0;
+	}
+	/* offset(pos) should be updated here based on the copy done*/
+	*pos += count;
+	*bytes_left = gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size - *pos;
+	return count;
+}
+
+void  wlan_set_svc_fw_mem_dump_req_cb (void * fw_mem_dump_req_cb, void * fw_mem_dump_req_cb_arg)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	gwlan_logging.fw_mem_dump_ctx.svc_fw_mem_dump_req_cb = fw_mem_dump_req_cb;
+	gwlan_logging.fw_mem_dump_ctx.svc_fw_mem_dump_req_cb_arg = fw_mem_dump_req_cb_arg;
+	spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+}
+
+void wlan_free_fwr_mem_dump_buffer (void )
+{
+	unsigned long flags;
+	void * tmp = NULL;
+	spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	tmp = gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc;
+	gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc = NULL;
+	gwlan_logging.fw_mem_dump_ctx.fw_dump_current_loc = NULL;
+	spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	// Don't set fw_dump_max_size to 0, only free the buffera
+	if(tmp != NULL)
+		vos_mem_vfree((void *)tmp);
+}
+
+void wlan_store_fwr_mem_dump_size(uint32 dump_size)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+	//Store the dump size
+	gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size = dump_size;
+	spin_unlock_irqrestore(&gwlan_logging.fw_mem_dump_ctx.fw_mem_dump_lock, flags);
+}
+/**
+ * wlan_indicate_mem_dump_complete() -  When H2H for mem
+ * dump finish invoke the handler.
+ *
+ * This is a handler used to indicate user space about the
+ * availability for firmware memory dump via vendor event.
+ *
+ * Return: None
+ */
+void wlan_indicate_mem_dump_complete(bool status )
+{
+	hdd_context_t *hdd_ctx;
+	void *vos_ctx;
+	int ret;
+	struct sk_buff *skb = NULL;
+	vos_ctx = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+	if (!vos_ctx) {
+		pr_err("Invalid VOS context");
+		return;
+	}
+
+	hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
+	if(!hdd_ctx) {
+		pr_err("Invalid HDD context");
+		return;
+	}
+
+	ret = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != ret) {
+		pr_err("HDD context is not valid");
+		return;
+	}
+
+
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(hdd_ctx->wiphy,
+		sizeof(uint32_t) + NLA_HDRLEN + NLMSG_HDRLEN);
+
+	if (!skb) {
+		pr_err("cfg80211_vendor_event_alloc failed");
+		return;
+	}
+	if(status)
+	{
+		if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_MEMDUMP_SIZE,
+				gwlan_logging.fw_mem_dump_ctx.fw_dump_max_size)) {
+			pr_err("nla put fail");
+			goto nla_put_failure;
+		}
+	}
+	else
+	{
+		pr_err("memdump failed.Returning size 0 to user");
+		if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_MEMDUMP_SIZE,
+				0)) {
+			pr_err("nla put fail");
+			goto nla_put_failure;
+		}
+	}
+	/*indicate mem dump complete*/
+	cfg80211_vendor_cmd_reply(skb);
+	pr_info("Memdump event sent successfully to user space : recvd size %d",(int)(gwlan_logging.fw_mem_dump_ctx.fw_dump_current_loc - gwlan_logging.fw_mem_dump_ctx.fw_dump_start_loc));
+	return;
+
+nla_put_failure:
+	kfree_skb(skb);
+	return;
+}
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/**
+ * wlan_report_log_completion() - Report bug report completion to userspace
+ * @is_fatal: Type of event, fatal or not
+ * @indicator: Source of bug report, framework/host/firmware
+ * @reason_code: Reason for triggering bug report
+ *
+ * This function is used to report the bug report completion to userspace
+ *
+ * Return: None
+ */
+void wlan_report_log_completion(uint32_t is_fatal,
+				uint32_t indicator,
+				uint32_t reason_code)
+{
+	WLAN_VOS_DIAG_EVENT_DEF(wlan_diag_event,
+				struct vos_event_wlan_log_complete);
+
+	wlan_diag_event.is_fatal = is_fatal;
+	wlan_diag_event.indicator = indicator;
+	wlan_diag_event.reason_code = reason_code;
+	wlan_diag_event.reserved = 0;
+
+	WLAN_VOS_DIAG_EVENT_REPORT(&wlan_diag_event, EVENT_WLAN_LOG_COMPLETE);
+}
+#endif
+
 #endif /* WLAN_LOGGING_SOCK_SVC_ENABLE */
diff --git a/wlan/prima/CORE/SVC/src/nlink/wlan_nlink_srv.c b/wlan/prima/CORE/SVC/src/nlink/wlan_nlink_srv.c
index 3bd5051..facf905 100644
--- a/wlan/prima/CORE/SVC/src/nlink/wlan_nlink_srv.c
+++ b/wlan/prima/CORE/SVC/src/nlink/wlan_nlink_srv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -164,7 +164,7 @@
  */
 int nl_srv_ucast(struct sk_buff *skb, int dst_pid, int flag)
 {
-   int err;
+   int err = -EINVAL;
 
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,7,0))
    NETLINK_CB(skb).pid = 0; //sender's pid
@@ -172,12 +172,15 @@
    NETLINK_CB(skb).portid = 0; //sender's pid
 #endif
    NETLINK_CB(skb).dst_group = 0; //not multicast
-
-   err = netlink_unicast(nl_srv_sock, skb, dst_pid, flag);
-
-   if (err < 0)
-      VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
-      "NLINK: netlink_unicast to pid[%d] failed, ret[%d]", dst_pid, err);
+   if (nl_srv_sock != NULL) {
+      err = netlink_unicast(nl_srv_sock, skb,
+                            dst_pid, flag);
+      if (err < 0)
+         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
+         "NLINK: netlink_unicast to pid[%d] failed, ret[%d]", dst_pid, err);
+   }
+   else
+      dev_kfree_skb(skb);
 
    return err;
 }
@@ -188,7 +191,7 @@
  */
 int nl_srv_bcast(struct sk_buff *skb)
 {
-   int err;
+   int err = -EINVAL;
    int flags = GFP_KERNEL;
 
    if (in_interrupt() || irqs_disabled() || in_atomic())
@@ -200,14 +203,18 @@
    NETLINK_CB(skb).portid = 0; //sender's pid
 #endif
    NETLINK_CB(skb).dst_group = WLAN_NLINK_MCAST_GRP_ID; //destination group
+   if (nl_srv_sock != NULL) {
+      err = netlink_broadcast(nl_srv_sock, skb, 0,
+                              WLAN_NLINK_MCAST_GRP_ID, flags);
 
-   err = netlink_broadcast(nl_srv_sock, skb, 0, WLAN_NLINK_MCAST_GRP_ID, flags);
-
-   if (err < 0)
-   {
-      VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
+      if ((err < 0) && (err != -ESRCH))
+         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
          "NLINK: netlink_broadcast failed err = %d", err);
    }
+   else
+      dev_kfree_skb(skb);
+
+
    return err;
 }
 
@@ -335,7 +342,7 @@
 
    /*multicast the message to all listening processes*/
    err = netlink_broadcast(nl_srv_sock, skb, 0, 1, GFP_KERNEL);
-   if (err)
+   if (err && (err != -ESRCH))
    {
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_LOW,
                 "NLINK: Ready Indication Send Fail %s, err %d",
diff --git a/wlan/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c b/wlan/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
index 5a5c187..5db47dd 100644
--- a/wlan/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
+++ b/wlan/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -96,7 +96,7 @@
          __func__, radio);
       return -EINVAL;
    }
-   payload_len = wmsg_length + 4;  // 4 extra bytes for the radio idx
+   payload_len = wmsg_length + sizeof(wnl->radio) + sizeof(tAniHdr);
    tot_msg_len = NLMSG_SPACE(payload_len);
    if ((skb = dev_alloc_skb(tot_msg_len)) == NULL) {
       PTT_TRACE(VOS_TRACE_LEVEL_ERROR, "%s: dev_alloc_skb() failed for msg size[%d]\n",
@@ -153,7 +153,7 @@
    pAdapterHandle->ptt_pid = reg_req->pid;
    rspmsg.regReq.pid= reg_req->pid;
    rspmsg.wniHdr.type = cpu_to_be16(ANI_MSG_APP_REG_RSP);
-   rspmsg.wniHdr.length = cpu_to_be16(sizeof(rspmsg));
+   rspmsg.wniHdr.length = cpu_to_be16(sizeof(rspmsg.wniHdr));
    if (ptt_sock_send_msg_to_app((tAniHdr *)&rspmsg.wniHdr, radio,
       ANI_NL_MSG_PUMAC, reg_req->pid, MSG_DONTWAIT) < 0)
    {
@@ -290,6 +290,10 @@
    tAniNlHdr *wnl;
    int radio;
    int type;
+
+   if (0 != wlan_hdd_validate_context(pAdapterHandle))
+       return -EINVAL;
+
    wnl = (tAniNlHdr *) skb->data;
    radio = wnl->radio;
    type = wnl->nlh.nlmsg_type;
@@ -320,4 +324,12 @@
 #endif /* WLAN_KD_READY_NOTIFIER */
    return 0;
 }
+
+int ptt_sock_deactivate_svc(hdd_context_t *pHddCtx)
+{
+   nl_srv_unregister(ANI_NL_MSG_PUMAC, ptt_sock_rx_nlink_msg);
+   nl_srv_unregister(ANI_NL_MSG_PTT, ptt_sock_rx_nlink_msg);
+   return 0;
+}
+
 #endif //PTT_SOCK_SVC_ENABLE
diff --git a/wlan/prima/CORE/SYS/common/src/wlan_qct_sys.c b/wlan/prima/CORE/SYS/common/src/wlan_qct_sys.c
index f55bd8c..be54dff 100644
--- a/wlan/prima/CORE/SYS/common/src/wlan_qct_sys.c
+++ b/wlan/prima/CORE/SYS/common/src/wlan_qct_sys.c
@@ -778,6 +778,7 @@
 
     vosMessage.reserved = FTM_SYS_MSG_COOKIE;
     vosMessage.type     = SYS_MSG_ID_MC_THR_PROBE;
+    vosMessage.callback = NULL;
     vosMessage.bodyptr  = NULL;
 
     vos_mq_post_message(VOS_MQ_ID_SYS, &vosMessage);
diff --git a/wlan/prima/CORE/SYS/legacy/src/pal/inc/palApi.h b/wlan/prima/CORE/SYS/legacy/src/pal/inc/palApi.h
index 71e1278..4007612 100644
--- a/wlan/prima/CORE/SYS/legacy/src/pal/inc/palApi.h
+++ b/wlan/prima/CORE/SYS/legacy/src/pal/inc/palApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -451,7 +451,7 @@
 
     \return tick count.
 ----------------------------------------------------------------------------------*/
-tANI_U32 palGetTickCount(tHddHandle hHdd);
+tANI_TIMESTAMP palGetTickCount(tHddHandle hHdd);
 
 /** ---------------------------------------------------------------------------
 
diff --git a/wlan/prima/CORE/SYS/legacy/src/pal/src/palApiComm.c b/wlan/prima/CORE/SYS/legacy/src/pal/src/palApiComm.c
index 8b0ce71..c6ce6f4 100644
--- a/wlan/prima/CORE/SYS/legacy/src/pal/src/palApiComm.c
+++ b/wlan/prima/CORE/SYS/legacy/src/pal/src/palApiComm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -165,7 +165,7 @@
    
 
 
-tANI_U32 palGetTickCount(tHddHandle hHdd)
+tANI_TIMESTAMP palGetTickCount(tHddHandle hHdd)
 {
    return( vos_timer_get_system_ticks() );
 }
diff --git a/wlan/prima/CORE/SYS/legacy/src/utils/src/dot11f.c b/wlan/prima/CORE/SYS/legacy/src/utils/src/dot11f.c
index a4fbb05..8f5be20 100644
--- a/wlan/prima/CORE/SYS/legacy/src/utils/src/dot11f.c
+++ b/wlan/prima/CORE/SYS/legacy/src/utils/src/dot11f.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -28,7 +28,7 @@
   *
   *
   * This file was automatically generated by 'framesc'
-  * Mon Nov 10 19:49:53 2014 from the following file(s):
+  * Wed Sep  9 10:17:04 2015 from the following file(s):
   *
   * dot11f.frms
   *
@@ -763,6 +763,16 @@
 
 #define SigFfListenInterval ( 0x000f )
 
+void dot11fUnpackFfMagicCode(tpAniSirGlobal pCtx,
+                             tANI_U8 *pBuf,
+                             tDot11fFfMagicCode *pDst)
+{
+    DOT11F_MEMCPY(pCtx, pDst->magic, pBuf, 6);
+    (void)pCtx;
+} /* End dot11fUnpackFfMagicCode. */
+
+#define SigFfMagicCode ( 0x0010 )
+
 void dot11fUnpackFfMaxTxPower(tpAniSirGlobal pCtx,
                               tANI_U8 *pBuf,
                               tDot11fFfMaxTxPower *pDst)
@@ -771,7 +781,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfMaxTxPower. */
 
-#define SigFfMaxTxPower ( 0x0010 )
+#define SigFfMaxTxPower ( 0x0011 )
 
 void dot11fUnpackFfNumOfRepetitions(tpAniSirGlobal pCtx,
                                     tANI_U8 *pBuf,
@@ -781,7 +791,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfNumOfRepetitions. */
 
-#define SigFfNumOfRepetitions ( 0x0011 )
+#define SigFfNumOfRepetitions ( 0x0012 )
 
 void dot11fUnpackFfOperatingMode(tpAniSirGlobal pCtx,
                                  tANI_U8 *pBuf,
@@ -796,7 +806,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfOperatingMode. */
 
-#define SigFfOperatingMode ( 0x0012 )
+#define SigFfOperatingMode ( 0x0013 )
 
 void dot11fUnpackFfP2POUI(tpAniSirGlobal pCtx,
                           tANI_U8 *pBuf,
@@ -806,7 +816,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfP2POUI. */
 
-#define SigFfP2POUI ( 0x0013 )
+#define SigFfP2POUI ( 0x0014 )
 
 void dot11fUnpackFfP2POUISubType(tpAniSirGlobal pCtx,
                                  tANI_U8 *pBuf,
@@ -816,7 +826,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfP2POUISubType. */
 
-#define SigFfP2POUISubType ( 0x0014 )
+#define SigFfP2POUISubType ( 0x0015 )
 
 void dot11fUnpackFfRCPI(tpAniSirGlobal pCtx,
                         tANI_U8 *pBuf,
@@ -826,7 +836,37 @@
     (void)pCtx;
 } /* End dot11fUnpackFfRCPI. */
 
-#define SigFfRCPI ( 0x0015 )
+#define SigFfRCPI ( 0x0016 )
+
+void dot11fUnpackFfRMCDialogToken(tpAniSirGlobal pCtx,
+                                  tANI_U8 *pBuf,
+                                  tDot11fFfRMCDialogToken *pDst)
+{
+    framesntohl(pCtx, &pDst->token, pBuf, 0);
+    (void)pCtx;
+} /* End dot11fUnpackFfRMCDialogToken. */
+
+#define SigFfRMCDialogToken ( 0x0017 )
+
+void dot11fUnpackFfRMCOUI(tpAniSirGlobal pCtx,
+                          tANI_U8 *pBuf,
+                          tDot11fFfRMCOUI *pDst)
+{
+    DOT11F_MEMCPY(pCtx, pDst->oui, pBuf, 3);
+    (void)pCtx;
+} /* End dot11fUnpackFfRMCOUI. */
+
+#define SigFfRMCOUI ( 0x0018 )
+
+void dot11fUnpackFfRMCVersion(tpAniSirGlobal pCtx,
+                              tANI_U8 *pBuf,
+                              tDot11fFfRMCVersion *pDst)
+{
+    pDst->version = *pBuf;
+    (void)pCtx;
+} /* End dot11fUnpackFfRMCVersion. */
+
+#define SigFfRMCVersion ( 0x0019 )
 
 void dot11fUnpackFfRSNI(tpAniSirGlobal pCtx,
                         tANI_U8 *pBuf,
@@ -836,9 +876,19 @@
     (void)pCtx;
 } /* End dot11fUnpackFfRSNI. */
 
-#define SigFfRSNI ( 0x0016 )
+#define SigFfRSNI ( 0x001a )
 
-#define SigFfReason ( 0x0017 )
+#define SigFfReason ( 0x001b )
+
+void dot11fUnpackFfRuler(tpAniSirGlobal pCtx,
+                         tANI_U8 *pBuf,
+                         tDot11fFfRuler *pDst)
+{
+    DOT11F_MEMCPY(pCtx, pDst->mac, pBuf, 6);
+    (void)pCtx;
+} /* End dot11fUnpackFfRuler. */
+
+#define SigFfRuler ( 0x001c )
 
 void dot11fUnpackFfRxAntennaId(tpAniSirGlobal pCtx,
                                tANI_U8 *pBuf,
@@ -848,7 +898,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfRxAntennaId. */
 
-#define SigFfRxAntennaId ( 0x0018 )
+#define SigFfRxAntennaId ( 0x001d )
 
 void dot11fUnpackFfSMPowerModeSet(tpAniSirGlobal pCtx,
                                   tANI_U8 *pBuf,
@@ -862,9 +912,9 @@
     (void)pCtx;
 } /* End dot11fUnpackFfSMPowerModeSet. */
 
-#define SigFfSMPowerModeSet ( 0x0019 )
+#define SigFfSMPowerModeSet ( 0x001e )
 
-#define SigFfStatus ( 0x001a )
+#define SigFfStatus ( 0x001f )
 
 void dot11fUnpackFfStatusCode(tpAniSirGlobal pCtx,
                               tANI_U8 *pBuf,
@@ -874,7 +924,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfStatusCode. */
 
-#define SigFfStatusCode ( 0x001b )
+#define SigFfStatusCode ( 0x0020 )
 
 void dot11fUnpackFfTPCEleID(tpAniSirGlobal pCtx,
                             tANI_U8 *pBuf,
@@ -884,7 +934,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTPCEleID. */
 
-#define SigFfTPCEleID ( 0x001c )
+#define SigFfTPCEleID ( 0x0021 )
 
 void dot11fUnpackFfTPCEleLen(tpAniSirGlobal pCtx,
                              tANI_U8 *pBuf,
@@ -894,7 +944,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTPCEleLen. */
 
-#define SigFfTPCEleLen ( 0x001d )
+#define SigFfTPCEleLen ( 0x0022 )
 
 void dot11fUnpackFfTSInfo(tpAniSirGlobal pCtx,
                           tANI_U8 *pBuf,
@@ -915,7 +965,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTSInfo. */
 
-#define SigFfTSInfo ( 0x001e )
+#define SigFfTSInfo ( 0x0023 )
 
 void dot11fUnpackFfTimeStamp(tpAniSirGlobal pCtx,
                              tANI_U8 *pBuf,
@@ -925,7 +975,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTimeStamp. */
 
-#define SigFfTimeStamp ( 0x001f )
+#define SigFfTimeStamp ( 0x0024 )
 
 void dot11fUnpackFfTransactionId(tpAniSirGlobal pCtx,
                                  tANI_U8 *pBuf,
@@ -935,7 +985,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTransactionId. */
 
-#define SigFfTransactionId ( 0x0020 )
+#define SigFfTransactionId ( 0x0025 )
 
 void dot11fUnpackFfTxAntennaId(tpAniSirGlobal pCtx,
                                tANI_U8 *pBuf,
@@ -945,7 +995,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTxAntennaId. */
 
-#define SigFfTxAntennaId ( 0x0021 )
+#define SigFfTxAntennaId ( 0x0026 )
 
 void dot11fUnpackFfTxPower(tpAniSirGlobal pCtx,
                            tANI_U8 *pBuf,
@@ -955,7 +1005,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTxPower. */
 
-#define SigFfTxPower ( 0x0022 )
+#define SigFfTxPower ( 0x0027 )
 
 void dot11fUnpackFfVhtMembershipStatusArray(tpAniSirGlobal pCtx,
                                             tANI_U8 *pBuf,
@@ -965,7 +1015,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfVhtMembershipStatusArray. */
 
-#define SigFfVhtMembershipStatusArray ( 0x0023 )
+#define SigFfVhtMembershipStatusArray ( 0x0028 )
 
 void dot11fUnpackFfVhtUserPositionArray(tpAniSirGlobal pCtx,
                                         tANI_U8 *pBuf,
@@ -975,7 +1025,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfVhtUserPositionArray. */
 
-#define SigFfVhtUserPositionArray ( 0x0024 )
+#define SigFfVhtUserPositionArray ( 0x0029 )
 
 tANI_U32 dot11fUnpackTlvAuthorizedMACs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U16 tlvlen, tDot11fTLVAuthorizedMACs *pDst)
 {
@@ -15729,6 +15779,53 @@
 
 } /* End dot11fUnpackQosMapConfigure. */
 
+    static const tFFDefn FFS_RMC[] = {
+        { "Category", offsetof(tDot11fRMC, Category), SigFfCategory , DOT11F_FF_CATEGORY_LEN, },
+        { "RMCOUI", offsetof(tDot11fRMC, RMCOUI), SigFfRMCOUI , DOT11F_FF_RMCOUI_LEN, },
+        { "MagicCode", offsetof(tDot11fRMC, MagicCode), SigFfMagicCode , DOT11F_FF_MAGICCODE_LEN, },
+        { "RMCVersion", offsetof(tDot11fRMC, RMCVersion), SigFfRMCVersion , DOT11F_FF_RMCVERSION_LEN, },
+        { "Action", offsetof(tDot11fRMC, Action), SigFfAction , DOT11F_FF_ACTION_LEN, },
+        { "RMCDialogToken", offsetof(tDot11fRMC, RMCDialogToken), SigFfRMCDialogToken , DOT11F_FF_RMCDIALOGTOKEN_LEN, },
+        { "Ruler", offsetof(tDot11fRMC, Ruler), SigFfRuler , DOT11F_FF_RULER_LEN, },
+    { NULL, 0, 0, 0,},
+    };
+
+    static const tIEDefn IES_RMC[] = {
+    {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
+
+tANI_U32 dot11fUnpackRMC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fRMC *pFrm)
+{
+    tANI_U32 i = 0;
+    tANI_U32 status = 0;
+    status = UnpackCore(pCtx, pBuf, nBuf, FFS_RMC, IES_RMC, ( tANI_U8* )pFrm, sizeof(*pFrm));
+
+    (void)i;
+#   ifdef DOT11F_DUMP_FRAMES
+    if (!DOT11F_FAILED(status))
+    {
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Unpacked the RMC:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), pBuf, nBuf);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("to:\n"));
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Category:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Category.category, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCOUI:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCOUI.oui, 3);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("MagicCode:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->MagicCode.magic, 6);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCVersion:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCVersion.version, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Action:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Action.action, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCDialogToken:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCDialogToken.token, 4);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Ruler:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Ruler.mac, 6);
+    }
+#   endif // DOT11F_DUMP_FRAMES
+    return status;
+
+} /* End dot11fUnpackRMC. */
+
     static const tFFDefn FFS_RadioMeasurementReport[] = {
         { "Category", offsetof(tDot11fRadioMeasurementReport, Category), SigFfCategory , DOT11F_FF_CATEGORY_LEN, },
         { "Action", offsetof(tDot11fRadioMeasurementReport, Action), SigFfAction , DOT11F_FF_ACTION_LEN, },
@@ -20585,6 +20682,9 @@
         case SigFfListenInterval:
             dot11fUnpackFfCommonFunc(pCtx, pBufRemaining, (tANI_U16*)&((( tDot11fFfListenInterval* )(pFrm + pFf->offset ))->interval));
             break;
+        case SigFfMagicCode:
+            dot11fUnpackFfMagicCode(pCtx, pBufRemaining, ( tDot11fFfMagicCode* )(pFrm + pFf->offset ));
+            break;
         case SigFfMaxTxPower:
             dot11fUnpackFfMaxTxPower(pCtx, pBufRemaining, ( tDot11fFfMaxTxPower* )(pFrm + pFf->offset ));
             break;
@@ -20603,12 +20703,24 @@
         case SigFfRCPI:
             dot11fUnpackFfRCPI(pCtx, pBufRemaining, ( tDot11fFfRCPI* )(pFrm + pFf->offset ));
             break;
+        case SigFfRMCDialogToken:
+            dot11fUnpackFfRMCDialogToken(pCtx, pBufRemaining, ( tDot11fFfRMCDialogToken* )(pFrm + pFf->offset ));
+            break;
+        case SigFfRMCOUI:
+            dot11fUnpackFfRMCOUI(pCtx, pBufRemaining, ( tDot11fFfRMCOUI* )(pFrm + pFf->offset ));
+            break;
+        case SigFfRMCVersion:
+            dot11fUnpackFfRMCVersion(pCtx, pBufRemaining, ( tDot11fFfRMCVersion* )(pFrm + pFf->offset ));
+            break;
         case SigFfRSNI:
             dot11fUnpackFfRSNI(pCtx, pBufRemaining, ( tDot11fFfRSNI* )(pFrm + pFf->offset ));
             break;
         case SigFfReason:
             dot11fUnpackFfCommonFunc(pCtx, pBufRemaining, (tANI_U16*)&((( tDot11fFfReason* )(pFrm + pFf->offset ))->code));
             break;
+        case SigFfRuler:
+            dot11fUnpackFfRuler(pCtx, pBufRemaining, ( tDot11fFfRuler* )(pFrm + pFf->offset ));
+            break;
         case SigFfRxAntennaId:
             dot11fUnpackFfRxAntennaId(pCtx, pBufRemaining, ( tDot11fFfRxAntennaId* )(pFrm + pFf->offset ));
             break;
@@ -22631,6 +22743,14 @@
     return status;
 } /* End dot11fGetPackedQosMapConfigureSize. */
 
+tANI_U32 dot11fGetPackedRMCSize(tpAniSirGlobal pCtx, tDot11fRMC *pFrm, tANI_U32 *pnNeeded)
+{
+    tANI_U32 status = 0;
+    *pnNeeded = 22;
+    status = GetPackedSizeCore(pCtx, ( tANI_U8* )pFrm, pnNeeded, IES_RMC);
+    return status;
+} /* End dot11fGetPackedRMCSize. */
+
 tANI_U32 dot11fGetPackedRadioMeasurementReportSize(tpAniSirGlobal pCtx, tDot11fRadioMeasurementReport *pFrm, tANI_U32 *pnNeeded)
 {
     tANI_U32 status = 0;
@@ -23892,6 +24012,14 @@
     (void)pCtx;
 } /* End dot11fPackFfListenInterval. */
 
+void dot11fPackFfMagicCode(tpAniSirGlobal pCtx,
+                           tDot11fFfMagicCode *pSrc,
+                           tANI_U8 *pBuf)
+{
+    DOT11F_MEMCPY(pCtx, pBuf, pSrc->magic, 6);
+    (void)pCtx;
+} /* End dot11fPackFfMagicCode. */
+
 void dot11fPackFfMaxTxPower(tpAniSirGlobal pCtx,
                             tDot11fFfMaxTxPower *pSrc,
                             tANI_U8 *pBuf)
@@ -23946,6 +24074,30 @@
     (void)pCtx;
 } /* End dot11fPackFfRCPI. */
 
+void dot11fPackFfRMCDialogToken(tpAniSirGlobal pCtx,
+                                tDot11fFfRMCDialogToken *pSrc,
+                                tANI_U8 *pBuf)
+{
+    frameshtonl(pCtx, pBuf, pSrc->token, 0);
+    (void)pCtx;
+} /* End dot11fPackFfRMCDialogToken. */
+
+void dot11fPackFfRMCOUI(tpAniSirGlobal pCtx,
+                        tDot11fFfRMCOUI *pSrc,
+                        tANI_U8 *pBuf)
+{
+    DOT11F_MEMCPY(pCtx, pBuf, pSrc->oui, 3);
+    (void)pCtx;
+} /* End dot11fPackFfRMCOUI. */
+
+void dot11fPackFfRMCVersion(tpAniSirGlobal pCtx,
+                            tDot11fFfRMCVersion *pSrc,
+                            tANI_U8 *pBuf)
+{
+    *pBuf = pSrc->version;
+    (void)pCtx;
+} /* End dot11fPackFfRMCVersion. */
+
 void dot11fPackFfRSNI(tpAniSirGlobal pCtx,
                       tDot11fFfRSNI *pSrc,
                       tANI_U8 *pBuf)
@@ -23962,6 +24114,14 @@
     (void)pCtx;
 } /* End dot11fPackFfReason. */
 
+void dot11fPackFfRuler(tpAniSirGlobal pCtx,
+                       tDot11fFfRuler *pSrc,
+                       tANI_U8 *pBuf)
+{
+    DOT11F_MEMCPY(pCtx, pBuf, pSrc->mac, 6);
+    (void)pCtx;
+} /* End dot11fPackFfRuler. */
+
 void dot11fPackFfRxAntennaId(tpAniSirGlobal pCtx,
                              tDot11fFfRxAntennaId *pSrc,
                              tANI_U8 *pBuf)
@@ -41402,6 +41562,40 @@
 
 } /* End dot11fUnpackQosMapConfigure. */
 
+tANI_U32 dot11fPackRMC(tpAniSirGlobal pCtx, tDot11fRMC *pFrm, tANI_U8 *pBuf, tANI_U32 nBuf, tANI_U32 *pnConsumed)
+{
+    tANI_U32 i = 0;
+    tANI_U32 status = 0;
+    (void)i;
+    *pnConsumed = 0U;
+    status = PackCore(pCtx, (tANI_U8*)pFrm, pBuf, nBuf, pnConsumed, FFS_RMC, IES_RMC);
+
+#   ifdef DOT11F_DUMP_FRAMES
+    if (!DOT11F_FAILED(status))
+    {
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Packed the RMC:\n"));
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Category:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Category.category, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCOUI:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCOUI.oui, 3);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("MagicCode:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->MagicCode.magic, 6);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCVersion:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCVersion.version, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Action:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Action.action, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCDialogToken:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCDialogToken.token, 4);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Ruler:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Ruler.mac, 6);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("to:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), pBuf, nBuf);
+    }
+#   endif // DOT11F_DUMP_FRAMES
+    return status;
+
+} /* End dot11fUnpackRMC. */
+
 tANI_U32 dot11fPackRadioMeasurementReport(tpAniSirGlobal pCtx, tDot11fRadioMeasurementReport *pFrm, tANI_U8 *pBuf, tANI_U32 nBuf, tANI_U32 *pnConsumed)
 {
     tANI_U32 i = 0;
@@ -45913,6 +46107,9 @@
             case SigFfListenInterval:
                 dot11fPackFfListenInterval(pCtx, (tDot11fFfListenInterval* )(pSrc + pFf->offset), pBufRemaining);
                 break;
+            case SigFfMagicCode:
+                dot11fPackFfMagicCode(pCtx, (tDot11fFfMagicCode* )(pSrc + pFf->offset), pBufRemaining);
+                break;
             case SigFfMaxTxPower:
                 dot11fPackFfMaxTxPower(pCtx, (tDot11fFfMaxTxPower* )(pSrc + pFf->offset), pBufRemaining);
                 break;
@@ -45931,12 +46128,24 @@
             case SigFfRCPI:
                 dot11fPackFfRCPI(pCtx, (tDot11fFfRCPI* )(pSrc + pFf->offset), pBufRemaining);
                 break;
+            case SigFfRMCDialogToken:
+                dot11fPackFfRMCDialogToken(pCtx, (tDot11fFfRMCDialogToken* )(pSrc + pFf->offset), pBufRemaining);
+                break;
+            case SigFfRMCOUI:
+                dot11fPackFfRMCOUI(pCtx, (tDot11fFfRMCOUI* )(pSrc + pFf->offset), pBufRemaining);
+                break;
+            case SigFfRMCVersion:
+                dot11fPackFfRMCVersion(pCtx, (tDot11fFfRMCVersion* )(pSrc + pFf->offset), pBufRemaining);
+                break;
             case SigFfRSNI:
                 dot11fPackFfRSNI(pCtx, (tDot11fFfRSNI* )(pSrc + pFf->offset), pBufRemaining);
                 break;
             case SigFfReason:
                 dot11fPackFfReason(pCtx, (tDot11fFfReason* )(pSrc + pFf->offset), pBufRemaining);
                 break;
+            case SigFfRuler:
+                dot11fPackFfRuler(pCtx, (tDot11fFfRuler* )(pSrc + pFf->offset), pBufRemaining);
+                break;
             case SigFfRxAntennaId:
                 dot11fPackFfRxAntennaId(pCtx, (tDot11fFfRxAntennaId* )(pSrc + pFf->offset), pBufRemaining);
                 break;
diff --git a/wlan/prima/CORE/SYS/legacy/src/utils/src/macTrace.c b/wlan/prima/CORE/SYS/legacy/src/utils/src/macTrace.c
index 0003a52..12a8a6b 100644
--- a/wlan/prima/CORE/SYS/legacy/src/utils/src/macTrace.c
+++ b/wlan/prima/CORE/SYS/legacy/src/utils/src/macTrace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -550,6 +550,11 @@
 #endif
         CASE_RETURN_STRING(eWNI_SME_CANDIDATE_FOUND_IND);
         CASE_RETURN_STRING(eWNI_SME_HANDOFF_REQ);
+#ifdef WLAN_FEATURE_RMC
+        CASE_RETURN_STRING(eWNI_SME_ENABLE_RMC_REQ);
+        CASE_RETURN_STRING(eWNI_SME_DISABLE_RMC_REQ);
+        CASE_RETURN_STRING(eWNI_SME_IBSS_PEER_INFO_RSP);
+#endif
         CASE_RETURN_STRING(eWNI_SME_GET_ROAM_RSSI_REQ);
         CASE_RETURN_STRING(eWNI_SME_GET_ROAM_RSSI_RSP);
         CASE_RETURN_STRING(eWNI_SME_GET_TSM_STATS_REQ);
@@ -804,6 +809,10 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
         CASE_RETURN_STRING(WDA_ROAM_SCAN_OFFLOAD_REQ);
         CASE_RETURN_STRING(WDA_ROAM_SCAN_OFFLOAD_RSP);
+        CASE_RETURN_STRING(WDA_PER_ROAM_SCAN_OFFLOAD_REQ);
+        CASE_RETURN_STRING(WDA_PER_ROAM_SCAN_OFFLOAD_RSP);
+        CASE_RETURN_STRING(WDA_PER_ROAM_SCAN_TRIGGER_REQ);
+        CASE_RETURN_STRING(WDA_PER_ROAM_SCAN_TRIGGER_RSP);
 #endif
 #ifdef WLAN_WAKEUP_EVENTS
         CASE_RETURN_STRING(WDA_WAKE_REASON_IND);
@@ -838,6 +847,13 @@
 #ifdef FEATURE_WLAN_LPHB
         CASE_RETURN_STRING(WDA_LPHB_WAIT_EXPIRE_IND);
 #endif
+#ifdef WLAN_FEATURE_RMC
+        CASE_RETURN_STRING(WDA_RMC_BECOME_RULER);
+        CASE_RETURN_STRING(WDA_RMC_RULER_SELECT_RESP);
+        CASE_RETURN_STRING(WDA_RMC_RULER_REQ);
+        CASE_RETURN_STRING(WDA_RMC_UPDATE_IND);
+        CASE_RETURN_STRING(WDA_GET_IBSS_PEER_INFO_RSP);
+#endif
 #ifdef FEATURE_WLAN_BATCH_SCAN
         CASE_RETURN_STRING(WDA_SET_BATCH_SCAN_REQ);
         CASE_RETURN_STRING(WDA_SET_BATCH_SCAN_RSP);
@@ -855,6 +871,10 @@
         CASE_RETURN_STRING(WDA_ADD_PERIODIC_TX_PTRN_IND);
         CASE_RETURN_STRING(WDA_DEL_PERIODIC_TX_PTRN_IND);
         CASE_RETURN_STRING(WDA_RATE_UPDATE_IND);
+#ifdef WLAN_FEATURE_RMC
+        CASE_RETURN_STRING(WDA_GET_IBSS_PEER_INFO_REQ);
+        CASE_RETURN_STRING(WDA_TX_FAIL_MONITOR_IND);
+#endif /* WLAN_FEATURE_RMC */
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
         CASE_RETURN_STRING(WDA_LINK_LAYER_STATS_SET_REQ);
         CASE_RETURN_STRING(WDA_LINK_LAYER_STATS_GET_REQ);
@@ -866,9 +886,8 @@
         CASE_RETURN_STRING(WDA_EXTSCAN_STOP_REQ);
         CASE_RETURN_STRING(WDA_EXTSCAN_SET_BSSID_HOTLIST_REQ);
         CASE_RETURN_STRING(WDA_EXTSCAN_RESET_BSSID_HOTLIST_REQ);
-        CASE_RETURN_STRING(WDA_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ);
-        CASE_RETURN_STRING(WDA_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ);
         CASE_RETURN_STRING(WDA_EXTSCAN_GET_CACHED_RESULTS_REQ);
+        CASE_RETURN_STRING(WDA_HIGH_PRIORITY_DATA_INFO_IND);
 #endif /* WLAN_FEATURE_EXTSCAN */
         CASE_RETURN_STRING(WDA_HT40_OBSS_SCAN_IND);
         CASE_RETURN_STRING(WDA_HT40_OBSS_STOP_SCAN_IND);
diff --git a/wlan/prima/CORE/SYS/legacy/src/utils/src/parsemactrace.cmm b/wlan/prima/CORE/SYS/legacy/src/utils/src/parsemactrace.cmm
new file mode 100644
index 0000000..82ec953
--- /dev/null
+++ b/wlan/prima/CORE/SYS/legacy/src/utils/src/parsemactrace.cmm
@@ -0,0 +1,973 @@
+;Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+
+;Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+
+;Permission to use, copy, modify, and/or distribute this software for
+;any purpose with or without fee is hereby granted, provided that the
+;above copyright notice and this permission notice appear in all
+;copies.
+
+;THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+;WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+;WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+;AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+;DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+;PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+;TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+;PERFORMANCE OF THIS SOFTWARE.
+
+;This file was originally distributed by Qualcomm Atheros, Inc.
+;under proprietary terms before Copyright ownership was assigned
+;to the Linux Foundation.
+
+;parsemactrace.cmm - This script parses MAC trace table in UMAC layer
+;This script relies on message id's placed in interface header file.
+;If some message ID's are changed later, since they do not use enum, this script
+;might show incorrect data. So message ID's should always be in sync
+;Author:        Saluja, Harpreet
+;Date:          09/09/2013
+;History:-
+;Date           Modified by    Modification Information
+;--------------------------------------------------------------------
+
+
+ENTRY &FILE
+
+IF "&FILE"==""
+(
+DIALOG.file *.txt
+ENTRY &FILE
+)
+
+OPEN #1 "&FILE" /Create /Write /Append
+
+
+Var.NEW  char [256][50] \halmsgtype
+
+Var.SET \halmsgtype[0x20]="SIR_HAL_RADAR_DETECTED_IND"
+Var.SET \halmsgtype[0x21]="SIR_HAL_WDT_KAM_RSP"
+Var.SET \halmsgtype[0x22]="SIR_HAL_TIMER_TEMP_MEAS_REQ"
+Var.SET \halmsgtype[0x23]="SIR_HAL_TIMER_PERIODIC_STATS_COLLECT_REQ"
+Var.SET \halmsgtype[0x24]="SIR_HAL_CAL_REQ_NTF"
+Var.SET \halmsgtype[0x25]="SIR_HAL_MNT_OPEN_TPC_TEMP_MEAS_REQ"
+Var.SET \halmsgtype[0x26]="SIR_HAL_CCA_MONITOR_INTERVAL_TO"
+Var.SET \halmsgtype[0x27]="SIR_HAL_CCA_MONITOR_DURATION_TO"
+Var.SET \halmsgtype[0x28]="SIR_HAL_CCA_MONITOR_START"
+Var.SET \halmsgtype[0x29]="SIR_HAL_CCA_MONITOR_STOP"
+Var.SET \halmsgtype[0x2A]="SIR_HAL_CCA_CHANGE_MODE"
+Var.SET \halmsgtype[0x2B]="SIR_HAL_TIMER_WRAP_AROUND_STATS_COLLECT_REQ"
+Var.SET \halmsgtype[0x2D]="SIR_HAL_ADD_STA_REQ"
+Var.SET \halmsgtype[0x2E]="SIR_HAL_ADD_STA_RSP"
+Var.SET \halmsgtype[0x2F]="SIR_HAL_DELETE_STA_REQ"
+Var.SET \halmsgtype[0x30]="SIR_HAL_DELETE_STA_RSP"
+Var.SET \halmsgtype[0x31]="SIR_HAL_ADD_BSS_REQ"
+Var.SET \halmsgtype[0x32]="SIR_HAL_ADD_BSS_RSP"
+Var.SET \halmsgtype[0x33]="SIR_HAL_DELETE_BSS_REQ"
+Var.SET \halmsgtype[0x34]="SIR_HAL_DELETE_BSS_RSP"
+Var.SET \halmsgtype[0x35]="SIR_HAL_INIT_SCAN_REQ"
+Var.SET \halmsgtype[0x36]="SIR_HAL_INIT_SCAN_RSP"
+Var.SET \halmsgtype[0x37]="SIR_HAL_START_SCAN_REQ"
+Var.SET \halmsgtype[0x38]="SIR_HAL_START_SCAN_RSP"
+Var.SET \halmsgtype[0x39]="SIR_HAL_END_SCAN_REQ"
+Var.SET \halmsgtype[0x3A]="SIR_HAL_END_SCAN_RSP"
+Var.SET \halmsgtype[0x3B]="SIR_HAL_FINISH_SCAN_REQ"
+Var.SET \halmsgtype[0x3C]="SIR_HAL_FINISH_SCAN_RSP"
+Var.SET \halmsgtype[0x3D]="SIR_HAL_SEND_BEACON_REQ"
+Var.SET \halmsgtype[0x3E]="SIR_HAL_SEND_BEACON_RSP"
+Var.SET \halmsgtype[0x3F]="SIR_HAL_INIT_CFG_REQ"
+Var.SET \halmsgtype[0x40]="SIR_HAL_INIT_CFG_RSP"
+Var.SET \halmsgtype[0x41]="SIR_HAL_INIT_WM_CFG_REQ"
+Var.SET \halmsgtype[0x42]="SIR_HAL_INIT_WM_CFG_RSP"
+Var.SET \halmsgtype[0x43]="SIR_HAL_SET_BSSKEY_REQ"
+Var.SET \halmsgtype[0x44]="SIR_HAL_SET_BSSKEY_RSP"
+Var.SET \halmsgtype[0x45]="SIR_HAL_SET_STAKEY_REQ"
+Var.SET \halmsgtype[0x46]="SIR_HAL_SET_STAKEY_RSP"
+Var.SET \halmsgtype[0x47]="SIR_HAL_DPU_STATS_REQ"
+Var.SET \halmsgtype[0x48]="SIR_HAL_DPU_STATS_RSP"
+Var.SET \halmsgtype[0x49]="SIR_HAL_GET_DPUINFO_REQ"
+Var.SET \halmsgtype[0x4A]="SIR_HAL_GET_DPUINFO_RSP"
+Var.SET \halmsgtype[0x4B]="SIR_HAL_UPDATE_EDCA_PROFILE_IND"
+Var.SET \halmsgtype[0x4D]="SIR_HAL_UPDATE_STARATEINFO_REQ"
+Var.SET \halmsgtype[0x4E]="SIR_HAL_UPDATE_STARATEINFO_RSP"
+Var.SET \halmsgtype[0x4F]="SIR_HAL_UPDATE_BEACON_IND"
+Var.SET \halmsgtype[0x50]="SIR_HAL_UPDATE_CF_IND"
+Var.SET \halmsgtype[0x51]="SIR_HAL_CHNL_SWITCH_REQ"
+Var.SET \halmsgtype[0x52]="SIR_HAL_ADD_TS_REQ"
+Var.SET \halmsgtype[0x53]="SIR_HAL_DEL_TS_REQ"
+Var.SET \halmsgtype[0x54]="SIR_HAL_SOFTMAC_TXSTAT_REPORT"
+Var.SET \halmsgtype[0x5D]="SIR_HAL_MBOX_SENDMSG_COMPLETE_IND"
+Var.SET \halmsgtype[0x55]="SIR_HAL_EXIT_BMPS_REQ"
+Var.SET \halmsgtype[0x56]="SIR_HAL_EXIT_BMPS_RSP"
+Var.SET \halmsgtype[0x57]="SIR_HAL_EXIT_BMPS_IND"
+Var.SET \halmsgtype[0x58]="SIR_HAL_ENTER_BMPS_REQ"
+Var.SET \halmsgtype[0x59]="SIR_HAL_ENTER_BMPS_RSP"
+Var.SET \halmsgtype[0x5A]="SIR_HAL_BMPS_STATUS_IND"
+Var.SET \halmsgtype[0x5B]="SIR_HAL_MISSED_BEACON_IND"
+Var.SET \halmsgtype[0x5C]="SIR_HAL_SWITCH_CHANNEL_RSP"
+Var.SET \halmsgtype[0x5E]="SIR_HAL_PWR_SAVE_CFG"
+Var.SET \halmsgtype[0x5F]="SIR_HAL_REGISTER_PE_CALLBACK"
+Var.SET \halmsgtype[0x60]="SIR_HAL_SOFTMAC_MEM_READREQUEST"
+Var.SET \halmsgtype[0x61]="SIR_HAL_SOFTMAC_MEM_WRITEREQUEST"
+Var.SET \halmsgtype[0x62]="SIR_HAL_SOFTMAC_MEM_READRESPONSE"
+Var.SET \halmsgtype[0x63]="SIR_HAL_SOFTMAC_BULKREGWRITE_CONFIRM"
+Var.SET \halmsgtype[0x64]="SIR_HAL_SOFTMAC_BULKREGREAD_RESPONSE"
+Var.SET \halmsgtype[0x65]="SIR_HAL_SOFTMAC_HOSTMESG_MSGPROCESSRESULT"
+Var.SET \halmsgtype[0x66]="SIR_HAL_ADDBA_REQ"
+Var.SET \halmsgtype[0x67]="SIR_HAL_ADDBA_RSP"
+Var.SET \halmsgtype[0x68]="SIR_HAL_DELBA_IND"
+Var.SET \halmsgtype[0x69]="SIR_HAL_DEL_BA_IND"
+Var.SET \halmsgtype[0x6A]="SIR_HAL_DELBA_REQ"
+Var.SET \halmsgtype[0x6B]="SIR_HAL_IBSS_STA_ADD"
+Var.SET \halmsgtype[0x6C]="SIR_HAL_TIMER_ADJUST_ADAPTIVE_THRESHOLD_IND"
+Var.SET \halmsgtype[0x6D]="SIR_HAL_SET_LINK_STATE"
+Var.SET \halmsgtype[0x6E]="SIR_HAL_ENTER_IMPS_REQ"
+Var.SET \halmsgtype[0x6F]="SIR_HAL_ENTER_IMPS_RSP"
+Var.SET \halmsgtype[0x70]="SIR_HAL_EXIT_IMPS_RSP"
+Var.SET \halmsgtype[0x71]="SIR_HAL_EXIT_IMPS_REQ"
+Var.SET \halmsgtype[0x72]="SIR_HAL_SOFTMAC_HOSTMESG_PS_STATUS_IND"
+Var.SET \halmsgtype[0x73]="SIR_HAL_POSTPONE_ENTER_IMPS_RSP"
+Var.SET \halmsgtype[0x74]="SIR_HAL_STA_STAT_REQ"
+Var.SET \halmsgtype[0x75]="SIR_HAL_GLOBAL_STAT_REQ"
+Var.SET \halmsgtype[0x76]="SIR_HAL_AGGR_STAT_REQ"
+Var.SET \halmsgtype[0x77]="SIR_HAL_STA_STAT_RSP"
+Var.SET \halmsgtype[0x78]="SIR_HAL_GLOBAL_STAT_RSP"
+Var.SET \halmsgtype[0x79]="SIR_HAL_AGGR_STAT_RSP"
+Var.SET \halmsgtype[0x7A]="SIR_HAL_STAT_SUMM_REQ"
+Var.SET \halmsgtype[0x7C]="SIR_HAL_STAT_SUMM_RSP"
+Var.SET \halmsgtype[0x7D]="SIR_HAL_REMOVE_BSSKEY_REQ"
+Var.SET \halmsgtype[0x7E]="SIR_HAL_REMOVE_BSSKEY_RSP"
+Var.SET \halmsgtype[0x7F]="SIR_HAL_REMOVE_STAKEY_REQ"
+Var.SET \halmsgtype[0x80]="SIR_HAL_REMOVE_STAKEY_RSP"
+Var.SET \halmsgtype[0x81]="SIR_HAL_SET_STA_BCASTKEY_REQ"
+Var.SET \halmsgtype[0x82]="SIR_HAL_SET_STA_BCASTKEY_RSP"
+Var.SET \halmsgtype[0x83]="SIR_HAL_REMOVE_STA_BCASTKEY_REQ"
+Var.SET \halmsgtype[0x84]="SIR_HAL_REMOVE_STA_BCASTKEY_RSP"
+Var.SET \halmsgtype[0x85]="SIR_HAL_ADD_TS_RSP"
+Var.SET \halmsgtype[0x86]="SIR_HAL_DPU_MIC_ERROR"
+Var.SET \halmsgtype[0x87]="SIR_HAL_TIMER_BA_ACTIVITY_REQ"
+Var.SET \halmsgtype[0x88]="SIR_HAL_TIMER_CHIP_MONITOR_TIMEOUT"
+Var.SET \halmsgtype[0x89]="SIR_HAL_TIMER_TRAFFIC_ACTIVITY_REQ"
+Var.SET \halmsgtype[0x8A]="SIR_HAL_TIMER_ADC_RSSI_STATS"
+Var.SET \halmsgtype[0x8B]="SIR_HAL_MIC_FAILURE_IND"
+Var.SET \halmsgtype[0x8C]="SIR_HAL_UPDATE_UAPSD_IND"
+Var.SET \halmsgtype[0x8D]="SIR_HAL_SET_MIMOPS_REQ"
+Var.SET \halmsgtype[0x8E]="SIR_HAL_SET_MIMOPS_RSP"
+Var.SET \halmsgtype[0x8F]="SIR_HAL_SYS_READY_IND"
+Var.SET \halmsgtype[0x90]="SIR_HAL_SET_TX_POWER_REQ"
+Var.SET \halmsgtype[0x91]="SIR_HAL_SET_TX_POWER_RSP"
+Var.SET \halmsgtype[0x92]="SIR_HAL_GET_TX_POWER_REQ"
+Var.SET \halmsgtype[0x93]="SIR_HAL_GET_TX_POWER_RSP"
+Var.SET \halmsgtype[0x94]="SIR_HAL_GET_NOISE_REQ"
+Var.SET \halmsgtype[0x95]="SIR_HAL_GET_NOISE_RSP"
+Var.SET \halmsgtype[0x96]="SIR_HAL_TRANSMISSION_CONTROL_IND"
+Var.SET \halmsgtype[0x97]="SIR_HAL_INIT_RADAR_IND"
+Var.SET \halmsgtype[0x98]="SIR_HAL_BEACON_PRE_IND"
+Var.SET \halmsgtype[0x99]="SIR_HAL_ENTER_UAPSD_REQ"
+Var.SET \halmsgtype[0x9A]="SIR_HAL_ENTER_UAPSD_RSP"
+Var.SET \halmsgtype[0x9B]="SIR_HAL_EXIT_UAPSD_REQ"
+Var.SET \halmsgtype[0x9C]="SIR_HAL_EXIT_UAPSD_RSP"
+Var.SET \halmsgtype[0x9D]="SIR_HAL_LOW_RSSI_IND"
+Var.SET \halmsgtype[0x9E]="SIR_HAL_BEACON_FILTER_IND"
+Var.SET \halmsgtype[0x9F]="SIR_HAL_WOWL_ADD_BCAST_PTRN"
+Var.SET \halmsgtype[0xA0]="SIR_HAL_WOWL_DEL_BCAST_PTRN"
+Var.SET \halmsgtype[0xA1]="SIR_HAL_WOWL_ENTER_REQ"
+Var.SET \halmsgtype[0xA2]="SIR_HAL_WOWL_ENTER_RSP"
+Var.SET \halmsgtype[0xA3]="SIR_HAL_WOWL_EXIT_REQ"
+Var.SET \halmsgtype[0xA4]="SIR_HAL_WOWL_EXIT_RSP"
+Var.SET \halmsgtype[0xA5]="SIR_HAL_TX_COMPLETE_IND"
+Var.SET \halmsgtype[0xA6]="SIR_HAL_TIMER_RA_COLLECT_AND_ADAPT"
+Var.SET \halmsgtype[0xA7]="SIR_HAL_GET_STATISTICS_REQ"
+Var.SET \halmsgtype[0xA8]="SIR_HAL_GET_STATISTICS_RSP"
+Var.SET \halmsgtype[0xA9]="SIR_HAL_SET_KEY_DONE"
+Var.SET \halmsgtype[0xAA]="SIR_HAL_BTC_SET_CFG"
+Var.SET \halmsgtype[0xAB]="SIR_HAL_SIGNAL_BT_EVENT"
+Var.SET \halmsgtype[0xAC]="SIR_HAL_HANDLE_FW_MBOX_RSP"
+Var.SET \halmsgtype[0xAD]="SIR_HAL_UPDATE_PROBE_RSP_TEMPLATE_IND"
+Var.SET \halmsgtype[0xAE]="SIR_LIM_ADDR2_MISS_IND"
+Var.SET \halmsgtype[0xAF]="SIR_HAL_START_OEM_DATA_REQ"
+Var.SET \halmsgtype[0xB0]="SIR_HAL_START_OEM_DATA_RSP"
+Var.SET \halmsgtype[0xB1]="SIR_HAL_FINISH_OEM_DATA_REQ"
+Var.SET \halmsgtype[0xB2]="SIR_HAL_SET_MAX_TX_POWER_REQ"
+Var.SET \halmsgtype[0xB3]="SIR_HAL_SET_MAX_TX_POWER_RSP"
+Var.SET \halmsgtype[0xB4]="SIR_HAL_SEND_MSG_COMPLETE"
+Var.SET \halmsgtype[0xB5]="SIR_HAL_SET_HOST_OFFLOAD"
+Var.SET \halmsgtype[0xB6]="SIR_HAL_ADD_STA_SELF_REQ"
+Var.SET \halmsgtype[0xB7]="SIR_HAL_ADD_STA_SELF_RSP"
+Var.SET \halmsgtype[0xB8]="SIR_HAL_DEL_STA_SELF_REQ"
+Var.SET \halmsgtype[0xB9]="SIR_HAL_DEL_STA_SELF_RSP"
+Var.SET \halmsgtype[0xBA]="SIR_HAL_SIGNAL_BTAMP_EVENT"
+Var.SET \halmsgtype[0xBB]="SIR_HAL_CFG_RXP_FILTER_REQ"
+Var.SET \halmsgtype[0xBC]="SIR_HAL_CFG_RXP_FILTER_RSP"
+Var.SET \halmsgtype[0xBD]="SIR_HAL_AGGR_ADD_TS_REQ"
+Var.SET \halmsgtype[0xBE]="SIR_HAL_AGGR_ADD_TS_RSP"
+Var.SET \halmsgtype[0xBF]="SIR_HAL_AGGR_QOS_REQ"
+Var.SET \halmsgtype[0xC0]="SIR_HAL_AGGR_QOS_RSP"
+Var.SET \halmsgtype[0xC1]="SIR_HAL_SET_P2P_GO_NOA_REQ"
+Var.SET \halmsgtype[0xC2]="SIR_HAL_P2P_NOA_ATTR_IND"
+Var.SET \halmsgtype[0xC3]="SIR_HAL_P2P_NOA_START_IND"
+Var.SET \halmsgtype[0xC5]="SIR_HAL_SET_LINK_STATE_RSP"
+Var.SET \halmsgtype[0xC6]="SIR_HAL_WLAN_SUSPEND_IND"
+Var.SET \halmsgtype[0xC7]="SIR_HAL_WLAN_RESUME_REQ"
+Var.SET \halmsgtype[0xC8]="SIR_HAL_SET_KEEP_ALIVE"
+Var.SET \halmsgtype[0xC9]="SIR_HAL_SET_NS_OFFLOAD"
+Var.SET \halmsgtype[0xCA]="SIR_HAL_SET_PNO_REQ"
+Var.SET \halmsgtype[0xCB]="SIR_HAL_SET_PNO_CHANGED_IND"
+Var.SET \halmsgtype[0xCC]="SIR_HAL_UPDATE_SCAN_PARAMS"
+Var.SET \halmsgtype[0xCD]="SIR_HAL_SET_RSSI_FILTER_REQ"
+Var.SET \halmsgtype[0xCE]="SIR_HAL_SET_TX_PER_TRACKING_REQ"
+Var.SET \halmsgtype[0xCF]="SIR_HAL_8023_MULTICAST_LIST_REQ"
+Var.SET \halmsgtype[0xD0]="SIR_HAL_RECEIVE_FILTER_SET_FILTER_REQ"
+Var.SET \halmsgtype[0xD1]="SIR_HAL_PACKET_COALESCING_FILTER_MATCH_COUNT_REQ"
+Var.SET \halmsgtype[0xD2]="SIR_HAL_PACKET_COALESCING_FILTER_MATCH_COUNT_RSP"
+Var.SET \halmsgtype[0xD3]="SIR_HAL_RECEIVE_FILTER_CLEAR_FILTER_REQ"
+Var.SET \halmsgtype[0xD4]="SIR_HAL_SET_POWER_PARAMS_REQ"
+Var.SET \halmsgtype[0xD5]="SIR_HAL_GTK_OFFLOAD_REQ"
+Var.SET \halmsgtype[0xD6]="SIR_HAL_GTK_OFFLOAD_GETINFO_REQ"
+Var.SET \halmsgtype[0xD7]="SIR_HAL_GTK_OFFLOAD_GETINFO_RSP"
+Var.SET \halmsgtype[0xD8]="SIR_HAL_TSM_STATS_REQ"
+Var.SET \halmsgtype[0xD9]="SIR_HAL_TSM_STATS_RSP"
+Var.SET \halmsgtype[0xDA]="SIR_HAL_WAKE_REASON_IND"
+Var.SET \halmsgtype[0xDB]="SIR_HAL_SET_TM_LEVEL_REQ"
+Var.SET \halmsgtype[0xDC]="SIR_HAL_UPDATE_OP_MODE"
+Var.SET \halmsgtype[0xDD]="SIR_HAL_TDLS_LINK_ESTABLISH"
+Var.SET \halmsgtype[0xDE]="SIR_HAL_TDLS_LINK_TEARDOWN"
+Var.SET \halmsgtype[0xE3]="SIR_HAL_TRAFFIC_STATS_IND"
+Var.SET \halmsgtype[0xE5]="SIR_HAL_START_SCAN_OFFLOAD_REQ"
+Var.SET \halmsgtype[0xE6]="SIR_HAL_START_SCAN_OFFLOAD_RSP"
+Var.SET \halmsgtype[0xE7]="SIR_HAL_UPDATE_CHAN_LIST_REQ"
+Var.SET \halmsgtype[0xE8]="SIR_HAL_UPDATE_CHAN_LIST_RSP"
+Var.SET \halmsgtype[0xE9]="SIR_HAL_STOP_SCAN_OFFLOAD_REQ"
+Var.SET \halmsgtype[0xEA]="SIR_HAL_STOP_SCAN_OFFLOAD_RSP"
+Var.SET \halmsgtype[0xEB]="SIR_HAL_RX_SCAN_EVENT"
+Var.SET \halmsgtype[0xEC]="SIR_HAL_DHCP_START_IND"
+Var.SET \halmsgtype[0xED]="SIR_HAL_DHCP_STOP_IND"
+Var.SET \halmsgtype[0xEE]="SIR_HAL_IBSS_PEER_INACTIVITY_IND"
+Var.SET \halmsgtype[0xEF]="SIR_HAL_LPHB_CONF_IND"
+Var.SET \halmsgtype[0xF0]="SIR_HAL_LPHB_WAIT_EXPIRE_IND"
+Var.SET \halmsgtype[0xF1]="SIR_HAL_ADD_PERIODIC_TX_PTRN_IND"
+Var.SET \halmsgtype[0xF2]="SIR_HAL_DEL_PERIODIC_TX_PTRN_IND"
+Var.SET \halmsgtype[0xF3]="SIR_HAL_RMC_BECOME_LEADER"
+Var.SET \halmsgtype[0xF4]="SIR_HAL_RMC_LEADER_SELECT_RESP"
+Var.SET \halmsgtype[0xF5]="SIR_HAL_RMC_LEADER_REQ"
+Var.SET \halmsgtype[0xF6]="SIR_HAL_RMC_UPDATE_IND"
+Var.SET \halmsgtype[0xF7]="SIR_HAL_IBSS_PEER_INFO_REQ"
+Var.SET \halmsgtype[0xF8]="SIR_HAL_IBSS_PEER_INFO_RSP"
+Var.SET \halmsgtype[0xF9]="SIR_HAL_RATE_UPDATE_IND"
+Var.SET \halmsgtype[0xFA]="SIR_HAL_IBSS_ROUTE_TABLE_UPDATE_IND"
+Var.SET \halmsgtype[0xFB]="SIR_HAL_TX_FAIL_MONITOR_IND"
+Var.SET \halmsgtype[0xFC]="SIR_HAL_IBSS_PEER_INFO_RSP"
+Var.SET \halmsgtype[0xFD]="SIR_HAL_RATE_UPDATE_IND"
+
+
+Var.NEW  char [256][100] \tlcodetype
+
+Var.SET \tlcodetype[0x00]="TRACE_CODE_TL_STA_STATE"
+Var.SET \tlcodetype[0x01]="TRACE_CODE_TL_EAPOL_PKT_PENDING"
+Var.SET \tlcodetype[0x02]="TRACE_CODE_TL_GET_FRAMES_EAPOL"
+Var.SET \tlcodetype[0x03]="TRACE_CODE_TL_RX_CONN_EAPOL"
+Var.SET \tlcodetype[0x04]="TRACE_CODE_TL_REGISTER_STA_CLIENT"
+Var.SET \tlcodetype[0x05]="TRACE_CODE_TL_SUSPEND_DATA_TX"
+Var.SET \tlcodetype[0x06]="TRACE_CODE_TL_RESUME_DATA_TX"
+Var.SET \tlcodetype[0x07]="TRACE_CODE_TL_STA_PKT_PENDING"
+Var.SET \tlcodetype[0x08]="TRACE_CODE_TL_QUEUE_CURRENT"
+Var.SET \tlcodetype[0x09]="TRACE_CODE_TL_REORDER_TIMER_EXP_CB"
+Var.SET \tlcodetype[0x0A]="TRACE_CODE_TL_BA_SESSION_DEL"
+Var.SET \tlcodetype[0x0B]="TRACE_CODE_TL_ASSOC_FAILED"
+Var.SET \tlcodetype[0x0C]="TRACE_CODE_TL_FORWARD_CACHED_FRAMES"
+Var.SET \tlcodetype[0x0D]="TRACE_CODE_TL_FLUSH_CACHED_FRAMES"
+Var.SET \tlcodetype[0x0E]="TRACE_CODE_TL_CACHE_FRAME"
+
+Var.NEW  char [256][100] \smecodetype
+
+Var.SET \smecodetype[0x00]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_REQ"
+Var.SET \smecodetype[0x01]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_GET_RESULTS"
+Var.SET \smecodetype[0x02]="TRACE_CODE_SME_RX_HDD_MSG_CONNECT"
+Var.SET \smecodetype[0x03]="TRACE_CODE_SME_RX_HDD_MSG_SET_11DINFO"
+Var.SET \smecodetype[0x04]="TRACE_CODE_SME_RX_HDD_MSG_GET_SOFTAP_DOMAIN"
+Var.SET \smecodetype[0x05]="TRACE_CODE_SME_RX_HDD_MSG_SET_REGINFO"
+Var.SET \smecodetype[0x06]="TRACE_CODE_SME_RX_HDD_MSG_UPDATE_CHANNEL_CONFIG"
+Var.SET \smecodetype[0x07]="TRACE_CODE_SME_RX_HDD_MSG_UPDATE_CONFIG"
+Var.SET \smecodetype[0x08]="TRACE_CODE_SME_RX_HDD_MSG_HDDREADYIND"
+Var.SET \smecodetype[0x09]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_FLUSH_RESULTS"
+Var.SET \smecodetype[0x0A]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_FLUSH_P2PRESULTS"
+Var.SET \smecodetype[0x0B]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_RESULT_GETFIRST"
+Var.SET \smecodetype[0x0C]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_RESULT_GETNEXT"
+Var.SET \smecodetype[0x0D]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_RESULT_PURGE"
+Var.SET \smecodetype[0x0E]="TRACE_CODE_SME_RX_HDD_ROAM_REASSOC"
+Var.SET \smecodetype[0x0F]="TRACE_CODE_SME_RX_HDD_ROAM_DISCONNECT"
+Var.SET \smecodetype[0x10]="TRACE_CODE_SME_RX_HDD_ROAM_GET_CONNECTPROFILE"
+Var.SET \smecodetype[0x11]="TRACE_CODE_SME_RX_HDD_ROAM_FREE_CONNECTPROFILE"
+Var.SET \smecodetype[0x12]="TRACE_CODE_SME_RX_HDD_ROAM_SET_PMKIDCACHE"
+Var.SET \smecodetype[0x13]="TRACE_CODE_SME_RX_HDD_GET_CONFIGPARAM"
+Var.SET \smecodetype[0x14]="TRACE_CODE_SME_RX_HDD_GET_MODPROFFIELDS"
+Var.SET \smecodetype[0x15]="TRACE_CODE_SME_RX_HDD_SET_CONFIG_PWRSAVE"
+Var.SET \smecodetype[0x16]="TRACE_CODE_SME_RX_HDD_GET_CONFIG_PWRSAVE"
+Var.SET \smecodetype[0x17]="TRACE_CODE_SME_RX_HDD_ENABLE_PWRSAVE"
+Var.SET \smecodetype[0x18]="TRACE_CODE_SME_RX_HDD_DISABLE_PWRSAVE"
+Var.SET \smecodetype[0x19]="TRACE_CODE_SME_RX_HDD_START_AUTO_BMPSTIMER"
+Var.SET \smecodetype[0x1A]="TRACE_CODE_SME_RX_HDD_STOP_AUTO_BMPSTIMER"
+Var.SET \smecodetype[0x1B]="TRACE_CODE_SME_RX_HDD_IS_PWRSAVE_ENABLED"
+Var.SET \smecodetype[0x1C]="TRACE_CODE_SME_RX_HDD_REQUEST_FULLPOWER"
+Var.SET \smecodetype[0x1D]="TRACE_CODE_SME_RX_HDD_REQUEST_BMPS"
+Var.SET \smecodetype[0x1E]="TRACE_CODE_SME_RX_HDD_SET_DHCP_FLAG"
+Var.SET \smecodetype[0x1F]="TRACE_CODE_SME_RX_HDD_REQUEST_STANDBY"
+Var.SET \smecodetype[0x20]="TRACE_CODE_SME_RX_HDD_WOWL_ADDBCAST_PATTERN"
+Var.SET \smecodetype[0x21]="TRACE_CODE_SME_RX_HDD_WOWL_DELBCAST_PATTERN"
+Var.SET \smecodetype[0x22]="TRACE_CODE_SME_RX_HDD_ENTER_WOWL"
+Var.SET \smecodetype[0x23]="TRACE_CODE_SME_RX_HDD_EXIT_WOWL"
+Var.SET \smecodetype[0x24]="TRACE_CODE_SME_RX_HDD_SET_KEY"
+Var.SET \smecodetype[0x25]="TRACE_CODE_SME_RX_HDD_REMOVE_KEY"
+Var.SET \smecodetype[0x26]="TRACE_CODE_SME_RX_HDD_GET_STATS"
+Var.SET \smecodetype[0x27]="TRACE_CODE_SME_RX_HDD_GET_CNTRYCODE"
+Var.SET \smecodetype[0x28]="TRACE_CODE_SME_RX_HDD_SET_CNTRYCODE"
+Var.SET \smecodetype[0x29]="TRACE_CODE_SME_RX_HDD_CHANGE_CNTRYCODE"
+Var.SET \smecodetype[0x2A]="TRACE_CODE_SME_RX_HDD_BTC_SIGNALEVENT"
+Var.SET \smecodetype[0x2B]="TRACE_CODE_SME_RX_HDD_BTC_SETCONFIG"
+Var.SET \smecodetype[0x2C]="TRACE_CODE_SME_RX_HDD_BTC_GETCONFIG"
+Var.SET \smecodetype[0x2D]="TRACE_CODE_SME_RX_HDD_SET_CFGPRIVACY"
+Var.SET \smecodetype[0x2E]="TRACE_CODE_SME_RX_HDD_NEIGHBOR_REPORTREQ"
+Var.SET \smecodetype[0x2F]="TRACE_CODE_SME_RX_HDD_DBG_READREG"
+Var.SET \smecodetype[0x30]="TRACE_CODE_SME_RX_HDD_DBG_WRITEREG"
+Var.SET \smecodetype[0x31]="TRACE_CODE_SME_RX_HDD_DBG_READMEM"
+Var.SET \smecodetype[0x32]="TRACE_CODE_SME_RX_HDD_DBG_WRITEMEM"
+Var.SET \smecodetype[0x33]="TRACE_CODE_SME_RX_HDD_OPEN_SESSION"
+Var.SET \smecodetype[0x34]="TRACE_CODE_SME_RX_HDD_CLOSE_SESSION"
+Var.SET \smecodetype[0x35]="TRACE_CODE_SME_RX_HDD_SET_HOSTOFFLOAD"
+Var.SET \smecodetype[0x36]="TRACE_CODE_SME_RX_HDD_SET_GTKOFFLOAD"
+Var.SET \smecodetype[0x37]="TRACE_CODE_SME_RX_HDD_GET_GTKOFFLOAD"
+Var.SET \smecodetype[0x38]="TRACE_CODE_SME_RX_HDD_SET_POWERPARAMS"
+Var.SET \smecodetype[0x39]="TRACE_CODE_SME_RX_HDD_ABORT_MACSCAN"
+Var.SET \smecodetype[0x3A]="TRACE_CODE_SME_RX_HDD_REGISTER_MGMTFR"
+Var.SET \smecodetype[0x3B]="TRACE_CODE_SME_RX_HDD_DEREGISTER_MGMTFR"
+Var.SET \smecodetype[0x3C]="TRACE_CODE_SME_RX_HDD_REMAIN_ONCHAN"
+Var.SET \smecodetype[0x3D]="TRACE_CODE_SME_RX_HDD_SEND_ACTION"
+Var.SET \smecodetype[0x3E]="TRACE_CODE_SME_RX_HDD_CANCEL_REMAIN_ONCHAN"
+Var.SET \smecodetype[0x3F]="TRACE_CODE_SME_RX_HDD_CONFIG_RXPFIL"
+Var.SET \smecodetype[0x40]="TRACE_CODE_SME_RX_HDD_CONFIG_SUSPENDIND"
+Var.SET \smecodetype[0x41]="TRACE_CODE_SME_RX_HDD_CONFIG_RESUMEREQ"
+Var.SET \smecodetype[0x42]="TRACE_CODE_SME_RX_HDD_SET_MAXTXPOW"
+Var.SET \smecodetype[0x43]="TRACE_CODE_SME_RX_HDD_SET_TXPOW"
+Var.SET \smecodetype[0x44]="TRACE_CODE_SME_RX_HDD_SET_TMLEVEL"
+Var.SET \smecodetype[0x45]="TRACE_CODE_SME_RX_HDD_CAPS_EXCH"
+Var.SET \smecodetype[0x46]="TRACE_CODE_SME_RX_HDD_DISABLE_CAP"
+Var.SET \smecodetype[0x47]="TRACE_CODE_SME_RX_HDD_GET_DEFCCNV"
+Var.SET \smecodetype[0x48]="TRACE_CODE_SME_RX_HDD_GET_CURCC"
+Var.SET \smecodetype[0x49]="TRACE_CODE_SME_RX_HDD_RESET_PW5G"
+Var.SET \smecodetype[0x4A]="TRACE_CODE_SME_RX_HDD_UPDATE_RP5G"
+Var.SET \smecodetype[0x4B]="TRACE_CODE_SME_RX_HDD_SET_ROAMIBAND"
+Var.SET \smecodetype[0x4C]="TRACE_CODE_SME_RX_HDD_GET_ROAMIBAND"
+Var.SET \smecodetype[0x4D]="TRACE_CODE_SME_RX_HDD_UPDATE_RSSIDIFF"
+Var.SET \smecodetype[0x4E]="TRACE_CODE_SME_RX_HDD_UPDATE_IMMRSSIDIFF"
+Var.SET \smecodetype[0x4F]="TRACE_CODE_SME_RX_HDD_UPDATE_FTENABLED"
+Var.SET \smecodetype[0x50]="TRACE_CODE_SME_RX_HDD_UPDATE_WESMODE"
+Var.SET \smecodetype[0x51]="TRACE_CODE_SME_RX_HDD_SET_SCANCTRL"
+;deprecated Var.SET \smecodetype[0x52]="TRACE_CODE_SME_RX_HDD_EXTSCAN_GET_CAPABILITIES"
+Var.SET \smecodetype[0x52]="TRACE_CODE_SME_RX_HDD_EXTSCAN_START"
+Var.SET \smecodetype[0x53]="TRACE_CODE_SME_RX_HDD_EXTSCAN_STOP"
+Var.SET \smecodetype[0x54]="TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_BSS_HOTLIST"
+Var.SET \smecodetype[0x55]="TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_BSS_HOTLIST"
+Var.SET \smecodetype[0x56]="TRACE_CODE_SME_RX_HDD_EXTSCAN_GET_CACHED_RESULTS"
+Var.SET \smecodetype[0x57]="TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_SSID_HOTLIST"
+Var.SET \smecodetype[0x58]="TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_SSID_HOTLIST"
+Var.SET \smecodetype[0x59]="TRACE_CODE_SME_RX_HDD_MSG_DEAUTH_STA"
+;#ifdef FEATURE_WLAN_TDLS	//assuming this flag is enabled by default
+Var.SET \smecodetype[0x5A]="TRACE_CODE_SME_RX_HDD_TDLS_LINK_ESTABLISH_PARAM"
+Var.SET \smecodetype[0x5B]="TRACE_CODE_SME_RX_HDD_TDLS_CHAN_SWITCH_REQ"
+Var.SET \smecodetype[0x5C]="TRACE_CODE_SME_RX_HDD_TDLS_SEND_MGMT_FRAME"
+Var.SET \smecodetype[0x5D]="TRACE_CODE_SME_RX_HDD_TDLS_CHANGE_PEER_STA"
+Var.SET \smecodetype[0x5E]="TRACE_CODE_SME_RX_HDD_TDLS_ADD_PEER_STA"
+Var.SET \smecodetype[0x5F]="TRACE_CODE_SME_RX_HDD_TDLS_DEL_PEER_STA"
+;#endif
+Var.SET \smecodetype[0x60]="TRACE_CODE_SME_RX_HDD_PREF_NET_LIST"
+;#ifdef FEATURE_WLAN_LPHB	//assuming this flag is enabled by default
+Var.SET \smecodetype[0x61]="TRACE_CODE_SME_RX_HDD_LPHB_CONFIG_REQ"
+;#endif /* FEATURE_WLAN_LPHB */
+Var.SET \smecodetype[0x62]="TRACE_CODE_SME_RX_HDD_ROAM_DEL_PMKIDCACHE"
+;From here hardcoded to 250 in host code
+Var.SET \smecodetype[0xFA]="TRACE_CODE_SME_COMMAND"
+Var.SET \smecodetype[0xFB]="TRACE_CODE_SME_TX_WDA_MSG"
+Var.SET \smecodetype[0xFC]="TRACE_CODE_SME_RX_WDA_MSG"
+
+Var.NEW  char [256][50] \cfgmsgtype
+
+Var.SET \cfgmsgtype[0xB0]="SIR_CFG_PARAM_UPDATE_IND"
+Var.SET \cfgmsgtype[0xB1]="SIR_CFG_DOWNLOAD_COMPLETE_IND"
+
+
+Var.NEW  char [256][50] \limmsgtype
+
+Var.SET \limmsgtype[0xB3]="SIR_LIM_RETRY_INTERRUPT_MSG"
+Var.SET \limmsgtype[0xB4]="SIR_BB_XPORT_MGMT_MSG"
+Var.SET \limmsgtype[0xB7]="SIR_LIM_INV_KEY_INTERRUPT_MSG"
+Var.SET \limmsgtype[0xB8]="SIR_LIM_KEY_ID_INTERRUPT_MSG"
+Var.SET \limmsgtype[0xB9]="SIR_LIM_REPLAY_THRES_INTERRUPT_MSG"
+Var.SET \limmsgtype[0xBA]="SIR_LIM_TD_DUMMY_CALLBACK_MSG"
+Var.SET \limmsgtype[0xBB]="SIR_LIM_SCH_CLEAN_MSG"
+Var.SET \limmsgtype[0xBC]="SIR_LIM_RADAR_DETECT_IND"
+Var.SET \limmsgtype[0xBE]="SIR_LIM_DEL_TS_IND"
+Var.SET \limmsgtype[0xBF]="SIR_LIM_ADD_BA_IND"
+Var.SET \limmsgtype[0xC0]="SIR_LIM_DEL_BA_ALL_IND"
+Var.SET \limmsgtype[0xC1]="SIR_LIM_DELETE_STA_CONTEXT_IND"
+Var.SET \limmsgtype[0xC2]="SIR_LIM_DEL_BA_IND"
+Var.SET \limmsgtype[0xC3]="SIR_LIM_UPDATE_BEACON"
+Var.SET \limmsgtype[0xD0]="SIR_LIM_MIN_CHANNEL_TIMEOUT"
+Var.SET \limmsgtype[0xD1]="SIR_LIM_MAX_CHANNEL_TIMEOUT"
+Var.SET \limmsgtype[0xD2]="SIR_LIM_JOIN_FAIL_TIMEOUT"
+Var.SET \limmsgtype[0xD3]="SIR_LIM_AUTH_FAIL_TIMEOUT"
+Var.SET \limmsgtype[0xD4]="SIR_LIM_AUTH_RSP_TIMEOUT"
+Var.SET \limmsgtype[0xD5]="SIR_LIM_ASSOC_FAIL_TIMEOUT"
+Var.SET \limmsgtype[0xD6]="SIR_LIM_REASSOC_FAIL_TIMEOUT"
+Var.SET \limmsgtype[0xD7]="SIR_LIM_HEART_BEAT_TIMEOUT"
+Var.SET \limmsgtype[0xD9]="SIR_LIM_PREAUTH_CLNUP_TIMEOUT"
+Var.SET \limmsgtype[0xDA]="SIR_LIM_CHANNEL_SCAN_TIMEOUT"
+Var.SET \limmsgtype[0xDB]="SIR_LIM_PROBE_HB_FAILURE_TIMEOUT"
+Var.SET \limmsgtype[0xDC]="SIR_LIM_ADDTS_RSP_TIMEOUT"
+Var.SET \limmsgtype[0xE0]="SIR_LIM_MEASUREMENT_IND_TIMEOUT"
+Var.SET \limmsgtype[0xE1]="SIR_LIM_LEARN_INTERVAL_TIMEOUT"
+Var.SET \limmsgtype[0xE2]="SIR_LIM_LEARN_DURATION_TIMEOUT"
+Var.SET \limmsgtype[0xE3]="SIR_LIM_LINK_TEST_DURATION_TIMEOUT"
+Var.SET \limmsgtype[0xE6]="SIR_LIM_HASH_MISS_THRES_TIMEOUT"
+Var.SET \limmsgtype[0xE7]="SIR_LIM_CNF_WAIT_TIMEOUT"
+Var.SET \limmsgtype[0xE8]="SIR_LIM_KEEPALIVE_TIMEOUT"
+Var.SET \limmsgtype[0xE9]="SIR_LIM_UPDATE_OLBC_CACHEL_TIMEOUT"
+Var.SET \limmsgtype[0xEA]="SIR_LIM_CHANNEL_SWITCH_TIMEOUT"
+Var.SET \limmsgtype[0xEB]="SIR_LIM_QUIET_TIMEOUT"
+Var.SET \limmsgtype[0xEC]="SIR_LIM_QUIET_BSS_TIMEOUT"
+Var.SET \limmsgtype[0xED]="SIR_LIM_WPS_OVERLAP_TIMEOUT"
+Var.SET \limmsgtype[0xEE]="SIR_LIM_FT_PREAUTH_RSP_TIMEOUT"
+Var.SET \limmsgtype[0xEF]="SIR_LIM_REMAIN_CHN_TIMEOUT"
+Var.SET \limmsgtype[0xF0]="SIR_LIM_INSERT_SINGLESHOT_NOA_TIMEOUT"
+Var.SET \limmsgtype[0xF1]="SIR_LIM_WMM_APSD_SP_START_MSG_TYPE"
+Var.SET \limmsgtype[0xF2]="SIR_LIM_WMM_APSD_SP_END_MSG_TYPE"
+Var.SET \limmsgtype[0xF3]="SIR_LIM_BEACON_GEN_IND"
+Var.SET \limmsgtype[0xF4]="SIR_LIM_PERIODIC_PROBE_REQ_TIMEOUT"
+Var.SET \limmsgtype[0xF5]="SIR_LIM_CCX_TSM_TIMEOUT"
+Var.SET \limmsgtype[0xF6]="SIR_LIM_DISASSOC_ACK_TIMEOUT"
+Var.SET \limmsgtype[0xF7]="SIR_LIM_DEAUTH_ACK_TIMEOUT"
+Var.SET \limmsgtype[0xF8]="SIR_LIM_PERIODIC_JOIN_PROBE_REQ_TIMEOUT"
+Var.SET \limmsgtype[0xF9]="SIR_LIM_TDLS_DISCOVERY_RSP_WAIT"
+Var.SET \limmsgtype[0xFA]="SIR_LIM_TDLS_LINK_SETUP_RSP_TIMEOUT"
+Var.SET \limmsgtype[0xFB]="SIR_LIM_TDLS_LINK_SETUP_CNF_TIMEOUT"
+Var.SET \limmsgtype[0xFC]="SIR_LIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE"
+Var.SET \limmsgtype[0xFF]="SIR_LIM_MSG_TYPES_END"
+
+
+Var.NEW  char [256][50] \schmsgtype
+
+Var.SET \schmsgtype[0x0]="SIR_SCH_CHANNEL_SWITCH_REQUEST"
+Var.SET \schmsgtype[0x1]="SIR_SCH_START_SCAN_REQ"
+Var.SET \schmsgtype[0x2]="SIR_SCH_START_SCAN_RSP"
+Var.SET \schmsgtype[0x3]="SIR_SCH_END_SCAN_NTF"
+Var.SET \schmsgtype[0xFF]="SIR_SCH_MSG_TYPES_END"
+
+Var.NEW  char [256][50] \pmmmsgtype
+
+Var.SET \pmmmsgtype[0x0]="SIR_PMM_CHANGE_PM_MODE"
+Var.SET \pmmmsgtype[0x1]="SIR_PMM_CHANGE_IMPS_MODE"
+Var.SET \pmmmsgtype[0xFF]="SIR_PMM_MSG_TYPES_END"
+
+
+Var.NEW  char [256][50] \mntmsgtype
+
+Var.SET \mntmsgtype[0x0]="SIR_MNT_RELEASE_BD"
+Var.SET \mntmsgtype[0xFF]="SIR_MNT_MSG_TYPES_END"
+
+Var.NEW  char [256][50] \dvtmsgtype
+
+Var.SET \dvtmsgtype[0xF]="SIR_DVT_ITC_MSG_TYPES_BEGIN"
+
+Var.NEW  char [0x301][50] \pttmsgtype
+
+Var.SET \pttmsgtype[0x0]="SIR_PTT_MSG_TYPES_BEGIN"
+Var.SET \pttmsgtype[0x300]="SIR_PTT_MSG_TYPES_END"
+
+
+Var.NEW  char [18][50] \code
+
+Var.SET \code[0]="TRACE_CODE_MLM_STATE"
+Var.SET \code[1]="TRACE_CODE_SME_STATE"
+Var.SET \code[2]="TRACE_CODE_TX_MGMT"
+Var.SET \code[3]="TRACE_CODE_RX_MGMT"
+Var.SET \code[4]="TRACE_CODE_RX_MGMT_TSF"
+Var.SET \code[5]="TRACE_CODE_TX_COMPLETE"
+Var.SET \code[6]="TRACE_CODE_TX_SME_MSG"
+Var.SET \code[7]="TRACE_CODE_RX_SME_MSG"
+Var.SET \code[8]="TRACE_CODE_TX_WDA_MSG"
+Var.SET \code[9]="TRACE_CODE_RX_WDA_MSG"
+Var.SET \code[10]="TRACE_CODE_TX_LIM_MSG"
+Var.SET \code[11]="TRACE_CODE_RX_LIM_MSG"
+Var.SET \code[12]="TRACE_CODE_TX_CFG_MSG"
+Var.SET \code[13]="TRACE_CODE_RX_CFG_MSG"
+Var.SET \code[14]="TRACE_CODE_RX_MGMT_DROP"
+Var.SET \code[15]="TRACE_CODE_TIMER_ACTIVATE"
+Var.SET \code[16]="TRACE_CODE_TIMER_DEACTIVATE"
+Var.SET \code[17]="TRACE_CODE_INFO_LOG"
+
+
+Var.NEW  char [13][50] \module
+
+
+Var.SET \module[0]="VOS_MODULE_ID_BAP"
+Var.SET \module[1]="VOS_MODULE_ID_TL"
+Var.SET \module[3]="VOS_MODULE_ID_SAL"
+Var.SET \module[4]="VOS_MODULE_ID_SSC"
+Var.SET \module[2]="VOS_MODULE_ID_WDI"
+Var.SET \module[5]="VOS_MODULE_ID_HDD"
+Var.SET \module[6]="VOS_MODULE_ID_SME"
+Var.SET \module[7]="VOS_MODULE_ID_PE"
+Var.SET \module[8]="VOS_MODULE_ID_WDA"
+Var.SET \module[9]="VOS_MODULE_ID_SYS"
+Var.SET \module[10]="VOS_MODULE_ID_VOSS"
+Var.SET \module[11]="VOS_MODULE_ID_SAP"
+Var.SET \module[12]="VOS_MODULE_ID_HDD_SOFTAP"
+
+Var.NEW char [16][50] \mgmttype
+
+Var.SET \mgmttype[0]="SIR_MAC_MGMT_ASSOC_REQ"
+Var.SET \mgmttype[1]="SIR_MAC_MGMT_ASSOC_RSP"
+Var.SET \mgmttype[2]="SIR_MAC_MGMT_REASSOC_REQ"
+Var.SET \mgmttype[3]="SIR_MAC_MGMT_REASSOC_RSP"
+Var.SET \mgmttype[4]="SIR_MAC_MGMT_PROBE_REQ"
+Var.SET \mgmttype[5]="SIR_MAC_MGMT_PROBE_RSP"
+Var.SET \mgmttype[8]="SIR_MAC_MGMT_BEACON"
+Var.SET \mgmttype[9]="SIR_MAC_MGMT_ATIM"
+Var.SET \mgmttype[10]="SIR_MAC_MGMT_DISASSOC"
+Var.SET \mgmttype[11]="SIR_MAC_MGMT_AUTH"
+Var.SET \mgmttype[12]="SIR_MAC_MGMT_DEAUTH"
+Var.SET \mgmttype[13]="SIR_MAC_MGMT_ACTION"
+Var.SET \mgmttype[15]="SIR_MAC_MGMT_RESERVED15"
+
+Var.NEW char [30][50] \limtimertype
+
+Var.SET \limtimertype[0]="eLIM_MIN_CHANNEL_TIMER"
+Var.SET \limtimertype[1]="eLIM_MAX_CHANNEL_TIMER"
+Var.SET \limtimertype[2]="eLIM_JOIN_FAIL_TIMER"
+Var.SET \limtimertype[3]="eLIM_AUTH_FAIL_TIMER"
+Var.SET \limtimertype[4]="eLIM_AUTH_RESP_TIMER"
+Var.SET \limtimertype[5]="eLIM_ASSOC_FAIL_TIMER"
+Var.SET \limtimertype[6]="eLIM_REASSOC_FAIL_TIMER"
+Var.SET \limtimertype[7]="eLIM_PRE_AUTH_CLEANUP_TIMER"
+Var.SET \limtimertype[8]="eLIM_HEART_BEAT_TIMER"
+Var.SET \limtimertype[9]="eLIM_BACKGROUND_SCAN_TIMER"
+Var.SET \limtimertype[10]="eLIM_KEEPALIVE_TIMER"
+Var.SET \limtimertype[11]="eLIM_CNF_WAIT_TIMER"
+Var.SET \limtimertype[12]="eLIM_AUTH_RSP_TIMER"
+Var.SET \limtimertype[13]="eLIM_UPDATE_OLBC_CACHE_TIMER"
+Var.SET \limtimertype[14]="eLIM_PROBE_AFTER_HB_TIMER"
+Var.SET \limtimertype[15]="eLIM_ADDTS_RSP_TIMER"
+Var.SET \limtimertype[16]="eLIM_CHANNEL_SWITCH_TIMER"
+Var.SET \limtimertype[17]="eLIM_LEARN_DURATION_TIMER"
+Var.SET \limtimertype[18]="eLIM_QUIET_TIMER"
+Var.SET \limtimertype[19]="eLIM_QUIET_BSS_TIMER"
+Var.SET \limtimertype[20]="eLIM_WPS_OVERLAP_TIMER"
+Var.SET \limtimertype[21]="eLIM_FT_PREAUTH_RSP_TIMER"
+Var.SET \limtimertype[22]="eLIM_REMAIN_CHN_TIMER"
+Var.SET \limtimertype[23]="eLIM_PERIODIC_PROBE_REQ_TIMER"
+;#ifdef FEATURE_WLAN_CCX
+;Var.SET \limtimertype[0]="eLIM_TSM_TIMER"
+;#endif
+;#ifdef FEATURE_WLAN_TDLS_INTERNAL
+;Var.SET \limtimertype[0]="eLIM_TDLS_DISCOVERY_RSP_WAIT"
+;Var.SET \limtimertype[0]="eLIM_TDLS_LINK_SETUP_RSP_TIMEOUT"
+;Var.SET \limtimertype[0]="eLIM_TDLS_LINK_SETUP_CNF_TIMEOUT"
+;#endif
+Var.SET \limtimertype[25]="eLIM_DISASSOC_ACK_TIMER"
+Var.SET \limtimertype[26]="eLIM_DEAUTH_ACK_TIMER"
+Var.SET \limtimertype[27]="eLIM_PERIODIC_JOIN_PROBE_REQ_TIMER"
+Var.SET \limtimertype[28]="eLIM_INSERT_SINGLESHOT_NOA_TIMER"
+Var.SET \limtimertype[29]="eLIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE"
+
+
+
+Var.NEW  char [256][100] \hddcodetype
+
+Var.SET \hddcodetype[0x00]="TRACE_CODE_HDD_OPEN_REQUEST"
+Var.SET \hddcodetype[0x01]="TRACE_CODE_HDD_STOP_REQUEST"
+Var.SET \hddcodetype[0x02]="TRACE_CODE_HDD_TX_TIMEOUT"
+Var.SET \hddcodetype[0x03]="TRACE_CODE_HDD_P2P_DEV_ADDR_IOCTL"
+Var.SET \hddcodetype[0x04]="TRACE_CODE_HDD_SETSUSPENDMODE_IOCTL"
+Var.SET \hddcodetype[0x05]="TRACE_CODE_HDD_SETROAMTRIGGER_IOCTL"
+Var.SET \hddcodetype[0x06]="TRACE_CODE_HDD_GETROAMTRIGGER_IOCTL"
+Var.SET \hddcodetype[0x07]="TRACE_CODE_HDD_SETROAMSCANPERIOD_IOCTL"
+Var.SET \hddcodetype[0x08]="TRACE_CODE_HDD_GETROAMSCANPERIOD_IOCTL"
+Var.SET \hddcodetype[0x09]="TRACE_CODE_HDD_SETROAMDELTA_IOCTL"
+Var.SET \hddcodetype[0x0A]="TRACE_CODE_HDD_GETROAMDELTA_IOCTL"
+Var.SET \hddcodetype[0x0B]="TRACE_CODE_HDD_GETBAND_IOCTL"
+Var.SET \hddcodetype[0x0C]="TRACE_CODE_HDD_GETCOUNTRYREV_IOCTL"
+Var.SET \hddcodetype[0x0D]="TRACE_CODE_HDD_SETROAMSCANCHANNELS_IOCTL"
+Var.SET \hddcodetype[0x0E]="TRACE_CODE_HDD_GETROAMSCANCHANNELS_IOCTL"
+Var.SET \hddcodetype[0x0F]="TRACE_CODE_HDD_HOSTAPD_OPEN_REQUEST"
+Var.SET \hddcodetype[0x10]="TRACE_CODE_HDD_HOSTAPD_STOP_REQUEST"
+Var.SET \hddcodetype[0x11]="TRACE_CODE_HDD_HOSTAPD_UNINIT_REQUEST"
+Var.SET \hddcodetype[0x12]="TRACE_CODE_HDD_SOFTAP_TX_TIMEOUT"
+Var.SET \hddcodetype[0x13]="TRACE_CODE_HDD_HOSTAPD_SET_MAC_ADDR"
+Var.SET \hddcodetype[0x14]="TRACE_CODE_HDD_HOSTAPD_P2P_SET_NOA_IOCTL"
+Var.SET \hddcodetype[0x15]="TRACE_CODE_HDD_HOSTAPD_P2P_SET_PS_IOCTL"
+Var.SET \hddcodetype[0x16]="TRACE_CODE_HDD_HOSTAPD_SET_SAP_CHANNEL_LIST_IOCTL"
+Var.SET \hddcodetype[0x17]="TRACE_CODE_HDD_ADD_VIRTUAL_INTF"
+Var.SET \hddcodetype[0x18]="TRACE_CODE_HDD_DEL_VIRTUAL_INTF"
+Var.SET \hddcodetype[0x19]="TRACE_CODE_HDD_CHANGE_VIRTUAL_INTF"
+Var.SET \hddcodetype[0x1A]="TRACE_CODE_HDD_CFG80211_START_AP"
+Var.SET \hddcodetype[0x1B]="TRACE_CODE_HDD_CFG80211_CHANGE_BEACON"
+Var.SET \hddcodetype[0x1C]="TRACE_CODE_HDD_CFG80211_STOP_AP"
+Var.SET \hddcodetype[0x1D]="TRACE_CODE_HDD_CFG80211_CHANGE_BSS"
+Var.SET \hddcodetype[0x1E]="TRACE_CODE_HDD_CFG80211_ADD_KEY"
+Var.SET \hddcodetype[0x1F]="TRACE_CODE_HDD_CFG80211_GET_KEY"
+Var.SET \hddcodetype[0x20]="TRACE_CODE_HDD_CFG80211_SET_DEFAULT_KEY"
+Var.SET \hddcodetype[0x21]="TRACE_CODE_HDD_CFG80211_CONNECT"
+Var.SET \hddcodetype[0x22]="TRACE_CODE_HDD_CFG80211_DISCONNECT"
+Var.SET \hddcodetype[0x23]="TRACE_CODE_HDD_CFG80211_JOIN_IBSS"
+Var.SET \hddcodetype[0x24]="TRACE_CODE_HDD_CFG80211_LEAVE_IBSS"
+Var.SET \hddcodetype[0x25]="TRACE_CODE_HDD_CFG80211_SET_WIPHY_PARAMS"
+Var.SET \hddcodetype[0x26]="TRACE_CODE_HDD_CFG80211_SET_TXPOWER"
+Var.SET \hddcodetype[0x27]="TRACE_CODE_HDD_CFG80211_GET_TXPOWER"
+Var.SET \hddcodetype[0x28]="TRACE_CODE_HDD_CFG80211_SET_CHANNEL"
+Var.SET \hddcodetype[0x29]="TRACE_CODE_HDD_CFG80211_ADD_BEACON"
+Var.SET \hddcodetype[0x2A]="TRACE_CODE_HDD_CFG80211_SET_BEACON"
+Var.SET \hddcodetype[0x2B]="TRACE_CODE_HDD_CFG80211_CHANGE_IFACE"
+Var.SET \hddcodetype[0x2C]="TRACE_CODE_HDD_CHANGE_STATION"
+Var.SET \hddcodetype[0x2D]="TRACE_CODE_HDD_CFG80211_UPDATE_BSS"
+Var.SET \hddcodetype[0x2E]="TRACE_CODE_HDD_CFG80211_SCAN"
+Var.SET \hddcodetype[0x2F]="TRACE_CODE_HDD_REMAIN_ON_CHANNEL"
+Var.SET \hddcodetype[0x30]="TRACE_CODE_HDD_REMAINCHANREADYHANDLER"
+Var.SET \hddcodetype[0x31]="TRACE_CODE_HDD_CFG80211_CANCEL_REMAIN_ON_CHANNEL"
+Var.SET \hddcodetype[0x32]="TRACE_CODE_HDD_ACTION"
+Var.SET \hddcodetype[0x33]="TRACE_CODE_HDD_MGMT_TX_CANCEL_WAIT"
+Var.SET \hddcodetype[0x34]="TRACE_CODE_HDD_CFG80211_GET_STA"
+Var.SET \hddcodetype[0x35]="TRACE_CODE_HDD_CFG80211_SET_POWER_MGMT"
+Var.SET \hddcodetype[0x36]="TRACE_CODE_HDD_CFG80211_DEL_STA"
+Var.SET \hddcodetype[0x37]="TRACE_CODE_HDD_CFG80211_ADD_STA"
+Var.SET \hddcodetype[0x38]="TRACE_CODE_HDD_CFG80211_SET_PMKSA"
+Var.SET \hddcodetype[0x39]="TRACE_CODE_HDD_CFG80211_UPDATE_FT_IES"
+Var.SET \hddcodetype[0x3A]="TRACE_CODE_HDD_CFG80211_TDLS_MGMT"
+Var.SET \hddcodetype[0x3B]="TRACE_CODE_HDD_CFG80211_TDLS_OPER"
+Var.SET \hddcodetype[0x3C]="TRACE_CODE_HDD_CFG80211_SET_REKEY_DATA"
+Var.SET \hddcodetype[0x3D]="TRACE_CODE_HDD_UNSUPPORTED_IOCTL"
+Var.SET \hddcodetype[0x3E]="TRACE_CODE_HDD_SETROAMSCANCHANNELMINTIME_IOCTL"
+Var.SET \hddcodetype[0x3F]="TRACE_CODE_HDD_GETROAMSCANCHANNELMINTIME_IOCTL"
+Var.SET \hddcodetype[0x40]="TRACE_CODE_HDD_STOP_NETDEV"
+Var.SET \hddcodetype[0x41]="TRACE_CODE_HDD_WAKE_NETDEV"
+Var.SET \hddcodetype[0x42]="TRACE_CODE_HDD_FLUSH_TX_QUEUES"
+Var.SET \hddcodetype[0x43]="TRACE_CODE_HDD_CFG80211_RESUME_WLAN"
+Var.SET \hddcodetype[0x44]="TRACE_CODE_HDD_CFG80211_SUSPEND_WLAN"
+Var.SET \hddcodetype[0x45]="TRACE_CODE_HDD_CFG80211_SET_MAC_ACL"
+Var.SET \hddcodetype[0x46]="TRACE_CODE_HDD_CFG80211_TESTMODE"
+Var.SET \hddcodetype[0x47]="TRACE_CODE_HDD_CFG80211_DUMP_SURVEY"
+Var.SET \hddcodetype[0x48]="TRACE_CODE_HDD_CFG80211_SCHED_SCAN_START"
+Var.SET \hddcodetype[0x49]="TRACE_CODE_HDD_CFG80211_SCHED_SCAN_STOP"
+Var.SET \hddcodetype[0x4A]="TRACE_CODE_HDD_CFG80211_DEL_PMKSA"
+
+&TRACETYPESIZE=v.value(sizeof(tvosTraceRecord))
+&TRACESIZE=v.value(sizeof(gvosTraceTbl))
+&TRACEMAXINDEX=v.value(&TRACESIZE/&TRACETYPESIZE)
+
+&HEAD=v.value(gvosTraceData.head)
+&TAIL=v.value(gvosTraceData.tail)
+
+IF ((&HEAD>&TRACEMAXINDEX)||(&TAIL>&TRACEMAXINDEX)||(&TAIL==&HEAD))
+(
+  GOTO ENDSCRIPT
+)
+
+&INDEX=&HEAD
+
+TRACESTART:
+
+&TIME=v.value(gvosTraceTbl[&INDEX].time)
+&MODULE=v.value(gvosTraceTbl[&INDEX].module)
+&CODE=v.value(gvosTraceTbl[&INDEX].code)
+&SESSION=v.value(gvosTraceTbl[&INDEX].session)
+&DATA=v.value(gvosTraceTbl[&INDEX].data)
+
+
+  WRITE #1 "TIME: "  &TIME
+  Var.Write #1 %STRING \module[&MODULE]
+
+IF (&MODULE==0x7)
+(
+if (&CODE>=0)&&(&CODE<=0x12)
+(
+    Var.Write #1 %STRING \code[&CODE] " [" %Hex &CODE "]"
+)
+
+   IF (&SESSION==0xFF)
+    (
+      WRITE #1 "NO SESSION"
+    )
+    ELSE
+    (
+      WRITE #1 "SESSION: " &SESSION
+    )
+
+
+;0 TRACE_CODE_MLM_STATE
+IF (&CODE==0x0)
+(
+  Var.NEW  tLimMlmStates \mlmstate
+  Var.Set \mlmstate=&DATA
+  ;Var.Write #1 \mlmstate %Hex &DATA
+)
+
+;1 TRACE_CODE_SME_STATE
+IF (&CODE==0x1)
+(
+  Var.NEW  tLimSmeStates \smestate
+  Var.Set \smestate=&DATA
+  Var.Write #1 \smestate %Hex &DATA
+)
+
+;2 TRACE_CODE_TX_MGMT
+IF (&CODE==0x2)
+(
+  WRITE #1 "DATA: " &DATA
+)
+
+;3 TRACE_CODE_RX_MGMT
+IF (&CODE==0x3)
+(
+  &SERIAL=v.value(&DATA>>16)
+  &SUBTYPE=v.value(&DATA&0xFF)
+  if (&SUBTYPE<=0xF)
+  (
+  Var.Write #1 %STRING \mgmttype[&SUBTYPE]
+  WRITE #1 "SEQ NUM: " &SERIAL
+  )
+  else
+  (
+    WRITE #1 "INCORRECT DATA"
+  )
+)
+
+;4 TRACE_CODE_RX_MGMT_TSF
+IF (&CODE==0x4)
+(
+  WRITE #1 "BEACON TS: " &DATA
+)
+
+;5 TRACE_CODE_TX_COMPLETE
+IF (&CODE==0x5)
+(
+  Var.Write #1 %STRING \mgmttype[&DATA] %Hex &DATA
+)
+
+;14 TRACE_CODE_RX_MGMT_DROP
+IF (&CODE==0xE)
+(
+  Var.NEW  tMgmtFrmDropReason \dropreason
+  Var.Set \dropreason=&DATA
+  Var.Write #1 \dropreason %Hex &DATA
+)
+
+
+;15 TRACE_CODE_TIMER_ACTIVATE/DEACTIVATE
+IF (&CODE==0xF)||(&CODE==0x10)
+(
+  Var.Write #1 %STRING \limtimertype[&DATA] %Hex &DATA
+)
+
+;6 TRACE_CODE_TX_SME_MSG
+IF (&CODE==0x6)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x12)&&(&DATA>=0x12B0)
+(
+Var.Write #1 %STRING \limmsgtype[&MSG] %Hex &MSG
+)
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg %Hex &DATA
+ )
+)
+
+;7 TRACE_CODE_RX_SME_MSG
+IF (&CODE==0x7)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x12)&&(&DATA>=0x12B0)
+(
+Var.Write #1 %STRING \limmsgtype[&MSG]  %Hex &MSG
+)
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg %Hex &DATA
+)
+)
+
+;8 TRACE_CODE_TX_WDA_MSG
+IF (&CODE==0x8)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x10)
+(
+Var.Write #1 %STRING \halmsgtype[&MSG] %Hex &MSG
+)
+)
+
+;9 TRACE_CODE_RX_WDA_MSG
+IF (&CODE==0x9)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x10)
+(
+Var.Write #1 %STRING \halmsgtype[&MSG]  %Hex &MSG
+)
+)
+
+;10 TRACE_CODE_TX_LIM_MSG
+IF (&CODE==0xA)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x12)&&(&DATA>=0x12B0)
+(
+Var.Write #1 %STRING \limmsgtype[&MSG] %Hex &MSG
+)
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg %Hex &DATA
+)
+)
+
+;11 TRACE_CODE_RX_LIM_MSG
+IF (&CODE==0xB)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x12)&&(&DATA>=0x12B0)
+(
+Var.Write #1 %STRING \limmsgtype[&MSG]  %Hex &MSG
+)
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  &DATA=v.value(&DATA&0xFFFF)
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg %Hex &DATA
+)
+)
+
+;12 TRACE_CODE_TX_CFG_MSG
+IF (&CODE==0xC)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x11)&&(&DATA>=0x11B0)
+(
+Var.Write #1 %STRING \cfgmsgtype[&MSG] %Hex &MSG
+)
+)
+
+;13 TRACE_CODE_RX_CFG_MSG
+IF (&CODE==0xD)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x11)&&(&DATA>=0x11B0)
+(
+Var.Write #1 %STRING \cfgmsgtype[&MSG] %Hex &MSG
+)
+)
+
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  &DATA=v.value(&DATA&0xFFFF)
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg  %Hex &DATA
+)
+
+)
+
+IF (&MODULE==0x1)
+(
+  Var.Write #1 %STRING \tlcodetype[&CODE] %Hex &CODE
+  WRITE #1 "DATA: " &DATA
+
+  IF (&SESSION==0xFF)
+  (
+    WRITE #1 "NO SESSION"
+  )
+  ELSE
+  (
+    WRITE #1 "SESSION: " &SESSION
+  )
+)
+
+
+IF (&MODULE==0x6)
+(
+
+  IF ((&CODE>=0x0)&&(&CODE<=0x62))
+  (
+    Var.Write #1 %STRING \smecodetype[&CODE] %Hex &CODE
+  )
+  ELSE
+  (
+    IF ((&CODE>=0xFA)&&(&CODE<=0xFC))
+    (
+      Var.Write #1 %STRING \smecodetype[&CODE] %Hex &CODE
+    )
+    ELSE
+    (
+      WRITE #1 "CODE: " &CODE
+    )
+  )
+  WRITE #1 "DATA: " &DATA
+
+  IF (&SESSION==0xFF)
+  (
+    WRITE #1 "NO SESSION"
+  )
+  ELSE
+  (
+    WRITE #1 "SESSION: " &SESSION
+  )
+)
+
+IF (&MODULE==0x5)
+(
+
+  IF ((&CODE>=0x0)&&(&CODE<=0x4A))
+  (
+    Var.Write #1 %STRING \hddcodetype[&CODE] %Hex &CODE
+  )
+  ELSE
+  (
+    WRITE #1 "CODE: " &CODE
+  )
+  WRITE #1 "DATA: " &DATA
+
+  IF (&SESSION==0xFF)
+  (
+    WRITE #1 "NO SESSION"
+  )
+  ELSE
+  (
+    WRITE #1 "SESSION: " &SESSION
+  )
+)
+
+WRITE #1 " "
+
+&INDEX=v.value((&INDEX+1)%(&TRACEMAXINDEX))
+
+  IF (&INDEX!=&HEAD)
+  (
+    GOTO TRACESTART
+  )
+
+
+
+ENDSCRIPT:
+CLOSE #1
+ENDDO
diff --git a/wlan/prima/CORE/SYS/legacy/src/utils/src/parserApi.c b/wlan/prima/CORE/SYS/legacy/src/utils/src/parserApi.c
index ca09447..3ae3f50 100644
--- a/wlan/prima/CORE/SYS/legacy/src/utils/src/parserApi.c
+++ b/wlan/prima/CORE/SYS/legacy/src/utils/src/parserApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -441,7 +441,7 @@
 
         val  = psessionEntry->cfgProtection.fromllb;
         if(!val ){
-            dot11fLog( pMac, LOGE, FL("11B protection not enabled. Not populating ERP IE %d" ),val );
+            dot11fLog( pMac, LOG1, FL("11B protection not enabled. Not populating ERP IE %d" ),val );
             return eSIR_SUCCESS;
         }
 
@@ -740,6 +740,8 @@
 void limLogQosMapSet(tpAniSirGlobal pMac, tSirQosMapSet *pQosMapSet)
 {
     tANI_U8 i;
+    if (pQosMapSet->num_dscp_exceptions > 21)
+        pQosMapSet->num_dscp_exceptions = 21;
     limLog(pMac, LOG1, FL("num of dscp exceptions : %d"),
                                    pQosMapSet->num_dscp_exceptions);
     for (i=0; i < pQosMapSet->num_dscp_exceptions; i++)
@@ -1585,7 +1587,8 @@
 tSirRetStatus
 PopulateDot11fRatesTdls(tpAniSirGlobal p_mac,
                            tDot11fIESuppRates *p_supp_rates,
-                           tDot11fIEExtSuppRates *p_ext_supp_rates)
+                           tDot11fIEExtSuppRates *p_ext_supp_rates,
+                           tANI_U8 curr_oper_channel)
 {
     tSirMacRateSet temp_rateset;
     tSirMacRateSet temp_rateset2;
@@ -1595,15 +1598,22 @@
     wlan_cfgGetInt(p_mac, WNI_CFG_DOT11_MODE, &self_dot11mode);
 
     /**
-     * Include 11b rates only when the device configured in
-     * auto, 11a/b/g or 11b_only
+     * Include 11b rates only when the device configured
+     * in auto, 11a/b/g or 11b_only and also if current base
+     * channel is 5 GHz then no need to advertise the 11b rates.
+     * If devices to move 2.4GHz off-channel then they can communicate
+     * in 11g rates i.e. (6, 9, 12, 18, 24, 36 and 54).
      */
-    if ((self_dot11mode == WNI_CFG_DOT11_MODE_ALL) ||
+    limLog(p_mac, LOG1, FL("Current operating channel %d self_dot11mode = %d"),
+           curr_oper_channel, self_dot11mode);
+
+    if ((curr_oper_channel <= SIR_11B_CHANNEL_END) &&
+        ((self_dot11mode == WNI_CFG_DOT11_MODE_ALL) ||
         (self_dot11mode == WNI_CFG_DOT11_MODE_11A) ||
         (self_dot11mode == WNI_CFG_DOT11_MODE_11AC) ||
         (self_dot11mode == WNI_CFG_DOT11_MODE_11N) ||
         (self_dot11mode == WNI_CFG_DOT11_MODE_11G) ||
-        (self_dot11mode == WNI_CFG_DOT11_MODE_11B) )
+        (self_dot11mode == WNI_CFG_DOT11_MODE_11B)))
     {
             val = WNI_CFG_SUPPORTED_RATES_11B_LEN;
             wlan_cfgGetStr(p_mac, WNI_CFG_SUPPORTED_RATES_11B,
@@ -2098,7 +2108,27 @@
                        FL("Added RSN Capability to the RSNIE as 0x00 0x00"));
 
                 return eHAL_STATUS_SUCCESS;
+            } else {
+                /* Workaround: Some APs may add extra 0x00 padding after IEs.
+                 * Return true to allow these probe response frames proceed.
+                 */
+                if (nFrameBytes - length > 0) {
+                    tANI_U32 i;
+                    tANI_BOOLEAN zero_padding = VOS_TRUE;
+
+                    for (i = length; i < nFrameBytes; i ++) {
+                        if (pMgmtFrame[i-1] != 0x0) {
+                            zero_padding = VOS_FALSE;
+                            break;
+                        }
+                    }
+
+                    if (zero_padding) {
+                        return eHAL_STATUS_SUCCESS;
+                    }
+                }
             }
+
             return eSIR_FAILURE;
         }
     }
@@ -2324,7 +2354,7 @@
     }
 #endif
 
-#if defined FEATURE_WLAN_ESE
+#if defined(FEATURE_WLAN_ESE) || defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD)
     if (pr->QBSSLoad.present)
     {
         vos_mem_copy(&pProbeResp->QBSSLoad, &pr->QBSSLoad, sizeof(tDot11fIEQBSSLoad));
@@ -3069,14 +3099,19 @@
            retStatus = eSIR_FAILURE;
            goto err_bcnrep;
        }
-       *pos = SIR_MAC_RATESET_EID;
-       pos++;
-       *pos = eseBcnReportMandatoryIe.supportedRates.numRates;
-       pos++;
-       vos_mem_copy(pos, (tANI_U8*)eseBcnReportMandatoryIe.supportedRates.rate,
-                    eseBcnReportMandatoryIe.supportedRates.numRates);
-       pos += eseBcnReportMandatoryIe.supportedRates.numRates;
-       freeBytes -= (1 + 1 + eseBcnReportMandatoryIe.supportedRates.numRates);
+       if (eseBcnReportMandatoryIe.supportedRates.numRates <=
+             SIR_MAC_RATESET_EID_MAX) {
+           *pos = SIR_MAC_RATESET_EID;
+           pos++;
+           *pos = eseBcnReportMandatoryIe.supportedRates.numRates;
+           pos++;
+           vos_mem_copy(pos,
+                        (tANI_U8*)eseBcnReportMandatoryIe.supportedRates.rate,
+                        eseBcnReportMandatoryIe.supportedRates.numRates);
+           pos += eseBcnReportMandatoryIe.supportedRates.numRates;
+           freeBytes -= (1 + 1 +
+                         eseBcnReportMandatoryIe.supportedRates.numRates);
+       }
     }
 
     /* Fill FH Parameter set IE */
@@ -4250,9 +4285,9 @@
     tDot11fQosMapConfigure mapConfigure;
     tANI_U32 status;
     status = dot11fUnpackQosMapConfigure(pMac, pFrame, nFrame, &mapConfigure);
-    if ( DOT11F_FAILED( status ) )
+    if ( DOT11F_FAILED( status ) || !mapConfigure.QosMapSet.present )
     {
-        dot11fLog(pMac, LOGE, FL("Failed to parse Qos Map Configure frame (0x%08x, %d bytes):"),
+        dot11fLog(pMac, LOGE, FL("Failed to parse or QosMapSet not present(0x%08x, %d bytes):"),
                   status, nFrame);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pFrame, nFrame);)
         return eSIR_FAILURE;
@@ -4329,7 +4364,7 @@
     tANI_U32                       status;
 
     // Zero-init our [out] parameter,
-    vos_mem_set( ( tANI_U8* )pMeasReqFrame, sizeof(tpSirMacMeasReqActionFrame), 0 );
+    vos_mem_set( ( tANI_U8* )pMeasReqFrame, sizeof(*pMeasReqFrame), 0 );
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackMeasurementRequest( pMac, pFrame, nFrame, &mr );
diff --git a/wlan/prima/CORE/SYS/legacy/src/utils/src/utilsParser.c b/wlan/prima/CORE/SYS/legacy/src/utils/src/utilsParser.c
index 98b09b6..3292b5c 100644
--- a/wlan/prima/CORE/SYS/legacy/src/utils/src/utilsParser.c
+++ b/wlan/prima/CORE/SYS/legacy/src/utils/src/utilsParser.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -689,6 +689,8 @@
 void ConvertQosMapsetFrame(tpAniSirGlobal pMac, tSirQosMapSet* Qos, tDot11fIEQosMapSet* dot11fIE)
 {
     tANI_U8 i,j=0;
+    if (dot11fIE->num_dscp_exceptions > 58)
+        dot11fIE->num_dscp_exceptions = 58;
     Qos->num_dscp_exceptions = (dot11fIE->num_dscp_exceptions - 16)/2;
     for (i=0;i<Qos->num_dscp_exceptions;i++)
     {
diff --git a/wlan/prima/CORE/TL/inc/wlan_qct_tl.h b/wlan/prima/CORE/TL/inc/wlan_qct_tl.h
index 80975c7..b309a1b 100644
--- a/wlan/prima/CORE/TL/inc/wlan_qct_tl.h
+++ b/wlan/prima/CORE/TL/inc/wlan_qct_tl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -3289,4 +3289,67 @@
  v_VOID_t
 );
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+void WLANTL_StartRxRateMonitor(v_PVOID_t pvosGCtx, wpt_uint8 staId,
+                  wpt_uint16 minRate,
+                  wpt_uint16 maxRate, wpt_uint8 minPercentage,
+                  wpt_uint16 minPktRequired, void *hHal,
+                  wpt_uint64 timeToWait,
+                  void (*triggerRoamScanfn) (void *, wpt_uint8));
+
+void WLANTL_StopRxRateMonitor(v_PVOID_t pvosGCtx);
+#endif
+#ifdef WLAN_FEATURE_RMC
+VOS_STATUS
+WLANTL_EnableRMC
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastAddr
+);
+
+
+VOS_STATUS
+WLANTL_DisableRMC
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastAddr
+);
+
+/*=============================================================================
+  FUNCTION    WLANTL_SetMcastDuplicateDetection
+
+  DESCRIPTION
+    This function sets multicate duplicate detection operation.
+    If enable is 1, the detection is enabled, else it is disabled.
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pvosGCtx   : Pointer to VOS global context
+   enable : Boolean to enable or disable
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAULT:   Sanity check on input failed
+
+    VOS_STATUS_SUCCESS:   Everything is good :)
+
+   Other return values are possible coming from the called functions.
+   Please check API for additional info.
+
+  SIDE EFFECTS
+
+==============================================================================*/
+VOS_STATUS
+WLANTL_SetMcastDuplicateDetection
+(
+    v_PVOID_t     pvosGCtx,
+    v_U8_t        enable
+);
+#endif /* WLAN_FEATURE_RMC */
+
 #endif /* #ifndef WLAN_QCT_WLANTL_H */
diff --git a/wlan/prima/CORE/TL/src/wlan_qct_tl.c b/wlan/prima/CORE/TL/src/wlan_qct_tl.c
index 5396d27..b74b1b6 100644
--- a/wlan/prima/CORE/TL/src/wlan_qct_tl.c
+++ b/wlan/prima/CORE/TL/src/wlan_qct_tl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -61,6 +61,7 @@
 
   when        who     what, where, why
 ----------    ---    --------------------------------------------------------
+2013-08-19    rajekuma Added RMC support
 2010-07-13    c_shinde Fixed an issue where WAPI rekeying was failing because 
                       WAI frame sent out during rekeying had the protected bit
                       set to 1.
@@ -334,6 +335,178 @@
     } \
   } while (0);
 
+
+/* Following is the copy of g11bRateInfo to understand rate index at TL */
+#define WLANTL_MAX_RATE_NUM               137
+typedef struct
+{
+   uint32 phyRate;   //unit in Mega bits per sec X 10
+   uint32 tputRate;  //unit in Mega bits per sec X 10
+   uint32 tputBpms;  //unit in Bytes per msec = (tputRateX1024x1024)/(8x10X1000) ~= (tputRate*13)
+   uint32 tputBpus;  //unit in Bytes per usec: round off to integral value
+}WLANTL_RateInfo;
+
+WLANTL_RateInfo gTLRateInfo[WLANTL_MAX_RATE_NUM]  = {
+    //11b rates
+    {  10,  9,  117, 0}, //index 0
+    {  20,  17, 221, 0}, //index 1
+    {  55,  41, 533, 0}, //index 2
+    { 110,  68, 884, 0}, //index 3
+
+    //11b short preamble
+    {  10,  10,  130, 0}, //index 4
+    {  20,  18,  234, 0}, //index 5
+    {  55,  44,  572, 0}, //index 6
+    { 110,  77, 1001, 0}, //index 7
+
+    //11ag
+    {  60,  50,  650, 1}, //index 8
+    {  90,  70,  910, 1}, //index 9
+    { 120, 100, 1300, 1}, //index 10
+    { 180, 150, 1950, 2}, //index 11
+    { 240, 190, 2470, 2}, //index 12
+    { 360, 280, 3640, 4}, //index 13
+    { 480, 350, 4550, 5}, //index 14
+    { 540, 380, 4940, 6}, //index 15
+
+    //11n SIMO
+    {  65,  54,  702, 1}, //index 16
+    { 130, 108, 1404, 1}, //index 17
+    { 195, 161, 2093, 2}, //index 18
+    { 260, 217, 2821, 3}, //index 19
+    { 390, 326, 4238, 4}, //index 20
+    { 520, 435, 5655, 6}, //index 21
+    { 585, 492, 6396, 6}, //index 22
+    { 650, 548, 7124, 7}, //index 23
+
+    //11n SIMO SGI
+    {  72,  59,  767, 1}, //index 24
+    { 144, 118, 1534, 2}, //index 25
+    { 217, 180, 2340, 2}, //index 26
+    { 289, 243, 3159, 3}, //index 27
+    { 434, 363, 4719, 5}, //index 28
+    { 578, 486, 6318, 6}, //index 29
+    { 650, 548, 7124, 7}, //index 30
+    { 722, 606, 7878, 8}, //index 31
+
+    //11n GF SIMO
+    {  65,  54,  702, 1}, //index 32
+    { 130, 108, 1404, 1}, //index 33
+    { 195, 161, 2093, 2}, //index 34
+    { 260, 217, 2821, 3}, //index 35
+    { 390, 326, 4238, 4}, //index 36
+    { 520, 435, 5655, 6}, //index 37
+    { 585, 492, 6396, 6}, //index 38
+    { 650, 548, 7124, 7}, //index 39
+
+    //11n SIMO CB MCS 0 - 7
+    { 135,   110,  1430,  1}, //index 40
+    { 270,   223,  2899,  3}, //index 41
+    { 405,   337,  4381,  4}, //index 42
+    { 540,   454,  5902,  6}, //index 43
+    { 810,   679,  8827,  9}, //index 44
+    { 1080,  909, 11817, 12}, //index 45
+    { 1215, 1022, 13286, 13}, //index 46
+    { 1350, 1137, 14781, 15}, //index 47
+
+    //11n SIMO CB SGI MCS 0 - 7
+    { 150,   121,  1573,  2}, //index 48
+    { 300,   249,  3237,  3}, //index 49
+    { 450,   378,  4914,  5}, //index 50
+    { 600,   503,  6539,  7}, //index 51
+    { 900,   758,  9854,  10}, //index 52
+    { 1200, 1010, 13130, 13}, //index 53
+    { 1350, 1137, 14781, 15}, //index 54
+    { 1500, 1262, 16406, 16}, //index 55
+
+    //11n SIMO GF CB MCS 0 - 7
+    { 135,   110,   1430,  1}, //index 56
+    { 270,   223,   2899,  3}, //index 57
+    { 405,   337,   4381,  4}, //index 58
+    { 540,   454,   5902,  6}, //index 59
+    { 810,   679,   8827,  9}, //index 60
+    { 1080,  909,  11817, 12}, //index 61
+    { 1215, 1022,  13286, 13}, //index 62
+    { 1350, 1137,  14781, 15}, //index 63
+
+    //11AC
+    { 1350,  675,  8775,  9}, //reserved 64
+    { 1350,  675,  8775,  9}, //reserved 65
+    {   65,   45,   585,  1}, //index 66
+    {  130,   91,  1183,  1}, //index 67
+    {  195,  136,  1768,  2}, //index 68
+    {  260,  182,  2366,  2}, //index 69
+    {  390,  273,  3549,  4}, //index 70
+    {  520,  364,  4732,  5}, //index 71
+    {  585,  409,  5317,  5}, //index 72
+    {  650,  455,  5915,  6}, //index 73
+    {  780,  546,  7098,  7}, //index 74
+    { 1350,  675,  8775,  9}, //reserved 75
+    { 1350,  675,  8775,  9}, //reserved 76
+    { 1350,  675,  8775,  9}, //reserved 77
+    { 1350,  675,  8775,  9}, //index 78
+    { 1350,  675,  8775,  9}, //index 79
+    { 1350,  675,  8775,  9}, //index 80
+    { 1350,  675,  8775,  9}, //index 81
+    { 1350,  675,  8775,  9}, //index 82
+    { 1350,  675,  8775,  9}, //index 83
+    {  655,  458,  5954,  6}, //index 84
+    {  722,  505,  6565,  7}, //index 85
+    {  866,  606,  7878,  8}, //index 86
+    { 1350,  675,  8775,  9}, //reserved 87
+    { 1350,  675,  8775,  9}, //reserved 88
+    { 1350,  675,  8775,  9}, //reserved 89
+    {  135,   94,  1222,  1}, //index 90
+    {  270,  189,  2457,  2}, //index 91
+    {  405,  283,  3679,  4}, //index 92
+    {  540,  378,  4914,  5}, //index 93
+    {  810,  567,  7371,  7}, //index 94
+    { 1080,  756,  9828, 10}, //index 95
+    { 1215,  850, 11050, 11}, //index 96
+    { 1350,  675,  8775,  9}, //index 97
+    { 1350,  675,  8775,  9}, //index 98
+    { 1620,  810, 10530, 11}, //index 99
+    { 1800,  900, 11700, 12}, //index 100
+    { 1350,  675,  8775,  9}, //reserved 101
+    { 1350,  675,  8775,  9}, //index 102
+    { 1350,  675,  8775,  9}, //index 103
+    { 1350,  675,  8775,  9}, //index 104
+    { 1350,  675,  8775,  9}, //index 105
+    { 1350,  675,  8775,  9}, //index 106
+    { 1200,  840, 10920, 11}, //index 107
+    { 1350,  675,  8775,  9}, //index 108
+    { 1500,  750,  9750, 10}, //index 109
+    { 1350,  675,  8775,  9}, //index 110
+    { 1800,  900, 11700, 12}, //index 111
+    { 2000, 1000, 13000, 13}, //index 112
+    { 1350,  675,  8775,  9}, //index 113
+    {  292,  204,  2652,  3}, //index 114
+    {  585,  409,  5317,  5}, //index 115
+    {  877,  613,  7969,  8}, //index 116
+    { 1170,  819, 10647, 11}, //index 117
+    { 1755,  877, 11401, 11}, //index 118
+    { 2340, 1170, 15210, 15}, //index 119
+    { 2632, 1316, 17108, 17}, //index 120
+    { 2925, 1462, 19006, 19}, //index 121
+    { 1350,  675,  8775,  9}, //index 122
+    { 3510, 1755, 22815, 23}, //index 123
+    { 3900, 1950, 25350, 25}, //index 124
+    { 1350,  675,  8775,  9}, //reserved 125
+    { 1350,  675,  8775,  9}, //index 126
+    { 1350,  675,  8775,  9}, //index 127
+    { 1350,  675,  8775,  9}, //index 128
+    { 1350,  675,  8775,  9}, //index 129
+    { 1350,  675,  8775,  9}, //index 130
+    { 1350,  675,  8775,  9}, //index 131
+    { 2925, 1462, 19006, 19}, //index 132
+    { 3250, 1625, 21125, 21}, //index 133
+    { 1350,  675,  8775,  9}, //index 134
+    { 3900, 1950, 25350, 25}, //index 135
+    { 4333, 2166, 28158, 28}  //index 136
+ };
+
+
+
 /*----------------------------------------------------------------------------
  * Static Variable Definitions
  * -------------------------------------------------------------------------*/
@@ -563,6 +736,16 @@
   }
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+   status = WLANTL_RmcInit(pvosGCtx);
+   if (!VOS_IS_STATUS_SUCCESS(status))
+   {
+    TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "RMC module init fail"));
+    return status;
+  }
+#endif
+
   pTLCb->isBMPS = VOS_FALSE;
   pmcRegisterDeviceStateUpdateInd( smeContext,
                                    WLANTL_PowerStateChangedCB, pvosGCtx );
@@ -820,6 +1003,14 @@
   }
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+  if(VOS_STATUS_SUCCESS != WLANTL_RmcDeInit(pvosGCtx))
+  {
+    TLLOGW(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_WARN,
+               "RMC module DeInit fail"));
+  }
+#endif
+
   /*------------------------------------------------------------------------
     Cleanup TL control block.
    ------------------------------------------------------------------------*/
@@ -1239,6 +1430,7 @@
   pClientSTA->tlPri    = WLANTL_STA_PRI_NORMAL;
   pClientSTA->wSTADesc.ucSTAId  = pwSTADescType->ucSTAId;
   pClientSTA->ptkInstalled = 0;
+  pClientSTA->disassoc_progress = VOS_FALSE;
 
   pMac = vos_get_context(VOS_MODULE_ID_PE, pvosGCtx);
   if ( NULL != pMac )
@@ -1451,6 +1643,10 @@
         pTLCb->ucTdlsPeerCount++;
 #endif
   }
+#ifdef WLAN_FEATURE_RMC
+  vos_lock_init(&pClientSTA->mcLock);
+#endif /* WLAN_FEATURE_RMC */
+
   return VOS_STATUS_SUCCESS;
 }/* WLANTL_RegisterSTAClient */
 
@@ -1555,6 +1751,15 @@
              "WLAN TL:Clearing STA Client ID: %d", ucSTAId ));
   WLANTL_CleanSTA(pTLCb->atlSTAClients[ucSTAId], 1 /*empty packets*/);
 
+#ifdef WLAN_FEATURE_RMC
+  /*--------------------------------------------------------------------
+    Delete multicast entries for duplicate detection
+    --------------------------------------------------------------------*/
+  WLANTL_McastDeleteAllEntries(pTLCb->atlSTAClients[ucSTAId]);
+
+  vos_lock_destroy(&pTLCb->atlSTAClients[ucSTAId]->mcLock);
+#endif /* WLAN_FEATURE_RMC */
+
   TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
              "WLAN TL:Clearing STA Reset History RSSI and Region number"));
   pTLCb->hoSupport.currentHOState.historyRSSI = 0;
@@ -1740,6 +1945,12 @@
 
   pClientSTA->wSTADesc.ucQosEnabled = pwSTADescType->ucQosEnabled;
 
+  TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+         "WLAN TL: %s: ucQosEnabled of pwSTADescType: %d"
+          "pClientSTA->wSTADesc: %d",
+          __func__, pwSTADescType->ucQosEnabled,
+          pClientSTA->wSTADesc.ucQosEnabled));
+
   return VOS_STATUS_SUCCESS;
 
 }
@@ -4719,7 +4930,8 @@
            for ( i = 0; i < WLAN_MAX_STA_COUNT; i++)
            {
               if (NULL != pTLCb->atlSTAClients[i] && (pTLCb->atlSTAClients[i]->ucExists) &&
-                  (pTLCb->atlSTAClients[i]->ucPktPending))
+                  (pTLCb->atlSTAClients[i]->ucPktPending) &&
+                  (pTLCb->atlSTAClients[i]->disassoc_progress == VOS_FALSE))
               {
                   /* There is station to be Served */
                   break;
@@ -6006,17 +6218,25 @@
         }
       }/*if bcast*/
 
-      if ((WLANTL_STA_ID_INVALID(ucSTAId)) || (WLANTL_TID_INVALID(ucTid)))
+      if (WLANTL_STA_ID_INVALID(ucSTAId))
       {
         TLLOGW(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_WARN,
-                   "WLAN TL:STAId %d, Tid %d. Invalid STA ID/TID- dropping pkt",
-                   ucSTAId, ucTid));
+                   "WLAN TL:STAId %d. Invalid STA ID dropping pkt",
+                   ucSTAId));
         /* Drop packet */
         vos_pkt_return_packet(vosTempBuff);
         vosTempBuff = vosDataBuff;
         continue;
       }
 
+      if (WLANTL_TID_INVALID( ucTid)) {
+         /* There is a possibility AP uses wrong TID. In that case to avoid
+            dropping EAPOL packet in the driver use TID to zero.*/
+         VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+             "WLAN TL:Invalid Tid: %d Frame type: %d", ucTid, ucFrmType);
+         ucTid = 0;
+      }
+
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
       ac = WLANTL_TID_2_AC[ucTid];
 #endif
@@ -8442,6 +8662,8 @@
         TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
                "WLAN TL:Invalid tid  %d (Station ID %d) on %s",
                ucTid, ucSTAId, __func__));
+        vos_pkt_return_packet(vosDataBuff);
+        return VOS_STATUS_E_FAILURE;
       }
 
       TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
@@ -8627,6 +8849,235 @@
    return VOS_STATUS_SUCCESS;
 }
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+void WLANTL_StopRxRateMonitor(v_PVOID_t pvosGCtx)
+{
+   WLANTL_CbType *pTLCb = VOS_GET_TL_CB(pvosGCtx);
+   if (!pTLCb)
+     return;
+   pTLCb->gDsRxRoamStats.running = eWLAN_PAL_FALSE;
+}
+
+void WLANTL_StartRxRateMonitor(v_PVOID_t pvosGCtx, v_U8_t staId,
+                  v_U16_t minRate,
+                  v_U16_t maxRate, v_U8_t minPercentage,
+                  v_U16_t minPktRequired, void *hHal,
+                  v_U64_t timeToWait,
+                  void (*triggerRoamScanfn) (void *, v_U8_t))
+{
+
+   WLANTL_CbType *pTLCb = VOS_GET_TL_CB(pvosGCtx);
+   if (!pTLCb)
+     return;
+
+   pTLCb->gDsRxRoamStats.running = eWLAN_PAL_TRUE;
+   pTLCb->gDsRxRoamStats.index = 0;
+   pTLCb->gDsRxRoamStats.lastTriggerTime = jiffies_to_msecs(jiffies);
+   pTLCb->gDsRxRoamStats.maxRate = maxRate;
+   pTLCb->gDsRxRoamStats.minRate = minRate;
+   pTLCb->gDsRxRoamStats.staId = staId;
+   pTLCb->gDsRxRoamStats.minPercentage = minPercentage;
+   pTLCb->gDsRxRoamStats.timeToWait = timeToWait * 1000;
+   pTLCb->gDsRxRoamStats.intialPktToStart = 0;
+   pTLCb->gDsRxRoamStats.minPktRequired = minPktRequired;
+   pTLCb->gDsRxRoamStats.triggerRoamScanfn = triggerRoamScanfn;
+   pTLCb->gDsRxRoamStats.hHal = hHal;
+   vos_mem_zero(pTLCb->gDsRxRoamStats.rxRoamStats, ROAM_MAX_INDEX_NUM *
+                                sizeof(WLANTL_RoamTrafficStatsType));
+   VOS_TRACE(VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_DEBUG,
+       "staId=%d, minRate=%d maxRate=%d minPercentage=%d minPktRequired=%d",
+       staId, minRate, maxRate, minPercentage, minPktRequired);
+}
+
+void static WLANTL_ClearAllRoamStats(WLANTL_CbType *pTLCb)
+{
+   pTLCb->gDsRxRoamStats.index = 0;
+   pTLCb->gDsRxRoamStats.totalPkt = 0;
+   pTLCb->gDsRxRoamStats.lowRatePkt = 0;
+   pTLCb->gDsRxRoamStats.intialPktToStart = 0;
+   vos_mem_zero(pTLCb->gDsRxRoamStats.rxRoamStats, ROAM_MAX_INDEX_NUM *
+                                sizeof(WLANTL_RoamTrafficStatsType));
+}
+
+/*
+ * WLANTL_ClearRoamStatsTillIndex : This API will clear older data
+ * at the indexes.
+ *
+ * Since its a circular buffer we don't know if we are filling
+ * data first time or some older data was already present at
+ * the index. In that case we should clear the older data from
+ * current index to new index and subtract this data from
+ * global count as well before filling new one.
+ */
+static inline void WLANTL_ClearRoamStatsTillIndex(WLANTL_CbType *pTLCb,
+                                           v_U8_t newIndex)
+{
+   while (pTLCb->gDsRxRoamStats.index < newIndex)
+   {
+     pTLCb->gDsRxRoamStats.index++;
+     pTLCb->gDsRxRoamStats.totalPkt -=
+         pTLCb->gDsRxRoamStats.
+             rxRoamStats[pTLCb->gDsRxRoamStats.index].totalPktRcvd;
+     pTLCb->gDsRxRoamStats.lowRatePkt -=
+         pTLCb->gDsRxRoamStats.
+             rxRoamStats[pTLCb->gDsRxRoamStats.index].lowRateRxPacketsRcvd;
+     pTLCb->gDsRxRoamStats.
+         rxRoamStats[pTLCb->gDsRxRoamStats.index].totalPktRcvd = 0;
+     pTLCb->gDsRxRoamStats.
+         rxRoamStats[pTLCb->gDsRxRoamStats.index].lowRateRxPacketsRcvd = 0;
+   }
+}
+
+
+static void WLANTL_ClearOldPERStats(WLANTL_CbType *pTLCb, v_U8_t incrementCnt)
+{
+   v_U8_t newIndex;
+
+   newIndex = (pTLCb->gDsRxRoamStats.index + incrementCnt) %
+                                             ROAM_MAX_INDEX_NUM;
+
+   /* We have crossed the max limit of buffer, clear the stats
+    * till ROAM_MAX_INDEX_NUM and set index as 0 */
+   if ((pTLCb->gDsRxRoamStats.index + incrementCnt) >=
+                                             ROAM_MAX_INDEX_NUM)
+   {
+       WLANTL_ClearRoamStatsTillIndex(pTLCb, ROAM_MAX_INDEX_NUM - 1);
+       pTLCb->gDsRxRoamStats.index = -1;
+   }
+   /* Clear the stats from current index till new index */
+   WLANTL_ClearRoamStatsTillIndex(pTLCb, newIndex);
+}
+
+/*
+ * This API implements a circular buffer to store rate stats for a station to
+ * trigger PER based roam scan.
+ * API will start monitoring only if DUT gets continues packets which are below
+ * configured rate. In the upper rates, this should have minimal effect on data
+ * throughput.
+ *
+ * This API will store stats in a circular buffer of size ROAM_MAX_INDEX_NUM
+ * where each index will have time duration of ROAM_PER_INDEX_TIME.
+ * Using a buffer instead of counter will help to maintain stats of time
+ * duration ROAM_PER_INDEX_TIME * ROAM_MAX_INDEX_NUM. Whenever host gets a new
+ * packet, it will remove last ROAM_PER_INDEX_TIME duration of packets from
+ * global entry and index entry and fill new data.
+ *
+ * Global stats of data also be maintained so that host need not to parse whole
+ * buffer while checking the trigger condition
+ * Each of the index will be having the packets stats at duration of
+ * ROAM_PER_INDEX_TIME from the first packet which arrived in that.
+ * Global index will be used to calculate new index position to fill once host
+ * gets a packet.
+ */
+static void WLANTL_updatePERStats(WLANTL_CbType *pTLCb,
+                                  v_U8_t rateIndex)
+{
+   v_U8_t incrementCnt;
+   v_U64_t currentTime, timeDifference;
+
+   /*
+    * Host will start monitoring Rx rates only if it gets
+    * MIN_PKTS_TO_START_MONTIOR number of pkts continuously below min rate
+    * This will make sure we never do this much processing in high
+    * rates/throughput cases
+    */
+
+   if(pTLCb->gDsRxRoamStats.intialPktToStart < MIN_PKTS_TO_START_MONTIOR)
+   {
+       if (gTLRateInfo[rateIndex].phyRate < pTLCb->gDsRxRoamStats.minRate)
+          pTLCb->gDsRxRoamStats.intialPktToStart++;
+       else
+          pTLCb->gDsRxRoamStats.intialPktToStart = 0;
+       return;
+   }
+
+   currentTime = jiffies_to_msecs(jiffies);
+   /*
+    * scan was triggered in last timeToWait time duration
+    * Wait for timeToWait before monitoring again.
+    */
+   if((currentTime - pTLCb->gDsRxRoamStats.lastTriggerTime) <
+       pTLCb->gDsRxRoamStats.timeToWait)
+       return;
+
+   /* paket above max rate, clear current stats and montior again */
+   if (gTLRateInfo[rateIndex].phyRate >=
+           pTLCb->gDsRxRoamStats.maxRate)
+   {
+       WLANTL_ClearAllRoamStats(pTLCb);
+       /* Stop any PER based scan if going on */
+       pTLCb->gDsRxRoamStats.
+                  triggerRoamScanfn(pTLCb->gDsRxRoamStats.hHal, 0);
+       return;
+   }
+
+   timeDifference = currentTime -
+       pTLCb->gDsRxRoamStats.rxRoamStats[pTLCb->gDsRxRoamStats.index].time;
+
+   if (timeDifference)
+       incrementCnt = do_div(timeDifference, ROAM_PER_INDEX_TIME);
+
+   /* More that ROAM_PER_INDEX_TIME has esclapsed,
+    * fill data at new index */
+   if (incrementCnt)
+   {
+       if (incrementCnt > ROAM_MAX_INDEX_NUM)
+       {
+           /*
+            * Clear all stats, these are older than
+            * ROAM_MAX_INDEX_NUM * ROAM_PER_INDEX_TIME (Max buffer time)
+            */
+           WLANTL_ClearAllRoamStats(pTLCb);
+           pTLCb->gDsRxRoamStats.index = 0;
+       }
+       else
+           WLANTL_ClearOldPERStats(pTLCb, incrementCnt);
+
+       pTLCb->gDsRxRoamStats.rxRoamStats
+                    [pTLCb->gDsRxRoamStats.index].time = currentTime;
+   }
+
+   /* If pkt rate below minRate, increment low pkts counts */
+   if (gTLRateInfo[rateIndex].phyRate <
+           pTLCb->gDsRxRoamStats.minRate)
+   {
+       pTLCb->gDsRxRoamStats.
+           rxRoamStats[pTLCb->gDsRxRoamStats.index].
+               lowRateRxPacketsRcvd++;
+       pTLCb->gDsRxRoamStats.lowRatePkt++;
+   }
+   /* Increment total pkts counts */
+   pTLCb->gDsRxRoamStats.
+           rxRoamStats[pTLCb->gDsRxRoamStats.index].totalPktRcvd++;
+   pTLCb->gDsRxRoamStats.totalPkt++;
+
+   /* Check if we have reached threshold value to trigger a roam scan */
+   if ((pTLCb->gDsRxRoamStats.totalPkt != 0) &&
+       (pTLCb->gDsRxRoamStats.totalPkt >
+                pTLCb->gDsRxRoamStats.minPktRequired)&&
+       ((pTLCb->gDsRxRoamStats.lowRatePkt * 100) >
+                (pTLCb->gDsRxRoamStats.totalPkt *
+       pTLCb->gDsRxRoamStats.minPercentage)))
+   {
+       /* callback handler to trigger a roam scan */
+       if (pTLCb->gDsRxRoamStats.triggerRoamScanfn)
+           pTLCb->gDsRxRoamStats.
+                   triggerRoamScanfn(pTLCb->gDsRxRoamStats.hHal, 1);
+
+       VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_DEBUG,
+           "PER Roam: triggerring roam scan totalPkt =%lu lowRatePkt %lu minPktRequired %u minPercentage %d",
+           (long unsigned int) pTLCb->gDsRxRoamStats.totalPkt,
+           (long unsigned int) pTLCb->gDsRxRoamStats.lowRatePkt,
+           (unsigned int) pTLCb->gDsRxRoamStats.minPktRequired,
+           pTLCb->gDsRxRoamStats.minPercentage);
+
+       WLANTL_ClearAllRoamStats(pTLCb);
+       /*  save current time as last trigger time */
+       pTLCb->gDsRxRoamStats.lastTriggerTime = currentTime;
+   }
+}
+#endif
+
 /*==========================================================================
   FUNCTION    WLANTL_STARxAuth
 
@@ -8673,6 +9124,10 @@
    v_U8_t                   ucMPDUHLen;
    v_U16_t                  usActualHLen = 0;   
    v_U8_t                   ucTid;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+   v_U8_t                   rxRate;
+   v_U8_t                   type;
+#endif
 #ifdef FEATURE_WLAN_WAPI
    v_U16_t                  usEtherType = 0;
    tSirMacMgmtHdr           *hdr;
@@ -8731,6 +9186,10 @@
   usMPDULen     = (v_U16_t)WDA_GET_RX_MPDU_LEN(aucBDHeader);
   ucMPDUHLen    = (v_U8_t)WDA_GET_RX_MPDU_HEADER_LEN(aucBDHeader);
   ucTid         = (v_U8_t)WDA_GET_RX_TID(aucBDHeader);
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+  rxRate        = (v_U8_t)WDA_GET_RX_MAC_RATE_IDX(aucBDHeader);
+  type          = (v_U8_t)WDA_GET_RX_TYPE(aucBDHeader);
+#endif
 
   /* Fix for a hardware bug. 
    * H/W does not update the tid field in BD header for BAR frames.
@@ -8788,6 +9247,25 @@
   }
   }
 
+#ifdef WLAN_FEATURE_RMC
+  if (pTLCb->multicastDuplicateDetectionEnabled &&
+      (WLAN_STA_IBSS == pClientSTA->wSTADesc.wSTAType) &&
+       WLANTL_IS_DATA_FRAME(WDA_GET_RX_TYPE_SUBTYPE(aucBDHeader)))
+  {
+    /*
+     * Multicast duplicate detection is only for frames received in
+     * IBSS mode.
+     */
+    if (VOS_TRUE == WLANTL_IsDuplicateMcastFrm(pClientSTA, vosDataBuff))
+    {
+         pTLCb->mcastDupCnt++;
+         /* Duplicate multicast data packet, drop the packet */
+         vos_pkt_return_packet(vosDataBuff);
+         return VOS_STATUS_SUCCESS;
+    }
+  }
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_WAPI
   if ( pClientSTA->wSTADesc.ucIsWapiSta )
   {
@@ -8844,8 +9322,18 @@
     TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
            "WLAN TL:Invalid tid  %d (Station ID %d) on %s",
            ucTid, ucSTAId, __func__));
+    vos_pkt_return_packet(vosDataBuff);
+    return VOS_STATUS_E_FAILURE;
   }
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+  if (pTLCb->gDsRxRoamStats.running &&
+     (ucSTAId == pTLCb->gDsRxRoamStats.staId) &&
+     (rxRate < WLANTL_MAX_RATE_NUM) && (type == SIR_MAC_DATA_FRAME))
+  {
+      WLANTL_updatePERStats(pTLCb, rxRate);
+  }
+#endif
   /*------------------------------------------------------------------------
     Check if AMSDU and send for processing if so
    ------------------------------------------------------------------------*/
@@ -11032,7 +11520,8 @@
           continue;
         }
 
-        if (WLANTL_STA_AUTHENTICATED != pTLCb->atlSTAClients[ucNextSTA]->tlState)
+        if ((WLANTL_STA_AUTHENTICATED != pTLCb->atlSTAClients[ucNextSTA]->tlState)
+           || (pTLCb->atlSTAClients[ucNextSTA]->disassoc_progress == VOS_TRUE ))
         {
           TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
                  "%s Sta %d not in auth state so skipping it.",
@@ -11700,7 +12189,7 @@
   ptlSTAClient->wSTADesc.ucSwFrameTXXlation = 0;
   ptlSTAClient->wSTADesc.ucSwFrameRXXlation = 0;
   ptlSTAClient->wSTADesc.ucProtectedFrame = 0;
-
+  ptlSTAClient->disassoc_progress = VOS_FALSE;
   /*-------------------------------------------------------------------------
     AMSDU information for the STA
    -------------------------------------------------------------------------*/
@@ -13284,3 +13773,618 @@
 
     return VOS_STATUS_SUCCESS;
 }/* WLANTL_GetSTALinkCapacity */
+
+
+#ifdef WLAN_FEATURE_RMC
+VOS_STATUS WLANTL_RmcInit
+(
+    v_PVOID_t   pAdapter
+)
+{
+    WLANTL_CbType   *pTLCb = VOS_GET_TL_CB(pAdapter);
+    VOS_STATUS       status = VOS_STATUS_SUCCESS;
+    tANI_U8          count;
+
+    /*sanity check*/
+    if (NULL == pTLCb)
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "Invalid TL handle"));
+        return VOS_STATUS_E_INVAL;
+    }
+
+    for ( count = 0; count < WLANTL_RMC_HASH_TABLE_SIZE; count++ )
+    {
+        pTLCb->rmcSession[count] = NULL;
+    }
+
+    vos_lock_init(&pTLCb->rmcLock);
+
+    pTLCb->multicastDuplicateDetectionEnabled = 1;
+    pTLCb->rmcDataPathEnabled = 0;
+
+    return status;
+}
+
+
+VOS_STATUS WLANTL_RmcDeInit
+(
+    v_PVOID_t   pAdapter
+)
+{
+    WLANTL_CbType   *pTLCb = VOS_GET_TL_CB(pAdapter);
+    VOS_STATUS       status = VOS_STATUS_SUCCESS;
+    tANI_U8          count;
+    WLANTL_RMC_SESSION *pNode;
+    WLANTL_RMC_SESSION *pPrev;
+
+    /*sanity check*/
+    if (NULL == pTLCb)
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "Invalid TL handle"));
+        return VOS_STATUS_E_INVAL;
+    }
+
+    for ( count = 0; count < WLANTL_RMC_HASH_TABLE_SIZE; count++ )
+    {
+        pNode = pTLCb->rmcSession[count];
+        while (pNode)
+        {
+            pPrev = pNode;
+            pNode = pNode->next;
+            vos_mem_free((v_VOID_t * )pPrev);
+        }
+    }
+
+    vos_lock_destroy(&pTLCb->rmcLock);
+
+    return status;
+}
+
+
+tANI_U8 WLANTL_RmcHashRmcSession ( v_MACADDR_t   *pMcastAddr )
+{
+    tANI_U32 sum;
+    tANI_U8  hash;
+
+    sum = (pMcastAddr->bytes[0] + pMcastAddr->bytes[1] + pMcastAddr->bytes[2] +
+           pMcastAddr->bytes[3] + pMcastAddr->bytes[4] + pMcastAddr->bytes[5]);
+
+    hash = (tANI_U8)(sum & ((WLANTL_RMC_HASH_TABLE_SIZE - 1)));
+
+    return hash;
+}
+
+
+WLANTL_RMC_SESSION* WLANTL_RmcLookUpRmcSession
+(
+    WLANTL_RMC_SESSION *rmcSession[],
+    v_MACADDR_t     *pMcastAddr
+)
+{
+    WLANTL_RMC_SESSION *pNode;
+    tANI_U8               index;
+
+    /*sanity check*/
+    if (NULL == pMcastAddr)
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "Sanity check failed pMcastAddr %p", pMcastAddr));
+        return NULL;
+    }
+
+    index = WLANTL_RmcHashRmcSession(pMcastAddr);
+    pNode = rmcSession[index];
+    while ( pNode )
+    {
+        if (vos_is_macaddr_equal( &(pNode->rmcAddr), pMcastAddr))
+        {
+            return pNode;
+        }
+        pNode = pNode->next;
+    }
+
+    return NULL;
+}
+
+WLANTL_RMC_SESSION *WLANTL_RmcAddRmcSession
+(
+  WLANTL_RMC_SESSION *rmcSession[],
+  v_MACADDR_t   *pMcastAddr
+)
+{
+    WLANTL_RMC_SESSION *pNode;
+    tANI_U8               index;
+
+    index = WLANTL_RmcHashRmcSession(pMcastAddr);
+    pNode = WLANTL_RmcLookUpRmcSession(rmcSession, pMcastAddr);
+    if ( NULL != pNode )
+    {
+        /*already exists*/
+        return NULL;
+    }
+    else
+    {
+        pNode = (WLANTL_RMC_SESSION *)vos_mem_malloc(sizeof(*pNode));
+        if (pNode)
+        {
+            vos_mem_copy( &(pNode->rmcAddr), pMcastAddr,
+                sizeof(pNode->rmcAddr) );
+            pNode->next = rmcSession[index];
+            rmcSession[index] = pNode;
+            return pNode;
+        }
+        else
+        {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: vos_mem_malloc failed can't enable RMC session",
+                __func__);
+            return NULL;
+        }
+    }
+}
+
+tANI_U8
+WLANTL_RmcDeleteRmcSession
+(
+  WLANTL_RMC_SESSION *rmcSession[],
+  v_MACADDR_t   *pMcastAddr
+)
+{
+    WLANTL_RMC_SESSION *pHead;
+    WLANTL_RMC_SESSION *pNode;
+    WLANTL_RMC_SESSION *pPrev;
+    tANI_U8               index;
+
+    index = WLANTL_RmcHashRmcSession(pMcastAddr);
+    pHead = pNode = rmcSession[index];
+    while (pNode)
+    {
+        if (vos_is_macaddr_equal( &(pNode->rmcAddr), pMcastAddr))
+        {
+            if (pHead == pNode)
+            {
+                rmcSession[index] = pNode->next;
+            }
+            else
+            {
+                pPrev->next = pNode->next;
+            }
+            vos_mem_free((v_VOID_t * )pNode);
+            return 1;
+        }
+        pPrev = pNode;
+        pNode = pNode->next;
+    }
+
+    return 0;
+}
+
+VOS_STATUS
+WLANTL_ProcessRmcCommand
+(
+    WLANTL_CbType*  pTLCb,
+    v_MACADDR_t    *pMcastAddr,
+    tANI_U32        command
+)
+{
+    VOS_STATUS status;
+    tANI_U32 count;
+    tANI_U32 rmcActive;
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire( &(pTLCb->rmcLock))))
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "%s Get Lock Fail", __func__));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    /*add or delete node from active rmc hash table*/
+    if (command)
+    {
+        /*add requested rmc session in active rmc session list*/
+        if (WLANTL_RmcAddRmcSession(pTLCb->rmcSession, pMcastAddr))
+        {
+            TLLOGE( VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "RMC session " MAC_ADDRESS_STR " added in TL hash table",
+                MAC_ADDR_ARRAY(pMcastAddr->bytes) ) );
+            pTLCb->rmcDataPathEnabled = TRUE;
+            status = VOS_STATUS_SUCCESS;
+        }
+        else
+        {
+            TLLOGE( VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "RMC session " MAC_ADDRESS_STR " already exists in TL hash"
+                " table", MAC_ADDR_ARRAY(pMcastAddr->bytes) ) );
+            status = VOS_STATUS_E_FAILURE;
+        }
+    }
+    else
+    {
+        /*delete requested rmc session from active rmc session list*/
+        if (WLANTL_RmcDeleteRmcSession(pTLCb->rmcSession, pMcastAddr))
+        {
+            TLLOGE( VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                "RMC session " MAC_ADDRESS_STR " deleted from TL hash table",
+                MAC_ADDR_ARRAY(pMcastAddr->bytes)) );
+            status = VOS_STATUS_SUCCESS;
+            rmcActive = FALSE;
+            for ( count = 0; count < WLANTL_RMC_HASH_TABLE_SIZE; count++ )
+            {
+                if (pTLCb->rmcSession[count])
+                {
+                    rmcActive = TRUE;
+                    break;
+                }
+            }
+            if (TRUE == rmcActive)
+            {
+                pTLCb->rmcDataPathEnabled = TRUE;
+            }
+            else
+            {
+                pTLCb->rmcDataPathEnabled = FALSE;
+            }
+        }
+        else
+        {
+            TLLOGE( VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "RMC session " MAC_ADDRESS_STR " doesn't exist in TL hash"
+                " table", MAC_ADDR_ARRAY(pMcastAddr->bytes) ) );
+            status = VOS_STATUS_E_FAILURE;
+        }
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_release(&(pTLCb->rmcLock))))
+    {
+         TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+             "%s Release Lock Fail", __func__));
+         return VOS_STATUS_E_FAILURE;
+    }
+
+    return status;
+}/* End of WLANTL_ProcessRmcCommand */
+
+VOS_STATUS
+WLANTL_EnableRMC
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastTransmitterAddr
+)
+{
+    WLANTL_CbType*  pTLCb;
+    VOS_STATUS status;
+
+    /*sanity check*/
+    if ( (NULL == pvosGCtx) || (NULL == pMcastTransmitterAddr) )
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: Sanity check failed pvosGCtx %p aMcastAddr %p",
+            __func__, pvosGCtx, pMcastTransmitterAddr));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    /*sanity check*/
+    pTLCb = VOS_GET_TL_CB(pvosGCtx);
+    if ( NULL == pTLCb )
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: pTLCb is NULL", __func__));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    status = WLANTL_ProcessRmcCommand(pTLCb, pMcastTransmitterAddr , 1);
+
+    return status;
+} /* End of WLANTL_EnableRMC */
+
+
+VOS_STATUS
+WLANTL_DisableRMC
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastTransmitterAddr
+)
+{
+    WLANTL_CbType* pTLCb;
+    VOS_STATUS status;
+
+    /*Sanity check*/
+    if ((NULL == pvosGCtx) || (NULL == pMcastTransmitterAddr))
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: Sanity check failed pvosGCtx %p aMcastAddr %p",
+             __func__, pvosGCtx, pMcastTransmitterAddr));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    /*Sanity check*/
+    pTLCb = VOS_GET_TL_CB(pvosGCtx);
+    if (NULL == pTLCb)
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: pTLCb is NULL", __func__));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    status = WLANTL_ProcessRmcCommand(pTLCb, pMcastTransmitterAddr, 0);
+
+    return status;
+} /* End of WLANTL_DisableRMC */
+
+
+/*=============================================================================
+        Duplicate Multicast Detection Functions
+==============================================================================*/
+
+/*=============================================================================
+  FUNCTION    WLANTL_IsDuplicateMcastFrm
+
+  DESCRIPTION
+    This function checks for duplicast multicast frames and drops them.
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pClientSTA  : Pointer to WLANTL_STAClientType
+   aucBDHeader : Pointer to BD header
+
+  RETURN VALUE
+
+    VOS_FALSE:  This frame is not a duplicate
+
+    VOS_TRUE:   This frame is a duplicate
+
+==============================================================================*/
+v_U8_t
+WLANTL_IsDuplicateMcastFrm
+(
+    WLANTL_STAClientType *pClientSTA,
+    vos_pkt_t *vosDataBuff
+)
+{
+    v_U8_t duplicate = VOS_FALSE;
+    WLANTL_RMC_SESSION *pNode;
+    v_U16_t     usSeqCtrl;
+    v_MACADDR_t mcastAddr;
+    VOS_STATUS  vosStatus;
+    v_PVOID_t   pvPeekData;
+
+    /* Get address 1 of Data Frame */
+    vosStatus = vos_pkt_peek_data(vosDataBuff, WLANTL_MAC_ADDR_ALIGN(1),
+                                  (v_PVOID_t)&pvPeekData, VOS_MAC_ADDR_SIZE);
+
+    if ( VOS_STATUS_SUCCESS != vosStatus )
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "WLAN TL: Failed to get Addr 1 of 80211 header from packet %d",
+                vosStatus));
+        return VOS_FALSE;
+    }
+
+    /* Copy address 1 of Data Frame */
+    vos_mem_copy(&mcastAddr.bytes, pvPeekData, VOS_MAC_ADDR_SIZE);
+
+    /*
+     * We perform duplicate detection for only multicast data frames
+     */
+    if (vos_is_macaddr_group(&mcastAddr) &&
+         !vos_is_macaddr_broadcast(&mcastAddr))
+    {
+        /* Get sequence control of Data Frame */
+        vosStatus = vos_pkt_peek_data(vosDataBuff,
+                    (WLANTL_MAC_ADDR_ALIGN(1) + (3 * VOS_MAC_ADDR_SIZE)),
+                      (v_PVOID_t)&pvPeekData, sizeof(v_U16_t));
+
+        if ( VOS_STATUS_SUCCESS != vosStatus )
+        {
+            TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                    "WLAN TL: Failed to get Sequence Control from packet %d",
+                    vosStatus));
+            return VOS_FALSE;
+        }
+
+        /* Copy sequence control from the Data Frame */
+        usSeqCtrl = *(v_U16_t *)pvPeekData;
+
+        if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&(pClientSTA->mcLock))))
+        {
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                    "%s Get Lock Fail", __func__));
+            return VOS_FALSE;
+        }
+
+        pNode = WLANTL_RmcLookUpRmcSession(pClientSTA->mcastSession,
+                                                      &mcastAddr);
+        if (NULL == pNode)
+        {
+            /* If the session does not exist, add it. */
+            pNode = WLANTL_RmcAddRmcSession(pClientSTA->mcastSession,
+                                              &mcastAddr);
+            /* If we could not add a entry, skip duplicate detection */
+            if (NULL == pNode)
+            {
+                TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                    "%s Failed to add multicast session", __func__));
+                if (!VOS_IS_STATUS_SUCCESS
+                     (vos_lock_release(&(pClientSTA->mcLock))))
+                {
+                    TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                        "%s Release Lock Fail", __func__));
+                }
+                return VOS_FALSE;
+            }
+            /* Initialize the sequence control value. */
+            pNode->mcSeqCtl = usSeqCtrl;
+        }
+        else
+        {
+            /*
+             * Check if the sequence number of this frame matches the last
+             * we have seen.
+             */
+            if (pNode->mcSeqCtl == usSeqCtrl)
+            {
+                pNode->rxMCDupcnt++;
+                TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                     "%s Rx Multicast Duplicate %d " MAC_ADDRESS_STR
+                     " (Seq %x)", __func__,
+                     pNode->rxMCDupcnt, MAC_ADDR_ARRAY(mcastAddr.bytes),
+                     usSeqCtrl));
+                duplicate = VOS_TRUE;
+            }
+            else
+            {
+                /* Update the last seen sequence number */
+                pNode->mcSeqCtl = usSeqCtrl;
+            }
+        }
+
+        if (!VOS_IS_STATUS_SUCCESS (vos_lock_release(&(pClientSTA->mcLock))))
+        {
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                    "%s Release Lock Fail", __func__));
+        }
+    }
+
+    return duplicate;
+}
+
+/*=============================================================================
+  FUNCTION    WLANTL_McastDeleteAllEntries
+
+  DESCRIPTION
+    This function removes all multicast entries used for duplicate detection
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pClientSTA  : Pointer to WLANTL_STAClientType
+
+  RETURN VALUE
+
+    None
+
+==============================================================================*/
+void
+WLANTL_McastDeleteAllEntries(WLANTL_STAClientType * pClientSTA)
+{
+    WLANTL_RMC_SESSION *pNode, **head;
+    int index;
+
+    TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                        "%s Deleting all multicast entries", __func__));
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&(pClientSTA->mcLock))))
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "%s Get Lock Fail", __func__));
+        return;
+    }
+
+    for (index = 0; index < WLANTL_RMC_HASH_TABLE_SIZE; index++)
+    {
+        head = &pClientSTA->mcastSession[index];
+
+        pNode = *head;
+
+        while (pNode)
+        {
+            *head = pNode->next;
+            /* free the group entry */
+            vos_mem_free(pNode);
+            pNode = *head;
+        }
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS (vos_lock_release(&(pClientSTA->mcLock))))
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "%s Release Lock Fail", __func__));
+    }
+}
+
+/*=============================================================================
+  FUNCTION    WLANTL_SetMcastDuplicateDetection
+
+  DESCRIPTION
+    This function sets multicate duplicate detection operation.
+    If enable is 1, the detection is enabled, else it is disabled.
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pvosGCtx   : Pointer to VOS global context
+   enable : Boolean to enable or disable
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAULT:   Sanity check on input failed
+
+    VOS_STATUS_SUCCESS:   Everything is good :)
+
+   Other return values are possible coming from the called functions.
+   Please check API for additional info.
+
+  SIDE EFFECTS
+
+==============================================================================*/
+VOS_STATUS
+WLANTL_SetMcastDuplicateDetection
+(
+    v_PVOID_t     pvosGCtx,
+    v_U8_t        enable
+)
+{
+    WLANTL_CbType* pTLCb;
+
+    /*Sanity check*/
+    if (NULL == pvosGCtx)
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: Sanity check failed pvosGCtx %p",
+             __func__, pvosGCtx));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    /*Sanity check*/
+    pTLCb = VOS_GET_TL_CB(pvosGCtx);
+    if (NULL == pTLCb)
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: pTLCb is NULL", __func__));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    switch (enable)
+    {
+    default:
+        /*
+         * Any value other than 0 or 1 is used to dump the
+         * duplicate count.
+         */
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: Multicast Duplicate Count %d",
+             __func__, pTLCb->mcastDupCnt));
+        break;
+    case 0:
+    case 1:
+        pTLCb->multicastDuplicateDetectionEnabled = enable;
+        break;
+    }
+
+    return VOS_STATUS_SUCCESS;
+}
+
+#endif /* WLAN_FEATURE_RMC */
diff --git a/wlan/prima/CORE/TL/src/wlan_qct_tl_ba.c b/wlan/prima/CORE/TL/src/wlan_qct_tl_ba.c
index a991a2b..9f60188 100644
--- a/wlan/prima/CORE/TL/src/wlan_qct_tl_ba.c
+++ b/wlan/prima/CORE/TL/src/wlan_qct_tl_ba.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1204,6 +1204,9 @@
          }
          if(VOS_STATUS_E_RESOURCES == status)
          {
+            MTRACE(vos_trace(VOS_MODULE_ID_TL, TRACE_CODE_TL_QUEUE_CURRENT,
+                    currentReorderInfo->sessionID , ucOpCode ));
+
             /* This is the case slot index is already cycle one route, route all the frames Qed */
             vosPktIdx = NULL;
             status = WLANTL_ChainFrontPkts(ucFwdIdx,
@@ -1332,6 +1335,9 @@
            }
          if(VOS_STATUS_E_RESOURCES == status)
          {
+            MTRACE(vos_trace(VOS_MODULE_ID_TL, TRACE_CODE_TL_QUEUE_CURRENT,
+                                  currentReorderInfo->sessionID , ucOpCode ));
+
             /* This is the case slot index is already cycle one route, route all the frames Qed */
             vosPktIdx = NULL;
             status = WLANTL_ChainFrontPkts(ucFwdIdx,
@@ -1393,6 +1399,9 @@
            }
          if(VOS_STATUS_E_RESOURCES == status)
          {
+            MTRACE(vos_trace(VOS_MODULE_ID_TL, TRACE_CODE_TL_QUEUE_CURRENT,
+                                   currentReorderInfo->sessionID , ucOpCode ));
+
             vos_pkt_return_packet(vosPktIdx); 
             /* This is the case slot index is already cycle one route, route all the frames Qed */
             vosPktIdx = NULL;
@@ -1526,6 +1535,13 @@
                WLANTL_FillReplayCounter(currentReorderInfo,
                                  ullreplayCounter, ucSlotIdx);
            }
+
+         if(VOS_STATUS_E_RESOURCES == status)
+         {
+             MTRACE(vos_trace(VOS_MODULE_ID_TL, TRACE_CODE_TL_QUEUE_CURRENT,
+                                   currentReorderInfo->sessionID , ucOpCode ));
+         }
+
          if(!VOS_IS_STATUS_SUCCESS(status))
          {
             TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,"Q Current frame fail %d",
@@ -1717,7 +1733,10 @@
       MTRACE(vos_trace(VOS_MODULE_ID_TL, TRACE_CODE_TL_QUEUE_CURRENT,
                       pwBaReorder->sessionID , pwBaReorder->pendingFramesCount ));
 
-      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,"One Cycle rounded, lost many frames already, not in Q %d",
+      MTRACE(vos_trace(VOS_MODULE_ID_TL, TRACE_CODE_TL_QUEUE_CURRENT,
+                                        pwBaReorder->sessionID , ucSlotIndex ));
+
+      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,"One Cycle rounded, lost many frames already, not in Q %d",
                   pwBaReorder->pendingFramesCount));
       return VOS_STATUS_E_RESOURCES;
    }
diff --git a/wlan/prima/CORE/TL/src/wlan_qct_tl_hosupport.c b/wlan/prima/CORE/TL/src/wlan_qct_tl_hosupport.c
index c4f8df6..950f3f0 100644
--- a/wlan/prima/CORE/TL/src/wlan_qct_tl_hosupport.c
+++ b/wlan/prima/CORE/TL/src/wlan_qct_tl_hosupport.c
@@ -1313,6 +1313,15 @@
       (WLANTL_MGMT_FRAME_TYPE != frameType))
    {
       tid = WDA_GET_RX_TID( pBDHeader );
+
+      /* If AP uses TID greater than 8 for EAPOL packet connection will not
+         be established. To ensure no connection fail use TID as zero.*/
+      if (WLANTL_TID_INVALID(tid)) {
+         VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+             "WLAN TL:Invalid Tid: %d", tid);
+         tid = 0;
+      }
+
       ac = WLANTL_HO_TID_2_AC[(v_U8_t)tid];
 
       /* Only Voice traffic is handled as real time traffic */
diff --git a/wlan/prima/CORE/TL/src/wlan_qct_tli.h b/wlan/prima/CORE/TL/src/wlan_qct_tli.h
index c59067c..5069863 100644
--- a/wlan/prima/CORE/TL/src/wlan_qct_tli.h
+++ b/wlan/prima/CORE/TL/src/wlan_qct_tli.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -58,6 +58,7 @@
 
 when        who    what, where, why
 --------    ---    ----------------------------------------------------------
+08/19/13    rajekuma Added RMC support in TL
 02/19/10    bad     Fixed 802.11 to 802.3 ft issues with WAPI
 01/14/10    rnair   Fixed the byte order for the WAI packet type.
 01/08/10    lti     Added TL Data Caching
@@ -185,6 +186,10 @@
 
 #define WLANTL_FRAME_TYPESUBTYPE_MASK 0x3F
 
+#ifdef WLAN_FEATURE_RMC
+#define WLANTL_RMC_HASH_TABLE_SIZE (32)
+#endif
+
 /*-------------------------------------------------------------------------
   BT-AMP related definition - !!! should probably be moved to BT-AMP header
 ---------------------------------------------------------------------------*/
@@ -491,6 +496,18 @@
   v_U8_t              ucSet;
 }WLANTL_UAPSDInfoType;
 
+#ifdef WLAN_FEATURE_RMC
+struct tTL_RMCList
+{
+  struct tTL_RMCList    *next;
+  v_MACADDR_t           rmcAddr;
+  v_U16_t               mcSeqCtl;
+  v_U32_t               rxMCDupcnt;
+};
+
+typedef struct tTL_RMCList WLANTL_RMC_SESSION;
+#endif
+
 /*---------------------------------------------------------------------------
   per-STA cache info
 ---------------------------------------------------------------------------*/
@@ -685,6 +702,11 @@
 
   v_U32_t       linkCapacity;
 
+#ifdef WLAN_FEATURE_RMC
+  WLANTL_RMC_SESSION *mcastSession[WLANTL_RMC_HASH_TABLE_SIZE];
+  vos_lock_t mcLock;
+#endif
+
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
 
   /* Value of the averaged Data RSSI for this station */
@@ -701,6 +723,9 @@
   /* BD Rate for transmitting ARP packets */
   v_U8_t arpRate;
   v_BOOL_t arpOnWQ5;
+
+  /* Disassoc in progress */
+  v_BOOL_t disassoc_progress;
 }WLANTL_STAClientType;
 
 /*---------------------------------------------------------------------------
@@ -785,6 +810,37 @@
    vos_lock_t                           hosLock;
 } WLANTL_HO_SUPPORT_TYPE;
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+#define ROAM_MAX_INDEX_NUM              50
+#define ROAM_PER_INDEX_TIME             500 /* (msec) */
+#define MIN_PKTS_TO_START_MONTIOR       10
+
+typedef struct
+{
+  v_U64_t lowRateRxPacketsRcvd;
+  v_U64_t totalPktRcvd;
+  v_U64_t time;
+}WLANTL_RoamTrafficStatsType;
+
+typedef struct {
+   v_U8_t running;
+   v_U8_t staId;
+   v_S7_t index;
+   v_U8_t intialPktToStart;
+   v_U8_t minPercentage;
+   v_U16_t minRate;
+   v_U16_t maxRate;
+   v_U32_t minPktRequired;
+   v_U64_t totalPkt;
+   v_U64_t timeToWait;
+   v_U64_t lowRatePkt;
+   v_U64_t lastTriggerTime;
+   WLANTL_RoamTrafficStatsType rxRoamStats[ROAM_MAX_INDEX_NUM];
+   void (*triggerRoamScanfn) (void *, v_U8_t);
+   void *hHal;
+}WLANTL_RoamMonitorType;
+#endif
+
 /*---------------------------------------------------------------------------
   TL control block type
 ---------------------------------------------------------------------------*/
@@ -896,11 +952,23 @@
   v_BOOL_t                  isBMPS;
   /* Whether WDA_DS_TX_START_XMIT msg is pending or not */
   v_BOOL_t   isTxTranmitMsgPending;
+
+#ifdef WLAN_FEATURE_RMC
+  WLANTL_RMC_SESSION *rmcSession[WLANTL_RMC_HASH_TABLE_SIZE];
+  vos_lock_t rmcLock;
+  v_U8_t multicastDuplicateDetectionEnabled;
+  v_U8_t rmcDataPathEnabled;
+  v_U32_t mcastDupCnt;
+#endif
   WLANTL_MonRxCBType           pfnMonRx;
   v_BOOL_t              isConversionReq;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+  WLANTL_RoamMonitorType gDsRxRoamStats;
+#endif
 
 }WLANTL_CbType;
 
+
 /*==========================================================================
 
   FUNCTION    WLANTL_GetFrames
@@ -1754,4 +1822,99 @@
   v_U8_t          ucSTAId
 );
 
+#ifdef WLAN_FEATURE_RMC
+VOS_STATUS WLANTL_RmcInit
+(
+     v_PVOID_t   pAdapter
+);
+
+VOS_STATUS WLANTL_RmcDeInit
+(
+    v_PVOID_t   pAdapter
+);
+
+
+tANI_U8 WLANTL_RmcHashRmcSession ( v_MACADDR_t   *pMcastAddr );
+
+
+WLANTL_RMC_SESSION *WLANTL_RmcLookUpRmcSession
+(
+    WLANTL_RMC_SESSION *rmcSession[],
+    v_MACADDR_t     *pMcastAddr
+);
+
+WLANTL_RMC_SESSION *WLANTL_RmcAddRmcSession
+(
+    WLANTL_RMC_SESSION *rmcSession[],
+    v_MACADDR_t   *pMcastAddr
+);
+
+tANI_U8
+WLANTL_RmcDeleteRmcSession
+(
+    WLANTL_RMC_SESSION *rmcSession[],
+    v_MACADDR_t   *pMcastAddr
+);
+
+VOS_STATUS
+WLANTL_ProcessRmcCommand
+(
+    WLANTL_CbType*  pTLCb,
+    v_MACADDR_t    *pMcastAddr,
+    tANI_U32        command
+);
+
+/*=============================================================================
+  FUNCTION    WLANTL_IsDuplicateMcastFrm
+
+  DESCRIPTION
+    This function checks for duplicast multicast frames and drops them.
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pClientSTA  : Pointer to WLANTL_STAClientType
+   aucBDHeader : Pointer to BD header
+
+  RETURN VALUE
+
+    VOS_FALSE:  This frame is not a duplicate
+
+    VOS_TRUE:   This frame is a duplicate
+
+==============================================================================*/
+v_U8_t
+WLANTL_IsDuplicateMcastFrm
+(
+    WLANTL_STAClientType *pClientSTA,
+    vos_pkt_t* vosDataBuff
+);
+
+/*=============================================================================
+  FUNCTION    WLANTL_McastDeleteAllEntries
+
+  DESCRIPTION
+    This function removes all multicast entries used for duplicate detection
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pClientSTA  : Pointer to WLANTL_STAClientType
+
+  RETURN VALUE
+
+    None
+
+==============================================================================*/
+void
+WLANTL_McastDeleteAllEntries(WLANTL_STAClientType * pClientSTA);
+
+#endif /*WLAN_FEATURE_RMC*/
+
 #endif /* #ifndef WLAN_QCT_TLI_H */
diff --git a/wlan/prima/CORE/VOSS/inc/event_defs.h b/wlan/prima/CORE/VOSS/inc/event_defs.h
index 4d2ba20..6907456 100644
--- a/wlan/prima/CORE/VOSS/inc/event_defs.h
+++ b/wlan/prima/CORE/VOSS/inc/event_defs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1903,7 +1903,14 @@
   EVENT_SNS_DRV_OPMODE_CHANGE = 0x768,
   EVENT_WLAN_EAPOL = 0xA8D,/* 18 bytes payload */
   EVENT_WLAN_WAKE_LOCK = 0xAA2, /* 96 bytes payload */
-
+  EVENT_WLAN_LOG_COMPLETE = 0xAA7, /* 16 bytes payload */
+  EVENT_WLAN_STATUS_V2 = 0xAB3,
+  EVENT_WLAN_TDLS_TEARDOWN = 0xAB5,
+  EVENT_WLAN_TDLS_ENABLE_LINK = 0XAB6,
+  EVENT_WLAN_SUSPEND_RESUME = 0xAB7,
+  EVENT_OFFLOAD_REQ = 0xAB8,
+  EVENT_TDLS_SCAN_BLOCK = 0xAB9,
+  EVENT_WLAN_TX_RX_MGMT = 0xABA,
   EVENT_NEXT_UNUSED_EVENT,
   EVENT_RSVD_START = 0x0800,
   EVENT_RSVD_END   = 0x083F,
diff --git a/wlan/prima/CORE/VOSS/inc/i_vos_trace.h b/wlan/prima/CORE/VOSS/inc/i_vos_trace.h
index ccc4c77..4708a3e 100644
--- a/wlan/prima/CORE/VOSS/inc/i_vos_trace.h
+++ b/wlan/prima/CORE/VOSS/inc/i_vos_trace.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -149,4 +149,6 @@
 
 #define VOS_RETURN_ADDRESS  __builtin_return_address(0)
 
+#define VOS_SMP_MB smp_mb()
+
 #endif
diff --git a/wlan/prima/CORE/VOSS/inc/log_codes.h b/wlan/prima/CORE/VOSS/inc/log_codes.h
index d5e4e9e..250727d 100644
--- a/wlan/prima/CORE/VOSS/inc/log_codes.h
+++ b/wlan/prima/CORE/VOSS/inc/log_codes.h
@@ -2010,8 +2010,11 @@
 
 #define LOG_TRSP_DATA_STALL_C                                       ((0x801) + LOG_1X_BASE_C)
 
+#define LOG_WLAN_PKT_LOG_INFO_C                                     ((0x8E0) + LOG_1X_BASE_C)
+
+
 /* The last defined DMSS log code */
-#define LOG_1X_LAST_C                                   ((0x801) + LOG_1X_BASE_C)
+#define LOG_1X_LAST_C                                   ((0x8E0) + LOG_1X_BASE_C)
 
 
 /* This is only here for old (pre equipment ID update) logging code */
diff --git a/wlan/prima/CORE/VOSS/inc/vos_api.h b/wlan/prima/CORE/VOSS/inc/vos_api.h
index 7e5d0da..d659281 100644
--- a/wlan/prima/CORE/VOSS/inc/vos_api.h
+++ b/wlan/prima/CORE/VOSS/inc/vos_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -75,8 +75,59 @@
 #include <vos_timer.h>
 #include <vos_pack_align.h>
 
+/**
+ * enum userspace_log_level - Log level at userspace
+ * @LOG_LEVEL_NO_COLLECTION: verbose_level 0 corresponds to no collection
+ * @LOG_LEVEL_NORMAL_COLLECT: verbose_level 1 correspond to normal log level,
+ * with minimal user impact. this is the default value
+ * @LOG_LEVEL_ISSUE_REPRO: verbose_level 2 are enabled when user is lazily
+ * trying to reproduce a problem, wifi performances and power can be impacted
+ * but device should not otherwise be significantly impacted
+ * @LOG_LEVEL_ACTIVE: verbose_level 3+ are used when trying to
+ * actively debug a problem
+ *
+ * Various log levels defined in the userspace for logging applications
+ */
+enum userspace_log_level {
+    LOG_LEVEL_NO_COLLECTION,
+    LOG_LEVEL_NORMAL_COLLECT,
+    LOG_LEVEL_ISSUE_REPRO,
+    LOG_LEVEL_ACTIVE,
+};
 
 /**
+ * enum wifi_driver_log_level - Log level defined in the driver for logging
+ * @WLAN_LOG_LEVEL_OFF: No logging
+ * @WLAN_LOG_LEVEL_NORMAL: Default logging
+ * @WLAN_LOG_LEVEL_REPRO: Normal debug level
+ * @WLAN_LOG_LEVEL_ACTIVE: Active debug level
+ *
+ * Log levels defined for logging by the wifi driver
+ */
+enum wifi_driver_log_level {
+    WLAN_LOG_LEVEL_OFF,
+    WLAN_LOG_LEVEL_NORMAL,
+    WLAN_LOG_LEVEL_REPRO,
+    WLAN_LOG_LEVEL_ACTIVE,
+};
+
+/**
+ * enum wifi_logging_ring_id - Ring id of logging entities
+ * @RING_ID_WAKELOCK:         Power events ring id
+ * @RING_ID_CONNECTIVITY:     Connectivity event ring id
+ * @RING_ID_PER_PACKET_STATS: Per packet statistic ring id
+ *
+ * This enum has the ring id values of logging rings
+ */
+enum wifi_logging_ring_id {
+    RING_ID_WAKELOCK,
+    RING_ID_CONNECTIVITY,
+    RING_ID_PER_PACKET_STATS,
+};
+
+/* 15 Min */
+#define WLAN_POWER_COLLAPSE_FAIL_THRESHOLD  (1000 * 60 * 15)
+/**
  * enum log_event_type - Type of event initiating bug report
  * @WLAN_LOG_TYPE_NON_FATAL: Non fatal event
  * @WLAN_LOG_TYPE_FATAL: Fatal event
@@ -94,6 +145,9 @@
  * @WLAN_LOG_INDICATOR_FRAMEWORK: Framework triggers bug report
  * @WLAN_LOG_INDICATOR_HOST_DRIVER: Host driver triggers bug report
  * @WLAN_LOG_INDICATOR_FIRMWARE: FW initiates bug report
+ * @WLAN_LOG_INDICATOR_IOCTL: Bug report is initiated by IOCTL
+ * @WLAN_LOG_INDICATOR_HOST_ONLY: Host initiated and only Host
+ * logs are needed
  *
  * Enum indicating the module that triggered the bug report
  */
@@ -102,51 +156,54 @@
 	WLAN_LOG_INDICATOR_FRAMEWORK,
 	WLAN_LOG_INDICATOR_HOST_DRIVER,
 	WLAN_LOG_INDICATOR_FIRMWARE,
-	WLAN_LOG_INDICATOR_IOCTL
+	WLAN_LOG_INDICATOR_IOCTL,
+	WLAN_LOG_INDICATOR_HOST_ONLY,
 };
 
 /**
  * enum log_event_host_reason_code - Reason code for bug report
  * @WLAN_LOG_REASON_CODE_UNUSED: Unused
- * @WLAN_LOG_REASON_COMMAND_UNSUCCESSFUL: Command response status from FW
- * is error
  * @WLAN_LOG_REASON_ROAM_FAIL: Driver initiated roam has failed
  * @WLAN_LOG_REASON_THREAD_STUCK: Monitor Health of host threads and report
  * fatal event if some thread is stuck
  * @WLAN_LOG_REASON_DATA_STALL: Unable to send/receive data due to low resource
  * scenario for a prolonged period
  * @WLAN_LOG_REASON_SME_COMMAND_STUCK: SME command is stuck in SME active queue
- * @WLAN_LOG_REASON_ZERO_SCAN_RESULTS: Full scan resulted in zero scan results
  * @WLAN_LOG_REASON_QUEUE_FULL: Defer queue becomes full for a prolonged period
  * @WLAN_LOG_REASON_POWER_COLLAPSE_FAIL: Unable to allow apps power collapse
  * for a prolonged period
- * @WLAN_LOG_REASON_SSR_FAIL: Unable to gracefully complete SSR
- * @WLAN_LOG_REASON_DISCONNECT_FAIL: Disconnect from Supplicant is not
- * successful
- * @WLAN_LOG_REASON_CLEAN_UP_FAIL: Clean up of  TDLS or Pre-Auth Sessions
- * not successful
  * @WLAN_LOG_REASON_MALLOC_FAIL: Memory allocation Fails
  * @WLAN_LOG_REASON_VOS_MSG_UNDER_RUN: VOS Core runs out of message wrapper
- * @WLAN_LOG_REASON_MSG_POST_FAIL: Unable to post msg
- *
+ * @WLAN_LOG_REASON_IOCTL: Initiated by IOCTL
+ * @WLAN_LOG_REASON_CODE_FRAMEWORK: Initiated by framework
+ * @WLAN_LOG_REASON_DEL_BSS_STA_FAIL: DEL BSS/STA rsp is failure
+ * @WLAN_LOG_REASON_ADD_BSS_STA_FAIL: ADD BSS/STA rsp is failure
+ * @WLAN_LOG_REASON_ENTER_IMPS_BMPS_FAIL: Enter IMPS/BMPS rsp failure
+ * @WLAN_LOG_REASON_EXIT_IMPS_BMPS_FAIL: Exit IMPS/BMPS rsp failure
+ * @WLAN_LOG_REASON_HDD_TIME_OUT: Wait for event Timeout in HDD layer
+ * @WLAN_LOG_REASON_MGMT_FRAME_TIMEOUT:Management frame timedout
+   @WLAN_LOG_REASON_SME_OUT_OF_CMD_BUFL sme out of cmd buffer
  * This enum contains the different reason codes for bug report
  */
 enum log_event_host_reason_code {
 	WLAN_LOG_REASON_CODE_UNUSED,
-	WLAN_LOG_REASON_COMMAND_UNSUCCESSFUL,
 	WLAN_LOG_REASON_ROAM_FAIL,
 	WLAN_LOG_REASON_THREAD_STUCK,
 	WLAN_LOG_REASON_DATA_STALL,
 	WLAN_LOG_REASON_SME_COMMAND_STUCK,
-	WLAN_LOG_REASON_ZERO_SCAN_RESULTS,
 	WLAN_LOG_REASON_QUEUE_FULL,
 	WLAN_LOG_REASON_POWER_COLLAPSE_FAIL,
-	WLAN_LOG_REASON_SSR_FAIL,
-	WLAN_LOG_REASON_DISCONNECT_FAIL,
-	WLAN_LOG_REASON_CLEAN_UP_FAIL,
 	WLAN_LOG_REASON_MALLOC_FAIL,
 	WLAN_LOG_REASON_VOS_MSG_UNDER_RUN,
-	WLAN_LOG_REASON_MSG_POST_FAIL,
+	WLAN_LOG_REASON_IOCTL,
+	WLAN_LOG_REASON_CODE_FRAMEWORK,
+	WLAN_LOG_REASON_DEL_BSS_STA_FAIL,
+	WLAN_LOG_REASON_ADD_BSS_STA_FAIL,
+	WLAN_LOG_REASON_ENTER_IMPS_BMPS_FAIL,
+	WLAN_LOG_REASON_EXIT_IMPS_BMPS_FAIL,
+	WLAN_LOG_REASON_HDD_TIME_OUT,
+	WLAN_LOG_REASON_MGMT_FRAME_TIMEOUT,
+	WLAN_LOG_REASON_SME_OUT_OF_CMD_BUF,
 };
 
 /*------------------------------------------------------------------------- 
@@ -255,10 +312,15 @@
 bool vos_is_log_report_in_progress(void);
 void vos_reset_log_report_in_progress(void);
 int vos_set_log_completion(uint32 is_fatal, uint32 indicator, uint32 reason_code);
-void vos_get_log_completion(uint32 *is_fatal, uint32 *indicator, uint32 *reason_code);
+void vos_get_log_and_reset_completion(uint32 *is_fatal,
+           uint32 *indicator, uint32 *reason_code, bool reset);
+v_BOOL_t vos_isFatalEventEnabled(void);
 VOS_STATUS vos_fatal_event_logs_req( uint32_t is_fatal, uint32_t indicator,
-                                 uint32_t reason_code, bool waitRequired);
+                                 uint32_t reason_code, bool wait_required,
+                                 bool dump_vos_trace);
 VOS_STATUS vos_process_done_indication(v_U8_t type, v_U32_t reason_code);
+void vos_flush_host_logs_for_fatal(void);
+
 void vos_send_fatal_event_done(void);
 
 
@@ -432,9 +494,18 @@
 v_U8_t vos_is_fw_logging_supported(void);
 void vos_set_multicast_logging(uint8_t value);
 v_U8_t vos_is_multicast_logging(void);
-bool vos_is_wakelock_enabled(void);
+void vos_set_ring_log_level(v_U32_t ring_id, v_U32_t log_level);
+v_U8_t vos_get_ring_log_level(v_U32_t ring_id);
+void get_rate_and_MCS(per_packet_stats *stats, uint32 rateindex);
+
 v_BOOL_t vos_isUnloadInProgress(void);
 v_BOOL_t vos_isLoadUnloadInProgress(void);
 
 void vos_probe_threads(void);
+void vos_per_pkt_stats_to_user(void *perPktStat);
+void vos_updatePktStatsInfo(void * pktStat);
+bool vos_is_wlan_logging_enabled(void);
+
+v_BOOL_t vos_is_probe_rsp_offload_enabled(void);
+
 #endif // if !defined __VOS_NVITEM_H
diff --git a/wlan/prima/CORE/VOSS/inc/vos_diag_core_event.h b/wlan/prima/CORE/VOSS/inc/vos_diag_core_event.h
index 715fbd2..c52a6f5 100644
--- a/wlan/prima/CORE/VOSS/inc/vos_diag_core_event.h
+++ b/wlan/prima/CORE/VOSS/inc/vos_diag_core_event.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -74,12 +74,12 @@
 } vos_event_wlan_security_payload_type;
 
 /*------------------------------------------------------------------------- 
-  Event ID: EVENT_WLAN_STATUS
+  Event ID: EVENT_WLAN_STATUS_V2
   ------------------------------------------------------------------------*/
 typedef struct
 {
    v_U8_t eventId;
-   v_U8_t ssid[6];
+   v_U8_t ssid[32];
    v_U8_t bssType;
    v_U8_t rssi;
    v_U8_t channel;
@@ -282,7 +282,108 @@
        char     name[WAKE_LOCK_NAME_LEN];
 };
 
+/**
+ * struct vos_event_tdls_teardown - tdls teardown diag event
+ * @reason: reason for tear down
+ * @peer_mac: peer mac
+ *
+ * This structure contain tdls teardown diag event info
+ */
 
+struct vos_event_tdls_teardown {
+   uint32_t reason;
+   uint8_t peer_mac[6];
+};
+
+/**
+ * struct vos_event_tdls_enable_link - tdls enable link event
+ * @peer_mac: peer mac
+ * @is_off_chan_supported: if off channel supported
+ * @is_off_chan_configured: if off channel configured
+ * @is_off_chan_established: if off channel established
+ *
+ * This structure contain tdls enable link diag event info
+ */
+struct vos_event_tdls_enable_link {
+   uint8_t   peer_mac[6];
+   uint8_t   is_off_chan_supported;
+   uint8_t   is_off_chan_configured;
+   uint8_t   is_off_chan_established;
+};
+
+/**
+ * struct vos_event_suspend - suspend/resume state
+ * @state: suspend/resume state
+ *
+ * This structure contains suspend resume diag event info
+ */
+
+struct vos_event_suspend {
+   uint8_t state;
+};
+
+/**
+ * struct vos_event_offload_req - offload state
+ * @offload_type: offload type
+ * @state: enabled or disabled state
+ *
+ * This structure contains offload diag event info
+ */
+
+struct vos_event_offload_req {
+   uint8_t offload_type;
+   uint8_t state;
+};
+
+/**
+ * struct vos_event_tdls_scan_rejected - scan
+ * rejected due to tdls
+ * @status: rejected status
+ *
+ * This structure contains scan rejected due to
+ * tdls event info
+ */
+struct vos_event_tdls_scan_rejected {
+    uint8_t status;
+};
+
+/**
+ * struct vos_event_tx_rx_mgmt - for TX RX management frame
+ * @event_id: event ID
+ * @tx_rx: tx or rx
+ * @type: type of frame
+ * @action_sub_type: action frame type
+ * @peer_mac: peer mac
+ *
+ * This structure contains tdls TX RX management frame info
+ */
+struct vos_event_tx_rx_mgmt {
+   uint8_t   event_id;
+   uint8_t   tx_rx;
+   uint8_t   type;
+   uint8_t   action_sub_type;
+   uint8_t   peer_mac[6];
+};
+
+
+/*-------------------------------------------------------------------------
+  Event ID: EVENT_WLAN_LOG_COMPLETE
+  ------------------------------------------------------------------------*/
+/**
+ * struct vos_event_wlan_log_complete - Holds log completion details
+ * @is_fatal: Indicates if the event is fatal or not
+ * @indicator: Source of the bug report - Framework/Host/Firmware
+ * @reason_code: Reason for triggering bug report
+ * @reserved: Reserved field
+ *
+ * This structure holds the log completion related information
+ */
+struct vos_event_wlan_log_complete {
+    uint32_t is_fatal;
+    uint32_t indicator;
+    uint32_t reason_code;
+    uint32_t reserved;
+};
 
 
 /*------------------------------------------------------------------------- 
diff --git a/wlan/prima/CORE/VOSS/inc/vos_diag_core_log.h b/wlan/prima/CORE/VOSS/inc/vos_diag_core_log.h
index 9a95c4a..adf6b2f 100644
--- a/wlan/prima/CORE/VOSS/inc/vos_diag_core_log.h
+++ b/wlan/prima/CORE/VOSS/inc/vos_diag_core_log.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -65,6 +65,88 @@
 #define VOS_LOG_MAX_NUM_HO_CANDIDATE_APS                    20
 #define VOS_LOG_MAX_WOW_PTRN_SIZE                           128
 #define VOS_LOG_MAX_WOW_PTRN_MASK_SIZE                      16
+/* Version to be updated whenever format of vos_log_pktlog_info changes */
+#define VERSION_LOG_WLAN_PKT_LOG_INFO_C                     1
+
+enum {
+   PKTLOG_FLG_FRM_TYPE_LOCAL_S = 0,
+   PKTLOG_FLG_FRM_TYPE_REMOTE_S,
+   PKTLOG_FLG_FRM_TYPE_UNKNOWN_S
+};
+
+/* Format of the packet stats event*/
+typedef struct {
+   v_U16_t flags;
+   v_U16_t missed_cnt;
+   v_U16_t log_type;
+   v_U16_t size;
+   v_U32_t timestamp;
+}__attribute__((packed))pkt_stats_hdr ;
+
+/* Per packet data info */
+#define PER_PACKET_ENTRY_FLAGS_DIRECTION_TX  1    // 0: TX, 1: RX
+#define PER_PACKET_ENTRY_FLAGS_TX_SUCCESS    2    // whether packet was transmitted or
+                                                  // received/decrypted successfully
+#define PER_PACKET_ENTRY_FLAGS_80211_HEADER  4    // has full 802.11 header, else has 802.3 header
+#define PER_PACKET_ENTRY_FLAGS_PROTECTED     8    // whether packet was encrypted
+#define STATS_MAX_RATE_INDEX      136
+
+
+enum {
+   S_BW20,
+   S_BW40,
+   S_BW80,
+   S_BW160
+};
+enum {
+   PREAMBLE_CCK,
+   PREAMBLE_OFDM,
+   PREAMBLE_HT,
+   PREAMBLE_VHT
+};
+
+typedef struct{
+   v_U16_t rate;
+   v_U16_t preamble;
+   v_U8_t bw;
+   v_U8_t short_gi;
+}rateidx_to_rate_bw_preamble_sgi;
+
+
+typedef struct {
+   v_U16_t rate       :  4;
+   v_U16_t nss        :  2;
+   v_U16_t preamble   :  2;
+   v_U16_t bw         :  2;
+   v_U16_t short_gi   :  1;
+   v_U16_t reserved   :  5;
+} mcs_stats;
+
+typedef struct {
+   v_U8_t  flags;
+   v_U8_t  tid;     // transmit or received tid
+   mcs_stats MCS;    // modulation and bandwidth
+   v_S7_t  rssi;    // TX: RSSI of ACK for that packet
+                // RX: RSSI of packet
+   v_U8_t  num_retries;                   // number of attempted retries
+   v_U16_t last_transmit_rate;           // last transmit rate in .5 mbps
+   v_U16_t link_layer_transmit_sequence; // receive sequence for that MPDU packet
+   v_U64_t dxe_timestamp;     // DXE timestamp
+   v_U64_t start_contention_timestamp; // 0 Not supported
+   v_U64_t transmit_success_timestamp; // 0 Not Supported
+   /* Whole frame for management/EAPOl/DHCP frames and 802.11 + LLC
+    * header + 40 bytes or full frame whichever is smaller for
+    * remaining Data packets
+    */
+   v_U8_t data[MAX_PKT_STAT_DATA_LEN];
+} __attribute__((packed)) per_packet_stats;
+
+typedef struct
+{
+   pkt_stats_hdr ps_hdr;
+   per_packet_stats stats;
+}tx_rx_pkt_stats;
+
 
 /*---------------------------------------------------------------------------
    This packet contains the scan results of the recent scan operation 
@@ -367,6 +449,23 @@
   v_S7_t            rssi;
 } vos_log_rssi_pkt_type;
 
+/**
+ * struct vos_log_pktlog_info - Packet log info
+ * @log_hdr: Log header
+ * @buf_len: Length of the buffer that follows
+ * @buf:     Buffer containing the packet log info
+ *
+ * Structure containing the packet log information
+ * LOG_WLAN_PKT_LOG_INFO_C          0x18E0
+ */
+typedef struct
+{
+  log_hdr_type log_hdr;
+  uint32_t version;
+  uint32_t seq_no;
+  uint32_t buf_len;
+}__attribute__((packed))vos_log_pktlog_info;
+
 /*------------------------------------------------------------------------- 
   Function declarations and documenation
   ------------------------------------------------------------------------*/
diff --git a/wlan/prima/CORE/VOSS/inc/vos_memory.h b/wlan/prima/CORE/VOSS/inc/vos_memory.h
index c6de77e..fd064c6 100644
--- a/wlan/prima/CORE/VOSS/inc/vos_memory.h
+++ b/wlan/prima/CORE/VOSS/inc/vos_memory.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -144,7 +144,15 @@
   --------------------------------------------------------------------------*/
 v_VOID_t vos_mem_zero( v_VOID_t *ptr, v_SIZE_t numBytes );
 
+static __inline__ unsigned long vos_htonl(unsigned long ul)
+{
+  return( ( ( ul & 0x000000ff ) << 24 ) |
+          ( ( ul & 0x0000ff00 ) <<  8 ) |
+          ( ( ul & 0x00ff0000 ) >>  8 ) |
+          ( ( ul & 0xff000000 ) >> 24 )   );
+}
 
+void vos_buff_to_hl_buff (v_U8_t *buffer, int size);
 /*----------------------------------------------------------------------------
   
   \brief vos_mem_copy() - Copy memory
diff --git a/wlan/prima/CORE/VOSS/inc/vos_timer.h b/wlan/prima/CORE/VOSS/inc/vos_timer.h
index 67a0d6b..70a0977 100644
--- a/wlan/prima/CORE/VOSS/inc/vos_timer.h
+++ b/wlan/prima/CORE/VOSS/inc/vos_timer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -343,4 +343,7 @@
 
 v_BOOL_t vos_timer_is_initialized(vos_timer_t *timer);
 
+void vos_process_wd_timer(void);
+void vos_wdthread_init_timer_work(void *callbackptr);
+void vos_wdthread_flush_timer_work(void);
 #endif // #if !defined __VOSS_TIMER_H
diff --git a/wlan/prima/CORE/VOSS/inc/vos_trace.h b/wlan/prima/CORE/VOSS/inc/vos_trace.h
index a0c32f7..538f58d 100644
--- a/wlan/prima/CORE/VOSS/inc/vos_trace.h
+++ b/wlan/prima/CORE/VOSS/inc/vos_trace.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -81,22 +81,14 @@
     
 } VOS_TRACE_LEVEL;
 
-enum {
-	LOG_PKT_TYPE_DATA_MGMT = 0x1,
-	LOG_PKT_TYPE_FW_LOG    = 0x2
-};
-
-
-
 /* Log types. These types are defined in mailbox*/
 typedef enum
 {
     WLAN_MGMT_FRAME_LOGS    = 0,
-    WLAN_QXDM_LOGGING       = 1,
+    WLAN_FW_LOGS            = 1,
     WLAN_FW_MEMORY_DUMP     = 2
 }FrameLoggingType;
 
-
 /*-------------------------------------------------------------------------- 
   Preprocessor definitions and constants
   ------------------------------------------------------------------------*/
@@ -199,10 +191,16 @@
 v_BOOL_t vos_trace_getLevel( VOS_MODULE_ID module, VOS_TRACE_LEVEL level );
 
 typedef void (*tpvosTraceCb) (void *pMac, tpvosTraceRecord, v_U16_t);
+typedef void (*tp_vos_state_info_cb) (void);
+
 void vos_trace(v_U8_t module, v_U8_t code, v_U8_t session, v_U32_t data);
 void vosTraceRegister(VOS_MODULE_ID, tpvosTraceCb);
+void vos_register_debug_callback(VOS_MODULE_ID moduleID,
+                                      tp_vos_state_info_cb vosStateInfoCb);
 VOS_STATUS vos_trace_spin_lock_init(void);
 void vosTraceInit(void);
+void vos_register_debugcb_init(void);
 void vosTraceEnable(v_U32_t, v_U8_t enable);
 void vosTraceDumpAll(void*, v_U8_t, v_U8_t, v_U32_t, v_U32_t);
+void vos_state_info_dump_all(void);
 #endif
diff --git a/wlan/prima/CORE/VOSS/inc/vos_types.h b/wlan/prima/CORE/VOSS/inc/vos_types.h
index 20002e9..7038749 100755
--- a/wlan/prima/CORE/VOSS/inc/vos_types.h
+++ b/wlan/prima/CORE/VOSS/inc/vos_types.h
@@ -66,6 +66,9 @@
   (( ( ( (_x) << 24 ) & 0xFF000000 ) | ( ( (_x) >> 24 ) & 0x000000FF ) ) | \
    ( ( ( (_x) << 8 ) & 0x00FF0000 ) | ( ( (_x) >> 8 ) & 0x0000FF00 ) ))
 
+/* Length enough to include full DHCP/EAPOL/Management frame */
+#define MAX_PKT_STAT_DATA_LEN         800
+
 // Endian operations for Big Endian and Small Endian modes
 #ifdef ANI_LITTLE_BYTE_ENDIAN
 
diff --git a/wlan/prima/CORE/VOSS/inc/vos_utils.h b/wlan/prima/CORE/VOSS/inc/vos_utils.h
index 5755336..59ce112 100644
--- a/wlan/prima/CORE/VOSS/inc/vos_utils.h
+++ b/wlan/prima/CORE/VOSS/inc/vos_utils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -59,6 +59,14 @@
 #define VOS_BAND_5GHZ          2
 
 #define VOS_24_GHZ_CHANNEL_14  14
+
+
+/* Type of packet log events.
+ */
+#define PKTLOG_TYPE_PKT_STAT         9
+
+
+
 /*-------------------------------------------------------------------------- 
   Type declarations
   ------------------------------------------------------------------------*/
@@ -165,6 +173,29 @@
 void vos_get_wlan_unsafe_channel(v_U16_t *unsafeChannelList,
                     v_U16_t buffer_size, v_U16_t *unsafeChannelCount);
 
+typedef struct {
+    v_BOOL_t  is_rx;
+    v_U8_t  tid;     // transmit or received tid
+    v_U8_t  num_retries;                   // number of attempted retries
+    v_U8_t  rssi;    // TX: RSSI of ACK for that packet
+                    // RX: RSSI of packet
+    v_U32_t rate_idx;           // last transmit rate in .5 mbps
+    v_U16_t seq_num; // receive sequence for that MPDU packet
+    v_U64_t dxe_timestamp;     // DXE timestamp
+    v_U32_t data_len;
+    /* Whole frame for management/EAPOl/DHCP frames and 802.11 + LLC
+    * header + 40 bytes or full frame whichever is smaller for
+    * remaining Data packets
+    */
+    v_U8_t data[MAX_PKT_STAT_DATA_LEN];
+} tPerPacketStats;
+
+typedef struct {
+    v_U32_t lastTxRate;           // 802.11 data rate at which the last data frame is transmitted.
+    v_U32_t  txAvgRetry;           // Average number of retries per 10 packets.
+    v_S7_t  avgRssi;              // Average of the Beacon RSSI.
+} tPerTxPacketFrmFw;
+
 #define ROAM_DELAY_TABLE_SIZE   10
 
 enum e_roaming_event
@@ -293,4 +324,21 @@
 void    vos_reset_roam_timer_log(void);
 void    vos_dump_roam_time_log_service(void);
 void    vos_record_roam_event(enum e_roaming_event, void *pBuff, v_ULONG_t buff_len);
+v_U32_t vos_copy_80211_data(void *pBuff, v_U8_t *dst, v_U8_t frametype);
+extern  v_U8_t vos_get_ring_log_level(v_U32_t ring_id);
+bool vos_isPktStatsEnabled(void);
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+void vos_tdls_tx_rx_mgmt_event(uint8_t event_id, uint8_t tx_rx,
+              uint8_t type, uint8_t sub_type, uint8_t *peer_mac);
+#else
+static inline
+void vos_tdls_tx_rx_mgmt_event(uint8_t event_id, uint8_t tx_rx,
+              uint8_t type, uint8_t sub_type, uint8_t *peer_mac)
+
+{
+    return;
+}
+#endif /* FEATURE_WLAN_DIAG_SUPPORT */
+
 #endif // #if !defined __VOSS_UTILS_H
diff --git a/wlan/prima/CORE/VOSS/src/vos_api.c b/wlan/prima/CORE/VOSS/src/vos_api.c
index bdd075d..5c76002 100644
--- a/wlan/prima/CORE/VOSS/src/vos_api.c
+++ b/wlan/prima/CORE/VOSS/src/vos_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -69,6 +69,7 @@
 #include "wlan_hdd_main.h"
 #include <linux/vmalloc.h>
 #include "wlan_hdd_cfg80211.h"
+#include "vos_diag_core_log.h"
 
 #include <linux/wcnss_wlan.h>
 
@@ -167,6 +168,7 @@
    #if defined(TRACE_RECORD)
        vosTraceInit();
    #endif
+   vos_register_debugcb_init();
 
    return VOS_STATUS_SUCCESS;
 
@@ -267,6 +269,7 @@
    /* Initialize the timer module */
    vos_timer_module_init();
 
+   vos_wdthread_init_timer_work(vos_process_wd_timer);
 
    /* Initialize the probe event */
    if (vos_event_init(&gpVosContext->ProbeEvent) != VOS_STATUS_SUCCESS)
@@ -813,6 +816,7 @@
   tSirRetStatus sirStatus     = eSIR_SUCCESS;
   pVosContextType pVosContext = (pVosContextType)vosContext;
   tHalMacStartParameters halStartParams;
+  hdd_context_t *pHddCtx = NULL;
 
   VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
             "%s: Starting Libra SW", __func__);
@@ -903,6 +907,16 @@
   VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
             "%s: WDA correctly started", __func__);
 
+  pHddCtx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD, pVosContext );
+  if (!pHddCtx)
+  {
+     VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+               "%s: HDD context is null", __func__);
+     goto err_wda_stop;
+  }
+
+  pHddCtx->wifi_turn_on_time_since_boot = vos_get_monotonic_boottime();
+
   /* Start the MAC */
   vos_mem_zero((v_PVOID_t)&halStartParams, sizeof(tHalMacStartParameters));
 
@@ -1196,6 +1210,8 @@
                 "%s: Could not deinit roamDelayStats", __func__);
   }
 
+  vos_wdthread_flush_timer_work();
+
   return VOS_STATUS_SUCCESS;
 }
                   
@@ -1689,11 +1705,12 @@
                                    indicator,reason_code);
 }
 
-void vos_get_log_completion(uint32 *is_fatal,
+void vos_get_log_and_reset_completion(uint32 *is_fatal,
                              uint32 *indicator,
-                             uint32 *reason_code)
+                             uint32 *reason_code,
+                             bool reset)
 {
-    wlan_get_log_completion(is_fatal, indicator, reason_code);
+    wlan_get_log_and_reset_completion(is_fatal, indicator, reason_code, reset);
 }
 
 
@@ -1719,17 +1736,56 @@
         return;
     }
     /*The below API will reset is_report_in_progress flag*/
-    vos_get_log_completion(&is_fatal, &indicator, &reason_code);
+    vos_get_log_and_reset_completion(&is_fatal, &indicator,
+                                         &reason_code, true);
     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-         "%s: is_fatal : %d, indicator: %d, reason_code=%d",
-         __func__, is_fatal, indicator, reason_code);
+         "is_fatal : %d, indicator: %d, reason_code=%d",
+         is_fatal, indicator, reason_code);
+    wlan_report_log_completion(is_fatal, indicator, reason_code);
+
+    /* Do ssr after reporting fatal event to recover from
+     * below conditions
+     */
+    if ((WLAN_LOG_INDICATOR_HOST_DRIVER == indicator) &&
+        (WLAN_LOG_REASON_SME_COMMAND_STUCK == reason_code ||
+         WLAN_LOG_REASON_SME_OUT_OF_CMD_BUF == reason_code))
+    {
+         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+           "Do SSR for reason_code=%d", reason_code);
+         vos_wlanRestart();
+    }
 }
 
+/**
+ * vos_isFatalEventEnabled()
+ *
+ * Return TRUE if Fatal event is enabled is in progress.
+ *
+ */
+v_BOOL_t vos_isFatalEventEnabled(void)
+{
+    hdd_context_t *pHddCtx = NULL;
+    v_CONTEXT_t pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
 
+    if(!pVosContext)
+    {
+       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: Global VOS context is Null", __func__);
+       return FALSE;
+    }
+
+    pHddCtx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD, pVosContext );
+    if(!pHddCtx) {
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                "%s: HDD context is Null", __func__);
+       return FALSE;
+    }
+
+    return pHddCtx->cfg_ini->enableFatalEvent;
+}
 
 /**---------------------------------------------------------------------------
 
-  \brief vos_fatal_event_logs_req() - used to send flush command to FW
+  \brief __vos_fatal_event_logs_req() - used to send flush command to FW
 
   This API is wrapper to SME flush API.
 
@@ -1740,23 +1796,52 @@
   \return VOS_STATUS_SUCCESS - if command is sent successfully.
           VOS_STATUS_E_FAILURE - if command is not sent successfully.
   --------------------------------------------------------------------------*/
-VOS_STATUS vos_fatal_event_logs_req( uint32_t is_fatal,
+VOS_STATUS __vos_fatal_event_logs_req( uint32_t is_fatal,
                         uint32_t indicator,
                         uint32_t reason_code,
-                        bool waitRequired)
+                        bool wait_required,
+                        bool dump_vos_trace)
 {
     VOS_STATUS vosStatus;
     eHalStatus status;
     VosContextType *vos_context;
+    hdd_context_t *pHddCtx = NULL;
 
     vos_context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
     if (!vos_context)
     {
         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
             "%s: vos context is Invalid", __func__);
-        return eHAL_STATUS_FAILURE;
+        return VOS_STATUS_E_FAILURE;
+    }
+    pHddCtx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD, vos_context );
+    if(!pHddCtx) {
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                "%s: HDD context is Null", __func__);
+       return VOS_STATUS_E_FAILURE;
     }
 
+    if(!pHddCtx->cfg_ini->wlanLoggingEnable)
+    {
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+            "%s: Wlan logging not enabled", __func__);
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    if(!pHddCtx->cfg_ini->enableFatalEvent)
+    {
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+            "%s: Fatal event not enabled", __func__);
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    if (pHddCtx->isLoadUnloadInProgress ||
+        vos_context->isLogpInProgress)
+    {
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+            "%s: un/Load/SSR in progress", __func__);
+        return VOS_STATUS_E_FAILURE;
+    }
 
     if (vos_is_log_report_in_progress() == true)
     {
@@ -1772,16 +1857,22 @@
         "%s: Failed to set log trigger params for fatalEvent", __func__);
         return VOS_STATUS_E_FAILURE;
     }
-    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
         "%s: Triggering fatal Event: type:%d, indicator=%d reason_code=%d",
         __func__, is_fatal, indicator, reason_code);
 
-    vos_event_reset(&gpVosContext->fwLogsComplete);
+    status = vos_event_reset(&gpVosContext->fwLogsComplete);
+    if(!HAL_STATUS_SUCCESS(status))
+    {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                    FL("fwLogsComplete reset failed:%d"),status);
+        return VOS_STATUS_E_FAILURE;
+    }
     status = sme_fatal_event_logs_req(vos_context->pMACContext,
                                       is_fatal, indicator,
-                                      reason_code);
+                                      reason_code, dump_vos_trace);
 
-    if (HAL_STATUS_SUCCESS(status) && (waitRequired == TRUE))
+    if (HAL_STATUS_SUCCESS(status) && (wait_required == TRUE))
     {
 
         /* Need to update time out of complete */
@@ -1810,6 +1901,22 @@
         return VOS_STATUS_E_FAILURE;
 }
 
+VOS_STATUS vos_fatal_event_logs_req( uint32_t is_fatal,
+                        uint32_t indicator,
+                        uint32_t reason_code,
+                        bool wait_required,
+                        bool dump_vos_trace)
+{
+    VOS_STATUS status;
+
+    vos_ssr_protect(__func__);
+    status = __vos_fatal_event_logs_req(is_fatal, indicator, reason_code,
+                                        wait_required, dump_vos_trace);
+    vos_ssr_unprotect(__func__);
+
+    return status;
+}
+
 /**---------------------------------------------------------------------------
 
   \brief vos_process_done_indication() - Process the done indication for fatal event,
@@ -1831,6 +1938,17 @@
     return VOS_STATUS_SUCCESS;
 }
 
+/**
+ * vos_flush_host_logs_for_fatal() -flush host logs and send
+ * fatal event to upper layer.
+ */
+void vos_flush_host_logs_for_fatal(void)
+{
+   wlan_flush_host_logs_for_fatal();
+   return;
+}
+
+
 /**---------------------------------------------------------------------------
 
   \brief vos_logger_pkt_serialize() - queue a logging vos pkt
@@ -1840,7 +1958,6 @@
 
   \param pPacket - a pointer to a vos pkt to be queued
          pkt_type - type of pkt to be queued
-                    LOG_PKT_TYPE_DATA_MGMT - frame log i.e data/mgmt pkts
 
   \return VOS_STATUS_SUCCESS - the pkt has been successfully queued.
           VOS_STATUS_E_FAILURE - the pkt queue handler has reported
@@ -1855,6 +1972,29 @@
 #endif
 }
 
+void vos_per_pkt_stats_to_user(void *perPktStat)
+{
+#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
+     wlan_pkt_stats_to_user(perPktStat);
+#else
+     return;
+#endif
+
+
+
+}
+
+void vos_updatePktStatsInfo(void * pktStat)
+{
+#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
+     wlan_fillTxStruct(pktStat);
+#else
+     return;
+#endif
+
+}
+
+
 /**---------------------------------------------------------------------------
   
   \brief vos_mq_post_message() - post a message to a message queue
@@ -1975,7 +2115,14 @@
   {
     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
               "%s: VOS Core run out of message wrapper", __func__);
-
+    if (!gpVosContext->vosWrapperFullReported)
+    {
+      gpVosContext->vosWrapperFullReported = 1;
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                      WLAN_LOG_INDICATOR_HOST_ONLY,
+                      WLAN_LOG_REASON_VOS_MSG_UNDER_RUN,
+                      FALSE, TRUE);
+    }
     return VOS_STATUS_E_RESOURCES;
   }
   
@@ -2112,6 +2259,14 @@
   {
     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
               "%s: VOS Core run out of message wrapper", __func__);
+    if (!gpVosContext->vosWrapperFullReported)
+    {
+      gpVosContext->vosWrapperFullReported = 1;
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                      WLAN_LOG_INDICATOR_HOST_ONLY,
+                      WLAN_LOG_REASON_VOS_MSG_UNDER_RUN,
+                      FALSE, TRUE);
+    }
     return VOS_STATUS_E_RESOURCES;
   }
 
@@ -2230,6 +2385,14 @@
   {
     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
               "%s: VOS Core run out of message wrapper", __func__);
+    if (!gpVosContext->vosWrapperFullReported)
+    {
+      gpVosContext->vosWrapperFullReported = 1;
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                      WLAN_LOG_INDICATOR_HOST_ONLY,
+                      WLAN_LOG_REASON_VOS_MSG_UNDER_RUN,
+                      FALSE, TRUE);
+    }
 
     return VOS_STATUS_E_RESOURCES;
   }
@@ -2345,6 +2508,14 @@
   {
     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
               "%s: VOS Core run out of message wrapper", __func__);
+    if (!gpVosContext->vosWrapperFullReported)
+    {
+      gpVosContext->vosWrapperFullReported = 1;
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                      WLAN_LOG_INDICATOR_HOST_ONLY,
+                      WLAN_LOG_REASON_VOS_MSG_UNDER_RUN,
+                      FALSE, TRUE);
+    }
 
     return VOS_STATUS_E_RESOURCES;
   }
@@ -3074,3 +3245,314 @@
     }
 }
 
+/**
+ * vos_set_ring_log_level() - Convert HLOS values to driver log levels
+ * @ring_id: ring_id
+ * @log_levelvalue: Log level specificed
+ *
+ * This function sets the log level of a particular ring
+ *
+ * Return: None
+ */
+ void vos_set_ring_log_level(v_U32_t ring_id, v_U32_t log_level)
+{
+    VosContextType *vos_context;
+    v_U32_t log_val;
+
+    vos_context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+    if (!vos_context) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+              "%s: vos context is Invald", __func__);
+      return;
+    }
+
+    switch (log_level) {
+    case LOG_LEVEL_NO_COLLECTION:
+        log_val = WLAN_LOG_LEVEL_OFF;
+        break;
+    case LOG_LEVEL_NORMAL_COLLECT:
+        log_val = WLAN_LOG_LEVEL_NORMAL;
+        break;
+    case LOG_LEVEL_ISSUE_REPRO:
+        log_val = WLAN_LOG_LEVEL_REPRO;
+        break;
+    case LOG_LEVEL_ACTIVE:
+    default:
+        log_val = WLAN_LOG_LEVEL_ACTIVE;
+        break;
+    }
+
+    if (ring_id == RING_ID_WAKELOCK) {
+        vos_context->wakelock_log_level = log_val;
+        return;
+    } else if (ring_id == RING_ID_CONNECTIVITY) {
+        vos_context->connectivity_log_level = log_val;
+        return;
+    } else if (ring_id == RING_ID_PER_PACKET_STATS) {
+        vos_context->packet_stats_log_level = log_val;
+        if (WLAN_LOG_LEVEL_ACTIVE != log_val)
+            wlan_disable_and_flush_pkt_stats();
+
+        return;
+    }
+}
+/**
+ * vos_get_ring_log_level() - Get the a ring id's log level
+ * @ring_id: Ring id
+ *
+ * Fetch and return the log level corresponding to a ring id
+ *
+ * Return: Log level corresponding to the ring ID
+ */
+v_U8_t vos_get_ring_log_level(v_U32_t ring_id)
+{
+    VosContextType *vos_context;
+
+     vos_context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+     if (!vos_context) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+            "%s: vos context is Invald", __func__);
+        return WLAN_LOG_LEVEL_OFF;
+    }
+
+    if (ring_id == RING_ID_WAKELOCK)
+        return vos_context->wakelock_log_level;
+    else if (ring_id == RING_ID_CONNECTIVITY)
+        return vos_context->connectivity_log_level;
+    else if (ring_id == RING_ID_PER_PACKET_STATS)
+        return vos_context->packet_stats_log_level;
+
+    return WLAN_LOG_LEVEL_OFF;
+}
+
+/* elements are rate, preamable, bw, short_gi */
+rateidx_to_rate_bw_preamble_sgi   rateidx_to_rate_bw_preamble_sgi_table[] =
+{
+/*11B CCK Long preamble (0-3)*/
+{ 10, PREAMBLE_CCK, S_BW20, 0},{ 20, PREAMBLE_CCK, S_BW20, 0},
+{ 55, PREAMBLE_CCK, S_BW20, 0},{ 110, PREAMBLE_CCK, S_BW20, 0},
+/*11B CCK Short preamble (4-7)*/
+{ 10, PREAMBLE_CCK, S_BW20, 0},{ 20, PREAMBLE_CCK, S_BW20, 0},
+{ 55, PREAMBLE_CCK, S_BW20, 0},{ 110, PREAMBLE_CCK, S_BW20, 0},
+/*11G/A (8-15)*/
+{ 60, PREAMBLE_OFDM, S_BW20, 0},{ 90, PREAMBLE_OFDM, S_BW20, 0},
+{ 120, PREAMBLE_OFDM, S_BW20, 0},{ 180, PREAMBLE_OFDM, S_BW20, 0},
+{ 240, PREAMBLE_OFDM, S_BW20, 0},{ 360, PREAMBLE_OFDM, S_BW20, 0},
+{ 480, PREAMBLE_OFDM, S_BW20, 0},{ 540, PREAMBLE_OFDM, S_BW20, 0},
+/*HT20 LGI MCS 0-7 (16-23)*/
+{ 65, PREAMBLE_HT, S_BW20, 0},{ 130, PREAMBLE_HT, S_BW20, 0},
+{ 195, PREAMBLE_HT, S_BW20, 0},{ 260, PREAMBLE_HT, S_BW20, 0},
+{ 390, PREAMBLE_HT, S_BW20, 0},{ 520, PREAMBLE_HT, S_BW20, 0},
+{ 585, PREAMBLE_HT, S_BW20, 0},{ 650, PREAMBLE_HT, S_BW20, 0},
+/*HT20 SGI MCS 0-7 (24-31)*/
+{ 72, PREAMBLE_HT, S_BW20, 1},{ 144, PREAMBLE_HT, S_BW20, 1},
+{ 217, PREAMBLE_HT, S_BW20, 1},{ 289, PREAMBLE_HT, S_BW20, 1},
+{ 433, PREAMBLE_HT, S_BW20, 1},{ 578, PREAMBLE_HT, S_BW20, 1},
+{ 650, PREAMBLE_HT, S_BW20, 1},{ 722, PREAMBLE_HT, S_BW20, 1},
+/*HT20 Greenfield MCS 0-7 rates (32-39)*/
+{ 65, PREAMBLE_HT, S_BW20, 0},{ 130, PREAMBLE_HT, S_BW20, 0},
+{ 195, PREAMBLE_HT, S_BW20, 0},{ 260, PREAMBLE_HT, S_BW20, 0},
+{ 390, PREAMBLE_HT, S_BW20, 0},{ 520, PREAMBLE_HT, S_BW20, 0},
+{ 585, PREAMBLE_HT, S_BW20, 0},{ 650, PREAMBLE_HT, S_BW20, 0},
+/*HT40 LGI MCS 0-7 (40-47)*/
+{ 135, PREAMBLE_HT, S_BW40, 0},{ 270, PREAMBLE_HT, S_BW40, 0},
+{ 405, PREAMBLE_HT, S_BW40, 0},{ 540, PREAMBLE_HT, S_BW40, 0},
+{ 810, PREAMBLE_HT, S_BW40, 0},{ 1080, PREAMBLE_HT, S_BW40, 0},
+{ 1215, PREAMBLE_HT, S_BW40, 0},{ 1350, PREAMBLE_HT, S_BW40, 0},
+/*HT40 SGI MCS 0-7 (48-55)*/
+{ 150, PREAMBLE_HT, S_BW40, 1},{ 300, PREAMBLE_HT, S_BW40, 1},
+{ 450, PREAMBLE_HT, S_BW40, 1},{ 600, PREAMBLE_HT, S_BW40, 1},
+{ 900, PREAMBLE_HT, S_BW40, 1},{ 1200, PREAMBLE_HT, S_BW40, 1},
+{ 1350, PREAMBLE_HT, S_BW40, 1},{ 1500, PREAMBLE_HT, S_BW40, 1},
+/*HT40 Greenfield MCS 0-7 rates (56-63) 64-65 are dummy*/
+{ 135, PREAMBLE_HT, S_BW40, 0},{ 270, PREAMBLE_HT, S_BW40, 0},
+{ 405, PREAMBLE_HT, S_BW40, 0},{ 540, PREAMBLE_HT, S_BW40, 0},
+{ 810, PREAMBLE_HT, S_BW40, 0},{ 1080, PREAMBLE_HT, S_BW40, 0},
+{ 1215, PREAMBLE_HT, S_BW40, 0},{ 1350, PREAMBLE_HT, S_BW40, 0},
+/*64-65 are dummy*/
+{ 1350, PREAMBLE_HT, S_BW40, 0},{ 1350, PREAMBLE_HT, S_BW40, 0},
+/*VHT20 LGI  MCS 0-9 rates (66-75)*/
+{ 65, PREAMBLE_VHT, S_BW20, 0},{ 130, PREAMBLE_VHT, S_BW20, 0},
+{ 195, PREAMBLE_VHT, S_BW20, 0},{ 260, PREAMBLE_VHT, S_BW20, 0},
+{ 390, PREAMBLE_VHT, S_BW20, 0},{ 520, PREAMBLE_VHT, S_BW20, 0},
+{ 585, PREAMBLE_VHT, S_BW20, 0},{ 650, PREAMBLE_VHT, S_BW20, 0},
+{ 780, PREAMBLE_VHT, S_BW20, 0},{ 865, PREAMBLE_VHT, S_BW20, 0},
+/*76-77 are dummy*/
+{ 865, PREAMBLE_VHT, S_BW20, 0},{ 865, PREAMBLE_VHT, S_BW20, 0},
+/*VHT20 SGI MCS 0-9 rates (78-87)*/
+{ 72, PREAMBLE_VHT, S_BW20, 1},{ 144, PREAMBLE_VHT, S_BW20, 1},
+{ 217, PREAMBLE_VHT, S_BW20, 1},{ 289, PREAMBLE_VHT, S_BW20, 1},
+{ 433, PREAMBLE_VHT, S_BW20, 1},{ 578, PREAMBLE_VHT, S_BW20, 1},
+{ 650, PREAMBLE_VHT, S_BW20, 1},{ 722, PREAMBLE_VHT, S_BW20, 1},
+{ 867, PREAMBLE_VHT, S_BW20, 1},{ 961, PREAMBLE_VHT, S_BW20, 1},
+/*88-89 are dummy*/
+{ 961, PREAMBLE_VHT, S_BW20, 1},{ 961, PREAMBLE_VHT, S_BW20, 1},
+/*VHT40 LGI MCS 0-9 rates (90-101) 98,101 is Dummy*/
+{ 135, PREAMBLE_VHT, S_BW40, 0},{ 270, PREAMBLE_VHT, S_BW40, 0},
+{ 405, PREAMBLE_VHT, S_BW40, 0},{ 540, PREAMBLE_VHT, S_BW40, 0},
+{ 810, PREAMBLE_VHT, S_BW40, 0},{ 1080, PREAMBLE_VHT, S_BW40, 0},
+{ 1215, PREAMBLE_VHT, S_BW40, 0},{ 1350, PREAMBLE_VHT, S_BW40, 0},
+{ 1350, PREAMBLE_VHT, S_BW40, 0},{ 1620, PREAMBLE_VHT, S_BW40, 0},
+{ 1800, PREAMBLE_VHT, S_BW40, 0},{ 1800, PREAMBLE_VHT, S_BW40, 0},
+/*VHT40 SGI MCS 0-9 rates (102-112) 110, 113 is Dummy*/
+{ 150, PREAMBLE_VHT, S_BW40, 1},{ 300, PREAMBLE_VHT, S_BW40, 1},
+{ 450, PREAMBLE_VHT, S_BW40, 1},{ 600, PREAMBLE_VHT, S_BW40, 1},
+{ 900, PREAMBLE_VHT, S_BW40, 1},{ 1200, PREAMBLE_VHT, S_BW40, 1},
+{ 1350, PREAMBLE_VHT, S_BW40, 1},{ 1500, PREAMBLE_VHT, S_BW40, 1},
+{ 1500, PREAMBLE_VHT, S_BW40, 1},{ 1800, PREAMBLE_VHT, S_BW40, 1},
+{ 2000, PREAMBLE_VHT, S_BW40, 1},{ 2000, PREAMBLE_VHT, S_BW40, 1},
+/*VHT80 LGI MCS 0-9 rates (114-125) 122, 125 is Dummy*/
+{ 293, PREAMBLE_VHT, S_BW80, 0},{ 585, PREAMBLE_VHT, S_BW80, 0},
+{ 878, PREAMBLE_VHT, S_BW80, 0},{ 1170, PREAMBLE_VHT, S_BW80, 0},
+{ 1755, PREAMBLE_VHT, S_BW80, 0},{ 2340, PREAMBLE_VHT, S_BW80, 0},
+{ 2633, PREAMBLE_VHT, S_BW80, 0},{ 2925, PREAMBLE_VHT, S_BW80, 0},
+{ 2925, PREAMBLE_VHT, S_BW80, 0},{ 3510, PREAMBLE_VHT, S_BW80, 0},
+{ 3900, PREAMBLE_VHT, S_BW80, 0},{ 3900, PREAMBLE_VHT, S_BW80, 0},
+/*VHT80 SGI MCS 0-9 rates (126-136) 134 is Dummy*/
+{ 325, PREAMBLE_VHT, S_BW80, 1},{ 650, PREAMBLE_VHT, S_BW80, 1},
+{ 975, PREAMBLE_VHT, S_BW80, 1},{ 1300, PREAMBLE_VHT, S_BW80, 1},
+{ 1950, PREAMBLE_VHT, S_BW80, 1},{ 2600, PREAMBLE_VHT, S_BW80, 1},
+{ 2925, PREAMBLE_VHT, S_BW80, 1},{ 3250, PREAMBLE_VHT, S_BW80, 1},
+{ 3250, PREAMBLE_VHT, S_BW80, 1},{ 3900, PREAMBLE_VHT, S_BW80, 1},
+{ 4333, PREAMBLE_VHT, S_BW80, 1},
+};
+
+void get_rate_and_MCS(per_packet_stats *stats, uint32 rateindex)
+{
+    rateidx_to_rate_bw_preamble_sgi *ratetbl;
+
+    if (STATS_MAX_RATE_INDEX < rateindex)
+        rateindex = STATS_MAX_RATE_INDEX;
+    ratetbl= &rateidx_to_rate_bw_preamble_sgi_table[rateindex];
+    stats->last_transmit_rate = ratetbl->rate/5;
+    stats->MCS.nss = 0;
+    if (0 <= rateindex && rateindex <= 7)
+        stats->MCS.rate = 7 - rateindex;
+    else if (8 <= rateindex && rateindex <= 15)
+    {
+        switch(rateindex)
+        {
+            case 8:stats->MCS.rate = 3; break;
+            case 9:stats->MCS.rate = 7; break;
+            case 10:stats->MCS.rate = 2; break;
+            case 11:stats->MCS.rate = 6; break;
+            case 12:stats->MCS.rate = 1; break;
+            case 13:stats->MCS.rate = 5; break;
+            case 14:stats->MCS.rate = 0; break;
+            case 15:stats->MCS.rate = 4; break;
+        }
+    }
+    else if(16 <= rateindex && rateindex <= 23)
+        stats->MCS.rate = rateindex - 16;
+    else if(24 <= rateindex  && rateindex <= 31)
+        stats->MCS.rate =  rateindex - 24;
+    else if(32 <= rateindex  && rateindex <= 39)
+        stats->MCS.rate = rateindex - 32;
+    else if(40 <= rateindex && rateindex <= 47)
+        stats->MCS.rate = rateindex - 40;
+    else if(48 <= rateindex && rateindex <= 55)
+        stats->MCS.rate = rateindex - 48;
+    else if(56 <= rateindex && rateindex <= 63)
+        stats->MCS.rate = rateindex - 56;
+    else if(66 <= rateindex && rateindex <= 75)
+        stats->MCS.rate = rateindex - 66;
+    else if(78 <= rateindex && rateindex <= 87)
+        stats->MCS.rate = rateindex - 78;
+    else if(90 <= rateindex && rateindex <= 100)
+        stats->MCS.rate = rateindex - 90;
+    else if(78 <= rateindex && rateindex <= 87)
+        stats->MCS.rate = rateindex - 78;
+    else if(90 <= rateindex && rateindex <= 97)
+        stats->MCS.rate = rateindex - 90;
+    else if(99 <= rateindex && rateindex <= 100)
+        stats->MCS.rate = rateindex - 91;
+    else if(102 <= rateindex && rateindex <= 109)
+        stats->MCS.rate = rateindex - 102;
+    else if(111 <= rateindex && rateindex <= 112)
+        stats->MCS.rate = rateindex - 103;
+    else if(114 <= rateindex && rateindex <= 121)
+        stats->MCS.rate = rateindex - 114;
+    else if(123 <= rateindex && rateindex <= 124)
+        stats->MCS.rate = rateindex - 115;
+    else if(126 <= rateindex && rateindex <= 133)
+        stats->MCS.rate = rateindex - 126;
+    else if(135 <= rateindex && rateindex <= 136)
+        stats->MCS.rate = rateindex - 127;
+    else /*Invalid rate index mark it 0*/
+        stats->MCS.rate = 0;
+    stats->MCS.preamble = ratetbl->preamble;
+    stats->MCS.bw = ratetbl->bw;
+    stats->MCS.short_gi = ratetbl->short_gi;
+}
+
+bool vos_isPktStatsEnabled(void)
+{
+    bool value;
+    value = wlan_isPktStatsEnabled();
+    return (value);
+}
+
+bool vos_is_wlan_logging_enabled(void)
+{
+    v_CONTEXT_t vos_ctx = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+    hdd_context_t *hdd_ctx;
+
+    if(!vos_ctx)
+    {
+       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: Global VOS context is Null", __func__);
+       return false;
+    }
+
+    hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
+
+    if(!hdd_ctx)
+    {
+       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: HDD context is Null", __func__);
+       return false;
+    }
+
+    if (!hdd_ctx->cfg_ini->wlanLoggingEnable)
+    {
+       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: Logging framework not enabled!", __func__);
+       return false;
+    }
+
+    return true;
+}
+
+/**---------------------------------------------------------------------------
+
+  \brief vos_is_probe_rsp_offload_enabled -
+
+  API to check if probe response offload feature is enabled from ini
+
+  \param  -  None
+
+  \return -  0: probe response offload is disabled
+             1: probe response offload is enabled
+
+  --------------------------------------------------------------------------*/
+v_BOOL_t vos_is_probe_rsp_offload_enabled(void)
+{
+	hdd_context_t *pHddCtx = NULL;
+	v_CONTEXT_t pVosContext = NULL;
+
+	/* Get the Global VOSS Context */
+	pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+	if (!pVosContext) {
+		hddLog(VOS_TRACE_LEVEL_FATAL,
+		       "%s: Global VOS context is Null", __func__);
+		return FALSE;
+	}
+
+	/* Get the HDD context */
+	pHddCtx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD,
+						   pVosContext);
+	if (!pHddCtx) {
+		hddLog(VOS_TRACE_LEVEL_FATAL,
+		       "%s: HDD context is Null", __func__);
+		return FALSE;
+	}
+
+	return pHddCtx->cfg_ini->sap_probe_resp_offload;
+}
diff --git a/wlan/prima/CORE/VOSS/src/vos_diag.c b/wlan/prima/CORE/VOSS/src/vos_diag.c
index 285581d..496ae47 100644
--- a/wlan/prima/CORE/VOSS/src/vos_diag.c
+++ b/wlan/prima/CORE/VOSS/src/vos_diag.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -142,6 +142,9 @@
         return;
     }
 
+    if (nl_srv_is_initialized() != 0)
+        return;
+
 #ifdef WLAN_KD_READY_NOTIFIER
     /* NL is not ready yet, WLAN KO started first */
     if ((pHddCtx->kd_nl_init) && (!pHddCtx->ptt_pid))
@@ -150,9 +153,6 @@
     }
 #endif /* WLAN_KD_READY_NOTIFIER */
 
-    if (nl_srv_is_initialized() != 0)
-        return;
-
    /* Send the log data to the ptt app only if it is registered with the wlan driver*/
     if(vos_is_multicast_logging())
     {
@@ -211,10 +211,18 @@
 void vos_log_wlock_diag(uint32_t reason, const char *wake_lock_name,
                               uint32_t timeout, uint32_t status)
 {
+     VosContextType *vos_context;
      WLAN_VOS_DIAG_EVENT_DEF(wlan_diag_event,
      struct vos_event_wlan_wake_lock);
 
-     if (nl_srv_is_initialized() != 0)
+    vos_context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+    if (!vos_context) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+            "vos context is Invald");
+       return;
+    }
+     if (nl_srv_is_initialized() != 0 ||
+         vos_context->wakelock_log_level == WLAN_LOG_LEVEL_OFF)
           return;
 
      wlan_diag_event.status = status;
@@ -270,6 +278,9 @@
         return;
     }
 
+    if (nl_srv_is_initialized() != 0)
+        return;
+
 #ifdef WLAN_KD_READY_NOTIFIER
     /* NL is not ready yet, WLAN KO started first */
     if ((pHddCtx->kd_nl_init) && (!pHddCtx->ptt_pid))
@@ -278,9 +289,6 @@
     }
 #endif /* WLAN_KD_READY_NOTIFIER */
     
-    if (nl_srv_is_initialized() != 0)
-        return;
-
     /* Send the log data to the ptt app only if it is registered with the wlan driver*/
     if(vos_is_multicast_logging())
     {
diff --git a/wlan/prima/CORE/VOSS/src/vos_memory.c b/wlan/prima/CORE/VOSS/src/vos_memory.c
index accf991..e87cfd3 100644
--- a/wlan/prima/CORE/VOSS/src/vos_memory.c
+++ b/wlan/prima/CORE/VOSS/src/vos_memory.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -62,7 +62,7 @@
 #include <linux/wcnss_wlan.h>
 #define WCNSS_PRE_ALLOC_GET_THRESHOLD (4*1024)
 #endif
-#define VOS_GET_MEMORY_TIME_THRESHOLD 3000
+#define VOS_GET_MEMORY_TIME_THRESHOLD 300
 
 #ifdef MEMORY_DEBUG
 #include "wlan_hdd_dp_utils.h"
@@ -225,8 +225,18 @@
       if (vos_timer_get_system_time() - time_before_kmalloc >=
                                     VOS_GET_MEMORY_TIME_THRESHOLD)
          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-               "%s: kmalloc took %lu msec", __func__,
-               vos_timer_get_system_time() - time_before_kmalloc);
+               "%s: kmalloc took %lu msec for size %d called from %pS at line %d",
+               __func__,
+               vos_timer_get_system_time() - time_before_kmalloc,
+               size, (void *)_RET_IP_, lineNum);
+      if ((flags != GFP_ATOMIC) && (NULL == memPtr))
+      {
+         WARN_ON(1);
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                       WLAN_LOG_INDICATOR_HOST_ONLY,
+                       WLAN_LOG_REASON_MALLOC_FAIL,
+                       false, true);
+      }
       return memPtr;
    }
 
@@ -239,8 +249,10 @@
    if (vos_timer_get_system_time() - time_before_kmalloc >=
                               VOS_GET_MEMORY_TIME_THRESHOLD)
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-          "%s: kmalloc took %lu msec", __func__,
-          vos_timer_get_system_time() - time_before_kmalloc);
+           "%s: kmalloc took %lu msec for size %d called from %pS at line %d",
+            __func__,
+            vos_timer_get_system_time() - time_before_kmalloc,
+            size, (void *)_RET_IP_, lineNum);
 
    if(memStruct != NULL)
    {
@@ -264,6 +276,14 @@
 
       memPtr = (v_VOID_t*)(memStruct + 1); 
    }
+   if ((flags != GFP_ATOMIC) && (NULL == memStruct))
+   {
+      WARN_ON(1);
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                    WLAN_LOG_INDICATOR_HOST_ONLY,
+                    WLAN_LOG_REASON_MALLOC_FAIL,
+                    false, true);
+   }
    return memPtr;
 }
 
@@ -350,12 +370,22 @@
    if (vos_timer_get_system_time() - time_before_kmalloc >=
                               VOS_GET_MEMORY_TIME_THRESHOLD)
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-          "%s: kmalloc took %lu msec", __func__,
-          vos_timer_get_system_time() - time_before_kmalloc);
+          "%s: kmalloc took %lu msec for size %d from %pS",
+          __func__,
+          vos_timer_get_system_time() - time_before_kmalloc,
+          size, (void *)_RET_IP_);
 
+   if ((flags != GFP_ATOMIC) && (NULL == memPtr))
+   {
+       WARN_ON(1);
+       vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_ONLY,
+                     WLAN_LOG_REASON_MALLOC_FAIL,
+                     false, true);
+   }
    return memPtr;
 
-}
+}   
 
 v_VOID_t vos_mem_free( v_VOID_t *ptr )
 {
@@ -373,14 +403,28 @@
 
 v_VOID_t * vos_mem_vmalloc(v_SIZE_t size)
 {
+    v_VOID_t* memPtr = NULL;
+    unsigned long  time_before_vmalloc;
+
     if (size == 0 || size >= (1024*1024))
     {
         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
                   "%s invalid size: %u", __func__, size);
         return NULL;
     }
-
-    return vmalloc(size);
+    time_before_vmalloc = vos_timer_get_system_time();
+    memPtr = vmalloc(size);
+    /* If time taken by vmalloc is greater than VOS_GET_MEMORY_TIME_THRESHOLD
+     * msec
+     */
+    if (vos_timer_get_system_time() - time_before_vmalloc >=
+                              VOS_GET_MEMORY_TIME_THRESHOLD)
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+           "%s: vmalloc took %lu msec for size %d from %pS",
+           __func__,
+           vos_timer_get_system_time() - time_before_vmalloc,
+           size, (void *)_RET_IP_);
+    return memPtr;
 }
 
 v_VOID_t vos_mem_vfree(void *addr)
@@ -406,6 +450,20 @@
    memset(ptr, value, numBytes);
 }
 
+void vos_buff_to_hl_buff (tANI_U8 *buffer, int size)
+{
+    int *val, i;
+    if (size % 4 != 0)
+        VOS_TRACE(VOS_MODULE_ID_PE,VOS_TRACE_LEVEL_ERROR,
+                  "%s: size should be multiple of 4, size %d",
+                  __func__, size);
+
+    val = (int *)buffer;
+
+    for (i=0; i<(size/4); i++)
+        *(val+i) = vos_htonl ((unsigned long)(*(val+i)));
+}
+
 v_VOID_t vos_mem_zero( v_VOID_t *ptr, v_SIZE_t numBytes )
 {
    if (0 == numBytes)
diff --git a/wlan/prima/CORE/VOSS/src/vos_nvitem.c b/wlan/prima/CORE/VOSS/src/vos_nvitem.c
index de581c1..c983af4 100644
--- a/wlan/prima/CORE/VOSS/src/vos_nvitem.c
+++ b/wlan/prima/CORE/VOSS/src/vos_nvitem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -123,11 +123,64 @@
 // loaded on driver initialization if available
 
 #ifdef CONFIG_ENABLE_LINUX_REG
+static struct
+chan_to_ht_40_index_map chan_to_ht_40_index[NUM_20MHZ_RF_CHANNELS] =
+{
+  /* ht_40_minus_index, ht_40_plus_index */
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_3},    //RF_CHAN_1,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_4},    //RF_CHAN_2,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_5},    //RF_CHAN_3,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_6},    //RF_CHAN_4,
+  {RF_CHAN_BOND_3, RF_CHAN_BOND_7},        //RF_CHAN_5,
+  {RF_CHAN_BOND_4, RF_CHAN_BOND_8},        //RF_CHAN_6,
+  {RF_CHAN_BOND_5, RF_CHAN_BOND_9},        //RF_CHAN_7,
+  {RF_CHAN_BOND_6, RF_CHAN_BOND_10},       //RF_CHAN_8,
+  {RF_CHAN_BOND_7, RF_CHAN_BOND_11},       //RF_CHAN_9,
+  {RF_CHAN_BOND_8, INVALID_RF_CHANNEL},    //RF_CHAN_10,
+  {RF_CHAN_BOND_9, INVALID_RF_CHANNEL},    //RF_CHAN_11,
+  {RF_CHAN_BOND_10, INVALID_RF_CHANNEL},   //RF_CHAN_12,
+  {RF_CHAN_BOND_11, INVALID_RF_CHANNEL},   //RF_CHAN_13,
+  {INVALID_RF_CHANNEL, INVALID_RF_CHANNEL},//RF_CHAN_14,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_242},  //RF_CHAN_240,
+  {RF_CHAN_BOND_242, RF_CHAN_BOND_246},    //RF_CHAN_244,
+  {RF_CHAN_BOND_246, RF_CHAN_BOND_250},    //RF_CHAN_248,
+  {RF_CHAN_BOND_250, INVALID_RF_CHANNEL},  //RF_CHAN_252,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_210},  //RF_CHAN_208,
+  {RF_CHAN_BOND_210, RF_CHAN_BOND_214},    //RF_CHAN_212,
+  {RF_CHAN_BOND_214, INVALID_RF_CHANNEL},  //RF_CHAN_216,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_38},   //RF_CHAN_36,
+  {RF_CHAN_BOND_38, RF_CHAN_BOND_42},      //RF_CHAN_40,
+  {RF_CHAN_BOND_42, RF_CHAN_BOND_46},      //RF_CHAN_44,
+  {RF_CHAN_BOND_46, RF_CHAN_BOND_50},      //RF_CHAN_48,
+  {RF_CHAN_BOND_50, RF_CHAN_BOND_54},      //RF_CHAN_52,
+  {RF_CHAN_BOND_54, RF_CHAN_BOND_58},      //RF_CHAN_56,
+  {RF_CHAN_BOND_58, RF_CHAN_BOND_62},      //RF_CHAN_60,
+  {RF_CHAN_BOND_62, INVALID_RF_CHANNEL},   //RF_CHAN_64,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_102},  //RF_CHAN_100,
+  {RF_CHAN_BOND_102, RF_CHAN_BOND_106},    //RF_CHAN_104,
+  {RF_CHAN_BOND_106, RF_CHAN_BOND_110},    //RF_CHAN_108,
+  {RF_CHAN_BOND_110, RF_CHAN_BOND_114},    //RF_CHAN_112,
+  {RF_CHAN_BOND_114, RF_CHAN_BOND_118},    //RF_CHAN_116,
+  {RF_CHAN_BOND_118, RF_CHAN_BOND_122},    //RF_CHAN_120,
+  {RF_CHAN_BOND_122, RF_CHAN_BOND_126},    //RF_CHAN_124,
+  {RF_CHAN_BOND_126, RF_CHAN_BOND_130},    //RF_CHAN_128,
+  {RF_CHAN_BOND_130, RF_CHAN_BOND_134},    //RF_CHAN_132,
+  {RF_CHAN_BOND_134, RF_CHAN_BOND_138},    //RF_CHAN_136,
+  {RF_CHAN_BOND_138, RF_CHAN_BOND_142},    //RF_CHAN_140,
+#ifdef FEATURE_WLAN_CH144
+  {RF_CHAN_BOND_142, INVALID_RF_CHANNEL},  //RF_CHAN_144,
+#endif /* FEATURE_WLAN_CH144 */
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_151},  //RF_CHAN_149,
+  {RF_CHAN_BOND_151, RF_CHAN_BOND_155},    //RF_CHAN_153,
+  {RF_CHAN_BOND_155, RF_CHAN_BOND_159},    //RF_CHAN_157,
+  {RF_CHAN_BOND_159, RF_CHAN_BOND_163},    //RF_CHAN_161,
+  {RF_CHAN_BOND_163, INVALID_RF_CHANNEL},  //RF_CHAN_165,
+};
 
 static CountryInfoTable_t countryInfoTable =
 {
     /* the first entry in the table is always the world domain */
-    138,
+    139,
     {
       {REGDOMAIN_WORLD, {'0', '0'}}, // WORLD DOMAIN
       {REGDOMAIN_ETSI, {'A', 'D'}}, // ANDORRA
@@ -184,7 +237,7 @@
       {REGDOMAIN_APAC, {'G', 'T'}},  //GUATEMALA
       {REGDOMAIN_FCC, {'G', 'U'}},  //GUAM
       {REGDOMAIN_ETSI, {'H', 'U'}}, //HUNGARY
-      {REGDOMAIN_FCC, {'I', 'D'}},  //INDONESIA
+      {REGDOMAIN_ETSI, {'I', 'D'}},  //INDONESIA
       {REGDOMAIN_ETSI, {'I', 'E'}}, //IRELAND
       {REGDOMAIN_ETSI, {'I', 'L'}}, //ISRAEL
       {REGDOMAIN_APAC, {'I', 'N'}}, //INDIA
@@ -254,19 +307,20 @@
       {REGDOMAIN_ETSI, {'T', 'R'}}, //TURKEY
       {REGDOMAIN_WORLD, {'T', 'T'}}, //TRINIDAD AND TOBAGO
       {REGDOMAIN_FCC, {'T', 'W'}}, //TAIWAN, PRIVINCE OF CHINA
-      {REGDOMAIN_FCC, {'T', 'Z'}}, //TANZANIA, UNITED REPUBLIC OF
+      {REGDOMAIN_ETSI, {'T', 'Z'}}, //TANZANIA, UNITED REPUBLIC OF
       {REGDOMAIN_WORLD, {'U', 'A'}}, //UKRAINE
       {REGDOMAIN_KOREA, {'U', 'G'}}, //UGANDA
       {REGDOMAIN_FCC, {'U', 'S'}}, //USA
       {REGDOMAIN_WORLD, {'U', 'Y'}}, //URUGUAY
-      {REGDOMAIN_FCC, {'U', 'Z'}}, //UZBEKISTAN
+      {REGDOMAIN_ETSI, {'U', 'Z'}}, //UZBEKISTAN
       {REGDOMAIN_ETSI, {'V', 'E'}}, //VENEZUELA
       {REGDOMAIN_FCC, {'V', 'I'}}, //VIRGIN ISLANDS, US
-      {REGDOMAIN_FCC, {'V', 'N'}}, //VIETNAM
+      {REGDOMAIN_ETSI, {'V', 'N'}}, //VIETNAM
       {REGDOMAIN_ETSI, {'Y', 'E'}}, //YEMEN
       {REGDOMAIN_ETSI, {'Y', 'T'}}, //MAYOTTE
       {REGDOMAIN_ETSI, {'Z', 'A'}}, //SOUTH AFRICA
       {REGDOMAIN_ETSI, {'Z', 'W'}}, //ZIMBABWE
+      {REGDOMAIN_JAPAN, {'X', 'A'}}, //JAPAN PASSIVE
     }
 };
 
@@ -1566,6 +1620,14 @@
     vos_mem_vfree(pEncodedBuf);
     vos_mem_free(pDictFile);
     vos_mem_vfree(pnvEncodedBuf);
+   /*
+    * Reset the linux_reg identifier to allow
+    * driver to send fresh regulatory hint to
+    * the kernel in case of a static driver reload
+    * under strict regulatory domain.
+    */
+    linux_reg_cc[0] = '0';
+    linux_reg_cc[1] = '0';
 
     gnvEFSTable=NULL;
     return VOS_STATUS_SUCCESS;
@@ -3256,81 +3318,19 @@
 
 #ifdef CONFIG_ENABLE_LINUX_REG
 
-static int bw20_ch_index_to_bw40_plus_minus_ch_index(int k,
+static inline int bw20_ch_index_to_bw40_plus_minus_ch_index(int k,
                                     eChannnelBondingTypes cbflag )
 {
-   int m = INVALID_RF_CHANNEL;
-   if (k >= RF_CHAN_1 && k <= RF_CHAN_14)
-   {
-      if(RF_CHAN_BOND_HT40_PLUS == cbflag)
-         m = k - RF_CHAN_1 + RF_CHAN_BOND_3 ;
-      else
-         m = k - RF_CHAN_1 + RF_CHAN_BOND_3 - HT_40MINUS_INDEX ;
+   if (k >= NUM_20MHZ_RF_CHANNELS) {
+     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+           "%s invlaid channel index %d",__func__, k);
+     return INVALID_RF_CHANNEL;
+   }
 
-      if (m > RF_CHAN_BOND_11)
-         m = INVALID_RF_CHANNEL;
-      if (m < RF_CHAN_BOND_3)
-         m = INVALID_RF_CHANNEL;
-   }
-   else if (k >= RF_CHAN_240 && k <= RF_CHAN_216)
-   {
-      if(RF_CHAN_BOND_HT40_PLUS == cbflag)
-         m = k - RF_CHAN_240 + RF_CHAN_BOND_242 ;
-      else
-         m = k - RF_CHAN_240 + RF_CHAN_BOND_242 - HT_40MINUS_INDEX;
-
-      if (m > RF_CHAN_BOND_214)
-         m = INVALID_RF_CHANNEL;
-      if (m < RF_CHAN_BOND_242)
-         m = INVALID_RF_CHANNEL;
-   }
-   else if (k >= RF_CHAN_36 && k <= RF_CHAN_64)
-   {
-      if(RF_CHAN_BOND_HT40_PLUS == cbflag)
-         m = k - RF_CHAN_36 + RF_CHAN_BOND_38;
-      else
-         m = k - RF_CHAN_36 + RF_CHAN_BOND_38 - HT_40MINUS_INDEX;
-
-      if (m > RF_CHAN_BOND_62)
-         m = INVALID_RF_CHANNEL;
-      if (m < RF_CHAN_BOND_38)
-         m = INVALID_RF_CHANNEL;
-   }
-#ifdef FEATURE_WLAN_CH144
-   else if (k >= RF_CHAN_100 && k <= RF_CHAN_144)
-#else
-   else if (k >= RF_CHAN_100 && k <= RF_CHAN_140)
-#endif /* FEATURE_WLAN_CH144 */
-   {
-      if(RF_CHAN_BOND_HT40_PLUS == cbflag)
-         m = k - RF_CHAN_100 + RF_CHAN_BOND_102;
-      else
-         m = k - RF_CHAN_100 + RF_CHAN_BOND_102 -  HT_40MINUS_INDEX;
-#ifdef FEATURE_WLAN_CH144
-      if (m > RF_CHAN_BOND_142)
-         m = INVALID_RF_CHANNEL;
-      if (m < RF_CHAN_BOND_102)
-         m = INVALID_RF_CHANNEL;
-#else
-      if (m > RF_CHAN_BOND_138)
-         m = INVALID_RF_CHANNEL;
-      if (m < RF_CHAN_BOND_102)
-         m = INVALID_RF_CHANNEL;
-#endif /* FEATURE_WLAN_CH144 */
-   }
-   else if (k >= RF_CHAN_149 && k <= RF_CHAN_165)
-   {
-      if(RF_CHAN_BOND_HT40_PLUS == cbflag)
-         m = k - RF_CHAN_149 + RF_CHAN_BOND_151;
-      else
-         m = k - RF_CHAN_149 + RF_CHAN_BOND_151 - HT_40MINUS_INDEX;
-
-      if (m > RF_CHAN_BOND_163)
-         m = INVALID_RF_CHANNEL;
-      if (m < RF_CHAN_BOND_151)
-         m = INVALID_RF_CHANNEL;
-   }
-   return m;
+   if (RF_CHAN_BOND_HT40_PLUS == cbflag)
+     return chan_to_ht_40_index[k].ht_40_plus_index;
+   else
+     return chan_to_ht_40_index[k].ht_40_minus_index;
 }
 /**------------------------------------------------------------------------
   \brief vos_nv_setRegDomain -
@@ -3438,11 +3438,13 @@
 
     if (REGDOMAIN_COUNT == temp_reg_domain) {
 
-        /* the country was not found in the driver database */
-        /* so we will return the REGDOMAIN_WORLD to SME/CSR */
+        /* the country was not found in the driver database
+         * so we will return the REGDOMAIN_WORLD to SME/CSR
+         */
 
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                   ("Country does not map to any Regulatory domain"));
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+            ("Country %c%c does not map to any Regulatory domain"),
+               country_code[0], country_code[1]);
 
         temp_reg_domain = REGDOMAIN_WORLD;
     }
@@ -4017,6 +4019,27 @@
     if (request->initiator == NL80211_REGDOM_SET_BY_DRIVER)
     {
 
+        if (vos_is_load_unload_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
+            temp_reg_domain = REGDOMAIN_COUNT;
+            /* lookup the country in the local database */
+            for (i = 0; i < countryInfoTable.countryCount &&
+                         REGDOMAIN_COUNT == temp_reg_domain; i++)
+            {
+                if (memcmp(request->alpha2, countryInfoTable.countryInfo[i].countryCode,
+                           VOS_COUNTRY_CODE_LEN) == 0)
+                {
+                /* country code is found */
+                /* record the temporary regulatory_domain as well */
+                temp_reg_domain = countryInfoTable.countryInfo[i].regDomain;
+                break;
+                }
+            }
+            if (REGDOMAIN_COUNT == temp_reg_domain)
+                temp_reg_domain = REGDOMAIN_WORLD;
+
+            cur_reg_domain = temp_reg_domain;
+        }
+
         isVHT80Allowed = pHddCtx->isVHT80Allowed;
         if (create_linux_regulatory_entry(wiphy, request, nBandCapability) == 0)
         {
@@ -4045,6 +4068,7 @@
 
         if (!(pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[0] == '0' &&
              pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[1] == '0') &&
+            (request->initiator ==  NL80211_REGDOM_SET_BY_CORE) &&
             (vos_is_load_unload_in_progress( VOS_MODULE_ID_VOSS, NULL)))
         {
            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
@@ -4096,14 +4120,13 @@
         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
         {
            sme_GenericChangeCountryCode(pHddCtx->hHal, country_code,
-                                           REGDOMAIN_COUNT);
+                                       REGDOMAIN_COUNT);
         }
         else
         {
            sme_GenericChangeCountryCode(pHddCtx->hHal, country_code,
-                                        temp_reg_domain);
+                                    temp_reg_domain);
         }
-
     }
 
     /* Mark channels 36-48 as passive for US CC */
diff --git a/wlan/prima/CORE/VOSS/src/vos_sched.c b/wlan/prima/CORE/VOSS/src/vos_sched.c
index fc1aea4..95f551b 100644
--- a/wlan/prima/CORE/VOSS/src/vos_sched.c
+++ b/wlan/prima/CORE/VOSS/src/vos_sched.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -73,6 +73,7 @@
 #define MAX_SSR_WAIT_ITERATIONS 200
 /* Timer value for detecting thread stuck issues */
 #define THREAD_STUCK_TIMER_VAL 5000 // 5 seconds
+#define THREAD_STUCK_COUNT 6
 
 #define MC_Thread 0
 #define TX_Thread 1
@@ -664,6 +665,19 @@
 
   spin_lock_irqsave(&gpVosWatchdogContext->thread_stuck_lock, flags);
 
+  if ((gpVosWatchdogContext->mcThreadStuckCount == THREAD_STUCK_COUNT) ||
+      (gpVosWatchdogContext->txThreadStuckCount == THREAD_STUCK_COUNT) ||
+      (gpVosWatchdogContext->rxThreadStuckCount == THREAD_STUCK_COUNT))
+  {
+       spin_unlock_irqrestore(&gpVosWatchdogContext->thread_stuck_lock, flags);
+       hddLog(LOGE, FL("Thread Stuck count reached threshold!!!"
+              "MC Count %d RX count %d TX count %d"),
+              gpVosWatchdogContext->mcThreadStuckCount,
+              gpVosWatchdogContext->rxThreadStuckCount,
+              gpVosWatchdogContext->txThreadStuckCount);
+       return;
+  }
+
   if (gpVosWatchdogContext->mcThreadStuckCount ||
       gpVosWatchdogContext->txThreadStuckCount ||
       gpVosWatchdogContext->rxThreadStuckCount)
@@ -694,6 +708,11 @@
          vos_dump_stack(RX_Thread);
      }
 
+     vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+              WLAN_LOG_INDICATOR_HOST_ONLY,
+              WLAN_LOG_REASON_THREAD_STUCK,
+              FALSE, TRUE);
+
      spin_lock_irqsave(&gpVosWatchdogContext->thread_stuck_lock, flags);
   }
 
@@ -846,6 +865,18 @@
     clear_bit(WD_POST_EVENT, &pWdContext->wdEventFlag);
     while(1)
     {
+
+      /* Post Msg to detect thread stuck. */
+      if (test_and_clear_bit(WD_WLAN_DETECT_THREAD_STUCK,
+                                          &pWdContext->wdEventFlag))
+      {
+        vos_wd_detect_thread_stuck();
+        /*
+         * Process here and return without processing any SSR
+         * related logic.
+         */
+        break;
+      }
       /* Check for any Active Entry Points
        * If active, delay SSR until no entry point is active or
        * delay until count is decremented to ZERO
@@ -937,12 +968,6 @@
         pWdContext->resetInProgress = false;
         complete(&pHddCtx->ssr_comp_var);
       }
-      /* Post Msg to detect thread stuck */
-      else if(test_and_clear_bit(WD_WLAN_DETECT_THREAD_STUCK,
-                                          &pWdContext->wdEventFlag))
-      {
-        vos_wd_detect_thread_stuck();
-      }
       else
       {
         //Unnecessary wakeup - Should never happen!!
@@ -1994,8 +2019,6 @@
        return VOS_STATUS_E_FAILURE;
     }
 
-    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
-        "%s: WLAN driver is shutting down ", __func__);
 
     pVosContext = vos_get_global_context(VOS_MODULE_ID_HDD, NULL);
     pHddCtx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD, pVosContext );
@@ -2052,6 +2075,9 @@
     /* Release the lock here */
     spin_unlock(&gpVosWatchdogContext->wdLock);
 
+    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+        "%s: WLAN driver is shutting down ", __func__);
+
     /* Update Riva Reset Statistics */
     pHddCtx->hddRivaResetStats++;
 #ifdef CONFIG_HAS_EARLYSUSPEND
@@ -2083,6 +2109,13 @@
 */
 VOS_STATUS vos_watchdog_wlan_re_init(void)
 {
+    /* Make sure that Vos Watchdog context has been initialized */
+    if (gpVosWatchdogContext == NULL) {
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+           "%s: gpVosWatchdogContext == NULL", __func__);
+       return VOS_STATUS_E_FAILURE;
+    }
+
     /* watchdog task is still running, it is not closed in shutdown */
     set_bit(WD_WLAN_REINIT_EVENT, &gpVosWatchdogContext->wdEventFlag);
     set_bit(WD_POST_EVENT, &gpVosWatchdogContext->wdEventFlag);
@@ -2133,6 +2166,14 @@
  */
 bool vos_is_wd_thread(int threadId)
 {
+   /* Make sure that Vos Watchdog context has been initialized */
+   if (gpVosWatchdogContext == NULL)
+   {
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+          "%s: gpVosWatchdogContext == NULL", __func__);
+      return false;
+   }
+
    return ((gpVosWatchdogContext->WdThread) &&
        (threadId == gpVosWatchdogContext->WdThread->pid));
 }
@@ -2143,12 +2184,15 @@
    {
       case MC_Thread:
           wcnss_dump_stack(gpVosSchedContext->McThread);
+          break;
       case TX_Thread:
           wcnss_dump_stack(gpVosSchedContext->TxThread);
+          break;
       case RX_Thread:
           wcnss_dump_stack(gpVosSchedContext->RxThread);
+          break;
       default:
           VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                             "%s: Invalid thread invoked",__func__);
+                    "%s: Invalid thread %d invoked",__func__, thread_id);
    }
 }
diff --git a/wlan/prima/CORE/VOSS/src/vos_sched.h b/wlan/prima/CORE/VOSS/src/vos_sched.h
index f1b680e..e73cf39 100644
--- a/wlan/prima/CORE/VOSS/src/vos_sched.h
+++ b/wlan/prima/CORE/VOSS/src/vos_sched.h
@@ -292,6 +292,11 @@
 } VosMsgWrapper, *pVosMsgWrapper;
 
 
+typedef struct vos_wdthread_timer_work {
+   vos_timer_callback_t callback;
+   v_PVOID_t userData;
+   struct list_head node;
+}vos_wdthread_timer_work_t;
 
 typedef struct _VosContextType
 {                                                  
@@ -352,6 +357,14 @@
 
    /*Fw log complete Event*/
    vos_event_t fwLogsComplete;
+   v_U32_t wakelock_log_level;
+   v_U32_t connectivity_log_level;
+   v_U32_t packet_stats_log_level;
+   v_U8_t      vosWrapperFullReported;
+   vos_wdthread_timer_work_t wdthread_timer_work;
+   struct list_head wdthread_timer_work_list;
+   struct work_struct wdthread_work;
+   spinlock_t wdthread_work_lock;
 } VosContextType, *pVosContextType;
 
 
diff --git a/wlan/prima/CORE/VOSS/src/vos_timer.c b/wlan/prima/CORE/VOSS/src/vos_timer.c
index feafd3b..2ce724e 100644
--- a/wlan/prima/CORE/VOSS/src/vos_timer.c
+++ b/wlan/prima/CORE/VOSS/src/vos_timer.c
@@ -44,6 +44,7 @@
 #include <vos_api.h>
 #include "wlan_qct_sys.h"
 #include "vos_sched.h"
+#include <linux/wcnss_wlan.h>
 
 /*-------------------------------------------------------------------------- 
   Preprocessor definitions and constants
@@ -120,7 +121,10 @@
    v_PVOID_t userData=NULL;
    int threadId;
    VOS_TIMER_TYPE type=VOS_TIMER_TYPE_SW;
-   
+   v_CONTEXT_t vos_context = NULL;
+   pVosContextType vos_global_context;
+   vos_wdthread_timer_work_t *wdthread_timer_work;
+
    VOS_ASSERT(timer);
 
    if (timer == NULL)
@@ -220,7 +224,28 @@
    {
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
                 "TIMER callback: running on wd thread");
-      callback(NULL);
+      vos_context = vos_get_global_context(VOS_MODULE_ID_HDD, NULL);
+      if(!vos_context)
+      {
+         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                   "%s: Global VOS context is Null", __func__);
+         return;
+      }
+      vos_global_context = (pVosContextType)vos_context;
+      wdthread_timer_work = vos_mem_malloc(sizeof(*wdthread_timer_work));
+      if (NULL == wdthread_timer_work) {
+          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                    "%s: No memory available", __func__);
+          return;
+      }
+      wdthread_timer_work->callback = callback;
+      wdthread_timer_work->userData = userData;
+      spin_lock(&vos_global_context->wdthread_work_lock);
+      list_add(&wdthread_timer_work->node,
+                    &vos_global_context->wdthread_timer_work_list);
+      spin_unlock(&vos_global_context->wdthread_work_lock);
+
+      schedule_work(&vos_global_context->wdthread_work);
       return;
    }
 #endif
@@ -957,3 +982,112 @@
         return VOS_FALSE;
 }
 
+/**
+ * vos_wdthread_init_timer_work() -  Initialize timer work
+ * @callbackptr: timer work callback
+ *
+ * Initialize watchdog thread timer work structure and linked
+ * list.
+ * return - void
+ */
+void vos_wdthread_init_timer_work(void *callbackptr)
+{
+   pVosContextType context;
+
+   context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+   if (!context) {
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                 "%s: Global VOS context is Null", __func__);
+       return;
+   }
+
+   spin_lock_init(&context->wdthread_work_lock);
+   INIT_LIST_HEAD(&context->wdthread_timer_work_list);
+#if defined (WLAN_OPEN_SOURCE)
+    INIT_WORK(&context->wdthread_work, callbackptr);
+#else
+    wcnss_init_work(&context->wdthread_work, callbackptr);
+#endif
+}
+
+/**
+ * vos_wdthread_flush_timer_work() -  Flush timer work
+ *
+ * Flush watchdog thread timer work structure.
+ * return - void
+ */
+void vos_wdthread_flush_timer_work()
+{
+   pVosContextType context;
+
+   context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+   if (!context) {
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                 "%s: Global VOS context is Null", __func__);
+       return;
+   }
+
+#if defined (WLAN_OPEN_SOURCE)
+   cancel_work_sync(&context->wdthread_work);
+#else
+   wcnss_flush_work(&context->wdthread_work);
+#endif
+}
+
+/**
+ * __vos_process_wd_timer() -  Handle wathdog thread timer work
+ *
+ * Process watchdog thread timer work.
+ * return - void
+ */
+static void __vos_process_wd_timer(void)
+{
+    v_CONTEXT_t vos_context = NULL;
+    pVosContextType vos_global_context;
+    vos_wdthread_timer_work_t *wdthread_timer_work;
+    struct list_head *pos, *next;
+
+    vos_context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+
+    if(!vos_context)
+    {
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                 "%s: Global VOS context is Null", __func__);
+       return;
+    }
+
+    vos_global_context = (pVosContextType)vos_context;
+
+    spin_lock(&vos_global_context->wdthread_work_lock);
+    list_for_each_safe(pos, next,
+                     &vos_global_context->wdthread_timer_work_list) {
+        wdthread_timer_work = list_entry(pos,
+                                         vos_wdthread_timer_work_t,
+                                         node);
+        list_del(pos);
+        spin_unlock(&vos_global_context->wdthread_work_lock);
+        if ((NULL != wdthread_timer_work->callback) &&
+            (NULL != wdthread_timer_work->userData)) {
+            wdthread_timer_work->callback(wdthread_timer_work->userData);
+        }
+        vos_mem_free(wdthread_timer_work);
+        spin_lock(&vos_global_context->wdthread_work_lock);
+    }
+    spin_unlock(&vos_global_context->wdthread_work_lock);
+
+    return;
+}
+
+/**
+ * vos_process_wd_timer() -  Wrapper function to handle timer work
+ *
+ * Wrapper function to process timer work.
+ * return - void
+ */
+void vos_process_wd_timer(void)
+{
+    vos_ssr_protect(__func__);
+    __vos_process_wd_timer();
+    vos_ssr_unprotect(__func__);
+}
+
diff --git a/wlan/prima/CORE/VOSS/src/vos_trace.c b/wlan/prima/CORE/VOSS/src/vos_trace.c
old mode 100755
new mode 100644
index 8c8beea..fda24aa
--- a/wlan/prima/CORE/VOSS/src/vos_trace.c
+++ b/wlan/prima/CORE/VOSS/src/vos_trace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -130,6 +130,8 @@
  */
 static tpvosTraceCb vostraceCBTable[VOS_MODULE_ID_MAX];
 static tpvosTraceCb vostraceRestoreCBTable[VOS_MODULE_ID_MAX];
+static tp_vos_state_info_cb vos_state_info_table[VOS_MODULE_ID_MAX];
+
 /*-------------------------------------------------------------------------
   Functions
   ------------------------------------------------------------------------*/
@@ -451,6 +453,15 @@
     }
 }
 
+void vos_register_debugcb_init()
+{
+    v_U8_t i;
+
+    for (i = 0; i < VOS_MODULE_ID_MAX; i++) {
+        vos_state_info_table[i] = NULL;
+    }
+}
+
 /*-----------------------------------------------------------------------------
   \brief vos_trace() - puts the messages in to ring-buffer
 
@@ -665,3 +676,28 @@
         spin_unlock(&ltraceLock);
     }
 }
+
+/**
+ * vos_register_debug_callback() - stores callback handlers to print
+ *                                                 state information
+ */
+void vos_register_debug_callback(VOS_MODULE_ID moduleID,
+                                      tp_vos_state_info_cb vos_state_infocb)
+{
+    vos_state_info_table[moduleID] = vos_state_infocb;
+}
+
+/**
+ * vos_state_info_dump_all() - it invokes callback of layer which registered
+ * its callback to print its state information.
+ * @cb_context: call back context to be passed
+ */
+void vos_state_info_dump_all()
+{
+    v_U8_t module;
+
+    for (module = 0; module < VOS_MODULE_ID_MAX; module++) {
+         if (NULL != vos_state_info_table[module])
+             vos_state_info_table[module]();
+    }
+}
diff --git a/wlan/prima/CORE/VOSS/src/vos_utils.c b/wlan/prima/CORE/VOSS/src/vos_utils.c
index 834b21b..879c376 100644
--- a/wlan/prima/CORE/VOSS/src/vos_utils.c
+++ b/wlan/prima/CORE/VOSS/src/vos_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -67,6 +67,8 @@
 #include <linux/completion.h>
 #include <linux/vmalloc.h>
 #include <crypto/hash.h>
+#include "vos_diag_core_event.h"
+
 
 /*----------------------------------------------------------------------------
  * Preprocessor Definitions and Constants
@@ -760,6 +762,20 @@
 #define VOS_QOS_DATA_VALUE                              ( 0x88 )
 #define VOS_NON_QOS_DATA_VALUE                          ( 0x80 )
 
+//802.11 header wil have 24 byte excluding qos
+#define VOS_802_11_HEADER_SIZE ( 24 )
+#define VOS_QOS_SIZE ( 2 )
+#define VOS_LLC_HEADER_SIZE   (8)
+#define VOS_IP_HEADER_SIZE    (20)
+#define VOS_TCP_MIN_HEADER_SIZE   (20)
+#define VOS_DEF_PKT_STATS_LEN_TO_COPY \
+       (VOS_802_11_HEADER_SIZE + VOS_LLC_HEADER_SIZE \
+       + VOS_IP_HEADER_SIZE + VOS_TCP_MIN_HEADER_SIZE)
+// DHCP Port number
+#define VOS_DHCP_SOURCE_PORT 0x4400
+#define VOS_DHCP_DESTINATION_PORT 0x4300
+
+
 
 // Frame Type definitions
 #define VOS_MAC_MGMT_FRAME    0x0
@@ -777,15 +793,13 @@
 {
     void       *pBuffer   = NULL;
     v_BOOL_t   fEAPOL     = VOS_FALSE;
-    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "enter vos_skb_is_eapol");
-    //vos_trace_hex_dump( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, &skb->data[0], skb->len);
+
     // Validate the skb
     if (unlikely(NULL == skb))
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                     "vos_skb_is_eapol [%d]: NULL skb", __LINE__);
-        return VOS_STATUS_E_INVAL;
-        VOS_ASSERT(0);
+        return VOS_FALSE;
     }
     // check for overflow
     if (unlikely((pktOffset + numBytes) > skb->len))
@@ -793,7 +807,7 @@
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "vos_skb_is_eapol [%d]: Packet overflow, offset %d size %d len %d",
                   __LINE__, pktOffset, numBytes, skb->len);
-        return VOS_STATUS_E_INVAL;
+        return VOS_FALSE;
     }
     //check for the Qos Data, if Offset length is more 12.
     //it means it will 802.11 header skb
@@ -808,7 +822,6 @@
     {
       fEAPOL = VOS_TRUE;
     }
-    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "exit vos_skb_is_eapol fEAPOL = %d", fEAPOL);
     return fEAPOL;
 }
 
@@ -1468,3 +1481,96 @@
          "||== END ====================="
          "===============================||\n");
 }
+
+v_U32_t vos_copy_80211_data(void *pBuff, v_U8_t *dst, v_U8_t frametype)
+{
+    vos_pkt_t *vos_pkt = NULL;
+    struct sk_buff *skb = NULL;
+    v_U32_t length_to_copy;
+
+    vos_pkt = (vos_pkt_t *)pBuff;
+
+    if(!vos_pkt || !dst)
+    {
+       VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "vos_pkt/dst is null");
+       return 0;
+    }
+    skb = vos_pkt->pSkb;
+    if(!skb)
+    {
+       VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                   " skb is null");
+       return 0;
+    }
+    if (VOS_MAC_MGMT_FRAME == frametype)
+    {
+      length_to_copy = skb->len;
+    }
+    else
+    {
+        length_to_copy = VOS_DEF_PKT_STATS_LEN_TO_COPY;
+           if(skb->data[0] == VOS_QOS_DATA_VALUE)
+              length_to_copy += VOS_QOS_SIZE;
+
+        /* Copy whole skb data if DHCP or EAPOL pkt.Here length_to_copy
+         * will give the pointer to IP header and adding VOS_IP_HEADER_SIZE
+         * to it will give the DHCP port number.
+         */
+        if (((skb->len > (length_to_copy + VOS_IP_HEADER_SIZE)) &&
+             ((*((u16*)((u8*)skb->data + length_to_copy + VOS_IP_HEADER_SIZE))
+              == VOS_DHCP_SOURCE_PORT) ||
+             (*((u16*)((u8*)skb->data + length_to_copy + VOS_IP_HEADER_SIZE))
+              == VOS_DHCP_DESTINATION_PORT)))  ||
+             vos_skb_is_eapol(skb,
+             VOS_ETHERTYPE_802_1_X_FRAME_OFFSET_IN_802_11_PKT,
+             VOS_ETHERTYPE_802_1_X_SIZE))
+        {
+           length_to_copy = skb->len;
+        }
+    }
+
+    if (length_to_copy > skb->len)
+    {
+        length_to_copy = skb->len;
+    }
+    if (length_to_copy > MAX_PKT_STAT_DATA_LEN)
+    {
+        length_to_copy = MAX_PKT_STAT_DATA_LEN;
+    }
+
+    vos_mem_copy(dst, skb->data, length_to_copy);
+    return length_to_copy;
+}
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/**
+ * vos_tdls_tx_rx_mgmt_event()- send tdls mgmt rx tx event
+ *
+ * @event_id: event id
+ * @tx_rx: tx or rx
+ * @type: type of frame
+ * @action_sub_type: action frame type
+ * @peer_mac: peer mac
+ *
+ * This Function sendsend tdls mgmt rx tx diag event
+ *
+ * Return: void.
+ */
+void vos_tdls_tx_rx_mgmt_event(uint8_t event_id, uint8_t tx_rx,
+              uint8_t type, uint8_t action_sub_type, uint8_t *peer_mac)
+{
+    WLAN_VOS_DIAG_EVENT_DEF(tdls_tx_rx_mgmt,
+                    struct vos_event_tx_rx_mgmt);
+    vos_mem_zero(&tdls_tx_rx_mgmt, sizeof(tdls_tx_rx_mgmt));
+
+    tdls_tx_rx_mgmt.event_id = event_id;
+    tdls_tx_rx_mgmt.tx_rx = tx_rx;
+    tdls_tx_rx_mgmt.type = type;
+    tdls_tx_rx_mgmt.action_sub_type = action_sub_type;
+    vos_mem_copy(tdls_tx_rx_mgmt.peer_mac,
+                     peer_mac, VOS_MAC_ADDR_SIZE);
+    WLAN_VOS_DIAG_EVENT_REPORT(&tdls_tx_rx_mgmt,
+                             EVENT_WLAN_TX_RX_MGMT);
+}
+#endif
diff --git a/wlan/prima/CORE/WDA/inc/legacy/wlan_qct_hal.h b/wlan/prima/CORE/WDA/inc/legacy/wlan_qct_hal.h
index 568f9f8..3d1909c 100644
--- a/wlan/prima/CORE/WDA/inc/legacy/wlan_qct_hal.h
+++ b/wlan/prima/CORE/WDA/inc/legacy/wlan_qct_hal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -230,7 +230,7 @@
 
 /*------------ RSSI and SNR Information extraction -------------*/
 #define WLANHAL_RX_BD_GET_RSSI0( _pvBDHeader )  \
-    (((((tpHalRxBd)_pvBDHeader)->phyStats0) >> 24) & 0xff)
+    (((((tpHalRxBd)_pvBDHeader)->phyStats0) >> 24) & 0x7f)
 #define WLANHAL_RX_BD_GET_RSSI1( _pvBDHeader )  \
     (((((tpHalRxBd)_pvBDHeader)->phyStats0) >> 16) & 0xff)
 #define WLANHAL_RX_BD_GET_RSSI2( _pvBDHeader )  \
@@ -339,7 +339,9 @@
 #define HAL_TDLS_PEER_STA_MASK              0x80 //bit 7 set for TDLS peer station 
 #endif
 
-#define HAL_RELIABLE_MCAST_REQUESTED_MASK   0x100
+#ifdef WLAN_FEATURE_RMC
+#define HAL_RMC_REQUESTED_MASK   0x100
+#endif
 
 #define HAL_USE_BD_RATE_1_MASK              0x1000 // bit 12 for BD RATE 1
 #define HAL_USE_BD_RATE_2_MASK              0x2000 // bit 13 for BD RATE 1
diff --git a/wlan/prima/CORE/WDA/inc/wlan_qct_wda.h b/wlan/prima/CORE/WDA/inc/wlan_qct_wda.h
index dc09fc9..ef48cd8 100644
--- a/wlan/prima/CORE/WDA/inc/wlan_qct_wda.h
+++ b/wlan/prima/CORE/WDA/inc/wlan_qct_wda.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -381,6 +381,10 @@
 //parameter 2 - txComplete status : 1- success, 0 - failure.
 typedef eHalStatus (*pWDAAckFnTxComp)(tpAniSirGlobal, void *pData);
 
+#ifdef WLAN_FEATURE_RMC
+typedef void (*WDA_txFailIndCallback)(tANI_U8 *, tANI_U8);
+#endif /* WLAN_FEATURE_RMC */
+
 typedef struct
 {
    tANI_U16 ucValidStaIndex ;
@@ -433,6 +437,16 @@
 
 #define BMPS_IMPS_FAILURE_REPORT_THRESHOLD    10
 
+/* Continous Response failure counts */
+typedef struct
+{
+   wpt_uint8            enterBmpsFailureCount;
+   wpt_uint8            exitBmpsFailureCount;
+   wpt_uint8            enterImpsFailureCount;
+   wpt_uint8            exitImpsFailureCount;
+} tWDA_RespFailureCounts;
+
+
 typedef struct
 {
    v_PVOID_t            pVosContext;             /* global VOSS context*/
@@ -501,7 +515,14 @@
    vos_event_t          ftmStopDoneEvent;
 
    tWDA_AddSelfStaDebugParams wdaAddSelfStaParams;
+
+#ifdef WLAN_FEATURE_RMC
+   WDA_txFailIndCallback txFailIndCallback;
+#endif /* WLAN_FEATURE_RMC */
+   tWDA_RespFailureCounts  failureCounts;
    wpt_uint8  mgmtTxfailureCnt;
+   uint8_t  mgmt_pktfree_fail;
+   vos_lock_t mgmt_pkt_lock;
 
 } tWDA_CbContext ; 
 
@@ -789,6 +810,7 @@
 #  define WDA_GET_OFFLOADSCANLEARN(pRxMeta) (((WDI_DS_RxMetaInfoType*)(pRxMeta))->offloadScanLearn)
 /* WDA_GET_ROAMCANDIDATEIND **************************************************/
 #  define WDA_GET_ROAMCANDIDATEIND(pRxMeta) (((WDI_DS_RxMetaInfoType*)(pRxMeta))->roamCandidateInd)
+#  define WDA_IF_PER_ROAMCANDIDATEIND(pRxMeta) (((WDI_DS_RxMetaInfoType*)(pRxMeta))->perRoamCndInd)
 #endif
 #ifdef WLAN_FEATURE_EXTSCAN
 #define WDA_GET_EXTSCANFULLSCANRESIND(pRxMeta) (((WDI_DS_RxMetaInfoType*)(pRxMeta))->extscanBuffer)
@@ -796,11 +818,7 @@
 /* WDA_GET_RX_RSSI_DB ********************************************************/
 // Volans RF
 #  define WDA_RSSI_OFFSET             100
-#  define WDA_GET_RSSI0_DB(rssi0)     (rssi0 - WDA_RSSI_OFFSET)
-#  define WDA_GET_RSSI1_DB(rssi0)     (0 - WDA_RSSI_OFFSET)
-#  define WDA_MAX_OF_TWO(val1, val2)  ( ((val1) > (val2)) ? (val1) : (val2))
-#  define WDA_GET_RSSI_DB(rssi0)  \
-                WDA_MAX_OF_TWO(WDA_GET_RSSI0_DB(rssi0), WDA_GET_RSSI1_DB(rssi0))
+#  define WDA_GET_RSSI_DB(rssi0)     ((int)rssi0 - WDA_RSSI_OFFSET)
 #  define WDA_GET_RX_RSSI_DB(pRxMeta) \
                        WDA_GET_RSSI_DB((((WDI_DS_RxMetaInfoType*)(pRxMeta))->rssi0))
 
@@ -1164,6 +1182,10 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 #define WDA_ROAM_SCAN_OFFLOAD_REQ   SIR_HAL_ROAM_SCAN_OFFLOAD_REQ
 #define WDA_ROAM_SCAN_OFFLOAD_RSP   SIR_HAL_ROAM_SCAN_OFFLOAD_RSP
+#define WDA_PER_ROAM_SCAN_OFFLOAD_REQ   SIR_HAL_PER_ROAM_SCAN_OFFLOAD_REQ
+#define WDA_PER_ROAM_SCAN_OFFLOAD_RSP   SIR_HAL_PER_ROAM_SCAN_OFFLOAD_RSP
+#define WDA_PER_ROAM_SCAN_TRIGGER_REQ   SIR_HAL_PER_ROAM_SCAN_TRIGGER_REQ
+#define WDA_PER_ROAM_SCAN_TRIGGER_RSP   SIR_HAL_PER_ROAM_SCAN_TRIGGER_RSP
 #endif
 
 #ifdef WLAN_WAKEUP_EVENTS
@@ -1182,6 +1204,10 @@
 #define WDA_DHCP_START_IND              SIR_HAL_DHCP_START_IND
 #define WDA_DHCP_STOP_IND               SIR_HAL_DHCP_STOP_IND
 
+#ifdef WLAN_FEATURE_RMC
+#define WDA_TX_FAIL_MONITOR_IND         SIR_HAL_TX_FAIL_MONITOR_IND
+#endif /* WLAN_FEATURE_RMC */
+
 
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 #define WDA_GTK_OFFLOAD_REQ             SIR_HAL_GTK_OFFLOAD_REQ
@@ -1217,14 +1243,24 @@
 #define WDA_ADD_PERIODIC_TX_PTRN_IND    SIR_HAL_ADD_PERIODIC_TX_PTRN_IND
 #define WDA_DEL_PERIODIC_TX_PTRN_IND    SIR_HAL_DEL_PERIODIC_TX_PTRN_IND
 
+#define WDA_RATE_UPDATE_IND         SIR_HAL_RATE_UPDATE_IND
+
+#ifdef WLAN_FEATURE_RMC
+#define WDA_RMC_BECOME_RULER       SIR_HAL_RMC_BECOME_RULER
+#define WDA_RMC_RULER_SELECT_RESP  SIR_HAL_RMC_RULER_SELECT_RESP
+#define WDA_RMC_RULER_REQ          SIR_HAL_RMC_RULER_REQ
+#define WDA_RMC_UPDATE_IND          SIR_HAL_RMC_UPDATE_IND
+/* IBSS peer info related message */
+#define WDA_GET_IBSS_PEER_INFO_REQ  SIR_HAL_IBSS_PEER_INFO_REQ
+#define WDA_GET_IBSS_PEER_INFO_RSP  SIR_HAL_IBSS_PEER_INFO_RSP
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
 #define WDA_SET_BATCH_SCAN_REQ            SIR_HAL_SET_BATCH_SCAN_REQ
 #define WDA_SET_BATCH_SCAN_RSP            SIR_HAL_SET_BATCH_SCAN_RSP
 #define WDA_STOP_BATCH_SCAN_IND           SIR_HAL_STOP_BATCH_SCAN_IND
 #define WDA_TRIGGER_BATCH_SCAN_RESULT_IND SIR_HAL_TRIGGER_BATCH_SCAN_RESULT_IND
 #endif
-#define WDA_RATE_UPDATE_IND         SIR_HAL_RATE_UPDATE_IND
-
 
 #define WDA_HT40_OBSS_SCAN_IND   SIR_HAL_HT40_OBSS_SCAN_IND
 #define WDA_HT40_OBSS_STOP_SCAN_IND SIR_HAL_HT40_OBSS_STOP_SCAN_IND
@@ -1250,6 +1286,8 @@
 #define WDA_SET_RTS_CTS_HTVHT                   SIR_HAL_SET_RTS_CTS_HTVHT
 #define WDA_MON_START_REQ                      SIR_HAL_MON_START_REQ
 #define WDA_MON_STOP_REQ                       SIR_HAL_MON_STOP_REQ
+#define WDA_START_RSSI_MONITOR_REQ             SIR_HAL_RSSI_MON_START_REQ
+#define WDA_STOP_RSSI_MONITOR_REQ              SIR_HAL_RSSI_MON_STOP_REQ
 
 tSirRetStatus wdaPostCtrlMsg(tpAniSirGlobal pMac, tSirMsgQ *pMsg);
 
@@ -1267,10 +1305,11 @@
 #define WDA_EXTSCAN_SET_BSSID_HOTLIST_RSP      SIR_HAL_EXTSCAN_SET_BSS_HOTLIST_RSP
 #define WDA_EXTSCAN_RESET_BSSID_HOTLIST_REQ    SIR_HAL_EXTSCAN_RESET_BSS_HOTLIST_REQ
 #define WDA_EXTSCAN_RESET_BSSID_HOTLIST_RSP    SIR_HAL_EXTSCAN_RESET_BSS_HOTLIST_RSP
-#define WDA_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ  SIR_HAL_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ
-#define WDA_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP  SIR_HAL_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP
-#define WDA_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ  SIR_HAL_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ
-#define WDA_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP  SIR_HAL_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP
+#define WDA_EXTSCAN_SET_SSID_HOTLIST_REQ       SIR_HAL_EXTSCAN_SET_SSID_HOTLIST_REQ
+#define WDA_EXTSCAN_SET_SSID_HOTLIST_RSP       SIR_HAL_EXTSCAN_SET_SSID_HOTLIST_RSP
+#define WDA_EXTSCAN_RESET_SSID_HOTLIST_REQ     SIR_HAL_EXTSCAN_RESET_SSID_HOTLIST_REQ
+#define WDA_EXTSCAN_RESET_SSID_HOTLIST_RSP     SIR_HAL_EXTSCAN_RESET_SSID_HOTLIST_RSP
+
 #define WDA_EXTSCAN_GET_CACHED_RESULTS_REQ    SIR_HAL_EXTSCAN_GET_CACHED_RESULTS_REQ
 #define WDA_EXTSCAN_GET_CACHED_RESULTS_RSP    SIR_HAL_EXTSCAN_GET_CACHED_RESULTS_RSP
 
@@ -1278,7 +1317,7 @@
 #define WDA_EXTSCAN_SCAN_AVAILABLE_IND      SIR_HAL_EXTSCAN_SCAN_AVAILABLE_IND
 #define WDA_EXTSCAN_SCAN_RESULT_IND         SIR_HAL_EXTSCAN_SCAN_RESULT_IND
 #define WDA_EXTSCAN_BSSID_HOTLIST_RESULT_IND SIR_HAL_EXTSCAN_HOTLIST_MATCH_IND
-#define WDA_EXTSCAN_SIGNF_RSSI_RESULT_IND    SIR_HAL_EXTSCAN_SIGNF_WIFI_CHANGE_IND
+#define WDA_EXTSCAN_SSID_HOTLIST_RESULT_IND  SIR_HAL_EXTSCAN_SSID_HOTLIST_MATCH_IND
 #endif /* WLAN_FEATURE_EXTSCAN */
 
 #define WDA_SPOOF_MAC_ADDR_REQ               SIR_HAL_SPOOF_MAC_ADDR_REQ
@@ -1292,6 +1331,24 @@
 
 #define WDA_SEND_FREQ_RANGE_CONTROL_IND        SIR_HAL_SEND_FREQ_RANGE_CONTROL_IND
 
+#ifdef WLAN_FEATURE_EXTSCAN
+#define WDA_HIGH_PRIORITY_DATA_INFO_IND         SIR_HAL_HIGH_PRIORITY_DATA_INFO_IND
+#endif /* WLAN_FEATURE_EXTSCAN */
+
+#define WDA_FW_MEM_DUMP_REQ                  SIR_HAL_FW_MEM_DUMP_REQ
+
+#define WDA_WIFI_CONFIG_REQ                    SIR_HAL_WIFI_CONFIG_PARAMS
+
+#define WDA_ANTENNA_DIVERSITY_SELECTION_REQ    SIR_HAL_ANTENNA_DIVERSITY_SELECTION_REQ
+#ifdef FEATURE_OEM_DATA_SUPPORT
+#define WDA_START_OEM_DATA_REQ_IND_NEW         SIR_HAL_START_OEM_DATA_REQ_IND_NEW
+#define WDA_START_OEM_DATA_RSP_IND_NEW         SIR_HAL_START_OEM_DATA_RSP_IND_NEW
+#endif
+
+#define WDA_MODIFY_ROAM_PARAMS_IND             SIR_HAL_MODIFY_ROAM_PARAMS_IND
+#define WDA_SET_ALLOWED_ACTION_FRAMES_IND      SIR_HAL_SET_ALLOWED_ACTION_FRAMES
+
+#define WDA_PAUSE_TL_IND                       SIR_HAL_PAUSE_TL_IND
 
 #define HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME 0x40 // Bit 6 will be used to control BD rate for Management frames
 
@@ -2108,5 +2165,8 @@
 void WDA_SetEnableSSR(v_BOOL_t enableSSR);
 
 
-void WDA_FWLoggingDXEdoneInd(void);
+void WDA_FWLoggingDXEdoneInd(v_U32_t logType);
+
+void WDA_SetMgmtPktViaWQ5(v_BOOL_t sendMgmtPktViaWQ5);
+
 #endif
diff --git a/wlan/prima/CORE/WDA/src/wlan_qct_wda.c b/wlan/prima/CORE/WDA/src/wlan_qct_wda.c
index 802cc7f..1685e02 100644
--- a/wlan/prima/CORE/WDA/src/wlan_qct_wda.c
+++ b/wlan/prima/CORE/WDA/src/wlan_qct_wda.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -131,11 +131,13 @@
 #define WDA_WAIT_MSEC_TILL_RING_EMPTY    10    /* 10 msec wait per cycle */
 #define WDA_IS_NULL_MAC_ADDRESS(mac_addr) \
    ((mac_addr[0] == 0x00) && (mac_addr[1] == 0x00) && (mac_addr[2] == 0x00) &&\
-    (mac_addr[1] == 0x00) && (mac_addr[2] == 0x00) && (mac_addr[3] == 0x00))
+    (mac_addr[3] == 0x00) && (mac_addr[4] == 0x00) && (mac_addr[5] == 0x00))
 
 #define WDA_MAC_ADDR_ARRAY(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
 #define WDA_MAC_ADDRESS_STR "%02x:%02x:%02x:%02x:%02x:%02x"
 #define WDA_DUMPCMD_WAIT_TIMEOUT 10000
+#define WDA_BA_MAX_RETRY_THRESHOLD 10
+#define WDA_BA_RETRY_TIME 300000   /* Time is in msec, equal to 5 mins */
 
 /* extern declarations */
 extern void vos_WDAComplete_cback(v_PVOID_t pVosContext);
@@ -160,6 +162,7 @@
                                                           void* pUserData ) ;
 static VOS_STATUS wdaCreateTimers(tWDA_CbContext *pWDA) ;
 static VOS_STATUS wdaDestroyTimers(tWDA_CbContext *pWDA);
+bool WDA_AllowAddBA(tpAniSirGlobal pMAc, tANI_U8 staId, tANI_U8 tid);
 void WDA_BaCheckActivity(tWDA_CbContext *pWDA) ;
 void WDA_TimerTrafficStatsInd(tWDA_CbContext *pWDA);
 void WDA_HALDumpCmdCallback(WDI_HALDumpCmdRspParamsType *wdiRspParams, void* pUserData);
@@ -177,7 +180,11 @@
 #endif // FEATURE_WLAN_SCAN_PNO
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 VOS_STATUS WDA_ProcessRoamScanOffloadReq(tWDA_CbContext *pWDA,tSirRoamOffloadScanReq *pRoamOffloadScanReqParams);
+VOS_STATUS WDA_ProcessPERRoamScanOffloadReq(tWDA_CbContext *pWDA,
+                    tSirPERRoamOffloadScanReq *pPERRoamOffloadScanReqParams);
 void WDA_RoamOffloadScanReqCallback(WDI_Status status, void* pUserData);
+void WDA_PERRoamOffloadScanReqCallback(WDI_Status status, void* pUserData);
+void WDA_PERRoamTriggerScanReqCallback(WDI_Status status, void* pUserData);
 void WDA_ConvertSirAuthToWDIAuth(WDI_AuthType *AuthType, v_U8_t csrAuthType);
 void WDA_ConvertSirEncToWDIEnc(WDI_EdType *EncrType, v_U8_t csrEncrType);
 #endif
@@ -227,6 +234,11 @@
                                   tSirLPHBReq *pData);
 #endif /* FEATURE_WLAN_LPHB */
 
+#ifdef WLAN_FEATURE_RMC
+void WDA_IBSSPeerInfoRequestHandler(v_PVOID_t pVosContext,
+                                                v_PVOID_t pData);
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef WLAN_FEATURE_EXTSCAN
 VOS_STATUS WDA_ProcessEXTScanStartReq(tWDA_CbContext *pWDA,
                                       tSirEXTScanStartReqParams *wdaRequest);
@@ -240,10 +252,12 @@
                             tSirEXTScanSetBssidHotListReqParams *wdaRequest);
 VOS_STATUS WDA_ProcessEXTScanResetBSSIDHotlistReq(tWDA_CbContext *pWDA,
                             tSirEXTScanResetBssidHotlistReqParams *wdaRequest);
-VOS_STATUS WDA_ProcessEXTScanSetSignfRSSIChangeReq(tWDA_CbContext *pWDA,
-                          tSirEXTScanSetSignificantChangeReqParams *wdaRequest);
-VOS_STATUS WDA_ProcessEXTScanResetSignfRSSIChangeReq(tWDA_CbContext *pWDA,
-                        tSirEXTScanResetSignificantChangeReqParams *wdaRequest);
+VOS_STATUS WDA_ProcessEXTScanSetSSIDHotlistReq(tWDA_CbContext *pWDA,
+                            tSirEXTScanSetSsidHotListReqParams *wdaRequest);
+VOS_STATUS WDA_ProcessEXTScanResetSSIDHotlistReq(tWDA_CbContext *pWDA,
+                            tSirEXTScanResetSsidHotlistReqParams *wdaRequest);
+VOS_STATUS WDA_ProcessHighPriorityDataInfoInd(tWDA_CbContext *pWDA,
+                            tSirHighPriorityDataInfoInd *wdaRequest);
 #endif /* WLAN_FEATURE_EXTSCAN */
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -266,10 +280,26 @@
 WDA_ProcessSetRtsCtsHTVhtInd(tWDA_CbContext *pWDA,
                          tANI_U32 val);
 
+VOS_STATUS
+WDA_ProcessFwrMemDumpReq(tWDA_CbContext *pWDA,
+                                tAniFwrDumpReq* pFwrMemDumpReq);
 
 VOS_STATUS WDA_ProcessMonStartReq( tWDA_CbContext *pWDA, void* wdaRequest);
 VOS_STATUS WDA_ProcessMonStopReq( tWDA_CbContext *pWDA, void* wdaRequest);
 VOS_STATUS WDA_ProcessEnableDisableCAEventInd(tWDA_CbContext *pWDA, tANI_U8 val);
+
+VOS_STATUS  WDA_ProcessWifiConfigReq(tWDA_CbContext *pWDA,
+                                     tSetWifiConfigParams *pwdaWificonfig);
+
+VOS_STATUS WDA_ProcessStartOemDataReqIndNew(tWDA_CbContext *pWDA,
+                                   tOemDataReqNewConfig *pOemDataReqNewConfig);
+
+
+v_VOID_t WDA_ProcessAntennaDiversitySelectionReq(tWDA_CbContext *pWDA,
+                                   tSirAntennaDiversitySelectionReq *pData);
+
+VOS_STATUS WDA_ProcessBcnMissPenaltyCount(tWDA_CbContext *pWDA,
+                                   tModifyRoamParamsReqParams *params);
 /*
  * FUNCTION: WDA_ProcessNanRequest
  * Process NAN request
@@ -334,7 +364,49 @@
    return CONVERT_WDI2VOS_STATUS(status) ;
 }
 
+/**
+ * wda_state_info_dump() - prints state information of wda layer
+ */
+static void wda_state_info_dump(void)
+{
+    v_CONTEXT_t vos_ctx_ptr = NULL;
+    tWDA_CbContext *wda = NULL ;
 
+    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                       "<------ %s " ,__func__);
+
+    /* Get the Global VOSS Context */
+    vos_ctx_ptr = vos_get_global_context(VOS_MODULE_ID_VOSS, NULL);
+
+    if (NULL != vos_ctx_ptr)
+        wda = (tWDA_CbContext *)vos_get_context( VOS_MODULE_ID_WDA,
+                                                            vos_ctx_ptr );
+    else {
+        VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_FATAL,
+                  "%s: Invalid Global VOSS Context", __func__);
+        VOS_ASSERT(0);
+        return;
+    }
+
+    if (NULL != wda)
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                   "wdaState: %d linkState: %d", wda->wdaState,
+                                                 wda->linkState);
+    else {
+        VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: Invalid WDA Context", __func__);
+        VOS_ASSERT(0);
+    }
+}
+
+/**
+ * wda_register_debug_callback() - registration function for wda layer
+ * to print wda state information
+ */
+static void wda_register_debug_callback(void)
+{
+    vos_register_debug_callback(VOS_MODULE_ID_WDA, &wda_state_info_dump);
+}
 
 /*
  * FUNCTION: WDA_open
@@ -362,7 +434,8 @@
    wdaContext->pVosContext = pVosContext;
    wdaContext->wdaState = WDA_INIT_STATE;
    wdaContext->uTxFlowMask = WDA_TXFLOWMASK;
-   
+   vos_lock_init(&wdaContext->mgmt_pkt_lock);
+
    /* Initialize WDA-WDI synchronization event */
    status = vos_event_init(&wdaContext->wdaWdiEvent);
    if(!VOS_IS_STATUS_SUCCESS(status)) 
@@ -414,6 +487,9 @@
        */
       wdaContext->frameTransRequired = wdiDevCapability.bFrameXtlSupported;
    }
+
+   wda_register_debug_callback();
+
    return status;
 
 error:
@@ -2247,6 +2323,20 @@
    tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
                            + sizeof(tHalCfg) + tlvStruct->length) ;
 
+   /* QWLAN_HAL_CFG_TOGGLE_ARP_BDRATES */
+   tlvStruct->type = QWLAN_HAL_CFG_TOGGLE_ARP_BDRATES;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+
+   if (wlan_cfgGetInt(pMac, WNI_CFG_TOGGLE_ARP_BDRATES,
+                                            configDataValue ) != eSIR_SUCCESS)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failed to get value for WNI_CFG_TOGGLE_ARP_BDRATES");
+      goto handle_failure;
+   }
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                           + sizeof(tHalCfg) + tlvStruct->length) ;
    /* QWLAN_HAL_CFG_OPTIMIZE_CA_EVENT */
    tlvStruct->type = QWLAN_HAL_CFG_OPTIMIZE_CA_EVENT ;
    tlvStruct->length = sizeof(tANI_U32);
@@ -2261,16 +2351,31 @@
    tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
                            + sizeof(tHalCfg) + tlvStruct->length) ;
 
-   /* QWLAN_HAL_CFG_TOGGLE_ARP_BDRATES */
-   tlvStruct->type = QWLAN_HAL_CFG_TOGGLE_ARP_BDRATES;
+   /* QWLAN_HAL_CFG_EXT_SCAN_CONC_MODE  */
+   tlvStruct->type = QWLAN_HAL_CFG_EXT_SCAN_CONC_MODE ;
    tlvStruct->length = sizeof(tANI_U32);
    configDataValue = (tANI_U32 *)(tlvStruct + 1);
 
-   if (wlan_cfgGetInt(pMac, WNI_CFG_TOGGLE_ARP_BDRATES,
+   if (wlan_cfgGetInt(pMac, WNI_CFG_EXT_SCAN_CONC_MODE,
                                             configDataValue ) != eSIR_SUCCESS)
    {
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
-               "Failed to get value for WNI_CFG_TOGGLE_ARP_BDRATES");
+               "Failed to get value for WNI_CFG_EXT_SCAN_CONC_MODE");
+      goto handle_failure;
+   }
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                           + sizeof(tHalCfg) + tlvStruct->length) ;
+
+   /* QWLAN_HAL_CFG_BAR_WAKEUP_HOST_DISABLE */
+   tlvStruct->type = QWLAN_HAL_CFG_BAR_WAKEUP_HOST_DISABLE;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+
+   if (wlan_cfgGetInt(pMac, WNI_CFG_DISABLE_BAR_WAKE_UP_HOST,
+                         configDataValue ) != eSIR_SUCCESS)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failed to get value for WNI_CFG_DISABLE_BAR_WAKE_UP_HOST");
       goto handle_failure;
    }
    tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
@@ -2548,6 +2653,7 @@
                                   "error in WDA close " );
       status = VOS_STATUS_E_FAILURE;
    }
+   vos_lock_destroy(&wdaContext->mgmt_pkt_lock);
    return status;
 }
 /*
@@ -3808,6 +3914,16 @@
       configBssReqParam->txMgmtPower = wdiConfigBssRsp->ucTxMgmtPower;
 #endif
    }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                    "%s: Failure with status %d", __func__,
+                    wdiConfigBssRsp->wdiStatus);
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_ADD_BSS_STA_FAIL,
+                     FALSE, TRUE);
+   }
    vos_mem_zero(pWdaParams->wdaWdiApiMsgParam,
                  sizeof(WDI_ConfigBSSReqParamsType));
    vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
@@ -3858,6 +3974,10 @@
    {
          vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
          vos_mem_free(pWdaParams) ;
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_ADD_BSS_STA_FAIL,
+                     FALSE, TRUE);
          WDA_SendMsg(pWDA, WDA_ADD_BSS_RSP, (void *)addBssParams , 0);
    }
 
@@ -4090,6 +4210,16 @@
          return ;
       }
    }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                    "%s: Failure with status %d", __func__,
+                    wdiConfigStaRsp->wdiStatus);
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_ADD_BSS_STA_FAIL,
+                     FALSE, TRUE);
+   }
    vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
    vos_mem_free(pWdaParams) ;
    WDA_SendMsg(pWDA, WDA_ADD_STA_RSP, (void *)addStaReqParam, 0) ;
@@ -4123,6 +4253,10 @@
    {
          vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
          vos_mem_free(pWdaParams) ;
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_ADD_BSS_STA_FAIL,
+                     FALSE, TRUE);
          WDA_SendMsg(pWDA, WDA_ADD_STA_RSP, (void *)addStaParams , 0);
    }
 
@@ -4213,6 +4347,16 @@
       vos_mem_copy(delBssReqParam->bssid, wdiDelBssRsp->macBSSID, 
                                              sizeof(tSirMacAddr)) ;
    }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                    "%s: Failure with status %d", __func__,
+                    wdiDelBssRsp->wdiStatus);
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_DEL_BSS_STA_FAIL,
+                 FALSE, TRUE);
+   }
    if(WDI_DS_GetStaIdxFromBssIdx(pWDA->pWdiContext, delBssReqParam->bssIdx, &staIdx))
    {
      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
@@ -4254,6 +4398,7 @@
          }
       }
    }
+
    WDA_SendMsg(pWDA, WDA_DELETE_BSS_RSP, (void *)delBssReqParam , 0) ;
    return ;
 }
@@ -4285,6 +4430,10 @@
    {
          vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
          vos_mem_free(pWdaParams) ;
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_DEL_BSS_STA_FAIL,
+                 FALSE, TRUE);
          WDA_SendMsg(pWDA, WDA_DELETE_BSS_RSP, (void *)delbssParams , 0) ;
    }
 
@@ -4377,6 +4526,16 @@
       delStaReqParam->staIdx = wdiDelStaRsp->ucSTAIdx ;
       WLANTL_StartForwarding(delStaReqParam->staIdx,0,0);
    }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                    "%s: Failure with status %d", __func__,
+                    wdiDelStaRsp->wdiStatus);
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_DEL_BSS_STA_FAIL,
+                 FALSE, TRUE);
+   }
    vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
    vos_mem_free(pWdaParams) ;
    /*Reset the BA information corresponding to this STAIdx */
@@ -4415,6 +4574,10 @@
    {
          vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
          vos_mem_free(pWdaParams) ;
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_DEL_BSS_STA_FAIL,
+                 FALSE, TRUE);
          WDA_SendMsg(pWDA, WDA_DELETE_STA_RSP, (void *)delStaParams , 0) ;
    }
 
@@ -4502,6 +4665,14 @@
    {
        pWDA->wdaAddSelfStaParams.wdaAddSelfStaFailReason = WDA_ADDSTA_RSP_WDI_FAIL;
        pWDA->wdaAddSelfStaParams.wdiAddStaSelfStaFailCounter++;
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                    "%s: Failure with status %d failcnter %d", __func__,
+                    pwdiAddSTASelfRsp->wdiStatus,
+                    pWDA->wdaAddSelfStaParams.wdiAddStaSelfStaFailCounter);
+       vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_ADD_BSS_STA_FAIL,
+                     FALSE, TRUE);
    }
    WDA_SendMsg( pWDA, WDA_ADD_STA_SELF_RSP, (void *)pAddStaSelfRsp, 0) ;
    return ;
@@ -4537,6 +4708,14 @@
          pWDA->wdaAddSelfStaParams.wdaAddSelfStaFailReason
                                         = WDA_ADDSTA_REQ_WDI_FAIL;
          pWDA->wdaAddSelfStaParams.wdiAddStaSelfStaFailCounter++;
+         VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                    "%s: Failure with status %d failcnter %d", __func__,
+                    wdiStatus,
+                    pWDA->wdaAddSelfStaParams.wdiAddStaSelfStaFailCounter);
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_ADD_BSS_STA_FAIL,
+                     FALSE, TRUE);
          WDA_SendMsg(pWDA, WDA_ADD_STA_SELF_RSP, (void *)addStaSelfParams , 0);
    }
 
@@ -4632,7 +4811,16 @@
    
    vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
    vos_mem_free(pWdaParams) ;
-   
+   if (WDI_STATUS_SUCCESS != delStaSelfParams->status)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                    "%s: Failure with status %d", __func__,
+                    wdiDelStaSelfRspParams->wdiStatus);
+      vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+               WLAN_LOG_INDICATOR_HOST_DRIVER,
+               WLAN_LOG_REASON_DEL_BSS_STA_FAIL,
+               FALSE, TRUE);
+   }
    WDA_SendMsg(pWDA, WDA_DEL_STA_SELF_RSP, (void *)delStaSelfParams , 0) ;
    return ;
 }
@@ -4669,6 +4857,10 @@
          VOS_ASSERT(0);
          vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
          vos_mem_free(pWdaParams) ;
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_DEL_BSS_STA_FAIL,
+                 FALSE, TRUE);
          WDA_SendMsg(pWDA, WDA_DEL_STA_SELF_RSP, (void *)delStaSelfParams , 0) ;
    }
 
@@ -5507,15 +5699,16 @@
    return ;
 
 }
+
 /*
- * FUNCTION: WDA_FWLoggingInitRspCallback
- * recieves Mgmt Logging init response from FW
+ * FUNCTION: WDA_RssiMonitorStopRspCallback
+ * recieves Rssi Monitor stop response from FW
  */
-void WDA_FWLoggingInitRspCallback(WDI_FWLoggingInitRspParamType* wdiRsp,
+void WDA_RssiMonitorStopRspCallback(WDI_RssiMonitorStopRspParamType *wdiRsp,
                                                             void* pUserData)
 {
    tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
-   tSirFWLoggingInitParam *pFWLoggingInitParams;
+   tSirRssiMonitorReq *pRssiMonitorReqParams;
 
    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
                                           "<------ %s " ,__func__);
@@ -5537,12 +5730,12 @@
       return ;
    }
 
-   pFWLoggingInitParams = (tSirFWLoggingInitParam *)pWdaParams->wdaMsgParam;
+   pRssiMonitorReqParams = (tSirRssiMonitorReq *)pWdaParams->wdaMsgParam;
 
-   if(pFWLoggingInitParams->fwlogInitCallback)
+   if(pRssiMonitorReqParams->rssiMonitorCallback)
    {
-      pFWLoggingInitParams->fwlogInitCallback(
-                               pFWLoggingInitParams->fwlogInitCbContext,
+      pRssiMonitorReqParams->rssiMonitorCallback(
+                               pRssiMonitorReqParams->rssiMonitorCbContext,
                                CONVERT_WDI2VOS_STATUS(wdiRsp->status));
    }
    else
@@ -5559,6 +5752,121 @@
 }
 
 /*
+ * FUNCTION: WDA_RssiMonitorStartRspCallback
+ * recieves Rssi Monitor start response from FW
+ */
+void WDA_RssiMonitorStartRspCallback(WDI_RssiMonitorStartRspParamType* wdiRsp,
+                                                            void* pUserData)
+{
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   tSirRssiMonitorReq *pRssiMonitorReqParams;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "<------ %s " ,__func__);
+
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0);
+      return ;
+   }
+
+   if(NULL == pWdaParams->wdaMsgParam)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams->wdaMsgParam is NULL", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pWdaParams);
+      return ;
+   }
+
+   pRssiMonitorReqParams = (tSirRssiMonitorReq *)pWdaParams->wdaMsgParam;
+
+   if(pRssiMonitorReqParams->rssiMonitorCallback)
+   {
+      pRssiMonitorReqParams->rssiMonitorCallback(
+                               pRssiMonitorReqParams->rssiMonitorCbContext,
+                               CONVERT_WDI2VOS_STATUS(wdiRsp->status));
+   }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pFWLoggingInitParams callback is NULL", __func__);
+   }
+
+   vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+   vos_mem_free(pWdaParams->wdaMsgParam);
+   vos_mem_free(pWdaParams);
+
+   return;
+}
+
+/*
+ * FUNCTION: WDA_FWLoggingInitRspCallback
+ * recieves Mgmt Logging init response from FW
+ */
+void WDA_FWLoggingInitRspCallback(WDI_FWLoggingInitRspParamType* wdiRsp,
+                                                            void* pUserData)
+{
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   tSirFWLoggingInitParam *pFWLoggingInitParams;
+   tAniLoggingInitRsp *pLoggingInitRsp;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "<------ %s " ,__func__);
+
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0);
+      return ;
+   }
+
+   if(NULL == pWdaParams->wdaMsgParam)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams->wdaMsgParam is NULL", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pWdaParams);
+      return ;
+   }
+
+   pLoggingInitRsp = (tAniLoggingInitRsp *)vos_mem_malloc(sizeof(tAniLoggingInitRsp)) ;
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: VOS MEM Alloc Failure for pLoggingInitRsp", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pWdaParams);
+      return;
+   }
+
+   pFWLoggingInitParams = (tSirFWLoggingInitParam *)pWdaParams->wdaMsgParam;
+   vos_mem_copy(pLoggingInitRsp, wdiRsp, sizeof(tAniLoggingInitRsp));
+
+   if(pFWLoggingInitParams->fwlogInitCallback)
+   {
+      pFWLoggingInitParams->fwlogInitCallback(
+                               pFWLoggingInitParams->fwlogInitCbContext,
+                               pLoggingInitRsp);
+   }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pFWLoggingInitParams callback is NULL", __func__);
+   }
+
+   vos_mem_free(pLoggingInitRsp);
+   vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+   vos_mem_free(pWdaParams->wdaMsgParam);
+   vos_mem_free(pWdaParams);
+
+   return;
+}
+
+/*
  * FUNCTION: WDA_SpoofMacAddrRspCallback
  * recieves spoof mac addr response from FW
  */
@@ -8591,6 +8899,26 @@
 
    vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
    vos_mem_free(pWdaParams);
+   if (WDI_STATUS_SUCCESS != status)
+   {
+       pWDA->failureCounts.enterImpsFailureCount++;
+       if (BMPS_IMPS_FAILURE_REPORT_THRESHOLD ==
+                 pWDA->failureCounts.enterImpsFailureCount)
+       {
+          VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: Status %d fail count %d", __func__, status,
+               pWDA->failureCounts.enterImpsFailureCount);
+           pWDA->failureCounts.enterImpsFailureCount = 0;
+           vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_ENTER_IMPS_BMPS_FAIL,
+                 FALSE, TRUE);
+       }
+   }
+   else
+   {
+      pWDA->failureCounts.enterImpsFailureCount = 0;
+   }
    WDA_SendMsg(pWDA, WDA_ENTER_IMPS_RSP, NULL , status) ;
    return ;
 }
@@ -8635,6 +8963,19 @@
    {
       vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
       vos_mem_free(pWdaParams);
+      pWDA->failureCounts.enterImpsFailureCount++;
+      if (BMPS_IMPS_FAILURE_REPORT_THRESHOLD ==
+                pWDA->failureCounts.enterImpsFailureCount)
+      {
+         VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: wdiStatus %d fail count %d", __func__, wdiStatus,
+               pWDA->failureCounts.enterImpsFailureCount);
+         pWDA->failureCounts.enterImpsFailureCount = 0;
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+               WLAN_LOG_INDICATOR_HOST_DRIVER,
+               WLAN_LOG_REASON_ENTER_IMPS_BMPS_FAIL,
+               FALSE, TRUE);
+      }
       WDA_SendMsg(pWDA, WDA_ENTER_IMPS_RSP, NULL,
                   CONVERT_WDI2SIR_STATUS(wdiStatus));
    }
@@ -8724,6 +9065,27 @@
 
    vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
    vos_mem_free(pWdaParams);
+   if (WDI_STATUS_SUCCESS != status)
+   {
+       pWDA->failureCounts.exitImpsFailureCount++;
+       if (BMPS_IMPS_FAILURE_REPORT_THRESHOLD ==
+                 pWDA->failureCounts.exitImpsFailureCount)
+       {
+          VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: Status %d fail count %d", __func__,
+               status,
+               pWDA->failureCounts.exitImpsFailureCount);
+           pWDA->failureCounts.exitImpsFailureCount = 0;
+           vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_EXIT_IMPS_BMPS_FAIL,
+                 FALSE, TRUE);
+       }
+   }
+   else
+   {
+      pWDA->failureCounts.exitImpsFailureCount = 0;
+   }
 
    WDA_SendMsg(pWDA, WDA_EXIT_IMPS_RSP, NULL , (status));
    return;
@@ -8735,6 +9097,7 @@
 void WDA_ExitImpsReqCallback(WDI_Status status, void* pUserData)
 {
    tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   tWDA_CbContext *pWDA;
    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
                                           "<------ %s " ,__func__);
    if(NULL == pWdaParams)
@@ -8744,11 +9107,26 @@
       VOS_ASSERT(0);
       return;
    }
-
+   pWDA = (tWDA_CbContext *)pWdaParams->pWdaContext;
    if (IS_WDI_STATUS_FAILURE(status))
    {
        vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
        vos_mem_free(pWdaParams);
+
+       pWDA->failureCounts.exitImpsFailureCount++;
+       if (BMPS_IMPS_FAILURE_REPORT_THRESHOLD ==
+                 pWDA->failureCounts.exitImpsFailureCount)
+       {
+          VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: wdiStatus %d fail count %d", __func__,
+               status,
+               pWDA->failureCounts.exitImpsFailureCount);
+          pWDA->failureCounts.exitImpsFailureCount = 0;
+          vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_EXIT_IMPS_BMPS_FAIL,
+                     FALSE, TRUE);
+       }
        if (WDI_STATUS_DEV_INTERNAL_FAILURE == status)
        {
            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
@@ -8853,6 +9231,27 @@
 
    vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
    vos_mem_free(pWdaParams) ;
+   if (eHAL_STATUS_SUCCESS != pEnterBmpsRspParams->status)
+   {
+       pWDA->failureCounts.enterBmpsFailureCount++;
+       if (BMPS_IMPS_FAILURE_REPORT_THRESHOLD ==
+                 pWDA->failureCounts.enterBmpsFailureCount)
+       {
+           VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: wdiStatus %d fail count %d", __func__,
+               pwdiEnterBmpsRsp->wdiStatus,
+               pWDA->failureCounts.enterBmpsFailureCount);
+           pWDA->failureCounts.enterBmpsFailureCount = 0;
+           vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_ENTER_IMPS_BMPS_FAIL,
+                 FALSE, TRUE);
+       }
+   }
+   else
+   {
+      pWDA->failureCounts.enterBmpsFailureCount = 0;
+   }
    WDA_SendMsg(pWDA, WDA_ENTER_BMPS_RSP, (void *)pEnterBmpsRspParams , 0);
 
    return ;
@@ -8895,6 +9294,20 @@
    {
       vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
       vos_mem_free(pWdaParams);
+      pWDA->failureCounts.enterBmpsFailureCount++;
+      if (BMPS_IMPS_FAILURE_REPORT_THRESHOLD ==
+                 pWDA->failureCounts.enterBmpsFailureCount)
+      {
+         VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: wdiStatus %d fail count %d", __func__,
+               wdiStatus,
+               pWDA->failureCounts.enterBmpsFailureCount);
+         pWDA->failureCounts.enterBmpsFailureCount = 0;
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_ENTER_IMPS_BMPS_FAIL,
+                     FALSE, TRUE);
+      }
       WDA_SendMsg(pWDA, WDA_ENTER_BMPS_RSP, (void *)pEnterBmpsRspParams, 0);
    }
 
@@ -9023,7 +9436,29 @@
    pExitBmpsRspParams->status = (pwdiExitBmpsRsp->wdiStatus);
 
    vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
-   vos_mem_free(pWdaParams) ;
+   vos_mem_free(pWdaParams);
+
+   if (WDI_STATUS_SUCCESS != pwdiExitBmpsRsp->wdiStatus)
+   {
+       pWDA->failureCounts.exitBmpsFailureCount++;
+       if (BMPS_IMPS_FAILURE_REPORT_THRESHOLD ==
+                 pWDA->failureCounts.exitBmpsFailureCount)
+       {
+          VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: Status %d fail count %d", __func__,
+               pExitBmpsRspParams->status,
+               pWDA->failureCounts.exitBmpsFailureCount);
+           pWDA->failureCounts.exitBmpsFailureCount = 0;
+           vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                 WLAN_LOG_INDICATOR_HOST_DRIVER,
+                 WLAN_LOG_REASON_EXIT_IMPS_BMPS_FAIL,
+                 FALSE, TRUE);
+       }
+   }
+   else
+   {
+      pWDA->failureCounts.exitBmpsFailureCount = 0;
+   }
 
    WDA_SendMsg(pWDA, WDA_EXIT_BMPS_RSP, (void *)pExitBmpsRspParams , 0) ;
    return ;
@@ -9066,6 +9501,20 @@
    {
       vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
       vos_mem_free(pWdaParams);
+      pWDA->failureCounts.exitBmpsFailureCount++;
+      if (BMPS_IMPS_FAILURE_REPORT_THRESHOLD ==
+                 pWDA->failureCounts.exitBmpsFailureCount)
+      {
+         VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: wdiStatus %d fail count %d", __func__,
+               wdiStatus,
+               pWDA->failureCounts.exitBmpsFailureCount);
+         pWDA->failureCounts.exitBmpsFailureCount = 0;
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_EXIT_IMPS_BMPS_FAIL,
+                     FALSE, TRUE);
+      }
       WDA_SendMsg(pWDA, WDA_EXIT_BMPS_RSP, (void *)pExitBmpsRspParams, 0);
    }
 
@@ -10228,6 +10677,149 @@
 }
 
 /*
+ * FUNCTION: WDA_ProcessStartRssiMonitorReq
+ *
+ */
+VOS_STATUS WDA_ProcessStartRssiMonitorReq(tWDA_CbContext *pWDA,
+                                tSirRssiMonitorReq *pRssiMonitorReqParam)
+{
+   VOS_STATUS status = VOS_STATUS_SUCCESS;
+   WDI_Status wstatus;
+   WDI_RssiMonitorReqInfoType *wdiRssiMonitorInfo;
+   tWDA_ReqParams *pWdaParams ;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "------> %s " ,__func__);
+
+   /* Sanity Check*/
+   if(NULL == pRssiMonitorReqParam)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: pRssiMonitorReqParam received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return VOS_STATUS_E_FAULT;
+   }
+
+   wdiRssiMonitorInfo = (WDI_RssiMonitorReqInfoType *)vos_mem_malloc(
+                                       sizeof(WDI_RssiMonitorReqInfoType));
+   if(NULL == wdiRssiMonitorInfo)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pRssiMonitorReqParam);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams)) ;
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(wdiRssiMonitorInfo);
+      vos_mem_free(pRssiMonitorReqParam);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   wdiRssiMonitorInfo->requestId = pRssiMonitorReqParam->requestId;
+   wdiRssiMonitorInfo->minRssi = pRssiMonitorReqParam->minRssi;
+   wdiRssiMonitorInfo->maxRssi = pRssiMonitorReqParam->maxRssi;
+   vos_mem_copy(wdiRssiMonitorInfo->currentBssId,
+                &(pRssiMonitorReqParam->currentBssId), sizeof(tSirMacAddr));
+
+   pWdaParams->pWdaContext = pWDA;
+   pWdaParams->wdaMsgParam = pRssiMonitorReqParam;
+   pWdaParams->wdaWdiApiMsgParam = (void *)wdiRssiMonitorInfo;
+
+   wstatus = WDI_StartRssiMonitorReq(wdiRssiMonitorInfo,
+                       (WDI_RssiMonitorStartRspCb)WDA_RssiMonitorStartRspCallback,
+                        pWdaParams);
+   if(IS_WDI_STATUS_FAILURE(wstatus))
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "Failure in Mgmt Logging init REQ WDI API, free all the memory" );
+      status = CONVERT_WDI2VOS_STATUS(wstatus);
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
+      vos_mem_free(pWdaParams->wdaMsgParam);
+      vos_mem_free(pWdaParams);
+   }
+
+   return status;
+}
+
+/*
+ * FUNCTION: WDA_ProcessStopRssiMonitorReq
+ *
+ */
+VOS_STATUS WDA_ProcessStopRssiMonitorReq(tWDA_CbContext *pWDA,
+                                tSirRssiMonitorReq *pRssiMonitorReqParam)
+{
+   VOS_STATUS status = VOS_STATUS_SUCCESS;
+   WDI_Status wstatus;
+   WDI_RssiMonitorReqInfoType *wdiRssiMonitorInfo;
+   tWDA_ReqParams *pWdaParams ;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "------> %s " ,__func__);
+
+   /* Sanity Check*/
+   if(NULL == pRssiMonitorReqParam)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: pRssiMonitorReqParam received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return VOS_STATUS_E_FAULT;
+   }
+
+   wdiRssiMonitorInfo = (WDI_RssiMonitorReqInfoType *)vos_mem_malloc(
+                                       sizeof(WDI_RssiMonitorReqInfoType));
+   if(NULL == wdiRssiMonitorInfo)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pRssiMonitorReqParam);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams)) ;
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(wdiRssiMonitorInfo);
+      vos_mem_free(pRssiMonitorReqParam);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   wdiRssiMonitorInfo->requestId = pRssiMonitorReqParam->requestId;
+   vos_mem_copy(wdiRssiMonitorInfo->currentBssId,
+                &(pRssiMonitorReqParam->currentBssId), sizeof(tSirMacAddr));
+
+   pWdaParams->pWdaContext = pWDA;
+   pWdaParams->wdaMsgParam = pRssiMonitorReqParam;
+   pWdaParams->wdaWdiApiMsgParam = (void *)wdiRssiMonitorInfo;
+
+   wstatus = WDI_StopRssiMonitorReq(wdiRssiMonitorInfo,
+                       (WDI_RssiMonitorStopRspCb)WDA_RssiMonitorStopRspCallback,
+                        pWdaParams);
+   if(IS_WDI_STATUS_FAILURE(wstatus))
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "Failure in Mgmt Logging init REQ WDI API, free all the memory" );
+      status = CONVERT_WDI2VOS_STATUS(wstatus);
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
+      vos_mem_free(pWdaParams->wdaMsgParam);
+      vos_mem_free(pWdaParams);
+   }
+
+   return status;
+}
+
+
+/*
  * FUNCTION: WDA_WdiIndicationCallback
  * 
  */ 
@@ -12648,7 +13240,10 @@
       VOS_ASSERT(0) ;
       return ;
    }
-   
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+              "%s: WDA HAL DUMP Resp Received",__func__);
+
    pWDA = pWdaParams->pWdaContext;
    buffer = (tANI_U8 *)pWdaParams->wdaMsgParam;
    if(wdiRspParams->usBufferLen > 0)
@@ -12738,6 +13333,10 @@
    
    /* store Params pass it to WDI */
    pWdaParams->wdaWdiApiMsgParam = (void *)wdiHALDumpCmdReqParam ;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+              "%s: WDA HAL DUMP Command sent",__func__);
+
    /* Send command to WDI */
    status = WDI_HALDumpCmdReq(wdiHALDumpCmdReqParam, WDA_HALDumpCmdCallback,
                                                                    pWdaParams);
@@ -12758,7 +13357,7 @@
             VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
             "%s: WDA_HALDUMP reporting  other error",__func__);
          }
-         VOS_ASSERT(0);
+         VOS_BUG(0);
       }
    }
    return status;
@@ -12915,6 +13514,56 @@
    return CONVERT_WDI2VOS_STATUS(wdiStatus);
 }
 
+/*
+ * FUNCTION: WDA_ProcessRateUpdateInd
+ *
+ */
+VOS_STATUS WDA_ProcessRateUpdateInd(tWDA_CbContext *pWDA,
+                               tSirRateUpdateInd *pRateUpdateParams)
+{
+   WDI_Status wdiStatus;
+   WDI_RateUpdateIndParams rateUpdateParams;
+
+   vos_mem_copy(rateUpdateParams.bssid,
+            pRateUpdateParams->bssid, sizeof(tSirMacAddr));
+
+   rateUpdateParams.ucastDataRateTxFlag =
+                     pRateUpdateParams->ucastDataRateTxFlag;
+   rateUpdateParams.rmcDataRateTxFlag =
+                     pRateUpdateParams->rmcDataRateTxFlag;
+   rateUpdateParams.mcastDataRate24GHzTxFlag =
+                     pRateUpdateParams->mcastDataRate24GHzTxFlag;
+   rateUpdateParams.mcastDataRate5GHzTxFlag =
+                     pRateUpdateParams->mcastDataRate5GHzTxFlag;
+
+   rateUpdateParams.ucastDataRate = pRateUpdateParams->ucastDataRate;
+   rateUpdateParams.rmcDataRate =
+                                 pRateUpdateParams->rmcDataRate;
+   rateUpdateParams.mcastDataRate24GHz = pRateUpdateParams->mcastDataRate24GHz;
+   rateUpdateParams.mcastDataRate5GHz = pRateUpdateParams->mcastDataRate5GHz;
+
+   rateUpdateParams.wdiReqStatusCB = WDA_WdiIndicationCallback;
+   rateUpdateParams.pUserData = pWDA;
+
+   wdiStatus = WDI_RateUpdateInd(&rateUpdateParams);
+
+   if (WDI_STATUS_PENDING == wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                "Pending received for %s:%d", __func__, __LINE__ );
+   }
+   else if (WDI_STATUS_SUCCESS_SYNC != wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "Failure in %s:%d", __func__, __LINE__ );
+   }
+
+   vos_mem_free(pRateUpdateParams);
+
+   return CONVERT_WDI2VOS_STATUS(wdiStatus);
+}
+
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
 /*
  * FUNCTION: WDA_ProcessStopBatchScanInd
@@ -13245,55 +13894,6 @@
    return CONVERT_WDI2VOS_STATUS(status) ;
 }
 /*
- * FUNCTION: WDA_ProcessRateUpdateInd
- *
- */
-VOS_STATUS WDA_ProcessRateUpdateInd(tWDA_CbContext *pWDA,
-                               tSirRateUpdateInd *pRateUpdateParams)
-{
-   WDI_Status wdiStatus;
-   WDI_RateUpdateIndParams rateUpdateParams;
-
-   vos_mem_copy(rateUpdateParams.bssid,
-            pRateUpdateParams->bssid, sizeof(tSirMacAddr));
-
-   rateUpdateParams.ucastDataRateTxFlag =
-                     pRateUpdateParams->ucastDataRateTxFlag;
-   rateUpdateParams.reliableMcastDataRateTxFlag =
-                     pRateUpdateParams->reliableMcastDataRateTxFlag;
-   rateUpdateParams.mcastDataRate24GHzTxFlag =
-                     pRateUpdateParams->mcastDataRate24GHzTxFlag;
-   rateUpdateParams.mcastDataRate5GHzTxFlag =
-                     pRateUpdateParams->mcastDataRate5GHzTxFlag;
-
-   rateUpdateParams.ucastDataRate = pRateUpdateParams->ucastDataRate;
-   rateUpdateParams.reliableMcastDataRate =
-                                 pRateUpdateParams->reliableMcastDataRate;
-   rateUpdateParams.mcastDataRate24GHz = pRateUpdateParams->mcastDataRate24GHz;
-   rateUpdateParams.mcastDataRate5GHz = pRateUpdateParams->mcastDataRate5GHz;
-
-   rateUpdateParams.wdiReqStatusCB = WDA_WdiIndicationCallback;
-   rateUpdateParams.pUserData = pWDA;
-
-   wdiStatus = WDI_RateUpdateInd(&rateUpdateParams);
-
-   if (WDI_STATUS_PENDING == wdiStatus)
-   {
-      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
-                "Pending received for %s:%d", __func__, __LINE__ );
-   }
-   else if (WDI_STATUS_SUCCESS_SYNC != wdiStatus)
-   {
-      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
-                "Failure in %s:%d", __func__, __LINE__ );
-   }
-
-   vos_mem_free(pRateUpdateParams);
-
-   return CONVERT_WDI2VOS_STATUS(wdiStatus);
-}
-
-/*
  * -------------------------------------------------------------------------
  * DATA interface with WDI for Mgmt Frames
  * ------------------------------------------------------------------------- 
@@ -13308,7 +13908,7 @@
    
    tWDA_CbContext *wdaContext= (tWDA_CbContext *)VOS_GET_WDA_CTXT(pVosContext);
    tpAniSirGlobal pMac = (tpAniSirGlobal)VOS_GET_MAC_CTXT((void *)pVosContext) ;
-   tANI_U64 uUserData;
+   uintptr_t uUserData;
 
    VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO, "Enter:%s", __func__);
 
@@ -13322,6 +13922,7 @@
       return VOS_STATUS_E_FAILURE;
    }
 
+    vos_lock_acquire(&wdaContext->mgmt_pkt_lock);
     /*Check if frame was timed out or not*/
     vos_pkt_get_user_data_ptr(  pData, VOS_PKT_USER_DATA_ID_WDA,
                                (v_PVOID_t)&uUserData);
@@ -13332,7 +13933,8 @@
        VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_WARN,
                             "%s: MGMT Frame Tx timed out",
                             __func__);
-       vos_pkt_return_packet(pData); 
+       vos_pkt_return_packet(pData);
+       vos_lock_release(&wdaContext->mgmt_pkt_lock);
        return VOS_STATUS_SUCCESS; 
     }
 
@@ -13350,9 +13952,17 @@
                            "%s:packet (%p) is already freed",
                            __func__, pData);
          //Return from here since we reaching here because the packet already timeout
+         vos_lock_release(&wdaContext->mgmt_pkt_lock);
          return status;
       }
    }
+   else {
+      wdaContext->mgmt_pktfree_fail++;
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                            "%s:packet (%p)  userData (%lx) is not freed",
+                            __func__, pData, uUserData);
+   }
+   vos_lock_release(&wdaContext->mgmt_pkt_lock);
 
    /* 
     * Trigger the event to bring the HAL TL Tx complete function to come 
@@ -13564,26 +14174,30 @@
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR, 
                  "%s: Status %d when waiting for TX Frame Event",
                  __func__, status);
-
+      vos_lock_acquire(&pWDA->mgmt_pkt_lock);
       /*Tag Frame as timed out for later deletion*/
       vos_pkt_set_user_data_ptr( (vos_pkt_t *)pFrmBuf, VOS_PKT_USER_DATA_ID_WDA,
                        (v_PVOID_t)WDA_TL_TX_MGMT_TIMED_OUT);
       pWDA->pTxCbFunc = NULL;   /*To stop the limTxComplete being called again  , 
                                 after the packet gets completed(packet freed once)*/
 
+      vos_atomic_set((uintptr_t*)&pWDA->VosPacketToFree, (uintptr_t)WDA_TX_PACKET_FREED);
+
+      /*
+       * Memory barrier to ensure pFrmBuf is set before TX thread access it in
+       * TX completion call back
+       */
+      VOS_SMP_MB;
+      vos_lock_release(&pWDA->mgmt_pkt_lock);
+
       /* TX MGMT fail with COMP timeout, try to detect DXE stall */
       WDA_TransportChannelDebug(pMac, 1, 0);
 
-      /* check whether the packet was freed already,so need not free again when 
-      * TL calls the WDA_Txcomplete routine
-      */
-      vos_atomic_set((uintptr_t*)&pWDA->VosPacketToFree, (uintptr_t)WDA_TX_PACKET_FREED);
-      /*if(vos_atomic_set(uintptr_t *)&pWDA->VosPacketToFree, (uintptr_t)WDA_TX_PACKET_FREED) == (v_U32_t)pFrmBuf)
-      {
-         pCompFunc(VOS_GET_MAC_CTXT(pWDA->pVosContext), (vos_pkt_t *)pFrmBuf);
-      } */
-
-      WLANTL_TLDebugMessage(WLANTL_DEBUG_FW_CLEANUP);
+      if (vos_isFatalEventEnabled())
+         vos_fatal_event_logs_req(WLAN_LOG_TYPE_FATAL,
+                     WLAN_LOG_INDICATOR_HOST_DRIVER,
+                     WLAN_LOG_REASON_MGMT_FRAME_TIMEOUT,
+                     FALSE, TRUE);
 
       if( pAckTxComp )
       {
@@ -13706,6 +14320,505 @@
    return CONVERT_WDI2VOS_STATUS(status) ;
  }
 
+#ifdef WLAN_FEATURE_RMC
+
+void
+WDA_RMCRulerRspCallback(WDI_RmcRspParamsType *wdiRmcResponse, void *pUserData)
+{
+    tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+    tWDA_CbContext *pWDA = pWdaParams->pWdaContext;
+
+    switch (wdiRmcResponse->cmd)
+    {
+        case eWDI_BECOME_RULER_CMD :
+        {
+            tSirRmcBecomeRulerInd *pRmcBecomeRulerInd;
+
+            pRmcBecomeRulerInd = (tSirRmcBecomeRulerInd *)
+                                   vos_mem_malloc(sizeof(*pRmcBecomeRulerInd));
+
+            if (NULL == pRmcBecomeRulerInd)
+            {
+               VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: unable to allocate pRmcBecomeRulerInd", __func__);
+               break;
+            }
+
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                        "Received eWDI_BECOME_RULER_CMD from WDI");
+
+            pRmcBecomeRulerInd->status = wdiRmcResponse->status;
+
+            vos_mem_copy(pRmcBecomeRulerInd->mcastTransmitter,
+                          wdiRmcResponse->mcastTransmitter,
+                          sizeof(tSirMacAddr));
+            vos_mem_copy(pRmcBecomeRulerInd->mcastGroup,
+                          wdiRmcResponse->mcastGroup,
+                          sizeof(tSirMacAddr));
+
+            WDA_SendMsg(pWDA, WDA_RMC_BECOME_RULER,
+                               (void *)pRmcBecomeRulerInd, 0) ;
+            break;
+        }
+        case eWDI_SUGGEST_RULER_CMD :
+        {
+            tSirRmcRulerSelectInd *pRmcRulerSelectInd;
+
+            pRmcRulerSelectInd = (tSirRmcRulerSelectInd *)
+                                   vos_mem_malloc(sizeof(tSirRmcRulerSelectInd));
+
+            if (NULL == pRmcRulerSelectInd)
+            {
+               VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: unable to allocate pRmcRulerSelectInd", __func__);
+               break;
+            }
+
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                              "Received eWDI_SUGGEST_RULER_CMD from WDI");
+
+            pRmcRulerSelectInd->status = wdiRmcResponse->status;
+
+            vos_mem_copy(pRmcRulerSelectInd->mcastTransmitter,
+                        wdiRmcResponse->mcastTransmitter,
+                        sizeof(tSirMacAddr));
+            vos_mem_copy(pRmcRulerSelectInd->mcastGroup,
+                        wdiRmcResponse->mcastGroup,
+                        sizeof(tSirMacAddr));
+            vos_mem_copy(pRmcRulerSelectInd->ruler,
+                        wdiRmcResponse->ruler,
+                        sizeof(pRmcRulerSelectInd->ruler));
+
+            WDA_SendMsg(pWDA, WDA_RMC_RULER_SELECT_RESP,
+                                       (void *)pRmcRulerSelectInd, 0) ;
+            break;
+        }
+    }
+
+    /* free the config structure */
+    if (pWdaParams->wdaWdiApiMsgParam != NULL)
+    {
+        vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+    }
+    vos_mem_free(pWdaParams->wdaMsgParam);
+    vos_mem_free(pWdaParams);
+
+}
+
+void WDA_RMCRulerReqCallback(WDI_Status wdiStatus, void* pUserData)
+{
+    tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+
+    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+              "<------ %s, wdiStatus: %d", __func__, wdiStatus);
+
+    if (NULL == pWdaParams)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: pWdaParams received NULL", __func__);
+        VOS_ASSERT(0);
+        return;
+    }
+
+    if (IS_WDI_STATUS_FAILURE(wdiStatus))
+    {
+        vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+        vos_mem_free(pWdaParams->wdaMsgParam);
+        vos_mem_free(pWdaParams);
+    }
+
+   return;
+}
+
+static VOS_STATUS
+WDA_ProcessRMCRulerReq(tWDA_CbContext *pWDA,
+                        tSirRmcRulerReq *rmcRulerReq)
+{
+    WDI_Status status;
+    WDI_RmcRulerReqParams *wdiRulerReq;
+    tWDA_ReqParams *pWdaParams;
+
+    wdiRulerReq = (WDI_RmcRulerReqParams *)
+                        vos_mem_malloc(sizeof(*wdiRulerReq));
+
+    if (NULL == wdiRulerReq)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: VOS MEM Alloc Failure", __func__);
+        VOS_ASSERT(0);
+        vos_mem_free(rmcRulerReq);
+        return VOS_STATUS_E_NOMEM;
+    }
+
+    pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams));
+    if (NULL == pWdaParams)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+        VOS_ASSERT(0);
+        vos_mem_free(rmcRulerReq);
+        vos_mem_free(wdiRulerReq);
+        return VOS_STATUS_E_NOMEM;
+    }
+
+    pWdaParams->wdaWdiApiMsgParam = (v_PVOID_t *)wdiRulerReq;
+    /* Store param pointer as passed in by caller */
+    pWdaParams->wdaMsgParam = rmcRulerReq;
+    pWdaParams->pWdaContext = pWDA;
+
+    wdiRulerReq->cmd = rmcRulerReq->cmd;
+
+    vos_mem_copy(wdiRulerReq->mcastTransmitter,
+            rmcRulerReq->mcastTransmitter, sizeof(tSirMacAddr));
+    vos_mem_copy(wdiRulerReq->mcastGroup,
+            rmcRulerReq->mcastGroup, sizeof(tSirMacAddr));
+    vos_mem_copy(wdiRulerReq->blacklist,
+            rmcRulerReq->blacklist, sizeof(wdiRulerReq->blacklist));
+
+    wdiRulerReq->wdiReqStatusCB = WDA_RMCRulerReqCallback;
+
+    status = WDI_RmcRulerReq(wdiRulerReq,
+                 (WDI_RmcRulerRspCb)WDA_RMCRulerRspCallback,
+                 (void *)pWdaParams);
+    if (IS_WDI_STATUS_FAILURE(status))
+    {
+        vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+        vos_mem_free(pWdaParams->wdaMsgParam);
+        vos_mem_free(pWdaParams) ;
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                   "Ruler Request failed");
+    }
+    return CONVERT_WDI2VOS_STATUS(status) ;
+}
+
+/*
+ * FUNCTION: WDA_ProcessRMCUpdateInd
+ * Forward Update Indication to WDI
+*/
+static VOS_STATUS
+WDA_ProcessRMCUpdateInd(tWDA_CbContext *pWDA,
+                         tSirRmcUpdateInd *rmcUpdateInd)
+{
+    WDI_Status status;
+    WDI_RmcUpdateIndParams wdiUpdateInd;
+
+    /* Copy the paramters for Update_Ind */
+
+    wdiUpdateInd.indication = rmcUpdateInd->indication;
+    wdiUpdateInd.role = rmcUpdateInd->role;
+
+    vos_mem_copy(wdiUpdateInd.mcastTransmitter,
+            rmcUpdateInd->mcastTransmitter, sizeof(tSirMacAddr));
+
+    vos_mem_copy(wdiUpdateInd.mcastGroup,
+            rmcUpdateInd->mcastGroup, sizeof(tSirMacAddr));
+
+    vos_mem_copy(wdiUpdateInd.mcastRuler,
+            rmcUpdateInd->mcastRuler, sizeof(tSirMacAddr));
+
+    wdiUpdateInd.wdiReqStatusCB = WDA_WdiIndicationCallback;
+    wdiUpdateInd.pUserData = pWDA;
+    status = WDI_RmcUpdateInd(&wdiUpdateInd);
+
+    if (WDI_STATUS_PENDING == status)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 "Pending received for %s:%d ",__func__,__LINE__ );
+    }
+    else if (WDI_STATUS_SUCCESS_SYNC != status)
+    {
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failure in %s:%d ",__func__,__LINE__ );
+    }
+
+    vos_mem_free(rmcUpdateInd);
+
+    return CONVERT_WDI2VOS_STATUS(status) ;
+}
+
+void WDA_GetIbssPeerInfoRspCallback(WDI_IbssPeerInfoRspParams *peerInfoRspParams
+                                    ,void* pUserData)
+{
+
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   WDI_IbssPeerInfoParams *pIbssPeerInfoParams;
+   tWDA_CbContext *pWDA;
+   tpSirIbssGetPeerInfoRspParams pIbssGetPeerInfoRsp;
+   vos_msg_t vosMsg;
+   v_U32_t wdaCnt = 0;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "<------ %s " ,__func__);
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0);
+      return;
+   }
+
+   if (NULL == peerInfoRspParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: peerInfoRspParams received NULL", __func__);
+      if(pWdaParams->wdaMsgParam)
+         vos_mem_free(pWdaParams->wdaMsgParam);
+      if(pWdaParams->wdaWdiApiMsgParam)
+         vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams);
+
+      VOS_ASSERT(0);
+      return;
+   }
+
+   pIbssPeerInfoParams =
+       (WDI_IbssPeerInfoParams *)peerInfoRspParams->wdiPeerInfoParams;
+
+   pIbssGetPeerInfoRsp =
+                  vos_mem_malloc(sizeof(tSirIbssGetPeerInfoRspParams));
+
+   if(NULL == pIbssGetPeerInfoRsp)
+   {
+      if(pWdaParams->wdaMsgParam)
+         vos_mem_free(pWdaParams->wdaMsgParam);
+      if(pWdaParams->wdaWdiApiMsgParam)
+         vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams);
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: Memory allocation failed for pIbssGetPeerInfoRsp",
+                 __func__);
+      VOS_ASSERT(0);
+      return;
+
+   }
+
+   pWDA = (tWDA_CbContext *)pWdaParams->pWdaContext ;
+
+
+   if (peerInfoRspParams->wdiNumPeers > 32)
+   {
+      pr_info("%s] Number of peers is more than 32, returning\n", __func__);
+      /* free the mem and return */
+      vos_mem_free((v_VOID_t *) pIbssGetPeerInfoRsp);
+         if(pWdaParams->wdaMsgParam)
+            vos_mem_free(pWdaParams->wdaMsgParam);
+         if(pWdaParams->wdaWdiApiMsgParam)
+            vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+         vos_mem_free(pWdaParams);
+
+      return;
+   }
+
+   /* Message Header */
+   pIbssGetPeerInfoRsp->mesgType = eWNI_SME_IBSS_PEER_INFO_RSP;
+   pIbssGetPeerInfoRsp->mesgLen = sizeof(tSirIbssGetPeerInfoRspParams);
+   pIbssGetPeerInfoRsp->ibssPeerInfoRspParams.status = peerInfoRspParams->wdiStatus;
+   pIbssGetPeerInfoRsp->ibssPeerInfoRspParams.numPeers = peerInfoRspParams->wdiNumPeers;
+
+   for (wdaCnt = 0; wdaCnt < peerInfoRspParams->wdiNumPeers; wdaCnt++)
+   {
+      WDI_IbssPeerInfoParams *pWdiTmp = &pIbssPeerInfoParams[wdaCnt];
+      tSirIbssPeerInfoParams *pSmeTmp =
+          &pIbssGetPeerInfoRsp->ibssPeerInfoRspParams.peerInfoParams[wdaCnt];
+
+      pSmeTmp->staIdx = pWdiTmp->wdiStaIdx;
+      pSmeTmp->mcsIndex = pWdiTmp->wdiMcsIndex;
+      pSmeTmp->rssi = pWdiTmp->wdiRssi;
+      pSmeTmp->txRate = pWdiTmp->wdiTxRate;
+      pSmeTmp->txRateFlags = pWdiTmp->wdiTxRateFlags;
+   }
+
+   /* VOS message wrapper */
+   vosMsg.type = eWNI_SME_IBSS_PEER_INFO_RSP;
+   vosMsg.bodyptr = (void *)pIbssGetPeerInfoRsp;
+   vosMsg.bodyval = 0;
+
+   if (VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MQ_ID_SME, (vos_msg_t*)&vosMsg))
+   {
+      /* free the mem and return */
+      vos_mem_free((v_VOID_t *) pIbssGetPeerInfoRsp);
+   }
+
+   if(NULL != pWdaParams)
+   {
+      if(pWdaParams->wdaMsgParam)
+         vos_mem_free(pWdaParams->wdaMsgParam);
+      if(pWdaParams->wdaWdiApiMsgParam)
+         vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams);
+   }
+
+   return;
+}
+
+static VOS_STATUS
+WDA_ProcessIbssPeerInfoReq(tWDA_CbContext *pWDA,
+                      tSirIbssGetPeerInfoReqParams *ibssPeerInfoReqParams)
+{
+   WDI_Status status;
+   WDI_IbssPeerInfoReqType *wdiPeerInfoReq;
+   tWDA_ReqParams *pWdaParams;
+
+   wdiPeerInfoReq = (WDI_IbssPeerInfoReqType *)
+                    vos_mem_malloc(sizeof(WDI_IbssPeerInfoReqType));
+   if (NULL == wdiPeerInfoReq)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(ibssPeerInfoReqParams);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams));
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                         "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(wdiPeerInfoReq);
+      vos_mem_free(ibssPeerInfoReqParams);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams->wdaWdiApiMsgParam = (v_PVOID_t *)wdiPeerInfoReq;
+   /* Store param pointer as passed in by caller */
+   pWdaParams->wdaMsgParam = ibssPeerInfoReqParams;
+   pWdaParams->pWdaContext = pWDA;
+
+   wdiPeerInfoReq->wdiAllPeerInfoReqd =
+                 ibssPeerInfoReqParams->allPeerInfoReqd;
+   wdiPeerInfoReq->wdiStaIdx =
+                 ibssPeerInfoReqParams->staIdx;
+
+   status = WDI_IbssPeerInfoReq(wdiPeerInfoReq,
+               (WDI_IbssPeerInfoReqCb)WDA_GetIbssPeerInfoRspCallback,
+               (void *)pWdaParams);
+   if (IS_WDI_STATUS_FAILURE(status))
+   {
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams->wdaMsgParam);
+      vos_mem_free(pWdaParams) ;
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "IBSS Peer Info Request failed");
+   }
+   return CONVERT_WDI2VOS_STATUS(status) ;
+
+}
+
+/*
+ * FUNCTION: WDA_ProcessTXFailMonitorInd
+ * Forward TX Fail Monitor to WDI
+ */
+static VOS_STATUS WDA_ProcessTXFailMonitorInd(
+                                        tWDA_CbContext *pWDA,
+                                        tAniTXFailMonitorInd *txFailMonitorInd)
+{
+   WDI_Status status;
+   WDI_TXFailMonitorInd *wdiTXFailMonitorInd =
+         (WDI_TXFailMonitorInd *)vos_mem_malloc(sizeof(WDI_TXFailMonitorInd));
+
+   VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+             "<------ %s " ,__func__);
+
+   if (NULL == wdiTXFailMonitorInd)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(txFailMonitorInd);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   wdiTXFailMonitorInd->tx_fail_count = txFailMonitorInd->tx_fail_count;
+
+   wdiTXFailMonitorInd->wdiReqStatusCB = WDA_WdiIndicationCallback;
+   wdiTXFailMonitorInd->pUserData = pWDA;
+
+   status = WDI_TXFailMonitorStartStopInd(wdiTXFailMonitorInd);
+
+   if (WDI_STATUS_PENDING == status)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "TX Fail Monitor Indication Pending");
+   }
+   else if (WDI_STATUS_SUCCESS_SYNC == status)
+   {
+     if (0 == txFailMonitorInd->tx_fail_count)
+       pWDA->txFailIndCallback = NULL;
+     else
+       pWDA->txFailIndCallback = txFailMonitorInd->txFailIndCallback;
+   }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "TX Fail Monitor Indication Failed");
+   }
+
+   vos_mem_free(wdiTXFailMonitorInd);
+   vos_mem_free(txFailMonitorInd);
+
+   return CONVERT_WDI2VOS_STATUS(status) ;
+}
+#endif /* WLAN_FEATURE_RMC */
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+VOS_STATUS WDA_ProcessPERRoamScanTriggerReq(tWDA_CbContext *pWDA,
+                    tPERRoamScanStart *pPERRoamTriggerScanReqParams)
+{
+   WDI_Status status;
+   tWDA_ReqParams *pWdaParams ;
+   WDI_PERRoamTriggerScanInfo *pwdiPERRoamTriggerScanInfo =
+       (WDI_PERRoamTriggerScanInfo *)vos_mem_malloc(
+                                         sizeof(WDI_PERRoamTriggerScanInfo));
+
+   VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+              "------> %s " ,__func__);
+
+   if (NULL == pwdiPERRoamTriggerScanInfo)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams)) ;
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pwdiPERRoamTriggerScanInfo);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pwdiPERRoamTriggerScanInfo->roamScanReq =
+                                    pPERRoamTriggerScanReqParams->start;
+
+   /* Store Params pass it to WDI */
+   pWdaParams->wdaWdiApiMsgParam = (void *)pwdiPERRoamTriggerScanInfo;
+   pWdaParams->pWdaContext = pWDA;
+
+   /* Store param pointer as passed in by caller */
+   pWdaParams->wdaMsgParam = pPERRoamTriggerScanReqParams;
+   status = WDI_PERRoamScanTriggerReq(pwdiPERRoamTriggerScanInfo,
+                    (WDI_PERRoamTriggerScanCb)WDA_PERRoamTriggerScanReqCallback,
+                    pWdaParams);
+
+   if(IS_WDI_STATUS_FAILURE(status))
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "Failure in Start Roam Candidate trigger Req WDI API" );
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
+      vos_mem_free(pWdaParams->wdaMsgParam);
+      pWdaParams->wdaWdiApiMsgParam = NULL;
+      pWdaParams->wdaMsgParam = NULL;
+   }
+   return CONVERT_WDI2VOS_STATUS(status) ;
+}
+#endif
+
 /*
  * FUNCTION: WDA_ProcessSetSpoofMacAddrReq
  *
@@ -13768,6 +14881,210 @@
     return CONVERT_WDI2VOS_STATUS(wdiStatus) ;
 }
 
+
+/*
+ * FUNCTION: WDA_FwrMemDumpRespCallback
+ * recieves Mgmt Logging init response from FW
+ */
+ void WDA_FwrMemDumpRespCallback(WDI_FwrMemDumpRsp* wdiRsp,
+                                                            void* pUserData)
+{
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   tAniFwrDumpReq *pFwrMemDumpReq;
+   tAniFwrDumpRsp  *pFwrMemDumpRsp;
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "<------ %s " ,__func__);
+
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0);
+      return ;
+   }
+
+   if(NULL == pWdaParams->wdaMsgParam)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams->wdaMsgParam is NULL", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pWdaParams);
+      return ;
+   }
+
+   pFwrMemDumpRsp = (tAniFwrDumpRsp *)vos_mem_malloc(sizeof(tAniFwrDumpRsp));
+   if(pFwrMemDumpRsp == NULL)
+   {
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: pFwrMemDumpRsp is NULL", __func__);
+       VOS_ASSERT(0);
+       vos_mem_free(pWdaParams);
+       return ;
+   }
+
+   pFwrMemDumpRsp->dump_status  = wdiRsp->dump_status;
+   pFwrMemDumpReq = (tAniFwrDumpReq *)pWdaParams->wdaMsgParam;
+
+   if(pFwrMemDumpReq->fwMemDumpReqCallback)
+   {
+      pFwrMemDumpReq->fwMemDumpReqCallback(
+                               pFwrMemDumpReq->fwMemDumpReqContext,
+                               pFwrMemDumpRsp);
+   }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: FwrMemDump callback is NULL", __func__);
+   }
+
+   vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+   vos_mem_free(pWdaParams->wdaMsgParam);
+   vos_mem_free(pWdaParams);
+   vos_mem_free(pFwrMemDumpRsp);
+
+   return ;
+}
+
+VOS_STATUS WDA_ProcessFwrMemDumpReq(tWDA_CbContext * pWDA,
+                         tAniFwrDumpReq* pFwrMemDumpReq)
+{
+   VOS_STATUS status = VOS_STATUS_SUCCESS;
+   WDI_Status wstatus;
+   WDI_FwrMemDumpReqType * pWdiFwrMemDumpReq;
+   tWDA_ReqParams *pWdaParams ;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "------> %s " ,__func__);
+   /* Sanity Check*/
+   if(NULL == pFwrMemDumpReq)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: pFwrMemDumpReq received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return VOS_STATUS_E_FAULT;
+   }
+
+   pWdiFwrMemDumpReq = (WDI_FwrMemDumpReqType *)vos_mem_malloc(sizeof(WDI_FwrMemDumpReqType));
+   if(NULL == pWdiFwrMemDumpReq)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: pWdiFwrMemDumpReq Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams)) ;
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: pWdaParams Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pWdiFwrMemDumpReq);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   /* Store Params pass it to WDI */
+   pWdaParams->wdaWdiApiMsgParam = (void *)pWdiFwrMemDumpReq;
+   pWdaParams->pWdaContext = pWDA;
+   /* Store param pointer as passed in by caller */
+   pWdaParams->wdaMsgParam = pFwrMemDumpReq;
+
+   status = WDI_FwrMemDumpReq(pWdiFwrMemDumpReq,
+                              (WDI_FwrMemDumpCb)WDA_FwrMemDumpRespCallback,
+                              pWdaParams);
+
+   if(IS_WDI_STATUS_FAILURE(wstatus))
+   {
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 FL("Fwr Mem Dump Req failed, free all the memory"));
+       status = CONVERT_WDI2VOS_STATUS(wstatus);
+       vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
+       pWdaParams->wdaWdiApiMsgParam = NULL;
+       vos_mem_free(pWdaParams->wdaMsgParam);
+       pWdaParams->wdaMsgParam = NULL;
+       vos_mem_free(pWdaParams);
+   }
+
+    return status;
+
+}
+
+/**
+ * wda_process_set_allowed_action_frames_ind() - Set allowed action frames to FW
+ *
+ * @pWDA: WDA Call back context
+ * @allowed_action_frames: Pointer to struct sir_allowed_action_frames
+ *                          that holds allowed action frames bitmask
+ *
+ * This function sets the allowed action frames that the FW needs to
+ * handover to host.The Action frames other than the requested ones
+ * can be dropped in FW
+ *
+ * Return: VOS_STATUS enumeration
+ */
+VOS_STATUS wda_process_set_allowed_action_frames_ind(tWDA_CbContext *pWDA,
+                      struct sir_allowed_action_frames *allowed_action_frames)
+{
+    WDI_Status status;
+    struct WDI_AllowedActionFramesInd *wdi_allowed_action_frames;
+    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                 FL("---> %s"), __func__);
+
+    wdi_allowed_action_frames = (struct WDI_AllowedActionFramesInd*)
+                                                  vos_mem_malloc(sizeof
+                                                  (*wdi_allowed_action_frames));
+    if (!wdi_allowed_action_frames) {
+        VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                  "%s: VOS MEM Alloc Failure", __func__);
+        vos_mem_free(allowed_action_frames);
+        return VOS_STATUS_E_NOMEM;
+    }
+
+    wdi_allowed_action_frames->bitmask = allowed_action_frames->bitmask;
+    wdi_allowed_action_frames->reserved = allowed_action_frames->reserved;
+
+    status = WDI_SetAllowedActionFramesInd(wdi_allowed_action_frames);
+    if (WDI_STATUS_PENDING == status) {
+        VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                              FL("pending status received"));
+    } else if (WDI_STATUS_SUCCESS_SYNC != status &&
+                                        (WDI_STATUS_SUCCESS != status)) {
+        VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                         FL("Failure in allowed_action_frames API %d"), status);
+    }
+
+    vos_mem_free(wdi_allowed_action_frames);
+    vos_mem_free(allowed_action_frames);
+    return CONVERT_WDI2VOS_STATUS(status) ;
+}
+
+/*
+ * FUNCTION: WDA_ProcessBcnMissPenaltyCount
+ * Request to WDI.
+ */
+VOS_STATUS WDA_ProcessTLPauseInd(tWDA_CbContext *pWDA, v_U32_t params)
+{
+    v_U8_t staId;
+    WLANTL_CbType*  pTLCb = NULL;
+
+    VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO, FL("---> %s"), __func__);
+
+    staId = (v_U8_t)params;
+
+    pTLCb = VOS_GET_TL_CB(pWDA->pVosContext);
+    if ( NULL == pTLCb )
+    {
+        VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+           "WLAN TL:Invalid TL pointer from pvosGCtx on WLANTL_SuspendDataTx");
+        return VOS_STATUS_E_FAULT;
+    }
+
+
+    pTLCb->atlSTAClients[staId]->disassoc_progress = VOS_TRUE;
+    /* Pause TL for Sta ID */
+    return WLANTL_SuspendDataTx(pWDA->pVosContext, &staId, NULL);
+}
+
 /*
  * FUNCTION: WDA_McProcessMsg
  * Trigger DAL-AL to start CFG download 
@@ -14161,9 +15478,19 @@
                                         (tAniGetFrameLogReq *)pMsg->bodyptr);
          break;
       }
+      case WDA_START_RSSI_MONITOR_REQ:
+      {
+         WDA_ProcessStartRssiMonitorReq(pWDA,(tSirRssiMonitorReq *)pMsg->bodyptr);
+         break;
+      }
+      case WDA_STOP_RSSI_MONITOR_REQ:
+      {
+         WDA_ProcessStopRssiMonitorReq(pWDA,(tSirRssiMonitorReq *)pMsg->bodyptr);
+         break;
+      }
       case WDA_SEND_LOG_DONE_IND:
       {
-         WDA_FWLoggingDXEdoneInd();
+         WDA_FWLoggingDXEdoneInd(pMsg->bodyval);
          break;
       }
       case WDA_FATAL_EVENT_LOGS_REQ:
@@ -14289,16 +15616,22 @@
                         (tSirEXTScanResetBssidHotlistReqParams *)pMsg->bodyptr);
          break;
       }
-      case WDA_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ:
+     case WDA_EXTSCAN_SET_SSID_HOTLIST_REQ:
       {
-         WDA_ProcessEXTScanSetSignfRSSIChangeReq(pWDA,
-                     (tSirEXTScanSetSignificantChangeReqParams *)pMsg->bodyptr);
+         WDA_ProcessEXTScanSetSSIDHotlistReq(pWDA,
+                         (tSirEXTScanSetSsidHotListReqParams *)pMsg->bodyptr);
          break;
       }
-      case WDA_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ:
+      case WDA_EXTSCAN_RESET_SSID_HOTLIST_REQ:
       {
-         WDA_ProcessEXTScanResetSignfRSSIChangeReq(pWDA,
-                   (tSirEXTScanResetSignificantChangeReqParams *)pMsg->bodyptr);
+         WDA_ProcessEXTScanResetSSIDHotlistReq(pWDA,
+                        (tSirEXTScanResetSsidHotlistReqParams *)pMsg->bodyptr);
+         break;
+      }
+      case WDA_HIGH_PRIORITY_DATA_INFO_IND:
+      {
+         WDA_ProcessHighPriorityDataInfoInd(pWDA,
+                        (tSirHighPriorityDataInfoInd *)pMsg->bodyptr);
          break;
       }
 #endif /* WLAN_FEATURE_EXTSCAN */
@@ -14432,6 +15765,11 @@
          WDA_ProcessRoamScanOffloadReq(pWDA, (tSirRoamOffloadScanReq *)pMsg->bodyptr);
          break;
       }
+      case WDA_PER_ROAM_SCAN_OFFLOAD_REQ:
+      {
+         WDA_ProcessPERRoamScanOffloadReq(pWDA, (tSirPERRoamOffloadScanReq *)pMsg->bodyptr);
+         break;
+      }
 #endif
       case WDA_SET_TX_PER_TRACKING_REQ:
       {
@@ -14473,6 +15811,12 @@
          WDA_ProcessSetPowerParamsReq(pWDA, (tSirSetPowerParamsReq *)pMsg->bodyptr);
          break;
       }
+      case WDA_FW_MEM_DUMP_REQ:
+      {
+          WDA_ProcessFwrMemDumpReq(pWDA, (tAniFwrDumpReq*)pMsg->bodyptr);
+          break;
+      }
+
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
       case WDA_GTK_OFFLOAD_REQ:
       {
@@ -14556,7 +15900,42 @@
             (tSirDelPeriodicTxPtrn *)pMsg->bodyptr);
          break;
       }
-
+      case WDA_RATE_UPDATE_IND:
+      {
+          WDA_ProcessRateUpdateInd(pWDA, (tSirRateUpdateInd *)pMsg->bodyptr);
+          break;
+      }
+#ifdef WLAN_FEATURE_RMC
+      case WDA_RMC_RULER_REQ:
+      {
+          WDA_ProcessRMCRulerReq(pWDA, (tSirRmcRulerReq *)pMsg->bodyptr);
+          break;
+      }
+      case WDA_RMC_UPDATE_IND:
+      {
+          WDA_ProcessRMCUpdateInd(pWDA, (tSirRmcUpdateInd *)pMsg->bodyptr);
+          break;
+      }
+      case WDA_GET_IBSS_PEER_INFO_REQ:
+      {
+          WDA_ProcessIbssPeerInfoReq(pWDA,
+                            (tSirIbssGetPeerInfoReqParams *)pMsg->bodyptr);
+          break;
+      }
+      case WDA_TX_FAIL_MONITOR_IND:
+      {
+         WDA_ProcessTXFailMonitorInd(pWDA, (tAniTXFailMonitorInd *)pMsg->bodyptr);
+         break;
+      }
+#endif /* WLAN_FEATURE_RMC */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+      case WDA_PER_ROAM_SCAN_TRIGGER_REQ:
+      {
+         WDA_ProcessPERRoamScanTriggerReq(pWDA,
+                                          (tPERRoamScanStart *)pMsg->bodyptr);
+         break;
+      }
+#endif
 #ifdef FEATURE_WLAN_BATCH_SCAN
       case WDA_SET_BATCH_SCAN_REQ:
       {
@@ -14564,11 +15943,6 @@
             (tSirSetBatchScanReq *)pMsg->bodyptr);
           break;
       }
-      case WDA_RATE_UPDATE_IND:
-      {
-          WDA_ProcessRateUpdateInd(pWDA, (tSirRateUpdateInd *)pMsg->bodyptr);
-          break;
-      }
       case WDA_TRIGGER_BATCH_SCAN_RESULT_IND:
       {
           WDA_ProcessTriggerBatchScanResultInd(pWDA,
@@ -14644,6 +16018,42 @@
          WDA_ProcessEnableDisableCAEventInd(pWDA, pMsg->bodyval);
          break;
       }
+     case WDA_WIFI_CONFIG_REQ:
+     {
+       WDA_ProcessWifiConfigReq(pWDA,(tSetWifiConfigParams *)pMsg->bodyptr);
+       break;
+      }
+#ifdef FEATURE_OEM_DATA_SUPPORT
+      case WDA_START_OEM_DATA_REQ_IND_NEW:
+      {
+         WDA_ProcessStartOemDataReqIndNew(pWDA,
+                                         (tOemDataReqNewConfig *)pMsg->bodyptr);
+         break;
+      }
+#endif
+      case WDA_ANTENNA_DIVERSITY_SELECTION_REQ:
+      {
+         WDA_ProcessAntennaDiversitySelectionReq(pWDA,
+                             (tSirAntennaDiversitySelectionReq *)pMsg->bodyptr);
+         break;
+      }
+      case WDA_MODIFY_ROAM_PARAMS_IND:
+      {
+         WDA_ProcessBcnMissPenaltyCount(pWDA,
+                             (tModifyRoamParamsReqParams *)pMsg->bodyptr);
+         break;
+      }
+
+     case WDA_SET_ALLOWED_ACTION_FRAMES_IND:
+          wda_process_set_allowed_action_frames_ind(pWDA,
+                            (struct sir_allowed_action_frames*)pMsg->bodyptr);
+          break;
+
+      case WDA_PAUSE_TL_IND:
+      {
+         WDA_ProcessTLPauseInd(pWDA, pMsg->bodyval);
+         break;
+      }
       default:
       {
          VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
@@ -15133,6 +16543,18 @@
          }
          break;
       }
+#ifdef WLAN_FEATURE_RMC
+      case WDI_TX_FAIL_IND:
+      {
+         if (pWDA->txFailIndCallback)
+         {
+            pWDA->txFailIndCallback(
+                     wdiLowLevelInd->wdiIndicationData.wdiTXFailInd.macAddr,
+                     wdiLowLevelInd->wdiIndicationData.wdiTXFailInd.seqNo);
+         }
+	 break;
+      }
+#endif /* WLAN_FEATURE_RMC */
   
 #ifdef FEATURE_WLAN_LPHB
       case WDI_LPHB_IND:
@@ -15212,6 +16634,48 @@
          break;
       }
 
+#ifdef WLAN_FEATURE_RMC
+      case WDI_RMC_RULER_PICK_NEW :
+      {
+         tSirRmcUpdateInd   *pRmcUpdateInd =
+            (tSirRmcUpdateInd *)vos_mem_malloc(sizeof(tSirRmcUpdateInd));
+
+         VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                              "Received WDI_RMC_UPDATE_IND from WDI");
+         if (NULL == pRmcUpdateInd)
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                  "Memory allocation failure, "
+                  "WDI_RMC_UPDATE_IND not forwarded");
+            break;
+         }
+
+         pRmcUpdateInd->indication =
+           wdiLowLevelInd->wdiIndicationData.wdiRmcPickNewRulerInd.indication;
+         pRmcUpdateInd->role =
+           wdiLowLevelInd->wdiIndicationData.wdiRmcPickNewRulerInd.role;
+
+         /* Copy the mcast transmitter which should be us */
+         vos_mem_copy(pRmcUpdateInd->mcastTransmitter,
+              wdiLowLevelInd->wdiIndicationData.wdiRmcPickNewRulerInd. \
+              mcastTransmitter,
+              sizeof(tSirMacAddr));
+         /* Copy the mcast group address */
+         vos_mem_copy(pRmcUpdateInd->mcastGroup,
+              wdiLowLevelInd->wdiIndicationData.wdiRmcPickNewRulerInd.mcastGroup,
+              sizeof(tSirMacAddr));
+         vos_mem_copy(pRmcUpdateInd->mcastRuler,
+              wdiLowLevelInd->wdiIndicationData.wdiRmcPickNewRulerInd.mcastRuler,
+              sizeof(tSirMacAddr));
+         vos_mem_copy(pRmcUpdateInd->ruler,
+              wdiLowLevelInd->wdiIndicationData.wdiRmcPickNewRulerInd.ruler,
+              sizeof(pRmcUpdateInd->ruler));
+
+         WDA_SendMsg(pWDA, WDA_RMC_UPDATE_IND, (void *)pRmcUpdateInd, 0) ;
+         break;
+      }
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
      case  WDI_BATCH_SCAN_RESULT_IND:
      {
@@ -15372,7 +16836,7 @@
      case  WDI_EXTSCAN_SCAN_AVAILABLE_IND:
      case  WDI_EXTSCAN_SCAN_RESULT_IND:
      case  WDI_EXTSCAN_BSSID_HOTLIST_RESULT_IND:
-     case  WDI_EXTSCAN_SIGN_RSSI_RESULT_IND:
+     case  WDI_EXTSCAN_SSID_HOTLIST_RESULT_IND:
      {
          void *pEXTScanData;
          void *pCallbackContext;
@@ -15420,12 +16884,12 @@
               "WDI_EXTSCAN Indication is WDI_EXTSCAN_BSSID_HOTLIST_RESULT_IND");
          }
          if (wdiLowLevelInd->wdiIndicationType ==
-                 WDI_EXTSCAN_SIGN_RSSI_RESULT_IND)
+                 WDI_EXTSCAN_SSID_HOTLIST_RESULT_IND)
          {
-             indType = WDA_EXTSCAN_SIGNF_RSSI_RESULT_IND;
+             indType = WDA_EXTSCAN_SSID_HOTLIST_RESULT_IND;
 
              VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
-                 "WDI_EXTSCAN Indication is WDA_EXTSCAN_SIGNF_RSSI_RESULT_IND");
+              "WDI_EXTSCAN Indication is WDI_EXTSCAN_SSID_HOTLIST_RESULT_IND");
          }
 
          pEXTScanData =
@@ -15467,7 +16931,7 @@
       case WDI_DEL_BA_IND:
       {
          tpBADeleteParams  pDelBAInd =
-           (tpBADeleteParams)vos_mem_malloc(sizeof(tpBADeleteParams));
+           (tpBADeleteParams)vos_mem_malloc(sizeof(*pDelBAInd));
 
          VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
                                   "Received WDI_DEL_BA_IND from WDI ");
@@ -15578,6 +17042,128 @@
                                        (void *)pLostLinkParamInd , 0) ;
           break;
       }
+      case WDI_RSSI_BREACHED_IND:
+      {
+         WDI_RssiBreachedIndType *pRssiBreachedInd;
+         tpAniSirGlobal pMac;
+
+         pRssiBreachedInd =
+             (WDI_RssiBreachedIndType *)vos_mem_malloc(sizeof(WDI_RssiBreachedIndType));
+         VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                   "Received WDI_RSSI_BREACHED_IND from FW");
+
+         vos_mem_copy(pRssiBreachedInd,
+                    &wdiLowLevelInd->wdiIndicationData.wdiRssiBreachedInd,
+                    sizeof(WDI_RssiBreachedIndType));
+
+         /*sanity check*/
+         if (NULL == pWDA)
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s:pWDA is NULL", __func__);
+            vos_mem_free(pRssiBreachedInd);
+            VOS_ASSERT(0);
+            return;
+         }
+
+         if (NULL == pRssiBreachedInd)
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s:Breach indication from FW is null can't invoke HDD callback",
+              __func__);
+            VOS_ASSERT(0);
+            return;
+         }
+
+         pMac = (tpAniSirGlobal )VOS_GET_MAC_CTXT(pWDA->pVosContext);
+         if (NULL == pMac)
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s:pMac is NULL", __func__);
+            VOS_ASSERT(0);
+            vos_mem_free(pRssiBreachedInd);
+            return;
+         }
+
+         if (pMac->sme.rssiThresholdBreachedCb)
+         {
+            pMac->sme.rssiThresholdBreachedCb(pMac->pAdapter, (void *)pRssiBreachedInd);
+         }
+         else
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s:HDD callback is null", __func__);
+         }
+         vos_mem_free(pRssiBreachedInd);
+         break;
+      }
+#ifdef FEATURE_OEM_DATA_SUPPORT
+      case  WDI_START_OEM_DATA_RSP_IND_NEW:
+      {
+            void *pCallbackContext;
+            tpAniSirGlobal pMac;
+            tANI_U16 indType;
+            void *pOemRspNewIndData;
+            tANI_U32 OemRspNewLen;
+
+            VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+            "Received WDI_START_OEM_DATA_RSP_IND_NEW Indications from FW");
+
+            /*sanity check*/
+            if (NULL == pWDA)
+           {
+                VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s:pWDA is NULL", __func__);
+                VOS_ASSERT(0);
+                return;
+           }
+
+           indType = WDA_START_OEM_DATA_RSP_IND_NEW;
+           pOemRspNewIndData =
+                   (void *)wdiLowLevelInd->wdiIndicationData.wdiOemDataRspNew.
+                                                              pOemRspNewIndData;
+           if (NULL == pOemRspNewIndData)
+           {
+               VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: OEM_DATA_RSP_IND_NEW Indication Data is null, can't invoke HDD callback",
+                __func__);
+               VOS_ASSERT(0);
+               return;
+           }
+
+           OemRspNewLen = wdiLowLevelInd->wdiIndicationData.wdiOemDataRspNew.
+                                                                   OemRspNewLen;
+
+           pMac = (tpAniSirGlobal )VOS_GET_MAC_CTXT(pWDA->pVosContext);
+           if (NULL == pMac)
+           {
+               VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                         "%s:pMac is NULL", __func__);
+               VOS_ASSERT(0);
+               return;
+           }
+
+           pCallbackContext = pMac->sme.pOemDataCallbackContext;
+
+           VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 "%s: OemRspNewLen: %d", __func__, OemRspNewLen);
+
+          if(pMac->sme.pOemDataIndCb)
+          {
+             pMac->sme.pOemDataIndCb(pCallbackContext,
+                                     indType,
+                                     pOemRspNewIndData,
+                                     OemRspNewLen);
+          }
+          else
+          {
+             VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                        "%s:HDD callback is null", __func__);
+          }
+          break;
+      }
+#endif /* FEATURE_OEM_DATA_SUPPORT */
+
       default:
       {
          /* TODO error */
@@ -15799,6 +17385,24 @@
    }
 }
 
+bool WDA_AllowAddBA(tpAniSirGlobal pMac, tANI_U8 staId, tANI_U8 tid)
+{
+   if (!pMac->lim.staBaInfo[staId].failed_count[tid])
+      return true;
+   if ((WDA_BA_MAX_RETRY_THRESHOLD <=
+        pMac->lim.staBaInfo[staId].failed_count[tid]) ||
+       ((pMac->lim.staBaInfo[staId].failed_timestamp[tid] +
+        (pMac->lim.staBaInfo[staId].failed_count[tid] * WDA_BA_RETRY_TIME)) >=
+        jiffies_to_msecs(jiffies)))
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+          "%s: AP/STA has declined ADDBA req for tid %d, declined %d times",
+          __func__, tid, pMac->lim.staBaInfo[staId].failed_count[tid]);
+      return false;
+   }
+   return true;
+}
+
 /*
  * BA Activity check timer handler
  */
@@ -15887,6 +17491,7 @@
             }
             else if(!WDA_GET_BA_TXFLAG(pWDA, curSta, tid)
                    && (WLANTL_STA_AUTHENTICATED == tlSTAState)
+                   && WDA_AllowAddBA(pMac, curSta, tid)
                    && (((eSYSTEM_STA_IN_IBSS_ROLE ==
                             pWDA->wdaGlobalSystemRole) && txPktCount )
                    || (txPktCount >= WDA_LAST_POLLED_THRESHOLD(pWDA,
@@ -15951,7 +17556,7 @@
       pWdaParams->pWdaContext = pWDA;
       pWdaParams->wdaWdiApiMsgParam = wdiTriggerBaReq ;
       pWdaParams->wdaMsgParam = NULL; 
-      status = WDI_TriggerBAReq(wdiTriggerBaReq, 
+      status = WDI_TriggerBAReq(wdiTriggerBaReq, size,
                                    WDA_TriggerBaReqCallback, pWdaParams) ;
       if(IS_WDI_STATUS_FAILURE(status))
       {
@@ -16498,6 +18103,69 @@
    }
 }
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+VOS_STATUS WDA_ProcessPERRoamScanOffloadReq(tWDA_CbContext *pWDA,
+                    tSirPERRoamOffloadScanReq *pPERRoamOffloadScanReqParams)
+{
+   WDI_Status status;
+   tWDA_ReqParams *pWdaParams ;
+   WDI_PERRoamOffloadScanInfo *pwdiPERRoamOffloadScanInfo;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+              "------> %s " ,__func__);
+
+   pwdiPERRoamOffloadScanInfo = (WDI_PERRoamOffloadScanInfo *)
+                             vos_mem_malloc(sizeof(WDI_PERRoamOffloadScanInfo));
+   if (NULL == pwdiPERRoamOffloadScanInfo) {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams)) ;
+   if (NULL == pWdaParams) {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pwdiPERRoamOffloadScanInfo);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pwdiPERRoamOffloadScanInfo->rateUpThreshold =
+          pPERRoamOffloadScanReqParams->rateUpThreshold;
+   pwdiPERRoamOffloadScanInfo->rateDownThreshold =
+          pPERRoamOffloadScanReqParams->rateDownThreshold;
+   pwdiPERRoamOffloadScanInfo->waitPeriodForNextPERScan =
+          pPERRoamOffloadScanReqParams->waitPeriodForNextPERScan;
+   pwdiPERRoamOffloadScanInfo->PERtimerThreshold =
+          pPERRoamOffloadScanReqParams->PERtimerThreshold;
+   pwdiPERRoamOffloadScanInfo->isPERRoamCCAEnabled =
+          pPERRoamOffloadScanReqParams->isPERRoamCCAEnabled;
+   pwdiPERRoamOffloadScanInfo->PERroamTriggerPercent =
+          pPERRoamOffloadScanReqParams->PERroamTriggerPercent;
+
+   /* Store Params pass it to WDI */
+   pWdaParams->wdaWdiApiMsgParam = (void *)pwdiPERRoamOffloadScanInfo;
+   pWdaParams->pWdaContext = pWDA;
+
+   /* Store param pointer as passed in by caller */
+   pWdaParams->wdaMsgParam = pPERRoamOffloadScanReqParams;
+   status = WDI_PERRoamScanOffloadReq(pwdiPERRoamOffloadScanInfo,
+                    (WDI_PERRoamOffloadScanCb)WDA_PERRoamOffloadScanReqCallback,
+                    pWdaParams);
+
+   if(IS_WDI_STATUS_FAILURE(status)) {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "Failure in Send config PER roam params");
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
+      vos_mem_free(pWdaParams->wdaMsgParam);
+      vos_mem_free(pWdaParams);
+   }
+   return CONVERT_WDI2VOS_STATUS(status) ;
+}
+#endif
+
 /*
  * FUNCTION: WDA_ProcessRoamScanOffloadReq
  * Request to WDI to set Roam Offload Scan
@@ -16893,6 +18561,75 @@
 
    return ;
 }
+
+void WDA_PERRoamTriggerScanReqCallback(WDI_Status status, void* pUserData)
+{
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   vos_msg_t vosMsg;
+   wpt_uint8 reason = 0;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "<------ %s " ,__func__);
+   if (NULL == pWdaParams) {
+     VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+             "%s: pWdaParams received NULL", __func__);
+     VOS_ASSERT(0) ;
+     return ;
+   }
+   if ( pWdaParams->wdaMsgParam != NULL)
+      vos_mem_free(pWdaParams->wdaMsgParam);
+
+   vos_mem_free(pWdaParams) ;
+   vosMsg.type = eWNI_SME_ROAM_SCAN_TRIGGER_RSP;
+   vosMsg.bodyptr = NULL;
+   if (WDI_STATUS_SUCCESS != status)
+      reason = 0;
+
+   vosMsg.bodyval = reason;
+   if (VOS_STATUS_SUCCESS !=
+       vos_mq_post_message(VOS_MQ_ID_SME, (vos_msg_t*)&vosMsg)) {
+      /* free the mem and return */
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 "%s: Failed to post the rsp to UMAC", __func__);
+   }
+
+   return ;
+}
+
+
+void WDA_PERRoamOffloadScanReqCallback(WDI_Status status, void* pUserData)
+{
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   vos_msg_t vosMsg;
+   wpt_uint8 reason = 0;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "<------ %s " ,__func__);
+   if (NULL == pWdaParams) {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return ;
+   }
+   if ( pWdaParams->wdaMsgParam != NULL)
+      vos_mem_free(pWdaParams->wdaMsgParam);
+
+   vos_mem_free(pWdaParams) ;
+   vosMsg.type = eWNI_SME_ROAM_SCAN_OFFLOAD_RSP;
+   vosMsg.bodyptr = NULL;
+   if (WDI_STATUS_SUCCESS != status)
+      reason = 0;
+
+   vosMsg.bodyval = reason;
+   if (VOS_STATUS_SUCCESS !=
+       vos_mq_post_message(VOS_MQ_ID_SME, (vos_msg_t*)&vosMsg)) {
+      /* free the mem and return */
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 "%s: Failed to post the rsp to UMAC", __func__);
+   }
+
+   return ;
+}
 #endif
 
 /*
@@ -17708,9 +19445,16 @@
    return wdaStatus;
 }
 
-void WDA_FWLoggingDXEdoneInd(void)
+void WDA_FWLoggingDXEdoneInd(v_U32_t logType)
 {
-   WDI_FWLoggingDXEdoneInd(NULL);
+   WDI_Status status;
+   status = WDI_FWLoggingDXEdoneInd(logType);
+
+   if (!(WDI_STATUS_SUCCESS_SYNC == status || WDI_STATUS_PENDING == status))
+   {
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 FL("Failure status %d"), status);
+   }
 }
 
  /*  FUNCTION    WDA_featureCapsExchange
@@ -18023,6 +19767,17 @@
    WDI_SetEnableSSR(enableSSR);
 }
 
+/**
+ * WDA_SetMgmtPktViaWQ5() - Set INI params sendMgmtPktViaWQ5 to WDI.
+ * @sendMgmtPktViaWQ5: INI params to enable/disable sending mgmt pkt via WQ5.
+ *
+ * Return: void
+ */
+void WDA_SetMgmtPktViaWQ5(v_BOOL_t sendMgmtPktViaWQ5)
+{
+   WDI_SetMgmtPktViaWQ5(sendMgmtPktViaWQ5);
+}
+
 #ifdef FEATURE_WLAN_LPHB
 /*
  * FUNCTION: WDA_LPHBconfRspCallback
@@ -18631,16 +20386,16 @@
 }
 
 /*==========================================================================
-  FUNCTION   WDA_EXTScanSetSignfRSSIChangeRspCallback
+  FUNCTION   WDA_EXTScanSetSSIDHotlistRspCallback
 
   DESCRIPTION
-    API to send EXTScan Set Significant RSSI Change RSP to HDD
+    API to send EXTScan Set SSID Hotlist Response to HDD
 
   PARAMETERS
     pEventData: Response from FW
    pUserData:
 ===========================================================================*/
-void WDA_EXTScanSetSignfRSSIChangeRspCallback(void *pEventData, void* pUserData)
+void WDA_EXTScanSetSSIDHotlistRspCallback(void *pEventData, void* pUserData)
 {
     tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
     tWDA_CbContext *pWDA = NULL;
@@ -18648,7 +20403,7 @@
     tpAniSirGlobal pMac;
 
     VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
-            "%s:", __func__);
+            "%s: ", __func__);
     if (NULL == pWdaParams)
     {
         VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
@@ -18681,7 +20436,7 @@
     if (pMac->sme.pEXTScanIndCb)
     {
         pMac->sme.pEXTScanIndCb(pCallbackContext,
-                WDA_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP,
+                WDA_EXTSCAN_SET_SSID_HOTLIST_RSP,
                 pEventData);
     }
     else
@@ -18708,17 +20463,16 @@
 }
 
 /*==========================================================================
-  FUNCTION   WDA_EXTScanResetSignfRSSIChangeRspCallback
+  FUNCTION   WDA_EXTScanResetSSIDHotlistRspCallback
 
   DESCRIPTION
-    API to send EXTScan Set Significant RSSI Change RSP to HDD
+    API to send EXTScan ReSet SSID Hotlist Response to HDD
 
   PARAMETERS
     pEventData: Response from FW
    pUserData:
 ===========================================================================*/
-void WDA_EXTScanResetSignfRSSIChangeRspCallback(void *pEventData,
-        void* pUserData)
+void WDA_EXTScanResetSSIDHotlistRspCallback(void *pEventData, void* pUserData)
 {
     tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
     tWDA_CbContext *pWDA = NULL;
@@ -18759,7 +20513,7 @@
     if (pMac->sme.pEXTScanIndCb)
     {
         pMac->sme.pEXTScanIndCb(pCallbackContext,
-                WDA_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP,
+                WDA_EXTSCAN_RESET_SSID_HOTLIST_RSP,
                 pEventData);
     }
     else
@@ -19044,17 +20798,17 @@
 }
 
 /*==========================================================================
-  FUNCTION   WDA_ProcessEXTScanSetSignfRSSIChangeReq
+  FUNCTION   WDA_ProcessEXTScanSetSSIDHotlistReq
 
   DESCRIPTION
-    API to send Set Significant RSSI Change Request to WDI
+    API to send Set SSID Hotlist Request to WDI
 
   PARAMETERS
     pWDA: Pointer to WDA context
     wdaRequest: Pointer to EXTScan req parameters
 ===========================================================================*/
-VOS_STATUS WDA_ProcessEXTScanSetSignfRSSIChangeReq(tWDA_CbContext *pWDA,
-        tSirEXTScanSetSignificantChangeReqParams *wdaRequest)
+VOS_STATUS WDA_ProcessEXTScanSetSSIDHotlistReq(tWDA_CbContext *pWDA,
+        tSirEXTScanSetSsidHotListReqParams *wdaRequest)
 {
     WDI_Status status = WDI_STATUS_SUCCESS;
     tWDA_ReqParams *pWdaParams;
@@ -19073,8 +20827,8 @@
     pWdaParams->wdaMsgParam = wdaRequest;
     pWdaParams->wdaWdiApiMsgParam = NULL;
 
-    status = WDI_EXTScanSetSignfRSSIChangeReq((void *)wdaRequest,
-    (WDI_EXTScanSetSignfRSSIChangeRspCb)WDA_EXTScanSetSignfRSSIChangeRspCallback,
+    status = WDI_EXTScanSetSSIDHotlistReq((void *)wdaRequest,
+         (WDI_EXTScanSetSSIDHotlistRspCb)WDA_EXTScanSetSSIDHotlistRspCallback,
             (void *)pWdaParams);
     if (IS_WDI_STATUS_FAILURE(status))
     {
@@ -19087,17 +20841,17 @@
 }
 
 /*==========================================================================
-  FUNCTION   WDA_ProcessEXTScanResetSignfRSSIChangeReq
+  FUNCTION   WDA_ProcessEXTScanReSetSSIDHotlistReq
 
   DESCRIPTION
-    API to send Reset Significant RSSI Change Request to WDI
+    API to send Reset SSID Hotlist Request to WDI
 
   PARAMETERS
     pWDA: Pointer to WDA context
     wdaRequest: Pointer to EXTScan req parameters
 ===========================================================================*/
-VOS_STATUS WDA_ProcessEXTScanResetSignfRSSIChangeReq(tWDA_CbContext *pWDA,
-        tSirEXTScanResetSignificantChangeReqParams *wdaRequest)
+VOS_STATUS WDA_ProcessEXTScanResetSSIDHotlistReq(tWDA_CbContext *pWDA,
+        tSirEXTScanResetSsidHotlistReqParams *wdaRequest)
 {
     WDI_Status status = WDI_STATUS_SUCCESS;
     tWDA_ReqParams *pWdaParams;
@@ -19116,9 +20870,8 @@
     pWdaParams->wdaMsgParam = wdaRequest;
     pWdaParams->wdaWdiApiMsgParam = NULL;
 
-    status = WDI_EXTScanResetSignfRSSIChangeReq((void *)wdaRequest,
-            (WDI_EXTScanResetSignfRSSIChangeRspCb)
-            WDA_EXTScanResetSignfRSSIChangeRspCallback,
+    status = WDI_EXTScanResetSSIDHotlistReq((void *)wdaRequest,
+     (WDI_EXTScanResetSSIDHotlistRspCb)WDA_EXTScanResetSSIDHotlistRspCallback,
             (void *)pWdaParams);
     if (IS_WDI_STATUS_FAILURE(status))
     {
@@ -19129,6 +20882,39 @@
     }
     return CONVERT_WDI2VOS_STATUS(status);
 }
+
+/*==========================================================================
+  FUNCTION   WDA_ProcessHighPriorityDataInfoInd
+
+  DESCRIPTION
+    API to send Reset SSID Hotlist Request to WDI
+
+  PARAMETERS
+    pWDA: Pointer to WDA context
+    wdaRequest: Pointer to EXTScan req parameters
+===========================================================================*/
+VOS_STATUS WDA_ProcessHighPriorityDataInfoInd(tWDA_CbContext *pWDA,
+        tSirHighPriorityDataInfoInd *wdaRequest)
+{
+    WDI_Status status = WDI_STATUS_SUCCESS;
+
+    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+            "%s:", __func__);
+
+    status = WDI_HighPriorityDataInfoInd((void *)wdaRequest);
+    if (WDI_STATUS_PENDING == status)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 FL("pending status received "));
+    }
+    else if (WDI_STATUS_SUCCESS_SYNC != status)
+    {
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               FL("Failure status %d"), status);
+    }
+    return CONVERT_WDI2VOS_STATUS(status);
+}
+
 #endif /* WLAN_FEATURE_EXTSCAN */
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -19725,3 +21511,305 @@
     }
     return CONVERT_WDI2VOS_STATUS(status) ;
 }
+
+/*==========================================================================
+  FUNCTION WDA_WifiConfigSetRspCallback
+
+  DESCRIPTION
+    API to process set WifiConfig response from FW
+
+  PARAMETERS
+    pRsp: Pointer to set WifiConfig response
+    pUserData: Pointer to user data
+
+  RETURN VALUE
+    NONE
+
+===========================================================================*/
+void WDA_WifiConfigSetRspCallback(void *pEventData, void* pUserData)
+{
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "<------ %s " ,__func__);
+
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0);
+      return ;
+   }
+
+   if(NULL == pWdaParams->wdaMsgParam)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams->wdaMsgParam is NULL", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pWdaParams);
+      return ;
+   }
+
+   vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+   vos_mem_free(pWdaParams->wdaMsgParam);
+   vos_mem_free(pWdaParams);
+
+   return;
+}
+
+/*==========================================================================
+  FUNCTION   WDA_ProcessWifiConfigReq
+
+  DESCRIPTION
+    API to send Set WifiConfig params request to WDI
+
+  PARAMETERS
+    pWDA: Pointer to WDA context
+    wdaRequest: Pointer to set WifiConfig req parameters
+===========================================================================*/
+
+VOS_STATUS  WDA_ProcessWifiConfigReq(tWDA_CbContext *pWDA,
+                                     tSetWifiConfigParams *pwdaWificonfig)
+{
+    WDI_Status status = WDI_STATUS_SUCCESS;
+    WDI_WifiConfigSetReqType    *pwdiWifConfigSetReqParams;
+    tWDA_ReqParams *pWdaParams ;
+    WDI_Status wstatus;
+
+    /* Sanity Check*/
+   if(NULL == pwdaWificonfig)
+  {
+     VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                          "%s: tSetWifiConfigParams received NULL", __func__);
+     VOS_ASSERT(0) ;
+     return VOS_STATUS_E_FAULT;
+   }
+
+   pwdiWifConfigSetReqParams = (WDI_WifiConfigSetReqType *)vos_mem_malloc(
+                                      sizeof(WDI_WifiConfigSetReqType));
+  if(NULL == pwdiWifConfigSetReqParams)
+  {
+     VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                          "%s: VOS MEM Alloc Failure", __func__);
+     VOS_ASSERT(0);
+     vos_mem_free(pwdaWificonfig);
+     return VOS_STATUS_E_NOMEM;
+  }
+
+  pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams)) ;
+  if(NULL == pWdaParams)
+  {
+     VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                          "%s: VOS MEM Alloc Failure", __func__);
+     VOS_ASSERT(0);
+     vos_mem_free(pwdiWifConfigSetReqParams);
+     vos_mem_free(pwdaWificonfig);
+     return VOS_STATUS_E_NOMEM;
+  }
+  pwdiWifConfigSetReqParams->paramType = pwdaWificonfig->paramType;
+  pwdiWifConfigSetReqParams->paramValue = pwdaWificonfig->paramValue;
+  vos_mem_copy(pwdiWifConfigSetReqParams->bssId,
+               &(pwdaWificonfig->bssId), sizeof(tSirMacAddr));
+
+  pWdaParams->pWdaContext = pWDA;
+  pWdaParams->wdaMsgParam = pwdaWificonfig;
+  pWdaParams->wdaWdiApiMsgParam = (void *)pwdiWifConfigSetReqParams;
+
+  wstatus = WDI_WifiConfigSetReq(pwdiWifConfigSetReqParams,
+                      (WDI_WifiConfigSetRspCb)WDA_WifiConfigSetRspCallback,
+                       pWdaParams);
+  if(IS_WDI_STATUS_FAILURE(wstatus))
+  {
+     VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+             "Failure in sendind WifiConfigReq, free all the memory" );
+     status = CONVERT_WDI2VOS_STATUS(wstatus);
+     vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
+     vos_mem_free(pWdaParams->wdaMsgParam);
+     vos_mem_free(pWdaParams);
+  }
+
+  return status;
+
+}
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+/*
+ * FUNCTION: WDA_ProcessStartOemDataReqIndNew
+ * Request to WDI.
+ */
+VOS_STATUS WDA_ProcessStartOemDataReqIndNew(tWDA_CbContext *pWDA,
+                                  tOemDataReqNewConfig *pOemDataReqNewConfig)
+{
+   VOS_STATUS status = VOS_STATUS_SUCCESS;
+   WDI_Status wstatus;
+   WDI_OemDataReqNewConfig *wdiOemDataReqNewConfig;
+
+   /* Sanity Check*/
+   if(NULL == pOemDataReqNewConfig)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: pOemDataReqNewConfig received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return VOS_STATUS_E_FAULT;
+   }
+
+   wdiOemDataReqNewConfig = (WDI_OemDataReqNewConfig *)vos_mem_malloc(
+                                              sizeof(WDI_OemDataReqNewConfig));
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "------> %s " ,__func__);
+
+   if(NULL == wdiOemDataReqNewConfig)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pOemDataReqNewConfig);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   vos_mem_copy(wdiOemDataReqNewConfig, pOemDataReqNewConfig,
+                                              sizeof(WDI_OemDataReqNewConfig));
+
+   wstatus = WDI_StartOemDataReqIndNew(wdiOemDataReqNewConfig);
+
+   if (WDI_STATUS_PENDING == wstatus)
+   {
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                  FL("pending status received "));
+   }
+   else if ((WDI_STATUS_SUCCESS_SYNC != wstatus) && (WDI_STATUS_SUCCESS != wstatus))
+   {
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+       FL("Failure in OemDataReqIndNew WDI API, free all memory %d"), wstatus);
+   }
+
+   vos_mem_free(wdiOemDataReqNewConfig);
+   vos_mem_free(pOemDataReqNewConfig);
+
+   return status;
+}
+
+void WDA_GetCurrentAntennaIndexCallback(WDI_Status status, void *params,
+                                        void *pUserData)
+{
+   tSirAntennaDiversitySelectionInfo *pAntennaDivSelInfo =
+                           (tSirAntennaDiversitySelectionInfo *)pUserData;
+
+   tSirAntennaDivSelRsp *resParams = (tSirAntennaDivSelRsp *)params;
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                 "<------ %s " ,__func__);
+   if (NULL == pAntennaDivSelInfo)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return ;
+   }
+   if (NULL == resParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: resParams received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return ;
+   }
+
+   if (pAntennaDivSelInfo->callback)
+   {
+       if (WDI_STATUS_SUCCESS == status)
+       {
+           pAntennaDivSelInfo->callback(resParams->selectedAntennaId,
+                                        pAntennaDivSelInfo->data);
+       }
+       else
+       {
+           pAntennaDivSelInfo->callback(-1,
+                                        pAntennaDivSelInfo->data);
+       }
+   }
+
+   vos_mem_free(pUserData);
+   return;
+}
+
+/*
+ * FUNCTION: WDA_ProcessAntennaDiversitySelectionReq
+ * Request to WDI.
+ */
+v_VOID_t WDA_ProcessAntennaDiversitySelectionReq(tWDA_CbContext *pWDA,
+                                  tSirAntennaDiversitySelectionReq *pData)
+{
+   WDI_Status wdiStatus;
+   tSirAntennaDiversitySelectionInfo *pAntennaDivSelInfo;
+
+   VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+             "------> %s " , __func__);
+
+   pAntennaDivSelInfo = (tSirAntennaDiversitySelectionInfo *)
+             vos_mem_malloc(sizeof(tSirAntennaDiversitySelectionInfo));
+   if (NULL == pAntennaDivSelInfo)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pData);
+      return;
+   }
+
+   pAntennaDivSelInfo->callback = (tAntennaDivSelCB)(pData->callback);
+   pAntennaDivSelInfo->data = pData->data;
+
+   wdiStatus = WDI_GetCurrentAntennaIndex(pAntennaDivSelInfo,
+               WDA_GetCurrentAntennaIndexCallback, pData->reserved);
+
+   if (WDI_STATUS_PENDING == wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+              "Pending received for %s:%d ", __func__, __LINE__);
+   }
+   else if (WDI_STATUS_SUCCESS != wdiStatus)
+   {
+       if (pAntennaDivSelInfo->callback)
+       {
+           pAntennaDivSelInfo->callback(-1, pAntennaDivSelInfo->data);
+       }
+   }
+
+   vos_mem_free(pData);
+   return;
+}
+
+/*
+ * FUNCTION: WDA_ProcessBcnMissPenaltyCount
+ * Request to WDI.
+ */
+VOS_STATUS WDA_ProcessBcnMissPenaltyCount(tWDA_CbContext *pWDA,
+                                          tModifyRoamParamsReqParams *params)
+{
+    WDI_Status status;
+
+    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 FL("---> %s"), __func__);
+
+    if (NULL == params)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 FL("tModifyRoamParamsReqParams is received NULL"));
+        return VOS_STATUS_E_NOMEM;
+    }
+
+    status = WDI_SetBcnMissPenaltyCount((WDI_ModifyRoamParamsReqType *)params);
+    if (WDI_STATUS_PENDING == status)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 FL("pending status received "));
+    }
+    else if (WDI_STATUS_SUCCESS_SYNC != status)
+    {
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               FL("Failure status %d"), status);
+    }
+    vos_mem_free(params);
+    return CONVERT_WDI2VOS_STATUS(status) ;
+}
+
+#endif
diff --git a/wlan/prima/CORE/WDA/src/wlan_qct_wda_ds.c b/wlan/prima/CORE/WDA/src/wlan_qct_wda_ds.c
index 5f3dfba..2e303fb 100644
--- a/wlan/prima/CORE/WDA/src/wlan_qct_wda_ds.c
+++ b/wlan/prima/CORE/WDA/src/wlan_qct_wda_ds.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -139,16 +139,17 @@
 }
 #endif /*WLAN_PERF*/
 
-void WDA_DS_RxLogCallback(void)
+void WDA_DS_RxLogCallback(v_U8_t logType)
 {
   vos_msg_t vosMessage;
 
-  vosMessage.bodyptr = NULL;
+  vosMessage.bodyval = (v_U32_t)logType;
   vosMessage.reserved = 0;
   vosMessage.type = WDA_SEND_LOG_DONE_IND;
-  if (VOS_STATUS_SUCCESS != vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage ))
+  if (VOS_STATUS_SUCCESS != vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage )) {
      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
                "WLAN WDA:Posting DXE logging done indication failed" );
+  }
   return;
 }
 
@@ -443,6 +444,10 @@
   WDI_DS_TxMetaInfoType* pTxMetaInfo = NULL;
   v_SIZE_t               usMacAddrSize;
   wpt_FrameCtrl          *pFrameControl;
+#ifdef WLAN_FEATURE_RMC
+  WLANTL_CbType*         pTLCb;
+  WLANTL_RMC_SESSION*    pRMCSession;
+#endif
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
 
   /*------------------------------------------------------------------------
@@ -456,6 +461,20 @@
     return VOS_STATUS_E_FAULT;
   }
 
+#ifdef WLAN_FEATURE_RMC
+/*----------------------------------------------------------------
+    Extract TL control block
+   --------------------------------------------------------------*/
+  pTLCb = VOS_GET_TL_CB(pvosGCtx);
+  if ( NULL == pTLCb )
+  {
+    TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+      "WLAN TL %s: pTLCb is NULL", __func__));
+
+    return VOS_STATUS_E_FAILURE;
+  }
+#endif
+
   /*------------------------------------------------------------------------
     Extract TX Meta Info pointer from PAL packet
    ------------------------------------------------------------------------*/
@@ -530,6 +549,42 @@
   // ADDR2
   vos_copy_macaddr( (v_MACADDR_t*)pTxMetaInfo->addr2MACAddress, pAddr2 );
 
+#ifdef WLAN_FEATURE_RMC
+  if (pTLCb->rmcDataPathEnabled)
+  {
+    /*look up for mcast transmitter MAC address in TL's active rmc list*/
+    if (((WDA_TLI_DATA_FRAME_TYPE >> 4) == pTxMetaInfo->frmType) &&
+        (vos_is_macaddr_group(pvDestMacAddr)))
+    {
+        pRMCSession =
+           WLANTL_RmcLookUpRmcSession(pTLCb->rmcSession,
+           (v_MACADDR_t*)pTxMetaInfo->addr2MACAddress);
+
+        if (pRMCSession)
+        {
+            if (0xFF == pvDestMacAddr->bytes[0])
+            {
+               pTxMetaInfo->txFlags |= (HAL_USE_BD_RATE_1_MASK);
+            }
+            else
+            {
+                pTxMetaInfo->txFlags |= (HAL_RMC_REQUESTED_MASK);
+
+                VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                    "RMC active for " MAC_ADDRESS_STR " RMC session",
+                    MAC_ADDR_ARRAY(pRMCSession->rmcAddr.bytes));
+            }
+        }
+        else
+        {
+            VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+               "RMC disabled for " MAC_ADDRESS_STR " RMC session",
+               MAC_ADDR_ARRAY(pTxMetaInfo->addr2MACAddress));
+        }
+    }
+  }
+#endif /*WLAN_FEATURE_RMC*/
+
   /* Dump TX meta infro for debugging */
   VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_LOW,
              "WLAN TL: Dump TX meta info: "
diff --git a/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi.h b/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi.h
index 0b614bd..b44e3f7 100644
--- a/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi.h
+++ b/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -395,12 +395,20 @@
 
   /* Periodic Tx Pattern FW Indication */
   WDI_PERIODIC_TX_PTRN_FW_IND,
+#ifdef WLAN_FEATURE_RMC
+  /* RMC_Ruler_Pick_New Indication */
+  WDI_RMC_RULER_PICK_NEW,
+#endif
 
 #ifdef FEATURE_WLAN_BATCH_SCAN
   /*Batch scan result indication from FW*/
   WDI_BATCH_SCAN_RESULT_IND,
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+  WDI_TX_FAIL_IND,
+#endif
+
 #ifdef FEATURE_WLAN_CH_AVOID
   WDI_CH_AVOID_IND,
 #endif /* FEATURE_WLAN_CH_AVOID */
@@ -413,12 +421,16 @@
   WDI_EXTSCAN_SCAN_RESULT_IND,
   WDI_EXTSCAN_GET_CAPABILITIES_IND,
   WDI_EXTSCAN_BSSID_HOTLIST_RESULT_IND,
-  WDI_EXTSCAN_SIGN_RSSI_RESULT_IND,
+  WDI_EXTSCAN_SSID_HOTLIST_RESULT_IND,
 #endif
   /*Delete BA Ind*/
   WDI_DEL_BA_IND,
   WDI_NAN_EVENT_IND,
   WDI_LOST_LINK_PARAMS_IND,
+  WDI_RSSI_BREACHED_IND,
+#ifdef FEATURE_OEM_DATA_SUPPORT
+  WDI_START_OEM_DATA_RSP_IND_NEW,
+#endif
   WDI_MAX_IND
 }WDI_LowLevelIndEnumType;
 
@@ -533,6 +545,22 @@
   wpt_uint8       macAddr[WDI_MAC_ADDR_LEN];
 }WDI_DHCPInd;
 
+#ifdef WLAN_FEATURE_RMC
+typedef struct
+{
+   /*Request status callback offered by UMAC - it is called if the current
+    req has returned PENDING as status; it delivers the status of sending
+    the message over the BUS */
+  WDI_ReqStatusCb   wdiReqStatusCB;
+
+  /*The user data passed in by UMAC, it will be sent back when the above
+    function pointer will be called */
+  void*             pUserData;
+
+  wpt_uint8         tx_fail_count;
+}WDI_TXFailMonitorInd;
+#endif /* WLAN_FEATURE_RMC */
+
 /*---------------------------------------------------------------------------
 
   WDI_MacSSid
@@ -735,6 +763,13 @@
 
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+typedef struct
+{
+  wpt_uint8 seqNo;
+  wpt_uint8 macAddr[WDI_MAC_ADDR_LEN];
+} WDI_TXFailIndType;
+#endif /* WLAN_FEATURE_RMC */
 
 typedef struct
 {
@@ -749,6 +784,13 @@
 
 }WDI_LostLinkParamsIndType;
 
+typedef struct
+{
+  wpt_uint32     request_id;
+  wpt_uint8      bssId[WDI_MAC_ADDR_LEN];
+  wpt_int8       rssi;
+}WDI_RssiBreachedIndType;
+
 /*---------------------------------------------------------------------------
  WDI_IbssPeerInactivityIndType
 -----------------------------------------------------------------------------*/
@@ -759,6 +801,112 @@
    wpt_macAddr staMacAddr;
 }WDI_IbssPeerInactivityIndType;
 
+#ifdef WLAN_FEATURE_RMC
+/*---------------------------------------------------------------------------
+ WDI_RmcRulerReqParams
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8       cmd;
+
+    /* MAC address of MCAST Transmitter (source) */
+    wpt_macAddr mcastTransmitter;
+
+    /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+    wpt_macAddr mcastGroup;
+
+    /* List of candidates for cmd = WLAN_HAL_SUGGEST_RULER*/
+    wpt_macAddr blacklist[8]; /* HAL_NUM_MAX_RULERS */
+
+    /*
+     * Request status callback offered by UMAC - it is called if the current
+     * req has returned PENDING as status; it delivers the status of sending
+     * the message over the BUS
+     */
+    WDI_ReqStatusCb    wdiReqStatusCB;
+
+} WDI_RmcRulerReqParams;
+
+/*---------------------------------------------------------------------------
+ WDI_RmcUpdateIndParams
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8       indication;  /* tRmcUpdateIndType */
+
+    wpt_uint8       role;
+
+    /* MAC address of MCAST Transmitter (source) */
+    wpt_macAddr mcastTransmitter;
+
+    /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+    wpt_macAddr mcastGroup;
+
+    wpt_macAddr mcastRuler;
+
+    wpt_macAddr ruler[16];
+
+    /*
+     * Request status callback offered by UMAC - it is called if the current
+     * req has returned PENDING as status; it delivers the status of sending
+     * the message over the BUS
+     */
+    WDI_ReqStatusCb   wdiReqStatusCB;
+
+    /*
+     * The user data passed in by UMAC, it will be sent back when the above
+     * function pointer will be called
+     */
+    void   *pUserData;
+
+} WDI_RmcUpdateIndParams;
+
+typedef enum
+{
+  eWDI_SUGGEST_RULER_CMD = 0,
+  eWDI_BECOME_RULER_CMD  = 1,
+} eWDI_RulerRspCmdType;
+
+/*---------------------------------------------------------------------------
+ WDI_RmcRspParamsType
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8       status;  /* success or failure */
+
+    /*  Command Type */
+    eWDI_RulerRspCmdType cmd;
+
+    /* MAC address of MCAST Transmitter (source) */
+    wpt_macAddr mcastTransmitter;
+
+    /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+    wpt_macAddr mcastGroup;
+
+    wpt_macAddr ruler[8];
+} WDI_RmcRspParamsType;
+
+/*---------------------------------------------------------------------------
+ WDI_RmcPickNewRuler
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8       indication;  /* pick_new */
+
+    wpt_uint8       role;
+
+    /* MAC address of MCAST Transmitter (source) */
+    wpt_macAddr mcastTransmitter;
+
+    /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+    wpt_macAddr mcastGroup;
+
+    wpt_macAddr mcastRuler;
+
+    wpt_macAddr ruler[16];
+} WDI_RmcPickNewRuler;
+#endif
+
 /*---------------------------------------------------------------------------
  WDI_TxRateFlags
 -----------------------------------------------------------------------------*/
@@ -795,10 +943,10 @@
      * 0 implies MCAST RA, positive value implies fixed rate,
      * -1 implies ignore this param
      */
-    wpt_int32 reliableMcastDataRate; //unit Mbpsx10
+    wpt_int32 rmcDataRate; //unit Mbpsx10
 
     /* TX flag to differentiate between HT20, HT40 etc */
-    WDI_TxRateFlags reliableMcastDataRateTxFlag;
+    WDI_TxRateFlags rmcDataRateTxFlag;
 
     /*
      * MCAST(or BCAST) fixed data rate in 2.4 GHz, unit Mbpsx10,
@@ -897,6 +1045,19 @@
     wpt_uint32 tx_complete_status;
     wpt_uint32 tx_bd_token;
 }  WDI_TxBDStatus;
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+/*----------------------------------------------------------------------------
+  OEM DATA RESPONSE - DATA STRUCTURES
+----------------------------------------------------------------------------*/
+typedef struct
+{
+    void *pOemRspNewIndData;
+    /* Max OemRspNewLen possible is NEW_OEM_DATA_RSP_SIZE*/
+    wpt_uint32 OemRspNewLen;
+} WDI_OemDataRspNew;
+#endif
+
 /*---------------------------------------------------------------------------
   WDI_LowLevelIndType
     Inidcation type and information about the indication being carried
@@ -957,11 +1118,19 @@
     /* Periodic TX Pattern FW Indication */
     WDI_PeriodicTxPtrnFwIndType  wdiPeriodicTxPtrnFwInd;
 
+#ifdef WLAN_FEATURE_RMC
+    WDI_RmcPickNewRuler        wdiRmcPickNewRulerInd;
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
     /*batch scan result indication from FW*/
     void *pBatchScanResult;
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+    WDI_TXFailIndType            wdiTXFailInd;
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_CH_AVOID
     WDI_ChAvoidIndType          wdiChAvoidInd;
 #endif /* FEATURE_WLAN_CH_AVOID */
@@ -980,6 +1149,11 @@
 
     WDI_TxBDStatus              wdiTxBdInd;
     WDI_LostLinkParamsIndType   wdiLostLinkParamsInd;
+    WDI_RssiBreachedIndType     wdiRssiBreachedInd;
+#ifdef FEATURE_OEM_DATA_SUPPORT
+/*OEM Data Rsp New Results from FW*/
+    WDI_OemDataRspNew           wdiOemDataRspNew;
+#endif
   }  wdiIndicationData;
 }WDI_LowLevelIndType;
 
@@ -2703,13 +2877,24 @@
   wpt_uint8 logMailBoxVer;
   //Qshrink is enabled
   wpt_boolean logCompressEnabled;
+  /* store the size of fw mem dump */
+  wpt_uint32 fw_mem_dump_max_size;
   //Reserved for future purpose
-  wpt_uint32 reserved0;
   wpt_uint32 reserved1;
   wpt_uint32 reserved2;
 }WDI_FWLoggingInitRspParamType;
 
+typedef struct
+{
+  /* wdi status */
+  wpt_uint32   status;
+}WDI_RssiMonitorStartRspParamType;
 
+typedef struct
+{
+  /* wdi status */
+  wpt_uint32   status;
+}WDI_RssiMonitorStopRspParamType;
 /*---------------------------------------------------------------------------
   WDI_FatalEventLogsRspParamType
 ---------------------------------------------------------------------------*/
@@ -4104,6 +4289,14 @@
 
 typedef struct
 {
+   wpt_uint32    requestId;
+   wpt_uint8     minRssi;
+   wpt_uint8     maxRssi;
+   wpt_macAddr   currentBssId;
+}WDI_RssiMonitorReqInfoType;
+
+typedef struct
+{
     wpt_uint32 reason_code;
 }WDI_FatalEventLogsReqInfoType;
 
@@ -4115,8 +4308,9 @@
 
 typedef struct
 {
+   wpt_uint16 status;
+   wpt_uint16 doneIndicationForSource;
    wpt_uint64 logBuffAddress[MAX_NUM_OF_BUFFER];
-   wpt_uint32 status;
    wpt_uint32 logBuffLength[MAX_NUM_OF_BUFFER];
 }WDI_FWLoggingDXEdoneIndInfoType;
 
@@ -4639,6 +4833,14 @@
 #define OEM_DATA_RSP_SIZE 1968
 #endif
 
+#ifndef NEW_OEM_DATA_REQ_SIZE
+#define NEW_OEM_DATA_REQ_SIZE 292
+#endif
+
+#ifndef NEW_OEM_DATA_RSP_SIZE
+#define NEW_OEM_DATA_RSP_SIZE 2100
+#endif
+
 /*----------------------------------------------------------------------------
   WDI_oemDataReqInfoType
 ----------------------------------------------------------------------------*/
@@ -4675,6 +4877,19 @@
   wpt_uint8           oemDataRsp[OEM_DATA_RSP_SIZE];
 }WDI_oemDataRspParamsType;
 
+/*----------------------------------------------------------------------------
+  OEM DATA REQ NEW/OEM DATA RSP NEW - DATA STRUCTURES
+----------------------------------------------------------------------------*/
+/* Structure for defining req sent to the PE */
+typedef struct
+{
+    wpt_macAddr selfMacAddr;
+    wpt_uint8 reserved[2];
+    wpt_uint8  oemDataReqNew[NEW_OEM_DATA_REQ_SIZE];
+} WDI_OemDataReqNew, WDI_OemDataReqNewConfig;
+
+/*************************************************************************************************************/
+
 #endif /* FEATURE_OEM_DATA_SUPPORT */
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -5367,6 +5582,22 @@
    function pointer will be called */
    void*                      pUserData;
 } WDI_RoamScanOffloadReqParamsType;
+
+typedef struct
+{
+  wpt_uint32  requestId;
+  wpt_uint32  rateUpThreshold;
+  wpt_uint32  rateDownThreshold;
+  wpt_uint32  isPERRoamCCAEnabled;
+  wpt_uint32  waitPeriodForNextPERScan;
+  wpt_uint32  PERtimerThreshold;
+  wpt_uint32  PERroamTriggerPercent;
+} WDI_PERRoamOffloadScanInfo;
+
+typedef struct
+{
+  wpt_boolean roamScanReq; // Request info for all peers
+} WDI_PERRoamTriggerScanInfo;
 #endif //WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 
 /*---------------------------------------------------------------------------
@@ -5837,12 +6068,64 @@
   void*             pUserData;
 } WDI_DelPeriodicTxPtrnParamsType;
 
+#ifdef WLAN_FEATURE_RMC
+/*---------------------------------------------------------------------------
+  WDI_IbssPeerInfoParams
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8  wdiStaIdx;       //StaIdx
+    wpt_uint32 wdiTxRate;       //Tx Rate
+    wpt_uint32 wdiMcsIndex;     //MCS Index
+    wpt_uint32 wdiTxRateFlags;  //TxRate Flags
+    wpt_int8   wdiRssi;         //RSSI
+}WDI_IbssPeerInfoParams;
+
+/*---------------------------------------------------------------------------
+  WDI_IbssPeerInfoRspParams
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint32        wdiStatus;                  // Return status
+    wpt_uint8         wdiNumPeers;                // Number of peers
+    WDI_IbssPeerInfoParams *wdiPeerInfoParams; // Peer Info parameters
+}WDI_IbssPeerInfoRspParams;
+
+/*---------------------------------------------------------------------------
+  WDI_GetIbssPeerInfoRspType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    WDI_IbssPeerInfoRspParams  wdiPeerInfoRspParams;
+
+    /*Request status callback offered by UMAC - it is called if the current
+      req has returned PENDING as status; it delivers the status of sending
+      the message over the BUS */
+    WDI_ReqStatusCb   wdiReqStatusCB;
+
+    /*The user data passed in by UMAC, it will be sent back when the above
+      function pointer will be called */
+    void*             pUserData;
+}WDI_GetIbssPeerInfoRspType;
+
+/*---------------------------------------------------------------------------
+  WDI_IbssPeerInfoReqType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_boolean wdiAllPeerInfoReqd; // Request info for all peers
+    wpt_uint8   wdiStaIdx;          // STA Index
+    wpt_uint8   wdiBssIdx;          // BSS Index
+}WDI_IbssPeerInfoReqType;
+
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef WLAN_FEATURE_EXTSCAN
 
 #define WDI_WLAN_EXTSCAN_MAX_CHANNELS                 16
 #define WDI_WLAN_EXTSCAN_MAX_BUCKETS                  16
 #define WDI_WLAN_EXTSCAN_MAX_HOTLIST_APS              128
-#define WDI_WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS   64
+#define WDI_WLAN_EXTSCAN_MAX_HOTLIST_SSID             8
 
 typedef enum
 {
@@ -5889,6 +6172,10 @@
      */
     wpt_uint8      reportEvents;
 
+    wpt_uint32        max_period;
+    wpt_uint32        exponent;
+    wpt_uint32        step_count;
+
     wpt_uint8      numChannels;
 
     /*
@@ -5905,8 +6192,10 @@
     wpt_uint32                maxAPperScan;
 
     /* in %, when buffer is this much full, wake up host */
-    wpt_uint32                reportThreshold;
+    wpt_uint32                reportThresholdPercent;
+    wpt_uint32                reportThresholdNumScans;
 
+    wpt_uint32               homeAwayTime;  //in units of milliseconds
     wpt_uint8                numBuckets;
     WDI_WifiScanBucketSpec  buckets[WDI_WLAN_EXTSCAN_MAX_BUCKETS];
 } WDI_EXTScanStartReqParams;
@@ -5940,15 +6229,22 @@
    wpt_uint8   bssid[6];     /* BSSID */
    wpt_int32    low;     // low threshold
    wpt_int32    high;    // high threshold
-   wpt_uint32   channel; // channel hint
 } WDI_APThresholdParam;
 
 typedef struct
 {
+   WDI_MacSSid  ssid;     /* SSID */
+   wpt_uint8 band;    /* band */
+   wpt_int32 lowRssiThreshold; /* low threshold */
+   wpt_int32 highRssiThreshold; /* high threshold */
+} WDI_SSIDThresholdParam;
+
+typedef struct
+{
     wpt_int32   requestId;
     wpt_int8    sessionId;    // session Id mapped to vdev_id
-
-    wpt_int32   numAp;        // number of hotlist APs
+    wpt_uint32  lostBssidSampleSize;
+    wpt_int32   numBssid;        // number of hotlist APs
     WDI_APThresholdParam   ap[WDI_WLAN_EXTSCAN_MAX_HOTLIST_APS];    // hotlist APs
 } WDI_EXTScanSetBSSIDHotlistReqParams;
 
@@ -5958,32 +6254,27 @@
     wpt_uint8     sessionId;
 } WDI_EXTScanResetBSSIDHotlistReqParams;
 
+typedef struct
+{
+    wpt_boolean pause;
+    wpt_uint32 reserved;
+} WDI_HighPriorityDataInfoIndParams;
 
 typedef struct
 {
     wpt_int32   requestId;
     wpt_int8    sessionId;    // session Id mapped to vdev_id
-
-    /* number of samples for averaging RSSI */
-    wpt_int32              rssiSampleSize;
-
-    /* number of missed samples to confirm AP loss */
-    wpt_int32              lostApSampleSize;
-
-    /* number of APs breaching threshold required for firmware
-     * to generate event
-     */
-    wpt_int32              minBreaching;
-
-    wpt_int32   numAp;        // number of hotlist APs
-    WDI_APThresholdParam   ap[WDI_WLAN_EXTSCAN_MAX_HOTLIST_APS];    // hotlist APs
-} WDI_EXTScanSetSignfRSSIChangeReqParams;
+    wpt_uint32  lostSsidSampleSize;
+    wpt_uint32   numSsid;        // number of hotlist APs
+    WDI_SSIDThresholdParam   ssid[WDI_WLAN_EXTSCAN_MAX_HOTLIST_SSID]; // hotlist SSIDs
+} WDI_EXTScanSetSSIDHotlistReqParams;
 
 typedef struct
 {
     wpt_uint32    requestId;
     wpt_uint8     sessionId;
-} WDI_EXTScanResetSignfRSSIChangeReqParams;
+} WDI_EXTScanResetSSIDHotlistReqParams;
+
 #endif /* WLAN_FEATURE_EXTSCAN */
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -6142,6 +6433,61 @@
 
 }WDI_MonStartReqType;
 
+typedef struct
+{
+   wpt_uint8  paramType;
+   wpt_uint32 paramValue;
+   wpt_macAddr  bssId;
+}WDI_WifiConfigSetReqType;
+
+/**
+ * struct WDI_FwrMemDumpReqType - firmware memory dump request details.
+.*.@FWMemDumpReqCb - Associated Callback
+ *.@fwMemDumpReqContext - Callback context
+ * @reserved - reserved field 1.
+ *
+ * This structure carries information about the firmware
+ * memory dump request.
+ */
+typedef struct
+{
+    wpt_uint32        reserved1;
+}WDI_FwrMemDumpReqType;
+
+/**
+ * struct WDI_FwrMemDumpRsp - firmware dump response details.
+ *
+ * This structure is used to store the firmware dump
+ * response from the firmware.
+ */
+typedef struct
+{
+    wpt_uint32 dump_status;
+}WDI_FwrMemDumpRsp;
+
+typedef struct
+{
+    wpt_uint32 wificonfigset_status;
+}WDI_WifconfigSetRsp;
+
+/**
+ * struct WDI_ModifyRoamParamsReqType - Modified roam parameter details.
+ *
+ */
+
+typedef struct {
+   wpt_uint8  param;
+   wpt_uint32   value;
+}WDI_ModifyRoamParamsReqType;
+
+/**
+ * struct WDI_AllowedActionFramesInd - Allowed Action frames details
+ *
+ */
+struct WDI_AllowedActionFramesInd {
+   wpt_uint32 bitmask;
+   wpt_uint32 reserved;
+};
 /*----------------------------------------------------------------------------
  *   WDI callback types
  *--------------------------------------------------------------------------*/
@@ -7731,6 +8077,8 @@
 typedef void  (*WDI_RoamOffloadScanCb)(WDI_Status  wdiStatus,
                                        void*       pUserData);
 
+typedef void (*WDI_PERRoamOffloadScanCb)(WDI_Status wdiStatus, void *pUserData);
+typedef void (*WDI_PERRoamTriggerScanCb)(WDI_Status wdiStatus, void *pUserData);
 #endif
 /*---------------------------------------------------------------------------
    WDI_SetTxPerTrackingRspCb
@@ -7893,6 +8241,25 @@
 typedef void  (*WDI_SetPowerParamsCb)(WDI_Status  wdiStatus,
                                       void*       pUserData);
 
+
+/*---------------------------------------------------------------------------
+   WDA_FwrMemDumpRespCallback
+
+   DESCRIPTION
+
+   This callback is invoked by DAL when it has received a Fwr Mem dump
+   response from the underlying device.
+
+   PARAMETERS
+
+    IN
+    wdiStatus:  response status received from HAL
+    pUserData:  user data
+ ---------------------------------------------------------------------------*/
+typedef void (* WDI_FwrMemDumpCb) (WDI_FwrMemDumpRsp* wdiRsp,
+                                        void*       pUserData);
+
+
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 /*---------------------------------------------------------------------------
    WDI_GtkOffloadCb
@@ -7992,6 +8359,15 @@
                                 void*        pUserData);
 #endif /* FEATURE_WLAN_LPHB */
 
+#ifdef WLAN_FEATURE_RMC
+typedef void  (*WDI_RmcRulerRspCb)(WDI_RmcRspParamsType *wdiRmcResponse,
+                                    void*        pUserData);
+
+typedef void  (*WDI_IbssPeerInfoReqCb)(WDI_IbssPeerInfoRspParams *pInfoRspParams,
+                                            void*        pUserData);
+
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
 /*---------------------------------------------------------------------------
    WDI_SetBatchScanCb
@@ -8032,9 +8408,9 @@
                                        void *pUserData);
 typedef void  (*WDI_EXTScanResetBSSIDHotlistRspCb)(void *pEventData,
                                        void *pUserData);
-typedef void  (*WDI_EXTScanSetSignfRSSIChangeRspCb)(void *pEventData,
+typedef void  (*WDI_EXTScanSetSSIDHotlistRspCb)(void *pEventData,
                                        void *pUserData);
-typedef void  (*WDI_EXTScanResetSignfRSSIChangeRspCb)(void *pEventData,
+typedef void  (*WDI_EXTScanResetSSIDHotlistRspCb)(void *pEventData,
                                        void *pUserData);
 #endif /* WLAN_FEATURE_EXTSCAN */
 
@@ -8062,6 +8438,15 @@
                          WDI_FatalEventLogsRspParamType *wdiRsp, void *pUserData);
 
 typedef void  (*WDI_MonModeRspCb)(void *pEventData,void *pUserData);
+typedef void  (*WDI_RssiMonitorStartRspCb)(void *pEventData,void *pUserData);
+typedef void  (*WDI_RssiMonitorStopRspCb)(void *pEventData,void *pUserData);
+
+typedef void  (*WDI_FwrMemDumpRspCb)(WDI_FwrMemDumpRsp *wdiRsp, void *pUserData);
+
+typedef void  (*WDI_WifiConfigSetRspCb) (WDI_WifconfigSetRsp *wdiRsp, void *pUserData);
+
+typedef void (*WDI_AntennaDivSelRspCb)(WDI_Status status,
+              void *resp, void *pUserData);
 
 /*========================================================================
  *     Function Declarations and Documentation
@@ -9586,6 +9971,69 @@
 );
 
 /**
+ @brief WDI_StartRssiMonitorReq will be called when the upper
+        MAC wants to initialize Rssi Monitor on a bssid.
+        Upon the call of this API the WLAN DAL will pack and
+        send a HAL Rssi Monitor init request message to
+        the lower RIVA sub-system.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param pwdiRssiMonitorInfo: the Rssi Monitor params
+                      as specified by the Device Interface
+
+        wdiRssiMonitorStartRspCb: callback for passing back the
+        response of the rssi monitor operation received
+        from the device
+
+        pUserData: user data will be passed back with the
+        callback
+
+ @return Result of the function call
+*/
+WDI_Status
+WDI_StartRssiMonitorReq
+(
+   WDI_RssiMonitorReqInfoType          *pwdiRssiMonitorInfo,
+   WDI_RssiMonitorStartRspCb            wdiRssiMonitorStartRspCb,
+   void*                                pUserData
+);
+
+
+/**
+ @brief WDI_StopRssiMonitorReq will be called when the upper
+        MAC wants to stop Rssi Monitor on a bssid.
+        Upon the call of this API the WLAN DAL will pack and
+        send a HAL Rssi Monitor stop request message to
+        the lower RIVA sub-system.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param pwdiRssiMonitorInfo: the Rssi Monitor params
+                      as specified by the Device Interface
+
+        wdiRssiMonitorStopRspCb: callback for passing back the
+        response of the rssi monitor operation received
+        from the device
+
+        pUserData: user data will be passed back with the
+        callback
+
+ @return Result of the function call
+*/
+WDI_Status
+WDI_StopRssiMonitorReq
+(
+   WDI_RssiMonitorReqInfoType          *pwdiRssiMonitorInfo,
+   WDI_RssiMonitorStopRspCb            wdiRssiMonitorStopRspCb,
+   void*                               pUserData
+);
+
+/**
  @brief WDI_ConfigureRxpFilterReq will be called when the upper 
         MAC wants to set/reset the RXP filters for received pkts
         (MC, BC etc.). Upon the call of this API the WLAN DAL will pack
@@ -10371,7 +10819,7 @@
 
  @param wdiAddBAReqParams: the add BA parameters as specified by
                       the Device Interface
-  
+        baReqParamUserDataSize: user data size of wdiAddBAReqParams
         wdiAddBARspCb: callback for passing back the response of
         the add BA operation received from the device
   
@@ -10385,6 +10833,7 @@
 WDI_TriggerBAReq
 (
   WDI_TriggerBAReqParamsType* pwdiTriggerBAReqParams,
+  wpt_uint8                   baReqParamUserDataSize,
   WDI_TriggerBARspCb          wdiTriggerBARspCb,
   void*                       pUserData
 );
@@ -10764,6 +11213,22 @@
   WDI_RoamOffloadScanCb                 wdiRoamOffloadScancb,
   void*                                 pUserData
 );
+
+WDI_Status
+WDI_PERRoamScanOffloadReq
+(
+  WDI_PERRoamOffloadScanInfo              *pwdiRoamScanOffloadReqParams,
+  WDI_PERRoamOffloadScanCb                 wdiRoamOffloadScancb,
+  void*                                    pUserData
+);
+
+WDI_Status
+WDI_PERRoamScanTriggerReq
+(
+  WDI_PERRoamTriggerScanInfo              *pwdiRoamScanTriggerReqParams,
+  WDI_PERRoamTriggerScanCb                 wdiRoamTriggerScancb,
+  void*                                    pUserData
+);
 #endif
 
 /**
@@ -10992,6 +11457,22 @@
   WDI_DHCPInd *wdiDHCPInd
 );
 
+#ifdef WLAN_FEATURE_RMC
+WDI_Status
+WDI_RmcRulerReq
+(
+  WDI_RmcRulerReqParams  *wdiRmcRulerReqParams,
+  WDI_RmcRulerRspCb rmcRulerRspCb,
+  void *usrData
+);
+
+WDI_Status
+WDI_RmcUpdateInd
+(
+  WDI_RmcUpdateIndParams  *wdiRmcUpdateIndParams
+);
+#endif /* WLAN_FEATURE_RMC */
+
 /**
  @brief WDI_RateUpdateInd will be called when the upper MAC
         requests the device to update rates.
@@ -11012,6 +11493,26 @@
   WDI_RateUpdateIndParams  *wdiRateUpdateIndParams
 );
 
+#ifdef WLAN_FEATURE_RMC
+/**
+ @brief WDI_TXFailMonitorStartStopInd
+       Forward TX monitor start/stop event
+
+ @param
+
+     WDI_TXFailMonitorInd
+
+ @see
+ @return Result of the function call
+*/
+
+WDI_Status
+WDI_TXFailMonitorStartStopInd
+(
+  WDI_TXFailMonitorInd *wdiTXFailMonitorInd
+);
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 /**
  @brief WDI_GTKOffloadReq will be called when the upper MAC 
@@ -11360,40 +11861,52 @@
 );
 
 /**
- @brief WDI_EXTScanSetSignfRSSIChangeReq
-    This API is called to send Set Significant RSSI Request FW
+ @brief WDI_EXTScanSetSSIDHotlistReq
+    This API is called to send Set SSID Hotlist Request FW
 
- @param pwdiEXTScanSetSignfRSSIChangeReqParams : pointer to the request params.
-        wdiEXTScanSetSignfRSSIChangeRspCb   : callback on getting the response.
+ @param pwdiEXTScanSetBssidHotlistReqParams : pointer to the request params.
+        wdiEXTScanSetBSSIDHotlistRspCb   : callback on getting the response.
         usrData : Client context
  @see
  @return SUCCESS or FAIL
 */
-WDI_Status WDI_EXTScanSetSignfRSSIChangeReq
+WDI_Status WDI_EXTScanSetSSIDHotlistReq
 (
-   WDI_EXTScanSetSignfRSSIChangeReqParams*
-                                    pwdiEXTScanSetSignfRSSIChangeReqParams,
-   WDI_EXTScanSetSignfRSSIChangeRspCb   wdiEXTScanSetSignfRSSIChangeRspCb,
+   WDI_EXTScanSetSSIDHotlistReqParams* pwdiEXTScanSetSSIDHotlistReqParams,
+   WDI_EXTScanSetSSIDHotlistRspCb     wdiEXTScanSetSSIDHotlistRspCb,
    void*                   pUserData
 );
 
 /**
- @brief WDI_EXTScanResetSignfRSSIChangeReq
-    This API is called to send Reset BSSID Hotlist Request FW
+ @brief WDI_EXTScanResetSSIDHotlistReq
+    This API is called to send Reset SSID Hotlist Request FW
 
- @param pwdiEXTScanResetSignfRSSIChangeReqParams : pointer to the request params.
-        wdiEXTScanResetSignfRSSIChangeRs  : callback on getting the response.
+ @param pwdiEXTScanResetSsidHotlistReqParams : pointer to the request params.
+        wdiEXTScanGetCachedResultsRspCb   : callback on getting the response.
         usrData : Client context
  @see
  @return SUCCESS or FAIL
 */
-WDI_Status WDI_EXTScanResetSignfRSSIChangeReq
+WDI_Status WDI_EXTScanResetSSIDHotlistReq
 (
-   WDI_EXTScanResetSignfRSSIChangeReqParams*
-                                       pwdiEXTScanResetSignfRSSIChangeReqParams,
-   WDI_EXTScanResetSignfRSSIChangeRspCb     wdiEXTScanResetSignfRSSIChangeRspCb,
+   WDI_EXTScanResetSSIDHotlistReqParams* pwdiEXTScanResetSSIDHotlistReqParams,
+   WDI_EXTScanResetSSIDHotlistRspCb     wdiEXTScanResetSSIDHotlistRspCb,
    void*                   pUserData
 );
+
+/**
+ @brief WDI_HighPriorityDataInfoInd
+
+ @param pHighPriorityDataInfoIndParams: Req parameter for the FW
+
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_HighPriorityDataInfoInd
+(
+   WDI_HighPriorityDataInfoIndParams* pHighPriorityDataInfoIndParams
+);
+
 #endif /* WLAN_FEATURE_EXTSCAN */
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -11515,6 +12028,26 @@
 
 #endif /*FEATURE_WLAN_BATCH_SCAN*/
 
+#ifdef WLAN_FEATURE_RMC
+/**
+ @brief Process peer info req
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+
+WDI_Status
+WDI_IbssPeerInfoReq
+(
+   WDI_IbssPeerInfoReqType*   wdiPeerInfoReqParams,
+   WDI_IbssPeerInfoReqCb      wdiIbssPeerInfoReqCb,
+  void*                         pUserData
+);
+#endif /* WLAN_FEATURE_RMC */
+
 /**
  @brief wdi_HT40OBSSScanInd
     This API is called to start OBSS scan
@@ -11556,6 +12089,16 @@
         void*                   pUserData
         );
 
+WDI_Status
+WDI_FwrMemDumpReq
+
+(
+   WDI_FwrMemDumpReqType          *pwdiFwrMemDumpReqInfo,
+   WDI_FwrMemDumpCb                wdiFwrMemDumpRspCb,
+   void*                           pUserData
+);
+
+
 /**
  @brief WDI_NanRequest
         NAN request
@@ -11594,7 +12137,7 @@
 WDI_Status
 WDI_FWLoggingDXEdoneInd
 (
-  WDI_FWLoggingDXEdoneIndInfoType*    pwdiFWLoggingDXEdoneInd
+  wpt_uint32 logType
 );
 
 /**
@@ -11612,8 +12155,85 @@
 wpt_uint32 val
 );
 
+#ifdef FEATURE_OEM_DATA_SUPPORT
+
+/**
+ @brief WDI_HighPriorityDataInfoInd
+
+ @param pHighPriorityDataInfoIndParams: Req parameter for the FW
+
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_StartOemDataReqIndNew
+(
+   WDI_OemDataReqNewConfig *pOemDataReqNewConfig
+);
+#endif
+
 #ifdef __cplusplus
  }
 #endif 
 
+/**
+ @brief WDI_WifiConfigSetReq
+    This API is called to send WifiConfig  request to FW
+
+ @param pwdiWifConfigSetReqParams : pointer to  wificonfig params
+        wdiLLStatsSetRspCb     : set wificonfig response callback
+        usrData : Client context
+ @see
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_WifiConfigSetReq
+   (WDI_WifiConfigSetReqType* pwdiWifConfigSetReqParams,
+    WDI_WifiConfigSetRspCb wdiWifiConfigSetRspCb,
+    void*                 pUserData);
+
+/**
+ @brief WDI_GetCurrentAntennaIndex
+    This API is called to send getCurretAntennaIndex request to FW
+
+ @param pUserData: pointer to request params
+        wdiLLStatsSetRspCb     : set wificonfig response callback
+        reserved: request parameter
+ @see
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_GetCurrentAntennaIndex
+(
+  void *pUserData,
+  WDI_AntennaDivSelRspCb wdiAntennaDivSelRspCb,
+  wpt_uint32 reserved
+);
+
+/**
+ @brief WDI_SetBcnMissPenaltyCount
+    This API is called to send modified roam parameters to FW
+
+ @param params: pointer to request params
+ @see
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_SetBcnMissPenaltyCount
+(
+    WDI_ModifyRoamParamsReqType *params
+);
+
+/**
+ * WDI_SetAllowedActionFramesInd - This API is called to send Allowed
+ *                    Action frame details to FW
+ * @allowed_action_frames: Pointer to WDI_AllowedActionFramesInd structure
+ *                     which holds bitmask of allowed action frames
+ *
+ */
+WDI_Status
+WDI_SetAllowedActionFramesInd(
+   struct WDI_AllowedActionFramesInd *allowed_action_frames
+);
+
+void WDI_SetMgmtPktViaWQ5(wpt_boolean sendMgmtPktViaWQ5);
 #endif /* #ifndef WLAN_QCT_WDI_H */
diff --git a/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_bd.h b/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_bd.h
index 59de6aa..e42c183 100644
--- a/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_bd.h
+++ b/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_bd.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -451,7 +451,8 @@
         wpt_uint32 reorderSlotIdx:6;
         
 #ifdef WCN_PRONTO
-        wpt_uint32 reserved7: 2;
+        wpt_uint32 reserved7: 1;
+        wpt_uint32 perRoamCndInd:1;
         wpt_uint32 outOfOrderForward: 1;
         wpt_uint32 reorderEnable: 1;
 #else
@@ -463,7 +464,8 @@
 #ifdef WCN_PRONTO
         wpt_uint32 reorderEnable: 1;
         wpt_uint32 outOfOrderForward: 1;
-        wpt_uint32 reserved7: 2;
+        wpt_uint32 perRoamCndInd:1;
+        wpt_uint32 reserved7: 1;
 #else
         wpt_uint32 reserved7:4;
 #endif //WCN_PRONTO
diff --git a/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_dp.h b/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_dp.h
index 76b3395..465946e 100644
--- a/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_dp.h
+++ b/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_dp.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -120,9 +120,9 @@
 #define HAL_TDLS_PEER_STA_MASK              0x80 //bit 7 set for TDLS peer station
 #endif
 
-/* Bit 8 is used to route reliable multicast data frames from QID 1.
-   This dynamically changes ACK_POLICY = TRUE for multicast frames */
-#define WDI_RELIABLE_MCAST_REQUESTED_MASK 0x100
+#ifdef WLAN_FEATURE_RMC
+#define WDI_RMC_REQUESTED_MASK 0x100
+#endif
 
 #define WDI_USE_BD_RATE_1_MASK            0x1000
 #define WDI_USE_BD_RATE_2_MASK            0x2000
@@ -139,6 +139,9 @@
 
 #define WDI_DPU_FEEDBACK_OFFSET       1
 
+#define WDI_MAC_LLC_HEADER_SIZE       8
+
+
 // Frame Type definitions
 
 #define WDI_MAC_MGMT_FRAME    0x0
@@ -303,6 +306,7 @@
 //LFR scan related
 #define WDI_RX_BD_GET_OFFLOADSCANLEARN( _pvBDHeader )         (((WDI_RxBdType*)_pvBDHeader)->offloadScanLearn)
 #define WDI_RX_BD_GET_ROAMCANDIDATEIND( _pvBDHeader )         (((WDI_RxBdType*)_pvBDHeader)->roamCandidateInd)
+#define WDI_RX_BD_GET_PER_ROAMCANDIDATEIND( _pvBDHeader )     (((WDI_RxBdType*)_pvBDHeader)->perRoamCndInd)
 #endif
 #ifdef WLAN_FEATURE_EXTSCAN
 #define WDI_RX_BD_GET_EXTSCANFULLSCANRESIND( _pvBDHeader ) (((WDI_RxBdType*)_pvBDHeader)->extscanBuffer)
@@ -336,6 +340,9 @@
 
 #define WDI_TX_BD_SET_MPDU_HEADER_LEN( _bd, _len )       (((WDI_TxBdType*)_bd)->mpduHeaderLength = _len)
 
+#define WDI_TX_BD_GET_MPDU_HEADER_LEN( _bd )               (((WDI_TxBdType*)_bd)->mpduHeaderLength)
+
+
 #define WDI_TX_BD_SET_MPDU_LEN( _bd, _len )              (((WDI_TxBdType*)_bd)->mpduLength = _len)
 
 #define WDI_RX_BD_GET_BA_OPCODE(_pvBDHeader)        (((WDI_RxBdType*)_pvBDHeader)->reorderOpcode)
diff --git a/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_i.h b/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_i.h
index d921d37..7debb41 100644
--- a/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_i.h
+++ b/wlan/prima/CORE/WDI/CP/inc/wlan_qct_wdi_i.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -96,8 +96,10 @@
  
 #ifdef WLAN_SOFTAP_VSTA_FEATURE
 #define WDI_MAX_SUPPORTED_STAS   41
+#define WDI_MAX_IBSS_PEER_SUPPORED_STAS 32
 #else
 #define WDI_MAX_SUPPORTED_STAS   12
+#define WDI_MAX_IBSS_PEER_SUPPORED_STAS 11
 #endif
 #define WDI_MAX_SUPPORTED_BSS     5 
 
@@ -435,96 +437,129 @@
 
   /* WLAN FW LPHB config request */
   WDI_LPHB_CFG_REQ                              = 85,
+#ifdef WLAN_FEATURE_RMC
+  WDI_RMC_RULER_REQ                            = 86,
+  WDI_HAL_IBSS_PEER_INFO_REQ                    = 87,
+#endif /* WLAN_FEATURE_RMC */
 
   /* WLAN FW set batch scan request */
-  WDI_SET_BATCH_SCAN_REQ                        = 86,
+  WDI_SET_BATCH_SCAN_REQ                        = 88,
 
   /*WLAN DAL Set Max Tx Power Per band Request*/
-  WDI_SET_MAX_TX_POWER_PER_BAND_REQ             = 87,
+  WDI_SET_MAX_TX_POWER_PER_BAND_REQ             = 89,
 
-  WDI_UPDATE_CHAN_REQ                           = 88,
+  WDI_UPDATE_CHAN_REQ                           = 90,
 
-  WDI_GET_BCN_MISS_RATE_REQ                     = 89,
+  WDI_GET_BCN_MISS_RATE_REQ                     = 91,
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
-  WDI_LL_STATS_SET_REQ                          = 90,
-  WDI_LL_STATS_GET_REQ                          = 91,
-  WDI_LL_STATS_CLEAR_REQ                        = 92,
+  WDI_LL_STATS_SET_REQ                          = 92,
+  WDI_LL_STATS_GET_REQ                          = 93,
+  WDI_LL_STATS_CLEAR_REQ                        = 94,
 #endif
 
 #ifdef WLAN_FEATURE_EXTSCAN
-  WDI_EXTSCAN_START_REQ                          = 93,
-  WDI_EXTSCAN_STOP_REQ                           = 94,
-  WDI_EXTSCAN_GET_CACHED_RESULTS_REQ             = 95,
-  WDI_EXTSCAN_GET_CAPABILITIES_REQ               = 96,
-  WDI_EXTSCAN_SET_BSSID_HOTLIST_REQ              = 97,
-  WDI_EXTSCAN_RESET_BSSID_HOTLIST_REQ            = 98,
-  WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ          = 99,
-  WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ        = 100,
+  WDI_EXTSCAN_START_REQ                          = 95,
+  WDI_EXTSCAN_STOP_REQ                           = 96,
+  WDI_EXTSCAN_GET_CACHED_RESULTS_REQ             = 97,
+  WDI_EXTSCAN_GET_CAPABILITIES_REQ               = 98,
+  WDI_EXTSCAN_SET_BSSID_HOTLIST_REQ              = 99,
+  WDI_EXTSCAN_RESET_BSSID_HOTLIST_REQ            = 100,
+  WDI_EXTSCAN_SET_SSID_HOTLIST_REQ               = 101,
+  WDI_EXTSCAN_RESET_SSID_HOTLIST_REQ             = 102,
 #endif
 
-  WDI_SPOOF_MAC_ADDR_REQ                         = 101,
+  WDI_SPOOF_MAC_ADDR_REQ                         = 103,
 
-  WDI_GET_FW_STATS_REQ                           = 102,
+  WDI_GET_FW_STATS_REQ                           = 104,
 
   /* Send command to encrypt the given message */
-  WDI_ENCRYPT_MSG_REQ                            = 103,
+  WDI_ENCRYPT_MSG_REQ                            = 105,
 
-  WDI_FW_LOGGING_INIT_REQ                        = 104,
-  WDI_GET_FRAME_LOG_REQ                          = 105,
-
+  WDI_FW_LOGGING_INIT_REQ                        = 106,
+  WDI_GET_FRAME_LOG_REQ                          = 107,
   /* NAN Request */
-  WDI_NAN_REQUEST                                = 106,
+  WDI_NAN_REQUEST                                = 108,
 
-  WDI_MON_START_REQ                              = 107,
-  WDI_MON_STOP_REQ                               = 108,
-  WDI_FATAL_EVENT_LOGGING_REQ                    = 109,
+  WDI_MON_START_REQ                              = 109,
+  WDI_MON_STOP_REQ                               = 110,
+  WDI_FATAL_EVENT_LOGGING_REQ                    = 111,
+  WDI_FWR_MEM_DUMP_REQ                           = 112,
+  WDI_START_RSSI_MONITOR_REQ                     = 113,
+  WDI_STOP_RSSI_MONITOR_REQ                      = 114,
+  WDI_WIFI_CONFIG_SET_REQ                        = 115,
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+  WDI_PER_ROAM_SCAN_OFFLOAD_REQ                  = 116,
+  WDI_PER_ROAM_SCAN_TRIGGER_REQ                  = 117,
+#endif
 
   WDI_MAX_REQ,
 
   /*Send a suspend Indication down to HAL*/
-  WDI_HOST_SUSPEND_IND          = WDI_MAX_REQ ,
+  WDI_HOST_SUSPEND_IND =  WDI_MAX_REQ,
 
   /* Send a traffic stats indication to HAL */
-  WDI_TRAFFIC_STATS_IND,
+  WDI_TRAFFIC_STATS_IND = WDI_MAX_REQ + 1,
 
   /* DHCP Start Indication */
-  WDI_DHCP_START_IND,
+  WDI_DHCP_START_IND = WDI_MAX_REQ + 2,
 
   /* DHCP Stop Indication */
-  WDI_DHCP_STOP_IND,
+  WDI_DHCP_STOP_IND = WDI_MAX_REQ + 3,
 
   /* Drop/Receive unencrypted frames indication to HAL */
-  WDI_EXCLUDE_UNENCRYPTED_IND,
+  WDI_EXCLUDE_UNENCRYPTED_IND = WDI_MAX_REQ + 4,
 
   /* Send an add periodic Tx pattern indication to HAL */
-  WDI_ADD_PERIODIC_TX_PATTERN_IND,
+  WDI_ADD_PERIODIC_TX_PATTERN_IND = WDI_MAX_REQ + 5,
 
   /* Send a delete periodic Tx pattern indicationto HAL */
-  WDI_DEL_PERIODIC_TX_PATTERN_IND,
+  WDI_DEL_PERIODIC_TX_PATTERN_IND = WDI_MAX_REQ + 6,
 
-  /*Send stop batch scan indication to FW*/
-  WDI_STOP_BATCH_SCAN_IND,
-
-  /*Send stop batch scan indication to FW*/
-  WDI_TRIGGER_BATCH_SCAN_RESULT_IND,
-
+#ifdef WLAN_FEATURE_RMC
+  /* Send RMC Update Indication */
+  WDI_RMC_UPDATE_IND = WDI_MAX_REQ + 7,
+#endif
   /* Send Rate Update Indication */
-  WDI_RATE_UPDATE_IND,
+  WDI_RATE_UPDATE_IND = WDI_MAX_REQ + 8,
 
-  WDI_START_HT40_OBSS_SCAN_IND,
-  WDI_STOP_HT40_OBSS_SCAN_IND,
+  /*Send stop batch scan indication to FW*/
+  WDI_STOP_BATCH_SCAN_IND = WDI_MAX_REQ + 9,
+
+  /*Send stop batch scan indication to FW*/
+  WDI_TRIGGER_BATCH_SCAN_RESULT_IND = WDI_MAX_REQ + 10,
+
+#ifdef WLAN_FEATURE_RMC
+  /* TX Monitor start/stop indication */
+  WDI_TX_FAIL_MONITOR_IND = WDI_MAX_REQ + 11,
+#endif
+  WDI_START_HT40_OBSS_SCAN_IND = WDI_MAX_REQ +12,
+  WDI_STOP_HT40_OBSS_SCAN_IND = WDI_MAX_REQ +13,
 
   /* csa channel switch req*/
-  WDI_CH_SWITCH_REQ_V1,
-  WDI_TDLS_CHAN_SWITCH_REQ,
-  WDI_SET_RTS_CTS_HTVHT_IND,
-  WDI_FW_LOGGING_DXE_DONE_IND,
-  WDI_SEND_FREQ_RANGE_CONTROL_IND,
+  WDI_CH_SWITCH_REQ_V1 = WDI_MAX_REQ + 14,
+  WDI_TDLS_CHAN_SWITCH_REQ = WDI_MAX_REQ + 15,
+  WDI_SET_RTS_CTS_HTVHT_IND = WDI_MAX_REQ + 16,
+  WDI_FW_LOGGING_DXE_DONE_IND = WDI_MAX_REQ + 17,
+  WDI_SEND_FREQ_RANGE_CONTROL_IND = WDI_MAX_REQ + 18,
+
+#ifdef WLAN_FEATURE_EXTSCAN
+  WDI_HIGH_PRIORITY_DATA_INFO_IND = WDI_MAX_REQ + 19,
+#endif
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+  WDI_START_OEM_DATA_REQ_IND_NEW = WDI_MAX_REQ + 20,
+#endif
 
   /*Keep adding the indications to the max request
     such that we keep them separate */
-  WDI_MAX_UMAC_IND
+  WDI_ANTENNA_DIVERSITY_SELECTION_REQ = WDI_MAX_REQ + 21,
+  WDI_MODIFY_ROAM_PARAMS_IND = WDI_MAX_REQ + 22,
+  WDI_SET_ALLOWED_ACTION_FRAMES_IND = WDI_MAX_REQ + 23,
+
+  WDI_MAX_UMAC_IND = WDI_MAX_REQ + 24
+
 }WDI_RequestEnumType;
 
 /*--------------------------------------------------------------------------- 
@@ -782,45 +817,59 @@
   /* WLAN FW LPHB Config response */
   WDI_LPHB_CFG_RESP                             = 84,
 
-  WDI_SET_BATCH_SCAN_RESP                       = 85,
+#ifdef WLAN_FEATURE_RMC
+  WDI_RMC_RULER_RESP                           = 85,
+  WDI_HAL_IBSS_PEER_INFO_RSP                    = 86,
+#endif /* WLAN_FEATURE_RMC */
 
-  WDI_SET_MAX_TX_POWER_PER_BAND_RSP             = 86,
+  WDI_SET_BATCH_SCAN_RESP                        = 87,
 
-  WDI_UPDATE_CHAN_RESP                          = 87,
+  WDI_SET_MAX_TX_POWER_PER_BAND_RSP             = 88,
+
+  WDI_UPDATE_CHAN_RESP                          = 89,
   /* channel switch resp v1*/
-  WDI_CH_SWITCH_RESP_V1                         = 88,
+  WDI_CH_SWITCH_RESP_V1                         = 90,
 
-  WDI_GET_BCN_MISS_RATE_RSP                     = 89,
+  WDI_GET_BCN_MISS_RATE_RSP                     = 91,
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
-  WDI_LL_STATS_SET_RSP                          = 90,
-  WDI_LL_STATS_GET_RSP                          = 91,
-  WDI_LL_STATS_CLEAR_RSP                        = 92,
+  WDI_LL_STATS_SET_RSP                          = 92,
+  WDI_LL_STATS_GET_RSP                          = 93,
+  WDI_LL_STATS_CLEAR_RSP                        = 94,
 #endif
 
 #ifdef WLAN_FEATURE_EXTSCAN
-  WDI_EXTSCAN_START_RSP                          = 93,
-  WDI_EXTSCAN_STOP_RSP                           = 94,
-  WDI_EXTSCAN_GET_CACHED_RESULTS_RSP             = 95,
-  WDI_EXTSCAN_GET_CAPABILITIES_RSP               = 96,
-  WDI_EXTSCAN_SET_HOTLIST_BSSID_RSP              = 97,
-  WDI_EXTSCAN_RESET_HOTLIST_BSSID_RSP            = 98,
-  WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP          = 99,
-  WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP        = 100,
+  WDI_EXTSCAN_START_RSP                          = 95,
+  WDI_EXTSCAN_STOP_RSP                           = 96,
+  WDI_EXTSCAN_GET_CACHED_RESULTS_RSP             = 97,
+  WDI_EXTSCAN_GET_CAPABILITIES_RSP               = 98,
+  WDI_EXTSCAN_SET_HOTLIST_BSSID_RSP              = 99,
+  WDI_EXTSCAN_RESET_HOTLIST_BSSID_RSP            = 100,
+  WDI_EXTSCAN_SET_HOTLIST_SSID_RSP               = 101,
+  WDI_EXTSCAN_RESET_HOTLIST_SSID_RSP             = 102,
 #endif
-  WDI_SPOOF_MAC_ADDR_RSP                         = 101,
-  WDI_GET_FW_STATS_RSP                           = 102,
+  WDI_SPOOF_MAC_ADDR_RSP                         = 103,
+  WDI_GET_FW_STATS_RSP                           = 104,
 
   /* Send command to encrypt the given message */
-  WDI_ENCRYPT_MSG_RSP                            = 103,
+  WDI_ENCRYPT_MSG_RSP                            = 105,
 
-  WDI_FW_LOGGING_INIT_RSP                        = 104,
-  WDI_GET_FRAME_LOG_RSP                          = 105,
+  WDI_FW_LOGGING_INIT_RSP                        = 106,
+  WDI_GET_FRAME_LOG_RSP                          = 107,
 
-  WDI_NAN_RESPONSE                               = 106,
+  WDI_NAN_RESPONSE                               = 108,
 
-  WDI_MON_START_RSP                              = 107,
-  WDI_MON_STOP_RSP                               = 108,
-  WDI_FATAL_EVENT_LOGGING_RSP                    = 109,
+  WDI_MON_START_RSP                              = 109,
+  WDI_MON_STOP_RSP                               = 110,
+  WDI_FATAL_EVENT_LOGGING_RSP                    = 111,
+  WDI_FWR_MEM_DUMP_RSP                           = 112,
+  WDI_START_RSSI_MONITOR_RSP                     = 113,
+  WDI_STOP_RSSI_MONITOR_RSP                      = 114,
+
+  WDI_WIFI_CONFIG_SET_RSP                        = 115,
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+  WDI_PER_ROAM_SCAN_OFFLOAD_RSP                  = 116,
+  WDI_PER_ROAM_SCAN_TRIGGER_RSP                  = 117,
+#endif
 
   /*-------------------------------------------------------------------------
     Indications
@@ -881,27 +930,38 @@
   /* Periodic Tx Pattern Indication from FW to Host */
   WDI_HAL_PERIODIC_TX_PTRN_FW_IND     = WDI_HAL_IND_MIN + 16,
 
+#ifdef WLAN_FEATURE_RMC
+  /* Update Indication from FW to Host */
+  WDI_RMC_UPDATE_IND_TO_HOST           = WDI_HAL_IND_MIN + 17,
+#endif
 
-  WDI_BATCHSCAN_RESULT_IND           =  WDI_HAL_IND_MIN + 17,
+  WDI_BATCHSCAN_RESULT_IND           =  WDI_HAL_IND_MIN + 18,
 
-  WDI_HAL_CH_AVOID_IND                 = WDI_HAL_IND_MIN + 18,
+#ifdef WLAN_FEATURE_RMC
+  WDI_HAL_TX_FAIL_IND                  = WDI_HAL_IND_MIN + 19,
+#endif
+
+  WDI_HAL_CH_AVOID_IND                 = WDI_HAL_IND_MIN + 20,
 
   /* print register values indication from FW to Host */
-  WDI_PRINT_REG_INFO_IND               = WDI_HAL_IND_MIN + 19,
+  WDI_PRINT_REG_INFO_IND               = WDI_HAL_IND_MIN + 21,
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
-  WDI_HAL_LL_STATS_RESULTS_IND         = WDI_HAL_IND_MIN + 20,
+  WDI_HAL_LL_STATS_RESULTS_IND         = WDI_HAL_IND_MIN + 22,
 #endif
 #ifdef WLAN_FEATURE_EXTSCAN
-  WDI_HAL_EXTSCAN_PROGRESS_IND       = WDI_HAL_IND_MIN + 21,
-  WDI_HAL_EXTSCAN_SCAN_AVAILABLE_IND = WDI_HAL_IND_MIN + 22,
-  WDI_HAL_EXTSCAN_RESULT_IND         = WDI_HAL_IND_MIN + 23,
-  WDI_HAL_EXTSCAN_BSSID_HOTLIST_RESULT_IND    = WDI_HAL_IND_MIN + 24,
-  WDI_HAL_EXTSCAN_SIG_RSSI_RESULT_IND         = WDI_HAL_IND_MIN + 25,
+  WDI_HAL_EXTSCAN_PROGRESS_IND       = WDI_HAL_IND_MIN + 23,
+  WDI_HAL_EXTSCAN_SCAN_AVAILABLE_IND = WDI_HAL_IND_MIN + 24,
+  WDI_HAL_EXTSCAN_RESULT_IND         = WDI_HAL_IND_MIN + 25,
+  WDI_HAL_EXTSCAN_BSSID_HOTLIST_RESULT_IND    = WDI_HAL_IND_MIN + 26,
+  WDI_HAL_EXTSCAN_SSID_HOTLIST_RESULT_IND    = WDI_HAL_IND_MIN + 27,
 #endif
-  WDI_TDLS_CHAN_SWITCH_REQ_RESP      = WDI_HAL_IND_MIN + 26,
-  WDI_HAL_DEL_BA_IND                 = WDI_HAL_IND_MIN + 27,
-  WDI_HAL_NAN_EVENT                  = WDI_HAL_IND_MIN + 28,
-  WDI_HAL_LOST_LINK_PARAMS_IND       = WDI_HAL_IND_MIN + 29,
+  WDI_TDLS_CHAN_SWITCH_REQ_RESP      = WDI_HAL_IND_MIN + 28,
+  WDI_HAL_DEL_BA_IND                 = WDI_HAL_IND_MIN + 29,
+  WDI_HAL_NAN_EVENT                  = WDI_HAL_IND_MIN + 30,
+  WDI_HAL_LOST_LINK_PARAMS_IND       = WDI_HAL_IND_MIN + 31,
+  WDI_HAL_RSSI_BREACHED_IND          = WDI_HAL_IND_MIN + 32,
+  WDI_HAL_START_OEM_DATA_RSP_IND_NEW = WDI_HAL_IND_MIN + 33,
+  WDI_ANTENNA_DIVERSITY_SELECTION_RSP = WDI_HAL_IND_MIN + 34,
   WDI_MAX_RESP
 }WDI_ResponseEnumType; 
 
@@ -1265,6 +1325,9 @@
 
    /* Roam delay statistic enabled in ini*/
    wpt_uint8                  roamDelayStatsEnabled;
+   /* enable/disable sendMgmtPktViaWQ5 params in ini */
+   wpt_boolean                 sendMgmtPktViaWQ5;
+
 }WDI_ControlBlockType; 
 
 
@@ -3163,6 +3226,23 @@
  );
 
 #endif
+#ifdef WLAN_FEATURE_RMC
+/**
+ @brief Process TX Fail monitor indication
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTXFailMonitor
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* WLAN_FEATURE_RMC */
 /**
  @brief Process start OBSS scan request from Host
 
@@ -4609,6 +4689,24 @@
   WDI_EventInfoType*     pEventData
 );
 
+#ifdef WLAN_FEATURE_RMC
+/**
+*@brief Process Tx Fail Indication
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTXFailInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* WLAN_FEATURE_RMC */
+
 /**
 *@brief Process Noa Start Indication function (called when
         an indication of this kind is being received over the
@@ -5471,7 +5569,6 @@
 );
 #endif // FEATURE_WLAN_SCAN_PNO
 
-
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 /**
  @brief Process Start Roam Candidate Lookup Request function
@@ -5488,6 +5585,14 @@
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 );
+
+WDI_Status
+WDI_ProcessPERRoamScanOffloadReq(WDI_ControlBlockType *pWDICtx,
+                                 WDI_EventInfoType *pEventData);
+
+WDI_Status
+WDI_ProcessPERRoamScanTriggerReq(WDI_ControlBlockType *pWDICtx,
+                                 WDI_EventInfoType *pEventData);
 /**
  @brief Process Start Roam Candidate Lookup Response function (called when a
         response is being received over the bus from HAL)
@@ -5504,8 +5609,21 @@
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 );
-#endif
 
+WDI_Status
+WDI_ProcessPERRoamScanOffloadRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessPERRoamScanTriggerRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif
 
 #ifdef WLAN_FEATURE_PACKET_FILTERING
 /**
@@ -5760,7 +5878,6 @@
   WDI_EventInfoType*     pEventData
 );
 #endif
-
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 /**
  *  @brief WDI_wdiEdTypeEncToEdTypeEnc -
@@ -5813,6 +5930,82 @@
     WDI_EventInfoType*     pEventData
 );
 
+#ifdef WLAN_FEATURE_RMC
+WDI_Status
+WDI_ProcessRMCRulerReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessRMCRulerResp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessRMCUpdateInd
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_RmcUpdateInd
+(
+    WDI_RmcUpdateIndParams  *wdiRmcUpdateIndParams
+);
+
+WDI_Status
+WDI_ProcessRMCRulerResp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessRMCUpdateIndToHost
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Process peer info req
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInfoReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Process peer info resp
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInfoRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
 /**
  @brief WDI_ProcessSetBatchScanRsp -
@@ -5999,28 +6192,35 @@
 );
 
 WDI_Status
-WDI_ProcessEXTScanSetSignifRSSIChangeReq
+WDI_ProcessEXTScanSetSSIDHotlistReq
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 );
 
 WDI_Status
-WDI_ProcessEXTScanSetSignfRSSIChangeRsp
+WDI_ProcessEXTScanSetHotlistSSIDRsp
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 );
 
 WDI_Status
-WDI_ProcessEXTScanResetSignfRSSIChangeReq
+WDI_ProcessEXTScanResetSSIDHotlistReq
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 );
 
 WDI_Status
-WDI_ProcessEXTScanResetSignfRSSIChangeRsp
+WDI_ProcessEXTScanResetHotlistSSIDRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessHighPriorityDataInfoInd
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
@@ -6048,12 +6248,13 @@
 );
 
 WDI_Status
-WDI_ProcessEXTScanSignfRssiResultInd
+WDI_ProcessEXTScanSsidHotListResultInd
 (
    WDI_ControlBlockType*  pWDICtx,
    WDI_EventInfoType*     pEventData
 );
 
+
 #endif /* WLAN_FEATURE_EXTSCAN */
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -6178,6 +6379,34 @@
 );
 
 WDI_Status
+WDI_ProcessRssiMonitorStartReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessRssiMonitorStartRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessRssiMonitorStopReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessRssiMonitorStopRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
 WDI_ProcessEncryptMsgReq
 (
   WDI_ControlBlockType*  pWDICtx,
@@ -6261,6 +6490,13 @@
     WDI_EventInfoType*     pEventData
 );
 
+WDI_Status
+WDI_Process_RssiBreachedInd
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
 
 /**
  @brief WDI_ProcessSetRtsCtsHtvhtInd
@@ -6315,5 +6551,130 @@
   WDI_EventInfoType*     pEventData
 );
 
+WDI_Status
+WDI_ProcessFwrMemDumpReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+    WDI_ProcessFwrMemDumpRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessWifiConfigReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+WDI_Status
+WDI_ProcessWificonfigSetRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+/**
+ @brief WDI_ProcessStartOemDataReqIndNew -
+    Send OEM Data request new indication to FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return none
+*/
+WDI_Status
+WDI_ProcessStartOemDataReqIndNew
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Process OemDataRsp New Indication indication from FW
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessStartOemDataRspIndNew
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif
+
+/**
+ @brief Process get current antenna index command
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessGetCurrentAntennaIndex
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Process get current antenna index response from FW
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessGetCurrentAntennaIndexRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Process set modified roam params command
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessBcnMissPenaltyCount
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ *  WDI_ProcessSetAllowedActionFramesInd - Process Set allowed action
+ *                                         frames command
+ *
+ *  @pWDICtx: pointer to the WLAN DAL context
+ *  @pEventData: pointer to the event information structure
+ *
+ */
+WDI_Status
+WDI_ProcessSetAllowedActionFramesInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
 #endif /*WLAN_QCT_WDI_I_H*/
 
diff --git a/wlan/prima/CORE/WDI/CP/src/wlan_qct_wdi.c b/wlan/prima/CORE/WDI/CP/src/wlan_qct_wdi.c
index 067f275..381006f 100644
--- a/wlan/prima/CORE/WDI/CP/src/wlan_qct_wdi.c
+++ b/wlan/prima/CORE/WDI/CP/src/wlan_qct_wdi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -189,7 +189,7 @@
    ,DYNAMIC_WMM_PS                 //43
 
    ,MAC_SPOOFED_SCAN               //44
-   ,FEATURE_NOT_SUPPORTED          //45
+   ,BMU_ERROR_GENERIC_RECOVERY     //45
    ,DISA                           //46
    ,FW_STATS                       //47
    ,WPS_PRBRSP_TMPL                //48
@@ -200,10 +200,26 @@
 #else
     ,FEATURE_NOT_SUPPORTED         //51
 #endif
-   ,FEATURE_NOT_SUPPORTED          //52
+   ,RTT3                           //52
    ,MGMT_FRAME_LOGGING             //53
    ,ENHANCED_TXBD_COMPLETION       //54
    ,LOGGING_ENHANCEMENT            //55
+#ifdef WLAN_FEATURE_EXTSCAN
+   ,EXT_SCAN_ENHANCED              //56
+#else
+    ,FEATURE_NOT_SUPPORTED         //56
+#endif
+   ,MEMORY_DUMP_SUPPORTED          //57
+   ,PER_PKT_STATS_SUPPORTED        //58
+   ,FEATURE_NOT_SUPPORTED          //59
+#ifdef FEATURE_EXT_LL_STAT
+   ,EXT_LL_STAT                    //60
+#else
+   ,FEATURE_NOT_SUPPORTED
+#endif
+   ,WIFI_CONFIG                    //61
+   ,ANTENNA_DIVERSITY_SELECTION    //62
+   ,PER_BASED_ROAMING              //63
 };
 
 /*-------------------------------------------------------------------------- 
@@ -425,6 +441,13 @@
 #else
   NULL,
 #endif /* FEATURE_WLAN_LPHB */
+#ifdef WLAN_FEATURE_RMC
+  WDI_ProcessRMCRulerReq,              /* WDI_LBP_RULER_REQ */
+  WDI_ProcessIbssPeerInfoReq,           /* WDI_HAL_IBSS_PEER_INFO_REQ */
+#else
+  NULL,
+  NULL,
+#endif /* WLAN_FEATURE_RMC */
 
 #ifdef FEATURE_WLAN_BATCH_SCAN
   WDI_ProcessSetBatchScanReq,               /* WDI_SET_BATCH_SCAN_REQ */
@@ -454,8 +477,8 @@
   WDI_ProcessEXTScanGetCapabilitiesReq,      /* WDI_EXTSCAN_GET_CAPABILITIES_REQ */
   WDI_ProcessEXTScanSetBSSIDHotlistReq,      /* WDI_EXTSCAN_SET_BSSID_HOTLIST_REQ */
   WDI_ProcessEXTScanResetBSSIDHotlistReq,    /* WDI_EXTSCAN_RESET_BSSID_HOTLIST_REQ */
-  WDI_ProcessEXTScanSetSignifRSSIChangeReq,  /* WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ */
-  WDI_ProcessEXTScanResetSignfRSSIChangeReq, /* WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ */
+  WDI_ProcessEXTScanSetSSIDHotlistReq,       /* WDI_EXTSCAN_SET_SSID_HOTLIST_REQ */
+  WDI_ProcessEXTScanResetSSIDHotlistReq,     /* WDI_EXTSCAN_RESET_SSID_HOTLIST_REQ */
 #else
   NULL,
   NULL,
@@ -480,6 +503,19 @@
   WDI_ProcessMonStartReq,          /* WDI_MON_START_REQ */
   WDI_ProcessMonStopReq,           /* WDI_MON_STOP_REQ */
   WDI_ProcessFatalEventLogsReq,     /*WDI_FATAL_EVENT_LOGGING_REQ*/
+  WDI_ProcessFwrMemDumpReq,           /* WDI_FWR_MEM_DUMP_REQ*/
+
+  WDI_ProcessRssiMonitorStartReq,          /* WDI_START_RSSI_MONITOR_REQ */
+  WDI_ProcessRssiMonitorStopReq,           /* WDI_STOP_RSSI_MONITOR_REQ */
+
+  WDI_ProcessWifiConfigReq,                /*WDI_WIFI_CONFIG_SET_REQ*/
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+  WDI_ProcessPERRoamScanOffloadReq,  /* WDI_PER_ROAM_SCAN_OFFLOAD_REQ */
+  WDI_ProcessPERRoamScanTriggerReq,  /* WDI_PER_ROAM_SCAN_TRIGGER_REQ */
+#else
+  NULL,
+  NULL,
+#endif /* WLAN_FEATURE_ROAM_SCAN_OFFLOAD */
   /*-------------------------------------------------------------------------
     Indications
   -------------------------------------------------------------------------*/
@@ -494,6 +530,12 @@
 #endif
   WDI_ProcessAddPeriodicTxPtrnInd,      /* WDI_ADD_PERIODIC_TX_PATTERN_IND */
   WDI_ProcessDelPeriodicTxPtrnInd,      /* WDI_DEL_PERIODIC_TX_PATTERN_IND */
+#ifdef WLAN_FEATURE_RMC
+  WDI_ProcessRMCUpdateInd,              /* WDI_RMC_UPDATE_IND */
+#else
+  NULL,
+#endif /* WLAN_FEATURE_RMC */
+  WDI_ProcessRateUpdateInd,              /* WDI_RATE_UPDATE_IND */
 #ifdef FEATURE_WLAN_BATCH_SCAN
   WDI_ProcessStopBatchScanInd,          /* WDI_STOP_BATCH_SCAN_IND */
   WDI_ProcessTriggerBatchScanResultInd, /* WDI_TRIGGER_BATCH_SCAN_RESULT_IND */
@@ -501,7 +543,11 @@
   NULL,
   NULL,
 #endif /* FEATURE_WLAN_BATCH_SCAN */
-  WDI_ProcessRateUpdateInd,              /* WDI_RATE_UPDATE_IND */
+#ifdef WLAN_FEATURE_RMC
+  WDI_ProcessTXFailMonitor,
+#else
+  NULL,
+#endif
 
   WDI_ProcessHT40OBSSScanInd,        /*WDI_START_HT40_OBSS_SCAN_IND */
   WDI_ProcessHT40OBSSStopScanInd,    /*WDI_STOP_HT40_OBSS_SCAN_IND */
@@ -515,6 +561,21 @@
   WDI_ProcessSetRtsCtsHtvhtInd,       /* WDI_SET_RTS_CTS_HTVHT_IND */
   WDI_ProcessFWLoggingDXEdoneInd,       /* WDI_FW_LOGGING_DXE_DONE_IND */
   WDI_ProcessEnableDisableCAEventInd,   /* WDI_SEND_FREQ_RANGE_CONTROL_IND */
+
+#ifdef WLAN_FEATURE_EXTSCAN
+  WDI_ProcessHighPriorityDataInfoInd,        /* WDI_HIGH_PRIORITY_DATA_INFO_IND */
+#else
+  NULL,
+#endif /* WLAN_FEATURE_EXTSCAN */
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+  WDI_ProcessStartOemDataReqIndNew,           /* WDI_START_OEM_DATA_REQ_IND_NEW */
+#else
+  NULL,
+#endif /* FEATURE_OEM_DATA_SUPPORT */
+  WDI_ProcessGetCurrentAntennaIndex,          /* WDI_ANTENNA_DIVERSITY_SELECTION_REQ  */
+  WDI_ProcessBcnMissPenaltyCount,             /* WDI_MODIFY_ROAM_PARAMS_IND */
+  WDI_ProcessSetAllowedActionFramesInd,  /* WDI_SET_ALLOWED_ACTION_FRAMES_IND */
 };
 
 
@@ -697,6 +758,17 @@
 #else
     NULL,
 #endif /* FEATURE_WLAN_LPHB */
+#ifdef WLAN_FEATURE_RMC
+  WDI_ProcessRMCRulerResp,          /* WDI_RMC_RULER_RESP */
+#else
+    NULL,
+#endif /* WLAN_FEATURE_RMC */
+
+#ifdef WLAN_FEATURE_RMC
+  WDI_ProcessIbssPeerInfoRsp,       /* WDI_HAL_GET_IBSS_PEER_INFO_RSP */
+#else
+  NULL,
+#endif /* WLAN_FEATURE_RMC */
 
 #ifdef FEATURE_WLAN_BATCH_SCAN
     WDI_ProcessSetBatchScanRsp,        /* WDI_SET_BATCH_SCAN_RESP */
@@ -728,8 +800,8 @@
     WDI_ProcessEXTScanGetCapabilitiesRsp,      /* WDI_EXTSCAN_GET_CAPABILITIES_RSP */
     WDI_ProcessEXTScanSetHotlistBSSIDRsp,      /* WDI_EXTSCAN_SET_HOTLIST_BSSID_RSP */
     WDI_ProcessEXTScanResetHotlistBSSIDRsp,    /* WDI_EXTSCAN_RESET_HOTLIST_BSSID_RSP */
-    WDI_ProcessEXTScanSetSignfRSSIChangeRsp,   /* WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP */
-    WDI_ProcessEXTScanResetSignfRSSIChangeRsp, /* WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP */
+    WDI_ProcessEXTScanSetHotlistSSIDRsp,      /* WDI_EXTSCAN_SET_HOTLIST_SSID_RSP */
+    WDI_ProcessEXTScanResetHotlistSSIDRsp,    /* WDI_EXTSCAN_RESET_HOTLIST_SSID_RSP */
 #else
     NULL,
     NULL,
@@ -753,6 +825,18 @@
     WDI_ProcessMonStartRsp,                    /* WDI_MON_START_RSP*/
     WDI_ProcessMonStopRsp,                    /* WDI_MON_STOP_RSP*/
     WDI_ProcessFatalEventLogsRsp,              /*WDI_FATAL_EVENT_LOGGING_RSP*/
+    WDI_ProcessFwrMemDumpRsp,                 /* WDI_FWR_MEM_DUMP_RSP */
+    WDI_ProcessRssiMonitorStartRsp,            /* WDI_START_RSSI_MONITOR_RSP*/
+    WDI_ProcessRssiMonitorStopRsp,             /* WDI_STOP_RSSI_MONITOR_RSP*/
+
+    WDI_ProcessWificonfigSetRsp,                   /* /WDI_WIFI_CONFIG_SET_RSP*/
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    WDI_ProcessPERRoamScanOffloadRsp, /* WDI_PER_ROAM_SCAN_OFFLOAD_RSP */
+    WDI_ProcessPERRoamScanTriggerRsp, /* WDI_PER_ROAM_SCAN_TRIGGER_RSP */
+#else
+    NULL,
+    NULL,
+#endif
   /*---------------------------------------------------------------------
     Indications
   ---------------------------------------------------------------------*/
@@ -800,14 +884,26 @@
 
   WDI_ProcessPeriodicTxPtrnFwInd,   /* WDI_HAL_PERIODIC_TX_PTRN_FW_IND */
 
+#ifdef WLAN_FEATURE_RMC
+  WDI_ProcessRMCUpdateIndToHost,       /* WDI_RMC_UPDATE_IND_TO_HOST */
+#else
+    NULL,
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
   WDI_ProcessBatchScanResultInd,     /* WDI_BATCHSCAN_RESULT_IND */
 #else
   NULL,
 #endif
 
+#ifdef WLAN_FEATURE_RMC
+  WDI_ProcessTXFailInd,                 /*WDI_HAL_TX_FAIL_IND*/
+#else
+  NULL,
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_CH_AVOID
-    WDI_ProcessChAvoidInd,               /* WDI_LBP_UPDATE_IND_TO_HOST */
+    WDI_ProcessChAvoidInd,               /* WDI_HAL_CH_AVOID_IND */
 #else
    NULL,
 #endif /* FEATURE_WLAN_CH_AVOID */
@@ -823,7 +919,7 @@
   WDI_ProcessEXTScanScanAvailableInd,       /* WDI_HAL_EXTSCAN_SCAN_AVAILABLE_IND */
   WDI_ProcessEXTScanResultInd,              /* WDI_HAL_EXTSCAN_RESULT_IND */
   WDI_ProcessEXTScanBssidHotListResultInd,  /* WDI_HAL_EXTSCAN_BSSID_HOTLIST_RESULT_IND */
-  WDI_ProcessEXTScanSignfRssiResultInd,     /* WDI_HAL_EXTSCAN_SIG_RSSI_RESULT_IND */
+  WDI_ProcessEXTScanSsidHotListResultInd,  /* WDI_HAL_EXTSCAN_SSID_HOTLIST_RESULT_IND */
 #else
   NULL,
   NULL,
@@ -839,6 +935,13 @@
   WDI_delBaInd,                             /* WDI_HAL_DEL_BA_IND*/
   WDI_ProcessNanEvent,                      /* WDI_HAL_NAN_EVENT */
   WDI_Process_LostLinkParamInd,             /* WDI_HAL_LOST_LINK_PARAMS_IND*/
+  WDI_Process_RssiBreachedInd,             /* WDI_HAL_RSSI_BREACHED_IND */
+#ifdef FEATURE_OEM_DATA_SUPPORT
+  WDI_ProcessStartOemDataRspIndNew,         /* WDI_HAL_START_OEM_DATA_RSP_IND_NEW */
+#else
+  NULL,
+#endif
+  WDI_ProcessGetCurrentAntennaIndexRsp,     /* WDI_ANTENNA_DIVERSITY_SELECTION_RSP */
 };
 
 
@@ -1154,6 +1257,9 @@
     CASE_RETURN_STRING( WDI_STOP_BATCH_SCAN_IND );
     CASE_RETURN_STRING( WDI_TRIGGER_BATCH_SCAN_RESULT_IND);
 #endif
+#ifdef WLAN_FEATURE_RMC
+    CASE_RETURN_STRING( WDI_TX_FAIL_MONITOR_IND );
+#endif /* WLAN_FEATURE_RMC */
     CASE_RETURN_STRING(WDI_START_HT40_OBSS_SCAN_IND);
     CASE_RETURN_STRING(WDI_STOP_HT40_OBSS_SCAN_IND);
     CASE_RETURN_STRING(WDI_UPDATE_CHAN_REQ);
@@ -1169,8 +1275,9 @@
     CASE_RETURN_STRING( WDI_EXTSCAN_GET_CAPABILITIES_REQ);
     CASE_RETURN_STRING( WDI_EXTSCAN_SET_BSSID_HOTLIST_REQ);
     CASE_RETURN_STRING( WDI_EXTSCAN_RESET_BSSID_HOTLIST_REQ);
-    CASE_RETURN_STRING( WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ);
-    CASE_RETURN_STRING( WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ);
+    CASE_RETURN_STRING( WDI_EXTSCAN_SET_SSID_HOTLIST_REQ);
+    CASE_RETURN_STRING( WDI_EXTSCAN_RESET_SSID_HOTLIST_REQ);
+    CASE_RETURN_STRING( WDI_HIGH_PRIORITY_DATA_INFO_IND);
 #endif /* WLAN_FEATURE_EXTSCAN */
     CASE_RETURN_STRING( WDI_SPOOF_MAC_ADDR_REQ);
     CASE_RETURN_STRING( WDI_GET_FW_STATS_REQ);
@@ -1183,6 +1290,13 @@
     CASE_RETURN_STRING( WDI_MON_STOP_REQ );
     CASE_RETURN_STRING( WDI_FATAL_EVENT_LOGGING_REQ );
     CASE_RETURN_STRING( WDI_SEND_FREQ_RANGE_CONTROL_IND );
+    CASE_RETURN_STRING( WDI_FWR_MEM_DUMP_REQ);
+    CASE_RETURN_STRING( WDI_START_RSSI_MONITOR_REQ );
+    CASE_RETURN_STRING( WDI_STOP_RSSI_MONITOR_REQ );
+    CASE_RETURN_STRING( WDI_START_OEM_DATA_REQ_IND_NEW );
+    CASE_RETURN_STRING( WDI_ANTENNA_DIVERSITY_SELECTION_REQ );
+    CASE_RETURN_STRING( WDI_MODIFY_ROAM_PARAMS_IND );
+    CASE_RETURN_STRING( WDI_SET_ALLOWED_ACTION_FRAMES_IND );
     default:
         return "Unknown WDI MessageId";
   }
@@ -1287,6 +1401,12 @@
     CASE_RETURN_STRING( WDI_SHUTDOWN_RESP );
     CASE_RETURN_STRING( WDI_SET_POWER_PARAMS_RESP );
     CASE_RETURN_STRING( WDI_GET_ROAM_RSSI_RESP );
+#ifdef WLAN_FEATURE_RMC
+    CASE_RETURN_STRING( WDI_RMC_RULER_RESP );
+    CASE_RETURN_STRING( WDI_RMC_UPDATE_IND_TO_HOST );
+
+    CASE_RETURN_STRING( WDI_HAL_IBSS_PEER_INFO_RSP );
+#endif /* WLAN_FEATURE_RMC */
 #ifdef FEATURE_WLAN_BATCH_SCAN
     CASE_RETURN_STRING( WDI_SET_BATCH_SCAN_RESP);
 #endif
@@ -1305,20 +1425,31 @@
     CASE_RETURN_STRING( WDI_EXTSCAN_GET_CAPABILITIES_RSP);
     CASE_RETURN_STRING( WDI_EXTSCAN_SET_HOTLIST_BSSID_RSP);
     CASE_RETURN_STRING( WDI_EXTSCAN_RESET_HOTLIST_BSSID_RSP);
-    CASE_RETURN_STRING( WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP);
-    CASE_RETURN_STRING( WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP);
+    CASE_RETURN_STRING( WDI_EXTSCAN_SET_HOTLIST_SSID_RSP);
+    CASE_RETURN_STRING( WDI_EXTSCAN_RESET_HOTLIST_SSID_RSP);
     CASE_RETURN_STRING( WDI_HAL_EXTSCAN_PROGRESS_IND);
     CASE_RETURN_STRING( WDI_HAL_EXTSCAN_SCAN_AVAILABLE_IND);
     CASE_RETURN_STRING( WDI_HAL_EXTSCAN_RESULT_IND);
     CASE_RETURN_STRING( WDI_HAL_EXTSCAN_BSSID_HOTLIST_RESULT_IND);
-    CASE_RETURN_STRING( WDI_HAL_EXTSCAN_SIG_RSSI_RESULT_IND);
-
+    CASE_RETURN_STRING( WDI_HAL_EXTSCAN_SSID_HOTLIST_RESULT_IND);
 #endif /* WLAN_FEATURE_EXTSCAN */
     CASE_RETURN_STRING( WDI_GET_FW_STATS_RSP);
     CASE_RETURN_STRING( WDI_ENCRYPT_MSG_RSP);
     CASE_RETURN_STRING( WDI_FW_LOGGING_INIT_RSP);
     CASE_RETURN_STRING( WDI_GET_FRAME_LOG_RSP);
     CASE_RETURN_STRING (WDI_FATAL_EVENT_LOGGING_RSP);
+    CASE_RETURN_STRING( WDI_FWR_MEM_DUMP_RSP);
+    CASE_RETURN_STRING (WDI_START_RSSI_MONITOR_RSP);
+    CASE_RETURN_STRING (WDI_STOP_RSSI_MONITOR_RSP);
+    CASE_RETURN_STRING( WDI_WIFI_CONFIG_SET_RSP);
+#ifdef FEATURE_OEM_DATA_SUPPORT
+    CASE_RETURN_STRING (WDI_HAL_START_OEM_DATA_RSP_IND_NEW);
+#endif
+    CASE_RETURN_STRING (WDI_ANTENNA_DIVERSITY_SELECTION_RSP);
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    CASE_RETURN_STRING (WDI_PER_ROAM_SCAN_OFFLOAD_RSP);
+    CASE_RETURN_STRING (WDI_PER_ROAM_SCAN_TRIGGER_RSP);
+#endif
     default:
         return "Unknown WDI MessageId";
   }
@@ -1447,6 +1578,9 @@
                      case EXTENDED_SCAN: snprintf(pCapStr, sizeof("EXTENDED_SCAN"), "%s", "EXTENDED_SCAN");
                           pCapStr += strlen("EXTENDED_SCAN");
                           break;
+                     case EXT_SCAN_ENHANCED: snprintf(pCapStr, sizeof("EXT_SCAN_ENHANCED"), "%s", "EXT_SCAN_ENHANCED");
+                          pCapStr += strlen("EXT_SCAN_ENHANCED");
+                          break;
 #endif
                      case MU_MIMO: snprintf(pCapStr, sizeof("MU_MIMO"), "%s", "MU_MIMO");
                           pCapStr += strlen("MU_MIMO");
@@ -1484,8 +1618,29 @@
                      case LOGGING_ENHANCEMENT: snprintf(pCapStr, sizeof("LOGGING_ENHANCEMENT"), "%s", "LOGGING_ENHANCEMENT");
                           pCapStr += strlen("LOGGING_ENHANCEMENT");
                           break;
-
-
+                     case MEMORY_DUMP_SUPPORTED:snprintf(pCapStr, sizeof("FW_MEM_DUMP_LOGGING"), "%s", "FW_MEM_DUMP_LOGGING");
+                          pCapStr += strlen("FW_MEM_DUMP_LOGGING");
+                          break;
+                     case PER_PKT_STATS_SUPPORTED: snprintf(pCapStr, sizeof("PER_PKT_STATS_SUPPORTED"), "%s", "PER_PKT_STATS_SUPPORTED");
+                          pCapStr += strlen("PER_PKT_STATS_SUPPORTED");
+                          break;
+                     case EXT_LL_STAT: snprintf(pCapStr, sizeof("EXT_LL_STAT"), "%s", "EXT_LL_STAT");
+                          pCapStr += strlen("EXT_LL_STAT");
+                          break;
+                     case RTT3: snprintf(pCapStr, sizeof("RTT3"), "%s", "RTT3");
+                          pCapStr += strlen("RTT3");
+                          break;
+                     case ANTENNA_DIVERSITY_SELECTION:
+                          snprintf(pCapStr,
+                          sizeof("ANTENNA_DIVERSITY_SELECTION"), "%s",
+                                 "ANTENNA_DIVERSITY_SELECTION");
+                          pCapStr += strlen("ANTENNA_DIVERSITY_SELECTION");
+                          break;
+                     case PER_BASED_ROAMING:
+                          snprintf(pCapStr, sizeof("PER_BASED_ROAMING"),
+                                         "%s", "PER_BASED_ROAMING");
+                          pCapStr += strlen("PER_BASED_ROAMING");
+                          break;
                  }
                  *pCapStr++ = ',';
                  *pCapStr++ = ' ';
@@ -1552,6 +1707,30 @@
   }
 }
 
+/**
+ * wdi_state_info_dump() - prints state information of wdi layer
+ */
+static void wdi_state_info_dump(void)
+{
+    WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                "%s pending commands: %d", __func__,
+                gWDICb.wptPendingQueue.count);
+    WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                "uGlobalState %d wdiExpectedResponse: %d",
+                gWDICb.uGlobalState, gWDICb.wdiExpectedResponse);
+}
+
+
+/**
+ * wdi_register_debug_callback() - registration function for wdi layer
+ * to print WDI state information
+  */
+static void wdi_register_debug_callback(void)
+{
+    vos_register_debug_callback(VOS_MODULE_ID_WDI, &wdi_state_info_dump);
+}
+
+
 /*========================================================================
 
                              INITIALIZATION APIs
@@ -1787,6 +1966,9 @@
   pWdiDevCapability->bFrameXtlSupported = eWLAN_PAL_FALSE;
   pWdiDevCapability->ucMaxSTASupported  = gWDICb.ucMaxStations;
   pWdiDevCapability->ucMaxBSSSupported  = gWDICb.ucMaxBssids;
+
+  wdi_register_debug_callback();
+
   return WDI_STATUS_SUCCESS;
 
   /* ERROR handlers
@@ -4245,7 +4427,7 @@
 WDI_Status
 WDI_FWLoggingDXEdoneInd
 (
-  WDI_FWLoggingDXEdoneIndInfoType*    pwdiFWLoggingDXEdoneInd
+  wpt_uint32    data
 )
 {
 
@@ -4267,8 +4449,8 @@
     Fill in Event data and post to the Main FSM
   ------------------------------------------------------------------------*/
   wdiEventData.wdiRequest      = WDI_FW_LOGGING_DXE_DONE_IND;
-  wdiEventData.pEventData      = pwdiFWLoggingDXEdoneInd;
-  wdiEventData.uEventDataSize  = sizeof(*pwdiFWLoggingDXEdoneInd);
+  wdiEventData.pEventData      = (void *)&data;
+  wdiEventData.uEventDataSize  = sizeof(wpt_uint32);
   wdiEventData.pCBfnc          = NULL;
   wdiEventData.pUserData       = NULL;
 
@@ -4448,6 +4630,180 @@
    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
 }
 
+
+/**
+ @brief WDI_FwrMemDumpReq will be called when the upper
+        MAC wants to get fwr mem dump. Upon the call of
+        this API the WLAN DAL will pack and send a HAL
+        Frame logging init request message to
+        the lower RIVA sub-system.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param pWdiFwrMemDumpReq: the fwr mem dump req params
+                      as specified by the Device Interface
+
+        wdiFWLoggingInitReqCb: callback for passing back the
+        response of the frame logging init operation received
+        from the device
+
+        pUserData: user data will be passed back with the
+        callback
+
+ @return Result of the function call
+*/
+
+WDI_Status
+WDI_FwrMemDumpReq
+
+(
+   WDI_FwrMemDumpReqType          *pwdiFwrMemDumpReqInfo,
+   WDI_FwrMemDumpCb                wdiFwrMemDumpRspCb,
+   void*                           pUserData
+)
+{
+   WDI_EventInfoType      wdiEventData;
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+     return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   /*------------------------------------------------------------------------
+     Fill in Event data and post to the Main FSM
+   ------------------------------------------------------------------------*/
+   wdiEventData.wdiRequest      = WDI_FWR_MEM_DUMP_REQ;
+   wdiEventData.pEventData      = pwdiFwrMemDumpReqInfo;
+   wdiEventData.uEventDataSize  = sizeof(WDI_FwrMemDumpReqType);
+   wdiEventData.pCBfnc          = wdiFwrMemDumpRspCb;
+   wdiEventData.pUserData       = pUserData;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+
+
+/**
+ @brief WDI_StartRssiMonitorReq will be called when the upper
+        MAC wants to initialize Rssi Monitor on a bssid.
+        Upon the call of this API the WLAN DAL will pack and
+        send a HAL Rssi Monitor init request message to
+        the lower RIVA sub-system.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param pwdiRssiMonitorInfo: the Rssi Monitor params
+                      as specified by the Device Interface
+
+        wdiRssiMonitorStartRspCb: callback for passing back the
+        response of the rssi monitor operation received
+        from the device
+
+        pUserData: user data will be passed back with the
+        callback
+
+ @return Result of the function call
+*/
+WDI_Status
+WDI_StartRssiMonitorReq
+(
+   WDI_RssiMonitorReqInfoType          *pwdiRssiMonitorInfo,
+   WDI_RssiMonitorStartRspCb            wdiRssiMonitorStartRspCb,
+   void*                                pUserData
+)
+{
+   WDI_EventInfoType      wdiEventData;
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+     return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   /*------------------------------------------------------------------------
+     Fill in Event data and post to the Main FSM
+   ------------------------------------------------------------------------*/
+   wdiEventData.wdiRequest      = WDI_START_RSSI_MONITOR_REQ;
+   wdiEventData.pEventData      = pwdiRssiMonitorInfo;
+   wdiEventData.uEventDataSize  = sizeof(*pwdiRssiMonitorInfo);
+   wdiEventData.pCBfnc          = wdiRssiMonitorStartRspCb;
+   wdiEventData.pUserData       = pUserData;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief WDI_StopRssiMonitorReq will be called when the upper
+        MAC wants to stop Rssi Monitor on a bssid.
+        Upon the call of this API the WLAN DAL will pack and
+        send a HAL Rssi Monitor stop request message to
+        the lower RIVA sub-system.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param pwdiRssiMonitorInfo: the Rssi Monitor params
+                      as specified by the Device Interface
+
+        wdiRssiMonitorStopRspCb: callback for passing back the
+        response of the rssi monitor operation received
+        from the device
+
+        pUserData: user data will be passed back with the
+        callback
+
+ @return Result of the function call
+*/
+WDI_Status
+WDI_StopRssiMonitorReq
+(
+   WDI_RssiMonitorReqInfoType          *pwdiRssiMonitorInfo,
+   WDI_RssiMonitorStopRspCb            wdiRssiMonitorStopRspCb,
+   void*                               pUserData
+)
+{
+   WDI_EventInfoType      wdiEventData;
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+     return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   /*------------------------------------------------------------------------
+     Fill in Event data and post to the Main FSM
+   ------------------------------------------------------------------------*/
+   wdiEventData.wdiRequest      = WDI_STOP_RSSI_MONITOR_REQ;
+   wdiEventData.pEventData      = pwdiRssiMonitorInfo;
+   wdiEventData.uEventDataSize  = sizeof(*pwdiRssiMonitorInfo);
+   wdiEventData.pCBfnc          = wdiRssiMonitorStopRspCb;
+   wdiEventData.pUserData       = pUserData;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+
 /**
  @brief WDI_ConfigureRxpFilterReq will be called when the upper
         MAC wants to set/reset the RXP filters for received pkts
@@ -5843,6 +6199,7 @@
  @param wdiAddBAReqParams: the add BA parameters as specified by
                       the Device Interface
 
+        baReqParamUserDataSize: user data size of wdiAddBAReqParams
         wdiAddBARspCb: callback for passing back the response of
         the add BA operation received from the device
 
@@ -5856,6 +6213,7 @@
 WDI_TriggerBAReq
 (
   WDI_TriggerBAReqParamsType* pwdiTriggerBAReqParams,
+  wpt_uint8                   baReqParamUserDataSize,
   WDI_TriggerBARspCb          wdiTriggerBARspCb,
   void*                       pUserData
 )
@@ -5879,7 +6237,8 @@
   ------------------------------------------------------------------------*/
   wdiEventData.wdiRequest      = WDI_TRIGGER_BA_REQ;
   wdiEventData.pEventData      = pwdiTriggerBAReqParams;
-  wdiEventData.uEventDataSize  = sizeof(*pwdiTriggerBAReqParams);
+  wdiEventData.uEventDataSize  = sizeof(*pwdiTriggerBAReqParams)
+                                      + baReqParamUserDataSize;
   wdiEventData.pCBfnc          = wdiTriggerBARspCb;
   wdiEventData.pUserData       = pUserData;
 
@@ -16399,7 +16758,7 @@
         WDI_ASSERT(0);
     }
   }
-  else
+  else if (WDI_STATUS_SUCCESS != wdiStatus)
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
                "Error returned WDI_ProcessInitScanRspi:%d BMPS%d",
@@ -17720,7 +18079,7 @@
 {
   WDI_LLStatsSetRspCb   wdiLLStatsSetRspCb;
 
-  WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+  WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
               "%s: Enter ", __func__);
   /*-------------------------------------------------------------------------
     Sanity check
@@ -17761,7 +18120,7 @@
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
   }
-  WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+  WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
               "%s: Enter ", __func__);
 
   wdiLLStatsGetRspCb = (WDI_LLStatsGetRspCb)pWDICtx->pfncRspCB;
@@ -17792,7 +18151,7 @@
      return WDI_STATUS_E_FAILURE;
   }
 
-  WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+  WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
               "%s: CLEAR RESPONSE CALL BACK", __func__);
   wdiLLStatsClearRspCb = (WDI_LLStatsClearRspCb)pWDICtx->pfncRspCB;
 
@@ -20493,7 +20852,7 @@
    eHalStatus           halStatus;
    WDI_KeepAliveCb      wdiKeepAliveCb;
    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
-   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
+   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_INFO,
                "Received WDI_ProcessKeepAliveRsp Callback from HAL");
 
 
@@ -21605,6 +21964,64 @@
   return WDI_STATUS_SUCCESS;
 }/*WDI_ProcessTdlsInd*/
 #endif
+
+#ifdef WLAN_FEATURE_RMC
+/**
+*@brief Process Tx Fail Indication
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTXFailInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_LowLevelIndType  wdiInd;
+  tHalTXFailIndMsg     halTXFailIndMsg;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*-------------------------------------------------------------------------
+  Sanity check
+ -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT( 0 );
+     return WDI_STATUS_E_FAILURE;
+  }
+  /*-------------------------------------------------------------------------
+  Extract indication and send it to UMAC
+ -------------------------------------------------------------------------*/
+  wpalMemoryCopy( &halTXFailIndMsg.txFailIndParams,
+                  pEventData->pEventData,
+                  sizeof(halTXFailIndMsg.txFailIndParams) );
+
+  /*Fill in the indication parameters*/
+  wdiInd.wdiIndicationType = WDI_TX_FAIL_IND;
+
+  wdiInd.wdiIndicationData.wdiTXFailInd.seqNo
+                          = halTXFailIndMsg.txFailIndParams.seqNo;
+
+  wpalMemoryCopy(wdiInd.wdiIndicationData.wdiTXFailInd.macAddr,
+                 halTXFailIndMsg.txFailIndParams.macAddr,
+                 sizeof(wdiInd.wdiIndicationData.wdiTXFailInd.macAddr));
+
+  /*Notify UMAC*/
+  if (pWDICtx->wdiLowLevelIndCB)
+     pWDICtx->wdiLowLevelIndCB( &wdiInd, pWDICtx->pIndUserData );
+
+  return WDI_STATUS_SUCCESS;
+}
+#endif /* WLAN_FEATURE_RMC */
+
 /**
 *@brief Process Noa Start Indication function (called when
         an indication of this kind is being received over the
@@ -22408,6 +22825,7 @@
 
   halMsgHeader.msgLen  = sizeof(halMsgHeader) + usBufferLen;
   *pusDataOffset       = sizeof(halMsgHeader);
+
   wpalMemoryCopy(*pMsgBuffer, &halMsgHeader, sizeof(halMsgHeader));
 
   return WDI_STATUS_SUCCESS;
@@ -22958,7 +23376,7 @@
   }/*switch ( pEventData->wdiRequest )*/
 
   if (!(WDI_STATUS_SUCCESS == wdiStatus || WDI_STATUS_PENDING == wdiStatus
-         || WDI_STATUS_SUCCESS_SYNC == wdiStatus))
+     || WDI_STATUS_SUCCESS_SYNC == wdiStatus))
   {
     WDI_ExtractRequestCBFromEvent(pEventData, &pfnReqStatusCB, &pUserData);
 
@@ -24211,6 +24629,16 @@
     return WLAN_HAL_ADD_PERIODIC_TX_PTRN_IND;
   case WDI_DEL_PERIODIC_TX_PATTERN_IND:
     return WLAN_HAL_DEL_PERIODIC_TX_PTRN_IND;
+#ifdef WLAN_FEATURE_RMC
+  case WDI_RMC_RULER_REQ:
+    return WLAN_HAL_RMC_RULER_REQ;
+  case WDI_RMC_UPDATE_IND:
+    return WLAN_HAL_RMC_UPDATE_IND;
+  case WDI_HAL_IBSS_PEER_INFO_REQ:
+    return WLAN_HAL_GET_IBSS_PEER_INFO_REQ;
+#endif /* WLAN_FEATURE_RMC */
+  case WDI_RATE_UPDATE_IND:
+    return WLAN_HAL_RATE_UPDATE_IND;
 
 #ifdef FEATURE_WLAN_BATCH_SCAN
   case WDI_SET_BATCH_SCAN_REQ:
@@ -24220,8 +24648,12 @@
   case WDI_TRIGGER_BATCH_SCAN_RESULT_IND:
        return WLAN_HAL_BATCHSCAN_TRIGGER_RESULT_IND;
 #endif
-  case WDI_RATE_UPDATE_IND:
-    return WLAN_HAL_RATE_UPDATE_IND;
+
+#ifdef WLAN_FEATURE_RMC
+  case WDI_TX_FAIL_MONITOR_IND:
+    return WLAN_HAL_TX_FAIL_MONITOR_IND;
+#endif
+
   case WDI_START_HT40_OBSS_SCAN_IND:
        return WLAN_HAL_START_HT40_OBSS_SCAN_IND;
   case WDI_STOP_HT40_OBSS_SCAN_IND:
@@ -24254,10 +24686,12 @@
        return WLAN_HAL_BSSID_HOTLIST_SET_REQ;
   case WDI_EXTSCAN_RESET_BSSID_HOTLIST_REQ:
        return WLAN_HAL_BSSID_HOTLIST_RESET_REQ;
-  case WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ:
-       return WLAN_HAL_SIG_RSSI_SET_REQ;
-  case WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ:
-       return WLAN_HAL_SIG_RSSI_RESET_REQ;
+  case WDI_EXTSCAN_SET_SSID_HOTLIST_REQ:
+       return WLAN_HAL_SSID_HOTLIST_SET_REQ;
+  case WDI_EXTSCAN_RESET_SSID_HOTLIST_REQ:
+       return WLAN_HAL_SSID_HOTLIST_RESET_REQ;
+  case WDI_HIGH_PRIORITY_DATA_INFO_IND:
+       return WLAN_HAL_HIGH_PRIORITY_DATA_INFO_REQ;
 #endif /* WLAN_FEATURE_EXTSCAN */
   case WDI_SPOOF_MAC_ADDR_REQ:
        return WLAN_HAL_MAC_SPOOFED_SCAN_REQ;
@@ -24283,6 +24717,28 @@
        return WLAN_HAL_FATAL_EVENT_LOGGING_REQ;
   case WDI_SEND_FREQ_RANGE_CONTROL_IND:
        return WLAN_HAL_SEND_FREQ_RANGE_CONTROL_IND;
+  case WDI_FWR_MEM_DUMP_REQ:
+       return WLAN_HAL_FW_MEMORY_DUMP_REQ;
+  case WDI_START_RSSI_MONITOR_REQ:
+       return WLAN_HAL_START_RSSI_MONITORING_REQ;
+  case WDI_STOP_RSSI_MONITOR_REQ:
+       return WLAN_HAL_STOP_RSSI_MONITORING_REQ;
+  case WDI_WIFI_CONFIG_SET_REQ:
+       return WLAN_HAL_WIFI_CONFIG_SET_PARAMS_REQ;
+  case WDI_START_OEM_DATA_REQ_IND_NEW:
+       return WLAN_HAL_START_OEM_DATA_REQ_IND_NEW;
+  case WDI_ANTENNA_DIVERSITY_SELECTION_REQ:
+       return WLAN_HAL_ANTENNA_DIVERSITY_SELECTION_REQ;
+  case WDI_MODIFY_ROAM_PARAMS_IND:
+       return WLAN_HAL_MODIFY_ROAM_PARAMS_IND;
+  case WDI_SET_ALLOWED_ACTION_FRAMES_IND:
+       return WLAN_HAL_SET_ALLOWED_ACTION_FRAMES_IND;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+  case WDI_PER_ROAM_SCAN_OFFLOAD_REQ:
+      return WLAN_HAL_SET_PER_ROAM_CONFIG_REQ;
+  case WDI_PER_ROAM_SCAN_TRIGGER_REQ:
+      return WLAN_HAL_PER_ROAM_SCAN_TRIGGER_REQ;
+#endif
   default:
     return WLAN_HAL_MSG_MAX;
   }
@@ -24537,6 +24993,15 @@
   case WLAN_HAL_PERIODIC_TX_PTRN_FW_IND:
     return WDI_HAL_PERIODIC_TX_PTRN_FW_IND;
 
+#ifdef WLAN_FEATURE_RMC
+  case WLAN_HAL_RMC_RULER_RSP:
+    return WDI_RMC_RULER_RESP;
+  case WLAN_HAL_RMC_UPDATE_IND:
+    return WDI_RMC_UPDATE_IND_TO_HOST;
+  case WLAN_HAL_GET_IBSS_PEER_INFO_RSP:
+    return WDI_HAL_IBSS_PEER_INFO_RSP;
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_BATCH_SCAN
   case WLAN_HAL_BATCHSCAN_SET_RSP:
     return WDI_SET_BATCH_SCAN_RESP;
@@ -24544,6 +25009,11 @@
     return WDI_BATCHSCAN_RESULT_IND;
 #endif // FEATURE_WLAN_BATCH_SCAN
 
+#ifdef WLAN_FEATURE_RMC
+  case WLAN_HAL_TX_FAIL_IND:
+    return WDI_HAL_TX_FAIL_IND;
+#endif /* WLAN_FEATURE_RMC */
+
 #ifdef FEATURE_WLAN_CH_AVOID
   case WLAN_HAL_AVOID_FREQ_RANGE_IND:
     return WDI_HAL_CH_AVOID_IND;
@@ -24579,10 +25049,10 @@
        return WDI_EXTSCAN_SET_HOTLIST_BSSID_RSP;
   case WLAN_HAL_BSSID_HOTLIST_RESET_RSP:
        return WDI_EXTSCAN_RESET_HOTLIST_BSSID_RSP;
-  case WLAN_HAL_SIG_RSSI_SET_RSP:
-       return WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP;
-  case WLAN_HAL_SIG_RSSI_RESET_RSP:
-       return WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP;
+  case WLAN_HAL_SSID_HOTLIST_SET_RSP:
+       return WDI_EXTSCAN_SET_HOTLIST_SSID_RSP;
+  case WLAN_HAL_SSID_HOTLIST_RESET_RSP:
+       return WDI_EXTSCAN_RESET_HOTLIST_SSID_RSP;
   case WLAN_HAL_EXT_SCAN_PROGRESS_IND:
        return WDI_HAL_EXTSCAN_PROGRESS_IND;
   case WLAN_HAL_EXT_SCAN_RESULT_AVAILABLE_IND:
@@ -24591,8 +25061,8 @@
        return WDI_HAL_EXTSCAN_RESULT_IND;
   case WLAN_HAL_BSSID_HOTLIST_RESULT_IND:
        return WDI_HAL_EXTSCAN_BSSID_HOTLIST_RESULT_IND;
-  case WLAN_HAL_SIG_RSSI_RESULT_IND:
-       return WDI_HAL_EXTSCAN_SIG_RSSI_RESULT_IND;
+  case WLAN_HAL_SSID_HOTLIST_RESULT_IND:
+       return WDI_HAL_EXTSCAN_SSID_HOTLIST_RESULT_IND;
 #endif /* WLAN_FEATURE_EXTSCAN */
   case WLAN_HAL_MAC_SPOOFED_SCAN_RSP:
        return WDI_SPOOF_MAC_ADDR_RSP;
@@ -24616,6 +25086,28 @@
        return WDI_MON_STOP_RSP;
   case WLAN_HAL_FATAL_EVENT_LOGGING_RSP:
        return WDI_FATAL_EVENT_LOGGING_RSP;
+  case WLAN_HAL_FW_MEMORY_DUMP_RSP:
+       return WDI_FWR_MEM_DUMP_RSP;
+  case WLAN_HAL_START_RSSI_MONITORING_RSP:
+       return WDI_START_RSSI_MONITOR_RSP;
+  case WLAN_HAL_STOP_RSSI_MONITORING_RSP:
+       return WDI_STOP_RSSI_MONITOR_RSP;
+  case WLAN_HAL_RSSI_MONITORING_IND:
+       return WDI_HAL_RSSI_BREACHED_IND;
+  case WLAN_HAL_WIFI_CONFIG_SET_PARAMS_RSP:
+       return WDI_WIFI_CONFIG_SET_RSP;
+#ifdef FEATURE_OEM_DATA_SUPPORT
+  case WLAN_HAL_START_OEM_DATA_RSP_IND_NEW:
+       return WDI_HAL_START_OEM_DATA_RSP_IND_NEW;
+#endif /* FEATURE_OEM_DATA_SUPPORT */
+  case WLAN_HAL_ANTENNA_DIVERSITY_SELECTION_RSP:
+       return WDI_ANTENNA_DIVERSITY_SELECTION_RSP;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+  case WLAN_HAL_SET_PER_ROAM_CONFIG_RSP:
+       return WDI_PER_ROAM_SCAN_OFFLOAD_RSP;
+  case WLAN_HAL_PER_ROAM_SCAN_TRIGGER_RSP:
+       return WDI_PER_ROAM_SCAN_TRIGGER_RSP;
+#endif
   default:
     return eDRIVER_TYPE_MAX;
   }
@@ -25249,7 +25741,11 @@
   phalConfigBSS->dualCTSProtection        = pwdiConfigBSS->ucDualCTSProtection;
   phalConfigBSS->ucMaxProbeRespRetryLimit = pwdiConfigBSS->ucMaxProbeRespRetryLimit;
   phalConfigBSS->bHiddenSSIDEn            = pwdiConfigBSS->bHiddenSSIDEn;
-  phalConfigBSS->bProxyProbeRespEn        = pwdiConfigBSS->bProxyProbeRespEn;
+
+  if (vos_is_probe_rsp_offload_enabled())
+     phalConfigBSS->bProxyProbeRespEn = 1;
+  else
+     phalConfigBSS->bProxyProbeRespEn = pwdiConfigBSS->bProxyProbeRespEn;
 
 #ifdef WLAN_FEATURE_VOWIFI
   phalConfigBSS->maxTxPower               = pwdiConfigBSS->cMaxTxPower;
@@ -26372,6 +26868,53 @@
    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
 }
 
+WDI_Status
+WDI_PERRoamScanOffloadReq(WDI_PERRoamOffloadScanInfo
+                          *pwdiPERRoamScanOffloadReqParams,
+                          WDI_PERRoamOffloadScanCb wdiPERRoamOffloadScancb,
+                          void *pUserData)
+{
+   WDI_EventInfoType wdiEventData = {{0}};
+
+   if (eWLAN_PAL_FALSE == gWDIInitialized) {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+     return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   wdiEventData.wdiRequest      = WDI_PER_ROAM_SCAN_OFFLOAD_REQ;
+   wdiEventData.pEventData      = pwdiPERRoamScanOffloadReqParams;
+   wdiEventData.uEventDataSize  = sizeof(*pwdiPERRoamScanOffloadReqParams);
+   wdiEventData.pCBfnc          = wdiPERRoamOffloadScancb;
+   wdiEventData.pUserData       = pUserData;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+WDI_Status
+WDI_PERRoamScanTriggerReq(WDI_PERRoamTriggerScanInfo
+                          *pwdiPERRoamScanTriggerReqParams,
+                          WDI_PERRoamTriggerScanCb wdiPERRoamTriggerScancb,
+                          void *pUserData)
+{
+   WDI_EventInfoType      wdiEventData = {{0}};
+   if (eWLAN_PAL_FALSE == gWDIInitialized) {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+     return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   wdiEventData.wdiRequest      = WDI_PER_ROAM_SCAN_TRIGGER_REQ;
+   wdiEventData.pEventData      = pwdiPERRoamScanTriggerReqParams;
+   wdiEventData.uEventDataSize  = sizeof(*pwdiPERRoamScanTriggerReqParams);
+   wdiEventData.pCBfnc          = wdiPERRoamTriggerScancb;
+   wdiEventData.pUserData       = pUserData;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
 void
 WDI_wdiEdTypeEncToEdTypeEnc(tEdType *EdType, WDI_EdType wdiEdType)
 {
@@ -26608,6 +27151,123 @@
                wdiRoamOffloadScancb, pEventData->pUserData, WDI_ROAM_SCAN_OFFLOAD_RESP);
 }
 
+
+WDI_Status
+WDI_ProcessPERRoamScanOffloadReq(WDI_ControlBlockType *pWDICtx,
+                                 WDI_EventInfoType *pEventData)
+{
+   wpt_uint16 usSendSize = 0;
+   wpt_uint16 usDataOffset = 0;
+   wpt_uint8 *pSendBuffer = NULL;
+   WDI_PERRoamOffloadScanInfo *wdiPERRoamOffloadReq = NULL;
+   WDI_PERRoamOffloadScanCb wdiPERRoamOffloadScancb = NULL;
+   tSetPerRoamConfigReq halPERRoamConfigReq;
+
+   wdiPERRoamOffloadReq = (WDI_PERRoamOffloadScanInfo *)pEventData->pEventData;
+   wdiPERRoamOffloadScancb   = (WDI_PERRoamOffloadScanCb)pEventData->pCBfnc;
+
+   if ((!pEventData) || (!wdiPERRoamOffloadReq)|| (!wdiPERRoamOffloadScancb)) {
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                  "%s: Invalid parameters", __func__);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+   }
+
+    if ((WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(pWDICtx,
+                    WDI_PER_ROAM_SCAN_OFFLOAD_REQ,
+                    sizeof(halPERRoamConfigReq.perRoamConfigParams),
+                    &pSendBuffer, &usDataOffset, &usSendSize))||
+                    (usSendSize < (usDataOffset +
+                    sizeof(halPERRoamConfigReq.perRoamConfigParams)))) {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer halPERRoamConfigReq Req");
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+   }
+
+   halPERRoamConfigReq.perRoamConfigParams.request_id =
+                     wdiPERRoamOffloadReq->requestId;
+   halPERRoamConfigReq.perRoamConfigParams.waitPeriodForNextPERScan =
+                     wdiPERRoamOffloadReq->waitPeriodForNextPERScan;
+   halPERRoamConfigReq.perRoamConfigParams.rateUpThreshold =
+                     wdiPERRoamOffloadReq->rateUpThreshold;
+   halPERRoamConfigReq.perRoamConfigParams.rateDownThreshold =
+                     wdiPERRoamOffloadReq->rateDownThreshold;
+   halPERRoamConfigReq.perRoamConfigParams.isPERRoamCCAEnabled =
+                     wdiPERRoamOffloadReq->isPERRoamCCAEnabled;
+   halPERRoamConfigReq.perRoamConfigParams.PERroamTriggerPercent =
+                     wdiPERRoamOffloadReq->PERroamTriggerPercent;
+   halPERRoamConfigReq.perRoamConfigParams.PERtimerThreshold =
+                     wdiPERRoamOffloadReq->PERtimerThreshold;
+
+   halPERRoamConfigReq.perRoamConfigParams.reserved = 0;
+
+   wpalMemoryCopy(pSendBuffer+usDataOffset,
+                   &halPERRoamConfigReq.perRoamConfigParams,
+                   sizeof(halPERRoamConfigReq.perRoamConfigParams));
+
+   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_INFO,
+          "request_id %d waitPeriodForNextPERScan=%d rateUpThreshold=%d rateDownThreshold=%d isPERRoamCCAEnabled=%d PERtimerThreshold=%d PERroamTriggerPercent =%d",
+          halPERRoamConfigReq.perRoamConfigParams.request_id,
+          halPERRoamConfigReq.perRoamConfigParams.waitPeriodForNextPERScan,
+          halPERRoamConfigReq.perRoamConfigParams.rateUpThreshold,
+          halPERRoamConfigReq.perRoamConfigParams.rateDownThreshold,
+          halPERRoamConfigReq.perRoamConfigParams.isPERRoamCCAEnabled,
+          halPERRoamConfigReq.perRoamConfigParams.PERtimerThreshold,
+          halPERRoamConfigReq.perRoamConfigParams.PERroamTriggerPercent);
+   return  WDI_SendMsg(pWDICtx, pSendBuffer, usSendSize,
+               wdiPERRoamOffloadScancb, pEventData->pUserData,
+               WDI_PER_ROAM_SCAN_OFFLOAD_RSP);
+}
+
+WDI_Status
+WDI_ProcessPERRoamScanTriggerReq(WDI_ControlBlockType *pWDICtx,
+                                 WDI_EventInfoType *pEventData)
+{
+   wpt_uint16 usSendSize = 0;
+   wpt_uint16 usDataOffset = 0;
+   wpt_uint8 *pSendBuffer = NULL;
+   WDI_PERRoamTriggerScanCb wdiPERRoamTriggerScancb  = NULL;
+   WDI_PERRoamTriggerScanInfo *wdiPERRoamTriggerReq;
+   tStartRoamScanReq halPERRoamTriggerReq;
+
+   wdiPERRoamTriggerReq = (WDI_PERRoamTriggerScanInfo *) pEventData->pEventData;
+   wdiPERRoamTriggerScancb   = (WDI_PERRoamTriggerScanCb)pEventData->pCBfnc;
+
+   if ((!pEventData) || (!wdiPERRoamTriggerReq) || (!wdiPERRoamTriggerScancb)) {
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                  "%s: Invalid parameters", __func__);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+   }
+
+   if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(pWDICtx,
+                    WDI_PER_ROAM_SCAN_TRIGGER_REQ,
+                    sizeof(halPERRoamTriggerReq.startRoamScanTriggerParams),
+                    &pSendBuffer, &usDataOffset, &usSendSize))||
+                    (usSendSize < (usDataOffset +
+                    sizeof(halPERRoamTriggerReq.startRoamScanTriggerParams)))) {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in GetFrameLog Req");
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+   }
+
+   halPERRoamTriggerReq.startRoamScanTriggerParams.roamScanReq =
+                     wdiPERRoamTriggerReq->roamScanReq;
+
+   wpalMemoryCopy(pSendBuffer+usDataOffset,
+                   &halPERRoamTriggerReq.startRoamScanTriggerParams,
+                   sizeof(halPERRoamTriggerReq.startRoamScanTriggerParams));
+
+   return  WDI_SendMsg(pWDICtx, pSendBuffer, usSendSize,
+               wdiPERRoamTriggerScancb, pEventData->pUserData,
+               WDI_PER_ROAM_SCAN_TRIGGER_RSP);
+}
+
+
+
+
 /**
  @brief Process Start Roam Candidate Lookup Rsp function (called when a
         response is being received over the bus from HAL)
@@ -26656,6 +27316,63 @@
 
    return WDI_STATUS_SUCCESS;
 }/* WDI_ProcessRoamScanOffloadRsp  */
+
+WDI_Status
+WDI_ProcessPERRoamScanOffloadRsp(WDI_ControlBlockType *pWDICtx,
+                                 WDI_EventInfoType *pEventData)
+{
+   WDI_Status                   wdiStatus;
+   eHalStatus                   halStatus;
+   WDI_PERRoamOffloadScanCb     wdiPERRoamOffloadScancb = NULL;
+
+   if ((NULL == pWDICtx) || (NULL == pEventData) ||
+       (NULL == pEventData->pEventData)) {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                  "%s: Invalid parameters", __func__);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+   }
+
+   wdiPERRoamOffloadScancb = (WDI_PERRoamOffloadScanCb)pWDICtx->pfncRspCB;
+
+   halStatus = *((eHalStatus*)pEventData->pEventData);
+   wdiStatus   =   WDI_HAL_2_WDI_STATUS(halStatus);
+
+   /*Notify UMAC*/
+   wdiPERRoamOffloadScancb(wdiStatus, pWDICtx->pRspCBUserData);
+
+   return WDI_STATUS_SUCCESS;
+}/* WDI_ProcessPERRoamScanOffloadRsp  */
+
+WDI_Status
+WDI_ProcessPERRoamScanTriggerRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+   WDI_Status                   wdiStatus;
+   eHalStatus                   halStatus;
+   WDI_PERRoamOffloadScanCb     wdiPERRoamTriggerScancb = NULL;
+
+   if ((NULL == pWDICtx) || (NULL == pEventData) ||
+       (NULL == pEventData->pEventData)) {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                  "%s: Invalid parameters", __func__);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+   }
+
+   wdiPERRoamTriggerScancb = (WDI_PERRoamTriggerScanCb)pWDICtx->pfncRspCB;
+
+   halStatus = *((eHalStatus*)pEventData->pEventData);
+   wdiStatus   =   WDI_HAL_2_WDI_STATUS(halStatus);
+
+   /* Notify UMAC */
+   wdiPERRoamTriggerScancb(wdiStatus, pWDICtx->pRspCBUserData);
+
+   return WDI_STATUS_SUCCESS;
+}/* WDI_ProcessPERRoamScanTriggerRsp  */
 #endif
 
 /**
@@ -28502,6 +29219,44 @@
    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
 }
 
+#ifdef WLAN_FEATURE_RMC
+/**
+ @brief WDI_TXFailMonitorInd
+        Host will send an event to the FW to start TX Fail Monitor
+
+ @param
+        WDI_TXFailMonitorInd
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_TXFailMonitorStartStopInd
+(
+  WDI_TXFailMonitorInd *wdiTXFailMonitorInd
+)
+{
+   WDI_EventInfoType   wdiEventData;
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+      return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   wdiEventData.wdiRequest      = WDI_TX_FAIL_MONITOR_IND;
+   wdiEventData.pEventData      = wdiTXFailMonitorInd;
+   wdiEventData.uEventDataSize  = sizeof(wdiTXFailMonitorInd);
+   wdiEventData.pCBfnc          = NULL;
+   wdiEventData.pUserData       = NULL;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+#endif /* WLAN_FEATURE_RMC */
 
 /**
  @brief Process DHCP Start Indication message and post it to HAL
@@ -28649,6 +29404,77 @@
 
 }/*WDI_ProcessDHCPStopInd*/
 
+#ifdef WLAN_FEATURE_RMC
+/**
+ @brief Process TX Fail monitor indication
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTXFailMonitor
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  wpt_uint8*              pSendBuffer           = NULL;
+  wpt_uint16              usDataOffset          = 0;
+  wpt_uint16              usSendSize            = 0;
+  wpt_uint16              usLen                 = 0;
+  WDI_TXFailMonitorInd*   pwdiTxFailMonitorInd  = NULL;
+  tTXFailMonitorInfo*     pTXFailMonitorInfo;
+  WDI_Status           wdiStatus;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+         "%s", __func__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+
+  if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pwdiTxFailMonitorInd = (WDI_TXFailMonitorInd*)pEventData->pEventData;
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                        WDI_TX_FAIL_MONITOR_IND,
+                        sizeof(tDHCPInfo),
+                        &pSendBuffer, &usDataOffset, &usSendSize))||
+      ( usSendSize < (usDataOffset + usLen )))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+              "Unable to get send buffer in DHCP Start req %p ",
+                pEventData);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pTXFailMonitorInfo = (tTXFailMonitorInfo*)pSendBuffer+usDataOffset;
+  pTXFailMonitorInfo->tx_fail_count = pwdiTxFailMonitorInd->tx_fail_count;
+
+  pWDICtx->pReqStatusUserData = pwdiTxFailMonitorInd->pUserData;
+  pWDICtx->wdiReqStatusCB = pwdiTxFailMonitorInd->wdiReqStatusCB;
+ /*-------------------------------------------------------------------------
+    Send TX Fail Monitor start/stop indication to HAL
+  -------------------------------------------------------------------------*/
+  wdiStatus = WDI_SendIndication( pWDICtx, pSendBuffer, usSendSize);
+
+  return  (wdiStatus != WDI_STATUS_SUCCESS)?wdiStatus:WDI_STATUS_SUCCESS_SYNC;
+}/*WDI_ProcessTXFailMonitor*/
+#endif /* WLAN_FEATURE_RMC */
 
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 /**
@@ -29556,6 +30382,7 @@
       gpFwWlanFeatCaps->featCaps[2],
       gpFwWlanFeatCaps->featCaps[3]
    );
+
    WPAL_TRACE(  eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_INFO, "Firmware Capability");
    WDI_TraceHostFWCapabilities(gpFwWlanFeatCaps->featCaps);
    wdiFeatureCapsExchangeCb = (WDI_featureCapsExchangeCb) pWDICtx -> pfncRspCB; 
@@ -29923,6 +30750,18 @@
    gWDICb.bEnableSSR = enableSSR;
 }
 
+/**
+ * WDI_SetMgmtPktViaWQ5() - Set INI params sendMgmtPktViaWQ5 to Control
+ *                           Block Type.
+ * @sendMgmtPktViaWQ5: INI params to enable/disable sending mgmt pkt via WQ5.
+ *
+ * Return: void
+ */
+void WDI_SetMgmtPktViaWQ5(wpt_boolean sendMgmtPktViaWQ5)
+{
+   gWDICb.sendMgmtPktViaWQ5 = sendMgmtPktViaWQ5;
+}
+
 
 #ifdef FEATURE_WLAN_LPHB
 /**
@@ -30299,6 +31138,7 @@
 
 } /*WDI_ProcessIbssPeerInactivityInd*/
 
+
 /**
 *@brief WDI_RateUpdateInd will be called when the upper MAC
         requests the device to set rates.
@@ -30409,8 +31249,8 @@
     /* Copy the tx flags */
     pRateUpdateInd->halRateUpdateParams.ucastDataRateTxFlag =
                              pwdiRateUpdateInd->ucastDataRateTxFlag;
-    pRateUpdateInd->halRateUpdateParams.reliableMcastDataRateTxFlag =
-                             pwdiRateUpdateInd->reliableMcastDataRateTxFlag;
+    pRateUpdateInd->halRateUpdateParams.rmcDataRateTxFlag =
+                             pwdiRateUpdateInd->rmcDataRateTxFlag;
     pRateUpdateInd->halRateUpdateParams.mcastDataRate24GHzTxFlag =
                              pwdiRateUpdateInd->mcastDataRate24GHzTxFlag;
     pRateUpdateInd->halRateUpdateParams.mcastDataRate5GHzTxFlag =
@@ -30419,8 +31259,8 @@
     /* Copy the tx rates */
     pRateUpdateInd->halRateUpdateParams.ucastDataRate =
                              pwdiRateUpdateInd->ucastDataRate;
-    pRateUpdateInd->halRateUpdateParams.reliableMcastDataRate =
-                             pwdiRateUpdateInd->reliableMcastDataRate;
+    pRateUpdateInd->halRateUpdateParams.rmcDataRate =
+                             pwdiRateUpdateInd->rmcDataRate;
     pRateUpdateInd->halRateUpdateParams.mcastDataRate24GHz =
                              pwdiRateUpdateInd->mcastDataRate24GHz;
     pRateUpdateInd->halRateUpdateParams.mcastDataRate5GHz =
@@ -30439,7 +31279,608 @@
 
 } /* WDI_ProcessRateUpdateInd */
 
+#ifdef WLAN_FEATURE_RMC
+WDI_Status
+WDI_ProcessRMCRulerResp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  tHalRmcRulerRspMsg halRmcRulerRspMsg;
+  WDI_RmcRulerRspCb wdiRmcRulerRspCb;
+  WDI_RmcRspParamsType wdiRmcRsp;
+
+  /* Sanity check */
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT( 0 );
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  wdiRmcRulerRspCb = (WDI_RmcRulerRspCb)pWDICtx->pfncRspCB;
+
+  /* Extract indication and send it to UMAC */
+  wpalMemoryCopy( &halRmcRulerRspMsg.rulerRspParams,
+                  pEventData->pEventData,
+                  sizeof(halRmcRulerRspMsg.rulerRspParams) );
+
+  wdiRmcRsp.status = halRmcRulerRspMsg.rulerRspParams.status;
+  wpalMemoryCopy(wdiRmcRsp.mcastTransmitter,
+                      &halRmcRulerRspMsg.rulerRspParams.mcastTransmitter,
+                      sizeof(wdiRmcRsp.mcastTransmitter));
+  wpalMemoryCopy(wdiRmcRsp.mcastGroup,
+                      &halRmcRulerRspMsg.rulerRspParams.mcastGroup,
+                      sizeof(wdiRmcRsp.mcastGroup));
+
+  switch (halRmcRulerRspMsg.rulerRspParams.cmd)
+  {
+    default:
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid command %d", __func__,
+                  halRmcRulerRspMsg.rulerRspParams.cmd);
+      return WDI_STATUS_E_FAILURE;
+
+    case WLAN_HAL_SUGGEST_RULER:
+    {
+      /* Fill in the indication parameters */
+      wdiRmcRsp.cmd = eWDI_SUGGEST_RULER_CMD;
+      wpalMemoryCopy(wdiRmcRsp.ruler,
+                      &halRmcRulerRspMsg.rulerRspParams.ruler,
+                      sizeof(halRmcRulerRspMsg.rulerRspParams.ruler));
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+               "%s Suggest_Ruler", __func__);
+      break;
+    }
+
+    case WLAN_HAL_BECOME_RULER:
+    {
+      /* Fill in the indication parameters */
+      wdiRmcRsp.cmd = eWDI_BECOME_RULER_CMD;
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+               "%s Become_Ruler", __func__);
+      break;
+    }
+  }
+
+  /* Notify UMAC */
+  wdiRmcRulerRspCb(&wdiRmcRsp, pWDICtx->pRspCBUserData);
+
+  return WDI_STATUS_SUCCESS;
+}
+
+WDI_Status
+WDI_ProcessRMCUpdateIndToHost
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_LowLevelIndType wdiInd;
+  tHalRmcUpdateInd halRmcUpdateInd;
+
+  /* Sanity check */
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT( 0 );
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  /* Extract indication and send it to UMAC */
+  wpalMemoryCopy( &halRmcUpdateInd.rulerIndParams,
+                  pEventData->pEventData,
+                  sizeof(halRmcUpdateInd.rulerIndParams) );
+
+  switch (halRmcUpdateInd.rulerIndParams.indication)
+  {
+    default:
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid command %d", __func__,
+                  halRmcUpdateInd.rulerIndParams.indication);
+      return WDI_STATUS_E_FAILURE;
+
+    case WLAN_HAL_RULER_PICK_NEW:
+    {
+      /* Fill in the indication parameters */
+      wdiInd.wdiIndicationType = WDI_RMC_RULER_PICK_NEW;
+      wdiInd.wdiIndicationData.wdiRmcPickNewRulerInd.indication
+                        = halRmcUpdateInd.rulerIndParams.indication;
+      wdiInd.wdiIndicationData.wdiRmcPickNewRulerInd.role
+                        = halRmcUpdateInd.rulerIndParams.role;
+      wpalMemoryCopy(wdiInd.wdiIndicationData.wdiRmcPickNewRulerInd. \
+                      mcastTransmitter,
+                      &halRmcUpdateInd.rulerIndParams.mcastTransmitter,
+                      sizeof(tSirMacAddr) );
+      wpalMemoryCopy(wdiInd.wdiIndicationData.wdiRmcPickNewRulerInd.mcastGroup,
+                      &halRmcUpdateInd.rulerIndParams.mcastGroup,
+                      sizeof(tSirMacAddr) );
+      wpalMemoryCopy(wdiInd.wdiIndicationData.wdiRmcPickNewRulerInd.mcastRuler,
+                      &halRmcUpdateInd.rulerIndParams.mcastRuler,
+                      sizeof(tSirMacAddr) );
+      wpalMemoryCopy(wdiInd.wdiIndicationData.wdiRmcPickNewRulerInd.ruler,
+                      &halRmcUpdateInd.rulerIndParams.ruler,
+                      sizeof(tSirMacAddr) * HAL_NUM_MAX_RULERS );
+      break;
+    }
+  }
+
+
+  /* Notify UMAC */
+  pWDICtx->wdiLowLevelIndCB( &wdiInd, pWDICtx->pIndUserData );
+
+  return WDI_STATUS_SUCCESS;
+}
+
+WDI_Status
+WDI_RmcRulerReq
+(
+    WDI_RmcRulerReqParams  *wdiRmcRulerReqParams,
+    WDI_RmcRulerRspCb wdiRmcRulerRspCb,
+    void *usrData
+)
+{
+   WDI_EventInfoType      wdiEventData;
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+    if ( eWLAN_PAL_FALSE == gWDIInitialized )
+    {
+        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+              "WDI API call before module is initialized - Fail request");
+
+        return WDI_STATUS_E_NOT_ALLOWED;
+    }
+
+    /*------------------------------------------------------------------------
+      Fill in Event data and post to the Main FSM
+     ------------------------------------------------------------------------*/
+    wdiEventData.wdiRequest      = WDI_RMC_RULER_REQ;
+    wdiEventData.pEventData      = wdiRmcRulerReqParams;
+    wdiEventData.uEventDataSize  = sizeof(WDI_RmcRulerReqParams);
+    wdiEventData.pCBfnc          = wdiRmcRulerRspCb;
+    wdiEventData.pUserData       = usrData;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+
+} /* WDI_RmcRulerReq */
+
+WDI_Status
+WDI_RmcUpdateInd
+(
+    WDI_RmcUpdateIndParams  *wdiRmcUpdateIndParams
+)
+{
+   WDI_EventInfoType      wdiEventData;
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+   /*------------------------------------------------------------------------
+    Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+       WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                  "WDI API call before module is initialized - Fail request");
+
+       return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   /*------------------------------------------------------------------------
+     Fill in Event data and post to the Main FSM
+   ------------------------------------------------------------------------*/
+    wdiEventData.wdiRequest      = WDI_RMC_UPDATE_IND;
+    wdiEventData.pEventData      = wdiRmcUpdateIndParams;
+    wdiEventData.uEventDataSize  = sizeof(WDI_RmcUpdateIndParams);
+    wdiEventData.pCBfnc          = NULL;
+    wdiEventData.pUserData       = NULL;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+
+}/* WDI_RmcUpdateInd */
+
+WDI_Status
+WDI_ProcessRMCRulerReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+    WDI_Status              wdiStatus;
+    wpt_uint8*              pSendBuffer        = NULL;
+    wpt_uint16              usDataOffset       = 0;
+    wpt_uint16              usSendSize         = 0;
+    WDI_RmcRulerReqParams *pwdiRulerReq      = NULL;
+    tHalRmcRulerReqMsg    *pRulerReq;
+
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+           "%s", __func__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+    -------------------------------------------------------------------------*/
+    if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "%s: Invalid parameters", __func__);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+    pwdiRulerReq = (WDI_RmcRulerReqParams *)pEventData->pEventData;
+    /*-----------------------------------------------------------------------
+      Get message buffer
+    -----------------------------------------------------------------------*/
+
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                          WDI_RMC_RULER_REQ,
+                          sizeof(tHalRmcRulerReqParams),
+                          &pSendBuffer, &usDataOffset, &usSendSize))||
+                          ( usSendSize < (usDataOffset +
+                                 sizeof(tHalRmcRulerReqParams) )))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in Ruler Req %p ",
+                  pEventData);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+
+    pRulerReq = (tHalRmcRulerReqMsg *)pSendBuffer;
+    pRulerReq->rulerReqParams.cmd = pwdiRulerReq->cmd;
+    wpalMemoryCopy(pRulerReq->rulerReqParams.mcastTransmitter,
+                     pwdiRulerReq->mcastTransmitter, WDI_MAC_ADDR_LEN);
+    wpalMemoryCopy(pRulerReq->rulerReqParams.mcastGroup,
+                     pwdiRulerReq->mcastGroup, WDI_MAC_ADDR_LEN);
+    wpalMemoryCopy(pRulerReq->rulerReqParams.blacklist,
+                     pwdiRulerReq->blacklist,
+                     WDI_MAC_ADDR_LEN * HAL_NUM_MAX_RULERS);
+
+    pWDICtx->pReqStatusUserData = pEventData->pUserData;
+    pWDICtx->pfncRspCB = pEventData->pCBfnc;
+
+    wdiStatus = WDI_SendMsg(pWDICtx, pSendBuffer,
+                            usSendSize, pWDICtx->pfncRspCB,
+                            pWDICtx->pReqStatusUserData,
+                            WDI_RMC_RULER_RESP);
+    return wdiStatus;
+
+} /* WDI_ProcessRMCRulerReq */
+
+/**
+ @brief Process Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessRMCUpdateInd
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+    wpt_uint8*              pSendBuffer        = NULL;
+    wpt_uint16              usDataOffset       = 0;
+    wpt_uint16              usSendSize         = 0;
+    WDI_RmcUpdateIndParams *pwdiUpdateInd      = NULL;
+    tHalRmcUpdateInd       *pUpdateInd;
+    WDI_Status              wdiStatus;
+
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+           "%s", __func__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+    -------------------------------------------------------------------------*/
+    if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "%s: Invalid parameters", __func__);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+    pwdiUpdateInd = (WDI_RmcUpdateIndParams *)pEventData->pEventData;
+    /*-----------------------------------------------------------------------
+      Get message buffer
+    -----------------------------------------------------------------------*/
+
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                          WDI_RMC_UPDATE_IND,
+                          sizeof(tHalRmcUpdateIndParams),
+                          &pSendBuffer, &usDataOffset, &usSendSize))||
+                          ( usSendSize < (usDataOffset +
+                                 sizeof(tHalRmcUpdateIndParams) )))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in RMC Update Indication %p ",
+                  pEventData);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+
+    pUpdateInd = (tHalRmcUpdateInd *)pSendBuffer;
+
+    pUpdateInd->rulerIndParams.indication = pwdiUpdateInd->indication;
+    pUpdateInd->rulerIndParams.role = pwdiUpdateInd->role;
+
+    wpalMemoryCopy(pUpdateInd->rulerIndParams.mcastTransmitter,
+                     pwdiUpdateInd->mcastTransmitter, WDI_MAC_ADDR_LEN);
+    wpalMemoryCopy(pUpdateInd->rulerIndParams.mcastGroup,
+                     pwdiUpdateInd->mcastGroup, WDI_MAC_ADDR_LEN);
+    wpalMemoryCopy(pUpdateInd->rulerIndParams.mcastRuler,
+                     pwdiUpdateInd->mcastRuler, WDI_MAC_ADDR_LEN);
+    /* Zero out parameters not needed for this command */
+    wpalMemoryZero(pUpdateInd->rulerIndParams.ruler,
+                     WDI_MAC_ADDR_LEN * HAL_NUM_MAX_RULERS);
+
+
+    /*-------------------------------------------------------------------------
+     Send Update Indication to HAL
+    -------------------------------------------------------------------------*/
+    pWDICtx->wdiReqStatusCB     = pwdiUpdateInd->wdiReqStatusCB;
+    pWDICtx->pReqStatusUserData = pwdiUpdateInd->pUserData;
+
+    wdiStatus = WDI_SendIndication(pWDICtx, pSendBuffer, usSendSize);
+
+    return (wdiStatus != WDI_STATUS_SUCCESS) ?
+                 wdiStatus : WDI_STATUS_SUCCESS_SYNC;
+
+} /* WDI_ProcessRMCUpdateInd */
+
+/**
+ @brief Process peer info req
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_IbssPeerInfoReq
+(
+   WDI_IbssPeerInfoReqType*   wdiPeerInfoReqParams,
+   WDI_IbssPeerInfoReqCb      wdiIbssPeerInfoReqCb,
+   void*                      pUserData
+)
+{
+
+   WDI_EventInfoType  wdiEventData;
+
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+    if ( eWLAN_PAL_FALSE == gWDIInitialized )
+    {
+        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+              "WDI API call before module is initialized - Fail request");
+
+        return WDI_STATUS_E_NOT_ALLOWED;
+    }
+
+    /*------------------------------------------------------------------------
+      Fill in Event data and post to the Main FSM
+     ------------------------------------------------------------------------*/
+    wdiEventData.wdiRequest      = WDI_HAL_IBSS_PEER_INFO_REQ;
+    wdiEventData.pEventData      = wdiPeerInfoReqParams;
+    wdiEventData.uEventDataSize  = sizeof(WDI_IbssPeerInfoReqType);
+    wdiEventData.pCBfnc          = wdiIbssPeerInfoReqCb;
+    wdiEventData.pUserData       = pUserData;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief Process peer info req
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInfoReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+    WDI_Status              wdiStatus;
+    wpt_uint8*              pSendBuffer        = NULL;
+    wpt_uint16              usDataOffset       = 0;
+    wpt_uint16              usSendSize         = 0;
+    WDI_IbssPeerInfoReqType *pwdiInfoReq        = NULL;
+    tHalIbssPeerInfoReq     *pPeerInfoReq;
+    WDI_StaStruct*   pSTATable = (WDI_StaStruct*) pWDICtx->staTable;
+
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+           "%s", __func__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+    -------------------------------------------------------------------------*/
+    if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "%s: Invalid parameters", __func__);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+    pwdiInfoReq = (WDI_IbssPeerInfoReqType *)pEventData->pEventData;
+    /*-----------------------------------------------------------------------
+      Get message buffer
+    -----------------------------------------------------------------------*/
+
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                          WDI_HAL_IBSS_PEER_INFO_REQ,
+                          sizeof(tHalIbssPeerInfoReqParams),
+                          &pSendBuffer, &usDataOffset, &usSendSize))||
+                          ( usSendSize < (usDataOffset +
+                                 sizeof(tHalIbssPeerInfoReqParams) )))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in IBSS Peer Info Req %p ",
+                  pEventData);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+
+    pPeerInfoReq = (tHalIbssPeerInfoReq *)pSendBuffer;
+    if (VOS_FALSE == pwdiInfoReq->wdiAllPeerInfoReqd)
+    {
+       if (pSTATable[pwdiInfoReq->wdiStaIdx].valid)
+       {
+          pPeerInfoReq->ibssPeerInfoReqParams.bssIdx =
+                        pSTATable[pwdiInfoReq->wdiStaIdx].bssIdx;
+       }
+       else
+       {
+          WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "Unable to find BSSIDX for STAIDX %d ",
+                    pwdiInfoReq->wdiStaIdx);
+          return WDI_STATUS_E_FAILURE;
+       }
+    }
+    else
+      pPeerInfoReq->ibssPeerInfoReqParams.bssIdx = 0;
+
+    pPeerInfoReq->ibssPeerInfoReqParams.staIdx = pwdiInfoReq->wdiStaIdx;
+    pPeerInfoReq->ibssPeerInfoReqParams.allPeerInfoReqd = pwdiInfoReq->wdiAllPeerInfoReqd;
+
+    pWDICtx->pReqStatusUserData = pEventData->pUserData;
+    pWDICtx->pfncRspCB = pEventData->pCBfnc;
+
+    /*-------------------------------------------------------------------------
+     Send IBSS Peer Info request to HAL
+    -------------------------------------------------------------------------*/
+    wdiStatus = WDI_SendMsg(pWDICtx, pSendBuffer,
+                            usSendSize, pWDICtx->pfncRspCB,
+                            pWDICtx->pReqStatusUserData,
+                            WDI_HAL_IBSS_PEER_INFO_RSP);
+    return wdiStatus;
+}
+
+/**
+ @brief Process peer info resp
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInfoRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+   WDI_IbssPeerInfoReqCb     wdiPeerInfoCb   = NULL;
+   tHalIbssPeerParams        *pHalPeerInfoParams;
+   WDI_IbssPeerInfoRspParams wdiPeerInfoRspParams;
+   wpt_uint32                allocSize=0;
+   WDI_IbssPeerInfoParams   *pPeerInfoParams = NULL;
+   wpt_uint8                 wdiCount=0;
+
+   /*-------------------------------------------------------------------------
+     Sanity check
+   -------------------------------------------------------------------------*/
+   if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+       ( NULL == pEventData->pEventData))
+   {
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                  "%s: Invalid parameters", __func__);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+   }
+
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+   wdiPeerInfoCb = (WDI_IbssPeerInfoReqCb)pWDICtx->pfncRspCB;
+
+   /*-------------------------------------------------------------------------
+     Extract response and send it to UMAC
+   -------------------------------------------------------------------------*/
+   pHalPeerInfoParams =
+             ((tHalIbssPeerInfoRspParams *)pEventData->pEventData)->ibssPeerParams;
+   wdiPeerInfoRspParams.wdiStatus =
+             WDI_HAL_2_WDI_STATUS(((tHalIbssPeerInfoRspParams *)pEventData->pEventData)->status);
+   wdiPeerInfoRspParams.wdiNumPeers =
+             ((tHalIbssPeerInfoRspParams *)pEventData->pEventData)->numOfPeers;
+
+   if (!wdiPeerInfoRspParams.wdiNumPeers) {
+      wdiPeerInfoRspParams.wdiPeerInfoParams = NULL;
+      goto error;
+   }
+   if (wdiPeerInfoRspParams.wdiNumPeers >=
+            WDI_MAX_IBSS_PEER_SUPPORED_STAS) {
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+             "Number of stations %d exceed max supported stations %d set max",
+              wdiPeerInfoRspParams.wdiNumPeers,
+               WDI_MAX_IBSS_PEER_SUPPORED_STAS);
+      wdiPeerInfoRspParams.wdiNumPeers =
+            WDI_MAX_IBSS_PEER_SUPPORED_STAS - 1;
+   }
+   /* Size of peer info data received from DAL */
+   allocSize = (sizeof(WDI_IbssPeerInfoParams) * (wdiPeerInfoRspParams.wdiNumPeers));
+
+   pPeerInfoParams = (WDI_IbssPeerInfoParams*)wpalMemoryAllocate(allocSize);
+
+   if (NULL == pPeerInfoParams)
+   {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
+           "Failed to allocate memory in ibss peer info response %p %p %p ",
+           pWDICtx, pEventData, pEventData->pEventData);
+       wdiPeerInfoRspParams.wdiPeerInfoParams = NULL;
+       goto error;
+   }
+
+   for (wdiCount = 0; wdiCount < wdiPeerInfoRspParams.wdiNumPeers; wdiCount++)
+   {
+      tHalIbssPeerParams        *pHalTemp = &pHalPeerInfoParams[wdiCount];
+      WDI_IbssPeerInfoParams    *pWdiTemp = &pPeerInfoParams[wdiCount];
+      pWdiTemp->wdiStaIdx = pHalTemp->staIdx;
+      pWdiTemp->wdiRssi = pHalTemp->rssi;
+      pWdiTemp->wdiMcsIndex = pHalTemp->mcsIndex;
+      pWdiTemp->wdiTxRate = pHalTemp->txRate;
+      pWdiTemp->wdiTxRateFlags = pHalTemp->txRateFlags;
+   }
+
+   wdiPeerInfoRspParams.wdiPeerInfoParams = pPeerInfoParams;
+error:
+   /*Notify UMAC*/
+   if (wdiPeerInfoCb)
+   {
+      wdiPeerInfoCb(&wdiPeerInfoRspParams, pWDICtx->pRspCBUserData);
+   }
+
+   /* Free the allocation */
+   if(pPeerInfoParams)
+     vos_mem_free (pPeerInfoParams);
+
+   return WDI_STATUS_SUCCESS;
+}
+#endif
 #ifdef FEATURE_WLAN_BATCH_SCAN
+
 /**
  @brief Process stop batch indication from WDA
 
@@ -32662,7 +34103,7 @@
 } /* End of WDI_ProcessEXTScanBssidHotListResultInd  */
 
 /**
- @brief Process EXTScan Significant RSSI Result Indication indication from FW
+ @brief Process EXTScan SSID Hotlist Result Indication indication from FW
 
  @param  pWDICtx:         pointer to the WLAN DAL context
          pEventData:      pointer to the event information structure
@@ -32671,7 +34112,7 @@
  @return Result of the function call
 */
 WDI_Status
-WDI_ProcessEXTScanSignfRssiResultInd
+WDI_ProcessEXTScanSsidHotListResultInd
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
@@ -32694,7 +34135,7 @@
     }
 
     /* Fill in the indication parameters */
-    wdiInd.wdiIndicationType = WDI_EXTSCAN_SIGN_RSSI_RESULT_IND;
+    wdiInd.wdiIndicationType = WDI_EXTSCAN_SSID_HOTLIST_RESULT_IND;
 
     /* extract response and send it to UMAC */
     wdiInd.wdiIndicationData.pEXTScanIndData = (void *)pEventData->pEventData;
@@ -32712,7 +34153,8 @@
         return WDI_STATUS_E_FAILURE;
     }
     return WDI_STATUS_SUCCESS;
-} /* End of WDI_ProcessEXTScanSignfRssiResultInd  */
+} /* End of WDI_ProcessEXTScanSsidHotListResultInd  */
+
 
 /**
  @brief WDI_EXTScanGetCapabilitiesReq
@@ -33202,11 +34644,14 @@
   pHalExtScanStartReqParams->basePeriod = pwdiEXTScanStartReqParams->basePeriod;
   pHalExtScanStartReqParams->maxApPerScan =
                                     pwdiEXTScanStartReqParams->maxAPperScan;
-  pHalExtScanStartReqParams->reportThreshold =
-                                pwdiEXTScanStartReqParams->reportThreshold;
+  pHalExtScanStartReqParams->reportThresholdPercent =
+                                pwdiEXTScanStartReqParams->reportThresholdPercent;
+  pHalExtScanStartReqParams->reportThresholdNumScans =
+                                pwdiEXTScanStartReqParams->reportThresholdNumScans;
   pHalExtScanStartReqParams->requestId = pwdiEXTScanStartReqParams->requestId;
   pHalExtScanStartReqParams->sessionId = pwdiEXTScanStartReqParams->sessionId;
   pHalExtScanStartReqParams->numBuckets = pwdiEXTScanStartReqParams->numBuckets;
+  pHalExtScanStartReqParams->homeAwayTime = pwdiEXTScanStartReqParams->homeAwayTime;
 
   for( i = 0; i < WDI_WLAN_EXTSCAN_MAX_BUCKETS ; i++ )
   {
@@ -33218,6 +34663,12 @@
                       pwdiEXTScanStartReqParams->buckets[i].period;
       pHalExtScanStartReqParams->bucketData[i].reportEvents =
                       pwdiEXTScanStartReqParams->buckets[i].reportEvents;
+      pHalExtScanStartReqParams->bucketData[i].max_period =
+                      pwdiEXTScanStartReqParams->buckets[i].max_period;
+      pHalExtScanStartReqParams->bucketData[i].exponent =
+                      pwdiEXTScanStartReqParams->buckets[i].exponent;
+      pHalExtScanStartReqParams->bucketData[i].step_count =
+                      pwdiEXTScanStartReqParams->buckets[i].step_count;
       pHalExtScanStartReqParams->bucketData[i].numChannels =
                       pwdiEXTScanStartReqParams->buckets[i].numChannels;
 
@@ -33235,25 +34686,32 @@
 
 
   VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-          " basePeriod %u maxApPerScan %u reportThreshold %u requestId %u"
-          " sessionId %u numBuckets%u ",
+          " basePeriod %u maxApPerScan %u reportThresholdPercent %u"
+          "reportThresholdNumScans %u requestId %u"
+          " sessionId %u numBuckets%u homeAwayTime %u",
           pHalExtScanStartReqParams->basePeriod,
           pHalExtScanStartReqParams->maxApPerScan,
-          pHalExtScanStartReqParams->reportThreshold,
+          pHalExtScanStartReqParams->reportThresholdPercent,
+          pHalExtScanStartReqParams->reportThresholdNumScans,
           pHalExtScanStartReqParams->requestId,
           pHalExtScanStartReqParams->sessionId,
-          pHalExtScanStartReqParams->numBuckets);
+          pHalExtScanStartReqParams->numBuckets,
+          pHalExtScanStartReqParams->homeAwayTime);
 
   for( i = 0; i < pHalExtScanStartReqParams->numBuckets ; i++ )
   {
       VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO ,
               " %d) bucketId %u  channelBand %u period %u "
-              " reportEvents %u numChannels %u ",i,
+              " reportEvents %u numChannels %u "
+              "max_period %u exponent %u step_count %u",i,
       pHalExtScanStartReqParams->bucketData[i].bucketId,
       pHalExtScanStartReqParams->bucketData[i].channelBand,
       pHalExtScanStartReqParams->bucketData[i].period,
       pHalExtScanStartReqParams->bucketData[i].reportEvents,
-      pHalExtScanStartReqParams->bucketData[i].numChannels);
+      pHalExtScanStartReqParams->bucketData[i].numChannels,
+      pHalExtScanStartReqParams->bucketData[i].max_period,
+      pHalExtScanStartReqParams->bucketData[i].exponent,
+      pHalExtScanStartReqParams->bucketData[i].step_count);
 
       for( j = 0; j< pHalExtScanStartReqParams->bucketData[i].numChannels; j++)
       {
@@ -33386,8 +34844,11 @@
   pHalBssidHotlistSetReqParams->sessionId =
                     pwdiEXTScanSetBSSIDHotlistReqParams->sessionId;
 
-  pHalBssidHotlistSetReqParams->numAp =
-                    pwdiEXTScanSetBSSIDHotlistReqParams->numAp;
+  pHalBssidHotlistSetReqParams->lostBssidSampleSize =
+                    pwdiEXTScanSetBSSIDHotlistReqParams->lostBssidSampleSize;
+
+  pHalBssidHotlistSetReqParams->numBssid =
+                    pwdiEXTScanSetBSSIDHotlistReqParams->numBssid;
 
   for( i = 0; i < WLAN_HAL_EXT_SCAN_MAX_HOTLIST_APS; i++){
 
@@ -33401,26 +34862,23 @@
     pHalBssidHotlistSetReqParams->ap[i].highRssiThreshold =
         pwdiEXTScanSetBSSIDHotlistReqParams->ap[i].high;
 
-    pHalBssidHotlistSetReqParams->ap[i].channel =
-        pwdiEXTScanSetBSSIDHotlistReqParams->ap[i].channel;
-
   }
 
   VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-          "ReqID %u sessionId %u numAp %u ",
+          "ReqID %u sessionId %u numBssid %u lostBssidSampleSize: %u",
       pHalBssidHotlistSetReqParams->requestId,
       pHalBssidHotlistSetReqParams->sessionId,
-      pHalBssidHotlistSetReqParams->numAp);
+      pHalBssidHotlistSetReqParams->numBssid,
+      pHalBssidHotlistSetReqParams->lostBssidSampleSize);
 
-  for( i = 0; i < pHalBssidHotlistSetReqParams->numAp; i++){
+  for( i = 0; i < pHalBssidHotlistSetReqParams->numBssid; i++){
 
     VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-         "%s %d %d) BSSID: %pM lowRssiThreshold %d highRssiThreshold %d Channel %u ",
+         "%s %d %d) BSSID: %pM lowRssiThreshold %d highRssiThreshold %d",
             __func__, __LINE__, i,
             pHalBssidHotlistSetReqParams->ap[i].bssid,
             pHalBssidHotlistSetReqParams->ap[i].lowRssiThreshold,
-            pHalBssidHotlistSetReqParams->ap[i].highRssiThreshold,
-            pHalBssidHotlistSetReqParams->ap[i].channel);
+            pHalBssidHotlistSetReqParams->ap[i].highRssiThreshold);
 
   }
 
@@ -33551,26 +35009,27 @@
                        WDI_EXTSCAN_RESET_HOTLIST_BSSID_RSP);
 }
 
-/**
- @brief WDI_EXTScanSetSignfRSSIChangeReq
 
- @param WDI_EXTScanSetSignfRSSIChangeReqParams: Req parameter for the FW
-        WDI_EXTScanSetSignfRSSIChangeRspCb: callback for passing back the response
+/**
+ @brief WDI_EXTScanSetSSIDHotlistReq
+
+ @param WDI_EXTScanSetSSIDHotlistReqParams: Req parameter for the FW
+        WDI_EXTScanSetSSIDHotlistRspCb: callback for passing back the response
         of the Req operation received from the device
         pUserData: user data will be passed back with the callback
 
  @return SUCCESS or FAIL
 */
 WDI_Status
-WDI_EXTScanSetSignfRSSIChangeReq(
- WDI_EXTScanSetSignfRSSIChangeReqParams* pwdiEXTScanSetSignfRSSIChangeReqParams,
- WDI_EXTScanSetSignfRSSIChangeRspCb  wdiEXTScanSetSignfRSSIChangeRspCb,
-        void*                   pUserData)
+WDI_EXTScanSetSSIDHotlistReq(
+      WDI_EXTScanSetSSIDHotlistReqParams* pwdiEXTScanSetSSIDHotlistReqParams,
+      WDI_EXTScanSetSSIDHotlistRspCb  wdiEXTScanSetSSIDHotlistRspCb,
+      void*                   pUserData)
 {
-  WDI_EventInfoType      wdiEventData;
+   WDI_EventInfoType      wdiEventData;
 
   VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-                  "%s: %d ",__func__, __LINE__);
+                  "%s: %d Enter ",__func__, __LINE__);
   /*------------------------------------------------------------------------
     Sanity Check
   ------------------------------------------------------------------------*/
@@ -33582,19 +35041,18 @@
      return WDI_STATUS_E_NOT_ALLOWED;
   }
 
-  wdiEventData.wdiRequest      = WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ;
-  wdiEventData.pEventData      = pwdiEXTScanSetSignfRSSIChangeReqParams;
-  wdiEventData.uEventDataSize  =
-                        sizeof(*pwdiEXTScanSetSignfRSSIChangeReqParams);
-  wdiEventData.pCBfnc          = wdiEXTScanSetSignfRSSIChangeRspCb;
+  wdiEventData.wdiRequest      = WDI_EXTSCAN_SET_SSID_HOTLIST_REQ;
+  wdiEventData.pEventData      = pwdiEXTScanSetSSIDHotlistReqParams;
+  wdiEventData.uEventDataSize  = sizeof(*pwdiEXTScanSetSSIDHotlistReqParams);
+  wdiEventData.pCBfnc          = wdiEXTScanSetSSIDHotlistRspCb;
   wdiEventData.pUserData       = pUserData;
 
   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
 }
 
 /**
- @brief WDI_ProcessEXTScanSetSignifRSSIChangeReq -
-    Extended Scan set Significant RSSI change Request to FW
+ @brief WDI_ProcessEXTScanSetSSIDHotlistReq -
+    Extended Scan Set SSSID Hotlist Request to FW
 
  @param  pWDICtx : wdi context
          pEventData : indication data
@@ -33603,19 +35061,18 @@
  @return none
 */
 WDI_Status
-WDI_ProcessEXTScanSetSignifRSSIChangeReq
+WDI_ProcessEXTScanSetSSIDHotlistReq
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 )
 {
-  WDI_EXTScanSetSignfRSSIChangeReqParams*
-                                pwdiEXTScanSetSignfRSSIChangeReqParams;
-  WDI_EXTScanSetSignfRSSIChangeRspCb  wdiEXTScanSetSignfRSSIChangeRspCb;
+  WDI_EXTScanSetSSIDHotlistReqParams* pwdiEXTScanSetSSIDHotlistReqParams;
+  WDI_EXTScanSetSSIDHotlistRspCb  wdiEXTScanSetSSIDHotlistRspCb;
   wpt_uint8*               pSendBuffer         = NULL;
   wpt_uint16               usSendSize          = 0;
   wpt_uint16               usDataOffset        = 0;
-  tpHalSigRssiSetReq       pHalSigRssiSetReqParams;
+  tpHalSsidHotlistSetReq   pHalSsidHotlistSetReqParams;
   int i;
 
   VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
@@ -33630,10 +35087,10 @@
      return WDI_STATUS_E_FAILURE;
   }
 
-  pwdiEXTScanSetSignfRSSIChangeReqParams =
-      (WDI_EXTScanSetSignfRSSIChangeReqParams *)pEventData->pEventData;
-  wdiEXTScanSetSignfRSSIChangeRspCb   =
-      (WDI_EXTScanSetSignfRSSIChangeRspCb)pEventData->pCBfnc;
+  pwdiEXTScanSetSSIDHotlistReqParams =
+      (WDI_EXTScanSetSSIDHotlistReqParams *)pEventData->pEventData;
+  wdiEXTScanSetSSIDHotlistRspCb   =
+      (WDI_EXTScanSetSSIDHotlistRspCb)pEventData->pCBfnc;
 
   /*-----------------------------------------------------------------------
     Get message buffer
@@ -33641,75 +35098,67 @@
   -----------------------------------------------------------------------*/
   if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(
                                         pWDICtx,
-                                        WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_REQ,
-                                        sizeof(tHalSigRssiSetReq),
+                                        WDI_EXTSCAN_SET_SSID_HOTLIST_REQ,
+                                        sizeof(tHalSsidHotlistSetReq),
                                         &pSendBuffer, &usDataOffset,
                                         &usSendSize))||
-      ( usSendSize < (usDataOffset + sizeof(tHalSigRssiSetReq) )))
+      ( usSendSize < (usDataOffset + sizeof(tHalSsidHotlistSetReq) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
               "Unable to get send buffer in %s %p %p %p", __func__,
-                pEventData, pwdiEXTScanSetSignfRSSIChangeReqParams,
-                wdiEXTScanSetSignfRSSIChangeRspCb);
+                pEventData, pwdiEXTScanSetSSIDHotlistReqParams,
+                wdiEXTScanSetSSIDHotlistRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
   }
+  pHalSsidHotlistSetReqParams =
+      (tpHalSsidHotlistSetReq) (pSendBuffer + usDataOffset);
 
-  pHalSigRssiSetReqParams =
-      (tpHalSigRssiSetReq) (pSendBuffer + usDataOffset);
+  pHalSsidHotlistSetReqParams->requestId =
+                    pwdiEXTScanSetSSIDHotlistReqParams->requestId;
 
-  pHalSigRssiSetReqParams->requestId =
-                    pwdiEXTScanSetSignfRSSIChangeReqParams->requestId;
-  pHalSigRssiSetReqParams->sessionId =
-                    pwdiEXTScanSetSignfRSSIChangeReqParams->sessionId;
-  pHalSigRssiSetReqParams->rssiSampleSize =
-                    pwdiEXTScanSetSignfRSSIChangeReqParams->rssiSampleSize;
-  pHalSigRssiSetReqParams->lostApSampleSize =
-                    pwdiEXTScanSetSignfRSSIChangeReqParams->lostApSampleSize;
-  pHalSigRssiSetReqParams->minBreaching =
-                    pwdiEXTScanSetSignfRSSIChangeReqParams->minBreaching;
-  pHalSigRssiSetReqParams->numAp =
-                    pwdiEXTScanSetSignfRSSIChangeReqParams->numAp;
+  pHalSsidHotlistSetReqParams->sessionId =
+                    pwdiEXTScanSetSSIDHotlistReqParams->sessionId;
 
+  pHalSsidHotlistSetReqParams->lostSsidSampleSize =
+                    pwdiEXTScanSetSSIDHotlistReqParams->lostSsidSampleSize;;
 
-  for( i = 0; i < WLAN_HAL_EXT_SCAN_MAX_SIG_CHANGE_APS; i++){
+  pHalSsidHotlistSetReqParams->numSsid =
+                    pwdiEXTScanSetSSIDHotlistReqParams->numSsid;
 
-    wpalMemoryCopy(pHalSigRssiSetReqParams->ap[i].bssid,
-              pwdiEXTScanSetSignfRSSIChangeReqParams->ap[i].bssid,
-                            WDI_MAC_ADDR_LEN);
+  for( i = 0; i < pHalSsidHotlistSetReqParams->numSsid; i++){
 
-    pHalSigRssiSetReqParams->ap[i].lowRssiThreshold =
-        pwdiEXTScanSetSignfRSSIChangeReqParams->ap[i].low;
+    wpalMemoryZero(pHalSsidHotlistSetReqParams->ssid[i].ssid, 33);
+    wpalMemoryCopy(pHalSsidHotlistSetReqParams->ssid[i].ssid,
+              pwdiEXTScanSetSSIDHotlistReqParams->ssid[i].ssid.sSSID,
+              pwdiEXTScanSetSSIDHotlistReqParams->ssid[i].ssid.ucLength);
 
-    pHalSigRssiSetReqParams->ap[i].highRssiThreshold =
-        pwdiEXTScanSetSignfRSSIChangeReqParams->ap[i].high;
+    pHalSsidHotlistSetReqParams->ssid[i].lowRssiThreshold =
+       pwdiEXTScanSetSSIDHotlistReqParams->ssid[i].lowRssiThreshold;
 
-    pHalSigRssiSetReqParams->ap[i].channel =
-        pwdiEXTScanSetSignfRSSIChangeReqParams->ap[i].channel;
+    pHalSsidHotlistSetReqParams->ssid[i].highRssiThreshold =
+        pwdiEXTScanSetSSIDHotlistReqParams->ssid[i].highRssiThreshold;
 
+    pHalSsidHotlistSetReqParams->ssid[i].band =
+        pwdiEXTScanSetSSIDHotlistReqParams->ssid[i].band;
   }
 
-
   VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-          "ReqID %u sessionId %u rssiSampleSize %u lostApSampleSize %u "
-          " minBreaching %u numAp %u ",
-          pHalSigRssiSetReqParams->requestId,
-          pHalSigRssiSetReqParams->sessionId,
-          pHalSigRssiSetReqParams->rssiSampleSize,
-          pHalSigRssiSetReqParams->lostApSampleSize,
-          pHalSigRssiSetReqParams->minBreaching,
-          pHalSigRssiSetReqParams->numAp);
+          "ReqID %u sessionId %u numSsid %u lost_ssid_sample_size: %u",
+      pHalSsidHotlistSetReqParams->requestId,
+      pHalSsidHotlistSetReqParams->sessionId,
+      pHalSsidHotlistSetReqParams->numSsid,
+      pHalSsidHotlistSetReqParams->lostSsidSampleSize);
 
-  for( i = 0; i < pHalSigRssiSetReqParams->numAp; i++){
+  for( i = 0; i < pHalSsidHotlistSetReqParams->numSsid; i++){
 
     VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-         "%d) BSSID: %pM lowRssiThreshold %d highRssiThreshold %d Channel %u ",
-            i,
-            pHalSigRssiSetReqParams->ap[i].bssid,
-            pHalSigRssiSetReqParams->ap[i].lowRssiThreshold,
-            pHalSigRssiSetReqParams->ap[i].highRssiThreshold,
-            pHalSigRssiSetReqParams->ap[i].channel);
-
+         "%s %d %d) SSID = %s lowRssiThreshold %d highRssiThreshold %d band: %d",
+            __func__, __LINE__, i,
+            pHalSsidHotlistSetReqParams->ssid[i].ssid,
+            pHalSsidHotlistSetReqParams->ssid[i].lowRssiThreshold,
+            pHalSsidHotlistSetReqParams->ssid[i].highRssiThreshold,
+            pHalSsidHotlistSetReqParams->ssid[i].band);
   }
 
   pWDICtx->pReqStatusUserData = pEventData->pUserData;
@@ -33719,32 +35168,30 @@
     Send EXTScan Stop Request to HAL
   -------------------------------------------------------------------------*/
   return  WDI_SendMsg( pWDICtx, pSendBuffer, usSendSize,
-                       wdiEXTScanSetSignfRSSIChangeRspCb, pEventData->pUserData,
-                       WDI_EXTSCAN_SET_SIGNF_RSSI_CHANGE_RSP);
+                       wdiEXTScanSetSSIDHotlistRspCb, pEventData->pUserData,
+                       WDI_EXTSCAN_SET_HOTLIST_SSID_RSP);
 }
 
 /**
- @brief WDI_EXTScanResetSignfRSSIChangeReq
+ @brief WDI_EXTScanResetSSIDHotlistReq
 
- @param WDI_EXTScanResetSignfRSSIChangeReqParams: Req parameter for the FW
-        WDI_EXTScanResetSignfRSSIChangeRspCb: callback for passing back the response
+ @param WDI_EXTScanResetSSIDHotlistReqParams: Req parameter for the FW
+        WDI_EXTScanResetSSIDHotlistRspCb: callback for passing back the response
         of the Req operation received from the device
         pUserData: user data will be passed back with the callback
 
  @return SUCCESS or FAIL
 */
 WDI_Status
-WDI_EXTScanResetSignfRSSIChangeReq(
-        WDI_EXTScanResetSignfRSSIChangeReqParams*
-                                    pwdiEXTScanResetSignfRSSIChangeReqParams,
-        WDI_EXTScanResetSignfRSSIChangeRspCb
-                                         wdiEXTScanResetSignfRSSIChangeRspCb,
-        void*                   pUserData)
+WDI_EXTScanResetSSIDHotlistReq(
+   WDI_EXTScanResetSSIDHotlistReqParams* pwdiEXTScanResetSSIDHotlistReqParams,
+   WDI_EXTScanResetSSIDHotlistRspCb  wdiEXTScanResetSSIDHotlistRspCb,
+   void*                   pUserData)
 {
    WDI_EventInfoType      wdiEventData;
 
   VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-                  "%s: %d ",__func__, __LINE__);
+                  "%s: %d",__func__, __LINE__);
   /*------------------------------------------------------------------------
     Sanity Check
   ------------------------------------------------------------------------*/
@@ -33756,19 +35203,18 @@
      return WDI_STATUS_E_NOT_ALLOWED;
   }
 
-  wdiEventData.wdiRequest      = WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ;
-  wdiEventData.pEventData      = pwdiEXTScanResetSignfRSSIChangeReqParams;
-  wdiEventData.uEventDataSize  =
-                        sizeof(*pwdiEXTScanResetSignfRSSIChangeReqParams);
-  wdiEventData.pCBfnc          = wdiEXTScanResetSignfRSSIChangeRspCb;
+  wdiEventData.wdiRequest      = WDI_EXTSCAN_RESET_SSID_HOTLIST_REQ;
+  wdiEventData.pEventData      = pwdiEXTScanResetSSIDHotlistReqParams;
+  wdiEventData.uEventDataSize  = sizeof(*pwdiEXTScanResetSSIDHotlistReqParams);
+  wdiEventData.pCBfnc          = wdiEXTScanResetSSIDHotlistRspCb;
   wdiEventData.pUserData       = pUserData;
 
   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
 }
 
 /**
- @brief WDI_ProcessEXTScanResetSignfRSSIChangeReq -
-    Extended Scana reset Significant RSSI change Request to FW
+ @brief WDI_ProcessEXTScanResetSSIDHotlistReq -
+    Extended Scan reset SSID hotlist Request to FW
 
  @param  pWDICtx : wdi context
          pEventData : indication data
@@ -33777,22 +35223,21 @@
  @return none
 */
 WDI_Status
-WDI_ProcessEXTScanResetSignfRSSIChangeReq
+WDI_ProcessEXTScanResetSSIDHotlistReq
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 )
 {
-  WDI_EXTScanResetSignfRSSIChangeReqParams*
-                            pwdiEXTScanResetSignfRSSIChangeReqParams;
-  WDI_EXTScanResetSignfRSSIChangeRspCb  wdiEXTScanResetSignfRSSIChangeRspCb;
+  WDI_EXTScanResetSSIDHotlistReqParams* pwdiEXTScanResetSSIDHotlistReqParams;
+  WDI_EXTScanResetSSIDHotlistRspCb  wdiEXTScanResetSSIDHotlistRspCb;
   wpt_uint8*               pSendBuffer         = NULL;
   wpt_uint16               usSendSize          = 0;
   wpt_uint16               usDataOffset        = 0;
-  tpHalSigRssiResetReq     pHalSigRssiResetReqParams;
+  tpHalSsidHotlistResetReq     pHalSsidHotlistResetReqParams;
 
   VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-                  "%s: %d ",__func__, __LINE__);
+                  "%s: %d",__func__, __LINE__);
 
   if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ) ||
       ( NULL == pEventData->pCBfnc ))
@@ -33803,43 +35248,154 @@
      return WDI_STATUS_E_FAILURE;
   }
 
-  pwdiEXTScanResetSignfRSSIChangeReqParams =
-      (WDI_EXTScanResetSignfRSSIChangeReqParams *)pEventData->pEventData;
-  wdiEXTScanResetSignfRSSIChangeRspCb   =
-      (WDI_EXTScanResetSignfRSSIChangeRspCb)pEventData->pCBfnc;
+  pwdiEXTScanResetSSIDHotlistReqParams =
+      (WDI_EXTScanResetSSIDHotlistReqParams *)pEventData->pEventData;
+  wdiEXTScanResetSSIDHotlistRspCb   =
+      (WDI_EXTScanResetSSIDHotlistRspCb)pEventData->pCBfnc;
 
   /*-----------------------------------------------------------------------
     Get message buffer
     ! TO DO : proper conversion into the HAL Message Request Format
   -----------------------------------------------------------------------*/
   if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(
-                                       pWDICtx,
-                                       WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_REQ,
-                                       sizeof(tHalSigRssiResetReq),
-                                       &pSendBuffer, &usDataOffset,
-                                       &usSendSize))||
-      ( usSendSize < (usDataOffset + sizeof(tHalSigRssiResetReq) )))
+                                        pWDICtx,
+                                        WDI_EXTSCAN_RESET_SSID_HOTLIST_REQ,
+                                        sizeof(tHalSsidHotlistResetReq),
+                                        &pSendBuffer, &usDataOffset,
+                                        &usSendSize))||
+     ( usSendSize < (usDataOffset + sizeof(tHalSsidHotlistResetReq) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
               "Unable to get send buffer in %s %p %p %p", __func__,
-                pEventData, pwdiEXTScanResetSignfRSSIChangeReqParams,
-                wdiEXTScanResetSignfRSSIChangeRspCb);
+                pEventData, pwdiEXTScanResetSSIDHotlistReqParams,
+                wdiEXTScanResetSSIDHotlistRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
   }
-  pHalSigRssiResetReqParams =
-      (tpHalSigRssiResetReq) (pSendBuffer+usDataOffset);
+  pHalSsidHotlistResetReqParams =
+      (tpHalSsidHotlistResetReq) (pSendBuffer+usDataOffset);
 
-  pHalSigRssiResetReqParams->requestId =
-                    pwdiEXTScanResetSignfRSSIChangeReqParams->requestId;
+  pHalSsidHotlistResetReqParams->requestId =
+                    pwdiEXTScanResetSSIDHotlistReqParams->requestId;
 
   pWDICtx->pReqStatusUserData = pEventData->pUserData;
 
-
+  /*-------------------------------------------------------------------------
+    Send RESET_HOTLIST_SSID Request to HAL
+  -------------------------------------------------------------------------*/
   return  WDI_SendMsg( pWDICtx, pSendBuffer, usSendSize,
-                       wdiEXTScanResetSignfRSSIChangeRspCb,
-                       pEventData->pUserData,
-                       WDI_EXTSCAN_RESET_SIGNF_RSSI_CHANGE_RSP);
+                       wdiEXTScanResetSSIDHotlistRspCb, pEventData->pUserData,
+                       WDI_EXTSCAN_RESET_HOTLIST_SSID_RSP);
+}
+
+
+/**
+ @brief WDI_HighPriorityDataInfoInd
+
+ @param pHighPriorityDataInfoIndParams: Req parameter for the FW
+
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_HighPriorityDataInfoInd
+(
+   WDI_HighPriorityDataInfoIndParams* pHighPriorityDataInfoIndParams
+)
+{
+   WDI_EventInfoType      wdiEventData;
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                  "%s: %d",__func__, __LINE__);
+  /*------------------------------------------------------------------------
+    Sanity Check
+  ------------------------------------------------------------------------*/
+  if ( eWLAN_PAL_FALSE == gWDIInitialized )
+  {
+     VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_ERROR,
+                "WDI API call before module is initialized - Fail request");
+
+     return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  wdiEventData.wdiRequest      = WDI_HIGH_PRIORITY_DATA_INFO_IND;
+  wdiEventData.pEventData      = pHighPriorityDataInfoIndParams;
+  wdiEventData.uEventDataSize  = sizeof(*pHighPriorityDataInfoIndParams);
+  wdiEventData.pCBfnc          = NULL;
+  wdiEventData.pUserData       = NULL;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief WDI_ProcessHighPriorityDataInfoInd -
+    Send WFD indication to FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return none
+*/
+WDI_Status
+WDI_ProcessHighPriorityDataInfoInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_HighPriorityDataInfoIndParams* pHighPriorityDataInfoIndParams;
+  wpt_uint8*               pSendBuffer         = NULL;
+  wpt_uint16               usSendSize          = 0;
+  wpt_uint16               usDataOffset        = 0;
+  tpHalHighPriorityDataInfoInd     pHalHighPriorityDataInfoIndParams;
+  WDI_Status wdiStatus = WDI_STATUS_SUCCESS;
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                  "%s: %d",__func__, __LINE__);
+
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+           ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pHighPriorityDataInfoIndParams =
+      (WDI_HighPriorityDataInfoIndParams *)pEventData->pEventData;
+
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(
+                                        pWDICtx,
+                                        WDI_HIGH_PRIORITY_DATA_INFO_IND,
+                                        sizeof(tHalHighPriorityDataInfoInd),
+                                        &pSendBuffer, &usDataOffset,
+                                        &usSendSize))||
+     ( usSendSize < (usDataOffset + sizeof(tHalHighPriorityDataInfoInd) )))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+              "Unable to get send buffer in %s %p %p", __func__,
+                pEventData, pHighPriorityDataInfoIndParams);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pHalHighPriorityDataInfoIndParams =
+      (tpHalHighPriorityDataInfoInd) (pSendBuffer+usDataOffset);
+
+  pHalHighPriorityDataInfoIndParams->pause =
+                    pHighPriorityDataInfoIndParams->pause;
+
+  pWDICtx->pReqStatusUserData = NULL;
+  pWDICtx->pfncRspCB = NULL;
+
+  /*-------------------------------------------------------------------------
+    Send HIGH_PRIORITY_DATA_INFO Request to HAL
+  -------------------------------------------------------------------------*/
+  wdiStatus =  WDI_SendIndication( pWDICtx, pSendBuffer, usSendSize);
+  return (wdiStatus != WDI_STATUS_SUCCESS) ? wdiStatus:WDI_STATUS_SUCCESS_SYNC;
 }
 
 /**
@@ -34143,7 +35699,59 @@
 }
 
 /**
- @brief Process Extended Scan Set Significant RSSI Change Rsp function (called
+ @brief Process Extended Scan Set hotlist SSID Rsp function (called when a
+        response is being received over the bus from HAL)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessEXTScanSetHotlistSSIDRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_EXTScanSetSSIDHotlistRspCb   wdiEXTScanSetSSIDHotlistRspCb;
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                  "%s: %d ",__func__, __LINE__);
+
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  wdiEXTScanSetSSIDHotlistRspCb =
+                (WDI_EXTScanSetSSIDHotlistRspCb)pWDICtx->pfncRspCB;
+  if ( NULL == wdiEXTScanSetSSIDHotlistRspCb)
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Callback function Invalid", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  wdiEXTScanSetSSIDHotlistRspCb(
+          (void *) pEventData->pEventData, pWDICtx->pRspCBUserData);
+
+  return WDI_STATUS_SUCCESS;
+}
+
+
+/**
+ @brief Process Extended Scan Reset Hotlist BSSID Rsp function (called
         when a response is being received over the bus from HAL)
 
  @param  pWDICtx:         pointer to the WLAN DAL context
@@ -34153,16 +35761,16 @@
  @return Result of the function call
 */
 WDI_Status
-WDI_ProcessEXTScanSetSignfRSSIChangeRsp
+WDI_ProcessEXTScanResetHotlistSSIDRsp
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 )
 {
-  WDI_EXTScanSetSignfRSSIChangeRspCb   wdiEXTScanSetSignfRSSIChangeRspCb;
+  WDI_EXTScanResetSSIDHotlistRspCb   wdiEXTScanResetSSIDHotlistRspCb;
 
   VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-                  "%s: %d",__func__, __LINE__);
+                  "%s: %d ",__func__, __LINE__);
 
 
   /*-------------------------------------------------------------------------
@@ -34177,9 +35785,9 @@
      return WDI_STATUS_E_FAILURE;
   }
 
-  wdiEXTScanSetSignfRSSIChangeRspCb =
-      (WDI_EXTScanSetSignfRSSIChangeRspCb)pWDICtx->pfncRspCB;
-  if ( NULL == wdiEXTScanSetSignfRSSIChangeRspCb)
+  wdiEXTScanResetSSIDHotlistRspCb =
+                (WDI_EXTScanResetSSIDHotlistRspCb)pWDICtx->pfncRspCB;
+  if ( NULL == wdiEXTScanResetSSIDHotlistRspCb)
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
                  "%s: Callback function Invalid", __func__);
@@ -34187,58 +35795,7 @@
      return WDI_STATUS_E_FAILURE;
   }
 
-  wdiEXTScanSetSignfRSSIChangeRspCb(
-          (void *) pEventData->pEventData, pWDICtx->pRspCBUserData);
-
-  return WDI_STATUS_SUCCESS;
-}
-
-/**
- @brief Process Extended Scan Reset Significant RSSI Change Rsp function
-        (called when a response is being received over the bus from HAL)
-
- @param  pWDICtx:         pointer to the WLAN DAL context
-         pEventData:      pointer to the event information structure
-
- @see
- @return Result of the function call
-*/
-WDI_Status
-WDI_ProcessEXTScanResetSignfRSSIChangeRsp
-(
-  WDI_ControlBlockType*  pWDICtx,
-  WDI_EventInfoType*     pEventData
-)
-{
-  WDI_EXTScanResetSignfRSSIChangeRspCb   wdiEXTScanResetSignfRSSIChangeRspCb;
-
-  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
-                  "%s: %d Enter",__func__, __LINE__);
-
-
-  /*-------------------------------------------------------------------------
-    Sanity check
-  -------------------------------------------------------------------------*/
-  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
-      ( NULL == pEventData->pEventData))
-  {
-     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-                 "%s: Invalid parameters", __func__);
-     WDI_ASSERT(0);
-     return WDI_STATUS_E_FAILURE;
-  }
-
-  wdiEXTScanResetSignfRSSIChangeRspCb =
-      (WDI_EXTScanResetSignfRSSIChangeRspCb)pWDICtx->pfncRspCB;
-  if ( NULL == wdiEXTScanResetSignfRSSIChangeRspCb)
-  {
-     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-                 "%s: Callback function Invalid", __func__);
-     WDI_ASSERT(0);
-     return WDI_STATUS_E_FAILURE;
-  }
-
-  wdiEXTScanResetSignfRSSIChangeRspCb(
+  wdiEXTScanResetSSIDHotlistRspCb(
           (void *) pEventData->pEventData, pWDICtx->pRspCBUserData);
 
   return WDI_STATUS_SUCCESS;
@@ -34465,6 +36022,273 @@
 
   return WDI_STATUS_SUCCESS;
 }
+
+/**
+ @brief Process RssiMonitorStartReq Request
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessRssiMonitorStartReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+    WDI_RssiMonitorReqInfoType*    wdiRssiMonitorStartReq;
+    wpt_uint8*                     pSendBuffer  = NULL;
+    wpt_uint16                     usDataOffset = 0;
+    wpt_uint16                     usSendSize   = 0;
+    WDI_Status                     wdiStatus;
+    tHalStartRssimonitoringReq     halStartRssiMonitorReq;
+    WDI_RssiMonitorStartRspCb      wdiRssiMonitorStartReqCb;
+
+
+    VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                                          "%s: %d Enter",__func__, __LINE__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+      ------------------------------------------------------------------------*/
+    if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+            ( NULL == pEventData->pEventData))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                "%s: Invalid parameters", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    wdiRssiMonitorStartReq = (WDI_RssiMonitorReqInfoType *)pEventData->pEventData;
+
+    /*-----------------------------------------------------------------------
+      Get message buffer
+      -----------------------------------------------------------------------*/
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                    WDI_START_RSSI_MONITOR_REQ,
+                    sizeof(halStartRssiMonitorReq.startRssiMonitoringReqParams),
+                    &pSendBuffer, &usDataOffset, &usSendSize))||
+                    (usSendSize < (usDataOffset +
+                    sizeof(halStartRssiMonitorReq.startRssiMonitoringReqParams))))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in GetFrameLog Req");
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    halStartRssiMonitorReq.startRssiMonitoringReqParams.request_id =
+            wdiRssiMonitorStartReq->requestId;
+
+    halStartRssiMonitorReq.startRssiMonitoringReqParams.min_rssi =
+            wdiRssiMonitorStartReq->minRssi;
+
+    halStartRssiMonitorReq.startRssiMonitoringReqParams.max_rssi =
+            wdiRssiMonitorStartReq->maxRssi;
+    wpalMemoryCopy(halStartRssiMonitorReq.startRssiMonitoringReqParams.bssId,
+            &(wdiRssiMonitorStartReq->currentBssId),
+            sizeof(halStartRssiMonitorReq.startRssiMonitoringReqParams.bssId));
+
+    wdiRssiMonitorStartReqCb = (WDI_RssiMonitorStartRspCb)pEventData->pCBfnc;
+
+    wpalMemoryCopy(pSendBuffer+usDataOffset,
+                   &halStartRssiMonitorReq.startRssiMonitoringReqParams,
+                   sizeof(halStartRssiMonitorReq.startRssiMonitoringReqParams));
+
+    /*-------------------------------------------------------------------------
+      Send Suspend Request to HAL
+      ------------------------------------------------------------------------*/
+    wdiStatus = WDI_SendMsg( pWDICtx, pSendBuffer, usSendSize,
+        wdiRssiMonitorStartReqCb, pEventData->pUserData, WDI_START_RSSI_MONITOR_RSP);
+
+    return  wdiStatus;
+}
+
+
+/**
+ @brief Process FWLoggingInit Request
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessRssiMonitorStopReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+    WDI_RssiMonitorReqInfoType*    wdiRssiMonitorStopReq;
+    wpt_uint8*                     pSendBuffer  = NULL;
+    wpt_uint16                     usDataOffset = 0;
+    wpt_uint16                     usSendSize   = 0;
+    WDI_Status                     wdiStatus;
+    tHalStopRssimonitoringReq      halStopRssiMonitorReq;
+    WDI_RssiMonitorStopRspCb       wdiRssiMonitorStopReqCb;
+
+
+    VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                                          "%s: %d Enter",__func__, __LINE__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+      ------------------------------------------------------------------------*/
+    if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+            ( NULL == pEventData->pEventData))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                "%s: Invalid parameters", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+    wdiRssiMonitorStopReq = (WDI_RssiMonitorReqInfoType *)pEventData->pEventData;
+
+    /*-----------------------------------------------------------------------
+      Get message buffer
+      -----------------------------------------------------------------------*/
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                    WDI_STOP_RSSI_MONITOR_REQ,
+                    sizeof(halStopRssiMonitorReq.stopRssiMonitoringParams),
+                    &pSendBuffer, &usDataOffset, &usSendSize))||
+            (usSendSize < (usDataOffset +
+            sizeof(halStopRssiMonitorReq.stopRssiMonitoringParams))))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in GetFrameLog Req");
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    halStopRssiMonitorReq.stopRssiMonitoringParams.request_id =
+            wdiRssiMonitorStopReq->requestId;
+
+    wpalMemoryCopy(halStopRssiMonitorReq.stopRssiMonitoringParams.bssId,
+            &(wdiRssiMonitorStopReq->currentBssId),
+            sizeof(halStopRssiMonitorReq.stopRssiMonitoringParams.bssId));
+
+    wdiRssiMonitorStopReqCb = (WDI_RssiMonitorStopRspCb)pEventData->pCBfnc;
+
+    wpalMemoryCopy(pSendBuffer+usDataOffset,
+                   &halStopRssiMonitorReq.stopRssiMonitoringParams,
+                   sizeof(halStopRssiMonitorReq.stopRssiMonitoringParams));
+
+    /*-------------------------------------------------------------------------
+      Send Suspend Request to HAL
+      ------------------------------------------------------------------------*/
+    wdiStatus = WDI_SendMsg( pWDICtx, pSendBuffer, usSendSize,
+    wdiRssiMonitorStopReqCb, pEventData->pUserData, WDI_STOP_RSSI_MONITOR_RSP);
+
+    return  wdiStatus;
+}
+
+/**
+ @brief Process MgmtFrame Logging Init Rsp function
+        (called when a response is being received over the bus from HAL)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessRssiMonitorStopRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  tHalStopRssimonitoringRspParams    halRsp;
+  WDI_RssiMonitorStopRspCb          wdiRssiMonitorStopRspCb;
+  WDI_RssiMonitorStopRspParamType   wdiRssiMonitorStopRsp;
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                  "%s: %d Enter",__func__, __LINE__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  wdiRssiMonitorStopRspCb = (WDI_RssiMonitorStopRspCb)pWDICtx->pfncRspCB;
+
+  /*-------------------------------------------------------------------------
+    Extract response and send it to UMAC
+  -------------------------------------------------------------------------*/
+  wpalMemoryCopy( &halRsp, pEventData->pEventData, sizeof(halRsp));
+
+  wdiRssiMonitorStopRsp.status = WDI_HAL_2_WDI_STATUS(halRsp.status);
+
+  /*Notify UMAC*/
+  wdiRssiMonitorStopRspCb( &wdiRssiMonitorStopRsp, pWDICtx->pRspCBUserData);
+
+  return WDI_STATUS_SUCCESS;
+}
+
+
+/**
+ @brief Process MgmtFrame Logging Init Rsp function
+        (called when a response is being received over the bus from HAL)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessRssiMonitorStartRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  tHalStartRssimonitoringRspParams              halRsp;
+  WDI_RssiMonitorStartRspCb          wdiRssiMonitorStartRspCb;
+  WDI_RssiMonitorStartRspParamType   wdiRssiMonitorStartRsp;
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                  "%s: %d Enter",__func__, __LINE__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  wdiRssiMonitorStartRspCb = (WDI_RssiMonitorStopRspCb)pWDICtx->pfncRspCB;
+
+  /*-------------------------------------------------------------------------
+    Extract response and send it to UMAC
+  -------------------------------------------------------------------------*/
+  wpalMemoryCopy( &halRsp, pEventData->pEventData, sizeof(halRsp));
+
+  wdiRssiMonitorStartRsp.status = WDI_HAL_2_WDI_STATUS(halRsp.status);
+
+  /*Notify UMAC*/
+  wdiRssiMonitorStartRspCb( &wdiRssiMonitorStartRsp, pWDICtx->pRspCBUserData);
+
+  return WDI_STATUS_SUCCESS;
+}
+
 /**
  @brief Process FWLoggingInit Request
 
@@ -34583,6 +36407,7 @@
   wpalMemoryCopy( &halRsp, pEventData->pEventData, sizeof(halRsp));
 
   wdiFWLogginginitRsp.status = WDI_HAL_2_WDI_STATUS(halRsp.status);
+  wdiFWLogginginitRsp.fw_mem_dump_max_size = halRsp.fw_dump_max_size;
 
   /*Notify UMAC*/
   wdiFWFrameLoggingInitRspCb( &wdiFWLogginginitRsp, pWDICtx->pRspCBUserData);
@@ -34590,6 +36415,57 @@
   return WDI_STATUS_SUCCESS;
 }
 
+/**
+ @brief Process Fwr Mem Dump Rsp function
+        (called when a response is being received over the bus from HAL)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+    WDI_ProcessFwrMemDumpRsp
+
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  tHalFwMemoryDumpRespMsg      halRsp;
+  WDI_FwrMemDumpRspCb          wdiFwrMemDumpRspCb;
+  WDI_FwrMemDumpRsp            wdiFwrMemDumpRsp;
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                  "%s: %d Enter",__func__, __LINE__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  wdiFwrMemDumpRspCb = (WDI_FwrMemDumpRspCb)pWDICtx->pfncRspCB;
+
+  /*-------------------------------------------------------------------------
+    Extract response and send it to UMAC
+  -------------------------------------------------------------------------*/
+  wpalMemoryCopy( &halRsp.tFwMemoryDumpResp, pEventData->pEventData, sizeof(halRsp.tFwMemoryDumpResp));
+
+  wdiFwrMemDumpRsp.dump_status = WDI_HAL_2_WDI_STATUS(halRsp.tFwMemoryDumpResp.status);
+
+  /*Notify UMAC*/
+  wdiFwrMemDumpRspCb( &wdiFwrMemDumpRsp, pWDICtx->pRspCBUserData);
+
+  return WDI_STATUS_SUCCESS;
+}
+
 WDI_Status
 WDI_ProcessFWLoggingDXEdoneInd
 (
@@ -34603,6 +36479,7 @@
   tFWLoggingDxeDoneInd  *FWLoggingDxeDoneIndParams;
   WDI_DS_LoggingSessionType *pLoggingSession;
   WDI_Status wdiStatus = WDI_STATUS_SUCCESS;
+  wpt_uint32 *pLogType;
 
 
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
@@ -34613,13 +36490,16 @@
   /*-------------------------------------------------------------------------
     Sanity check
   -------------------------------------------------------------------------*/
-  if (NULL == pEventData)
+  if (NULL == pEventData ||
+      NULL == pEventData->pEventData)
   {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
              "%s: Invalid parameters", __func__);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
   }
+  pLogType = (wpt_uint32 *)pEventData->pEventData;
+
   pLoggingSession = (WDI_DS_LoggingSessionType *)
                        WDI_DS_GetLoggingSession(WDI_DS_GetDatapathContext(
                                                   (void *)pWDICtx));
@@ -34646,7 +36526,8 @@
                  &pLoggingSession->logBuffAddress, MAX_NUM_OF_BUFFER *
                  sizeof(FWLoggingDxeDoneIndParams->logBuffAddress[0]));
 
-  FWLoggingDxeDoneIndParams->status = eHAL_STATUS_SUCCESS;
+  FWLoggingDxeDoneIndParams->status = pLoggingSession->status;
+  FWLoggingDxeDoneIndParams->doneIndicationForSource = (wpt_uint16)*pLogType;
 
   wpalMemoryCopy(&FWLoggingDxeDoneIndParams->logBuffLength,
                  &pLoggingSession->logBuffLength, MAX_NUM_OF_BUFFER *
@@ -34888,6 +36769,78 @@
 }
 
 /**
+ @brief Process FwrMemDumpReq Request
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+    WDI_ProcessFwrMemDumpReq
+
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+    WDI_FwrMemDumpReqType *            wdiFwrMemDumpReq;
+    wpt_uint8*                         pSendBuffer  = NULL;
+    wpt_uint16                         usDataOffset = 0;
+    wpt_uint16                         usSendSize   = 0;
+    WDI_Status                         wdiStatus;
+    tHalFwMemoryDumpReqMsg             halFwrMemDumpReq;
+    WDI_FwrMemDumpRspCb                wdiFwrMemDumpRspCb;
+
+    VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+            "%s: %d Enter",__func__, __LINE__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+      ------------------------------------------------------------------------*/
+    if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+            ( NULL == pEventData->pEventData))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                "%s: Invalid parameters", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    wdiFwrMemDumpReq = (WDI_FwrMemDumpReqType *)pEventData->pEventData;
+
+    /*-----------------------------------------------------------------------
+      Get message buffer
+      -----------------------------------------------------------------------*/
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                    WDI_FWR_MEM_DUMP_REQ,
+                    sizeof(halFwrMemDumpReq.tFwMemoryDumpReqParam),
+                    &pSendBuffer, &usDataOffset, &usSendSize))||
+            (usSendSize < (usDataOffset +
+            sizeof(halFwrMemDumpReq.tFwMemoryDumpReqParam))))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in Process Fwr Mem Dump Req");
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    wdiFwrMemDumpRspCb   = (WDI_FwrMemDumpRspCb)pEventData->pCBfnc;
+    wpalMemoryCopy( pSendBuffer+usDataOffset,
+                    &halFwrMemDumpReq.tFwMemoryDumpReqParam,
+                    sizeof(halFwrMemDumpReq.tFwMemoryDumpReqParam));
+
+    /*-------------------------------------------------------------------------
+        Send Fwr Mem Dump Request to HAL
+      ------------------------------------------------------------------------*/
+    wdiStatus = WDI_SendMsg( pWDICtx, pSendBuffer, usSendSize,
+                             wdiFwrMemDumpRspCb, pEventData->pUserData,
+                             WDI_FWR_MEM_DUMP_RSP);
+    return  wdiStatus;
+}
+
+/**
  @brief WDI_EncryptMsgReq
 
  @param pwdiEncryptMsgParams: Req parameter for the FW
@@ -35244,6 +37197,58 @@
 }/*WDI_ProcessNanEvent*/
 
 
+WDI_Status
+WDI_Process_RssiBreachedInd
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+  WDI_LowLevelIndType  wdiInd;
+  tHalRssiMonitorIndParams *halRssiBreachedInd;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*-------------------------------------------------------------------------
+     Sanity check
+    -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  /*-------------------------------------------------------------------------
+    Extract indication and send it to UMAC
+   -------------------------------------------------------------------------*/
+  halRssiBreachedInd = pEventData->pEventData;
+
+  /*Fill in the indication parameters*/
+  wdiInd.wdiIndicationType = WDI_RSSI_BREACHED_IND;
+  wdiInd.wdiIndicationData.wdiRssiBreachedInd.request_id =
+                                      halRssiBreachedInd->request_id;
+  wpalMemoryCopy(wdiInd.wdiIndicationData.wdiRssiBreachedInd.bssId,
+                 halRssiBreachedInd->bssId,
+                 WDI_MAC_ADDR_LEN);
+  wdiInd.wdiIndicationData.wdiRssiBreachedInd.rssi =
+                                      halRssiBreachedInd->rssi;
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+          "%s: session_id %d, rssi : %d, bssId: " MAC_ADDRESS_STR" ", __func__,
+           wdiInd.wdiIndicationData.wdiRssiBreachedInd.request_id,
+           wdiInd.wdiIndicationData.wdiRssiBreachedInd.rssi,
+           MAC_ADDR_ARRAY(wdiInd.wdiIndicationData.wdiRssiBreachedInd.bssId));
+  /*Notify UMAC*/
+  if (pWDICtx->wdiLowLevelIndCB)
+  {
+    pWDICtx->wdiLowLevelIndCB(&wdiInd, pWDICtx->pIndUserData);
+  }
+
+  return WDI_STATUS_SUCCESS;
+
+}
+
 
 WDI_Status
 WDI_Process_LostLinkParamInd
@@ -35483,3 +37488,685 @@
   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
 
 } /* WDI_EnableDisableCAEventInd */
+
+/**
+ @brief WDI_WifiConfigSetReq
+    This API is called to set WifiConfig params request in FW
+
+ @param pwdiWifiConfigSetReqParams : pointer to set WifiCofig request params
+        wdiWifiConfigSetRspCb : WifiConfig stats resp callback
+        usrData : Client context
+ @see
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_WifiConfigSetReq(WDI_WifiConfigSetReqType* pwdiWifConfigSetReqParams,
+                           WDI_WifiConfigSetRspCb   wdiWifiConfigSetRspCb,
+                           void*                   pUserData)
+{
+   WDI_EventInfoType      wdiEventData;
+
+  /*------------------------------------------------------------------------
+    Sanity Check
+  ------------------------------------------------------------------------*/
+  if ( eWLAN_PAL_FALSE == gWDIInitialized )
+  {
+     VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_ERROR,
+                "WDI API call before module is initialized - Fail request");
+
+     return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  wdiEventData.wdiRequest      = WDI_WIFI_CONFIG_SET_REQ;
+  wdiEventData.pEventData      = pwdiWifConfigSetReqParams;
+  wdiEventData.uEventDataSize  = sizeof(*pwdiWifConfigSetReqParams);
+  wdiEventData.pCBfnc          = wdiWifiConfigSetRspCb;
+  wdiEventData.pUserData       = pUserData;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief WDI_ProcessWifiConfigReq -
+    Set WifiConfig request to FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return none
+*/
+   WDI_Status
+   WDI_ProcessWifiConfigReq
+   (
+     WDI_ControlBlockType*  pWDICtx,
+     WDI_EventInfoType*     pEventData
+   )
+   {
+     WDI_WifiConfigSetReqType* pwdiWifiConfigSetReqParams;
+     WDI_WifiConfigSetRspCb wdiWifiConfigSetRspCb;
+     wpt_uint8*               pSendBuffer         = NULL;
+     wpt_uint16               usSendSize          = 0;
+     wpt_uint16               usDataOffset        = 0;
+     tSetWifiConfigParamsReq halWifiConfigSetParams;
+
+     if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ) ||
+         ( NULL == pEventData->pCBfnc ))
+     {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                    "%s: Invalid parameters", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+     }
+     pwdiWifiConfigSetReqParams = (WDI_WifiConfigSetReqType*)pEventData->pEventData;
+     wdiWifiConfigSetRspCb   = (WDI_WifiConfigSetRspCb)pEventData->pCBfnc;
+
+     /*-----------------------------------------------------------------------
+       Get message buffer
+       ! TO DO : proper conversion into the HAL Message Request Format
+     -----------------------------------------------------------------------*/
+     if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(
+                                           pWDICtx,
+                                           WDI_WIFI_CONFIG_SET_REQ,
+                                           sizeof(halWifiConfigSetParams.wifiConfigParams),
+                                           &pSendBuffer, &usDataOffset,
+                                           &usSendSize))||
+         ( usSendSize < (usDataOffset + sizeof(halWifiConfigSetParams.wifiConfigParams) )))
+     {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "Unable to get send buffer in %s %p %p %p", __func__,
+                   pEventData, pwdiWifiConfigSetReqParams, wdiWifiConfigSetRspCb);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+     }
+
+     halWifiConfigSetParams.wifiConfigParams.paramType = pwdiWifiConfigSetReqParams->paramType;
+     halWifiConfigSetParams.wifiConfigParams.paramValue =
+         pwdiWifiConfigSetReqParams->paramValue;
+     vos_mem_copy(halWifiConfigSetParams.wifiConfigParams.bssid, &(pwdiWifiConfigSetReqParams->bssId),
+                                            sizeof(tSirMacAddr));
+
+     wpalMemoryCopy(pSendBuffer+usDataOffset,
+                     &halWifiConfigSetParams.wifiConfigParams,
+                     sizeof(halWifiConfigSetParams.wifiConfigParams));
+
+     pWDICtx->pReqStatusUserData = pEventData->pUserData;
+
+     /*-------------------------------------------------------------------------
+       Send Clear Link Layer Stats Request to HAL
+     -------------------------------------------------------------------------*/
+     return  WDI_SendMsg( pWDICtx, pSendBuffer, usSendSize,
+                          wdiWifiConfigSetRspCb, pEventData->pUserData,
+                          WDI_WIFI_CONFIG_SET_RSP);
+   }
+
+WDI_Status
+WDI_ProcessWificonfigSetRsp
+( WDI_ControlBlockType* pWDICtx,
+  WDI_EventInfoType* pEventData )
+
+{
+  tHalSetWifiConfigRspParams    halRsp;
+  WDI_WifiConfigSetRspCb        wdiWifiConfigSetRspCb;
+  WDI_WifconfigSetRsp           wdiWifconfigSetRsp;
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                  "%s: %d Enter",__func__, __LINE__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  wdiWifiConfigSetRspCb = (WDI_WifiConfigSetRspCb)pWDICtx->pfncRspCB;
+
+  /*-------------------------------------------------------------------------
+    Extract response and send it to UMAC
+  -------------------------------------------------------------------------*/
+  wpalMemoryCopy(&halRsp, pEventData->pEventData, sizeof(halRsp));
+
+  wdiWifconfigSetRsp.wificonfigset_status = WDI_HAL_2_WDI_STATUS(halRsp.status);
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                     "WifiConfig RSP status = %d",
+                     wdiWifconfigSetRsp.wificonfigset_status);
+  /*Notify UMAC*/
+  wdiWifiConfigSetRspCb( &wdiWifconfigSetRsp, pWDICtx->pRspCBUserData);
+
+  return WDI_STATUS_SUCCESS;
+}
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+
+/**
+ @brief WDI_StartOemDataReqIndNew
+
+ @param pOemDataReqNewConfig: Req parameter for the FW
+
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_StartOemDataReqIndNew
+(
+   WDI_OemDataReqNewConfig *pOemDataReqNewConfig
+)
+{
+   WDI_EventInfoType      wdiEventData;
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_ERROR,
+                  "%s: %d",__func__, __LINE__);
+  /*------------------------------------------------------------------------
+    Sanity Check
+  ------------------------------------------------------------------------*/
+  if ( eWLAN_PAL_FALSE == gWDIInitialized )
+  {
+     VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_ERROR,
+                "WDI API call before module is initialized - Fail request");
+
+     return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  wdiEventData.wdiRequest      = WDI_START_OEM_DATA_REQ_IND_NEW;
+  wdiEventData.pEventData      = pOemDataReqNewConfig;
+  wdiEventData.uEventDataSize  = sizeof(*pOemDataReqNewConfig);
+  wdiEventData.pCBfnc          = NULL;
+  wdiEventData.pUserData       = NULL;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief WDI_ProcessStartOemDataReqIndNew -
+    Send OEM Data request new indication to FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return none
+*/
+WDI_Status
+WDI_ProcessStartOemDataReqIndNew
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_OemDataReqNewConfig* wdiOemDataReqNewConfig;
+  wpt_uint8*               pSendBuffer         = NULL;
+  wpt_uint16               usSendSize          = 0;
+  wpt_uint16               usDataOffset        = 0;
+  tpStartOemDataReqParamsNew   pHalStartOemDataReqParamsNew;
+  WDI_Status wdiStatus = WDI_STATUS_SUCCESS;
+
+  VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_ERROR,
+                  "%s: %d",__func__, __LINE__);
+
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+           ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  wdiOemDataReqNewConfig =
+      (WDI_OemDataReqNewConfig *)pEventData->pEventData;
+
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(
+                                        pWDICtx,
+                                        WDI_START_OEM_DATA_REQ_IND_NEW,
+                                        sizeof(*pHalStartOemDataReqParamsNew),
+                                        &pSendBuffer, &usDataOffset,
+                                        &usSendSize))||
+     ( usSendSize < (usDataOffset + sizeof(*pHalStartOemDataReqParamsNew) )))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+              "Unable to get send buffer in %s %p %p", __func__,
+                pEventData, wdiOemDataReqNewConfig);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pHalStartOemDataReqParamsNew =
+      (tpStartOemDataReqParamsNew) (pSendBuffer + usDataOffset);
+
+  wpalMemoryCopy(pHalStartOemDataReqParamsNew,
+                 wdiOemDataReqNewConfig,
+                 sizeof(*pHalStartOemDataReqParamsNew));
+
+  VOS_TRACE(VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+          "%s: selfMacAddr: " MAC_ADDRESS_STR" ", __func__,
+           MAC_ADDR_ARRAY(pHalStartOemDataReqParamsNew->selfMacAddr));
+
+  pWDICtx->pReqStatusUserData = NULL;
+  pWDICtx->pfncRspCB = NULL;
+
+  /*-------------------------------------------------------------------------
+    Send WDI_START_OEM_DATA_REQ_IND_NEW Request to HAL
+  -------------------------------------------------------------------------*/
+  wdiStatus =  WDI_SendIndication( pWDICtx, pSendBuffer, usSendSize);
+  return (wdiStatus != WDI_STATUS_SUCCESS) ? wdiStatus:WDI_STATUS_SUCCESS_SYNC;
+}
+
+/**
+ @brief Process OemDataRsp New Indication indication from FW
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessStartOemDataRspIndNew
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+    WDI_LowLevelIndType wdiInd;
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                "%s: ", __func__);
+
+    /* sanity check */
+    if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                 "%s: Invalid parameters", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    /* Fill in the indication parameters */
+    wdiInd.wdiIndicationType = WDI_START_OEM_DATA_RSP_IND_NEW;
+
+    wdiInd.wdiIndicationData.wdiOemDataRspNew.pOemRspNewIndData =
+                                                (void *)pEventData->pEventData;
+    wdiInd.wdiIndicationData.wdiOemDataRspNew.OemRspNewLen =
+                                                    pEventData->uEventDataSize;
+    /* Notify UMAC */
+    if (pWDICtx->wdiLowLevelIndCB)
+    {
+        pWDICtx->wdiLowLevelIndCB( &wdiInd, pWDICtx->pIndUserData );
+    }
+    else
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_INFO,
+                 "%s: WDILowLevelIndCb is null", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+    return WDI_STATUS_SUCCESS;
+} /* End of WDI_ProcessEXTScanResultInd  */
+
+/**
+ @brief Process Current Antenna Index information from FW
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessGetCurrentAntennaIndexRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+   WDI_AntennaDivSelRspCb wdiGetCurrentAntennaIndexRspCb;
+   tHalAntennaDiversitySelectionRspParams *pHalAntDivSelRsp;
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pHalAntDivSelRsp =
+  (tHalAntennaDiversitySelectionRspParams*)pEventData->pEventData;
+  wdiGetCurrentAntennaIndexRspCb = (WDI_AntennaDivSelRspCb)pWDICtx->pfncRspCB;
+
+  if (pHalAntDivSelRsp->status != 0)
+  {
+      wdiGetCurrentAntennaIndexRspCb(WDI_STATUS_E_FAILURE,
+                      (void *)pHalAntDivSelRsp, pWDICtx->pRspCBUserData);
+  }
+  else
+  {
+      wdiGetCurrentAntennaIndexRspCb(WDI_STATUS_SUCCESS,
+                                     (void *)pHalAntDivSelRsp,
+                                     pWDICtx->pRspCBUserData);
+  }
+
+  return WDI_STATUS_SUCCESS;
+}
+
+/**
+ @brief Process Get Current Antenna Index request command
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessGetCurrentAntennaIndex
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+    wpt_uint8*  pSendBuffer = NULL;
+    wpt_uint16  usDataOffset = 0;
+    wpt_uint16  usSendSize = 0;
+    tHalAntennaDiversitySelectionReqParams halAntDivSelReq;
+    WDI_AntennaDivSelRspCb wdiGetCurrentAntennaIndexRspCb;
+
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+               "%s", __func__);
+
+    /*-------------------------------------------------------------------------
+       Sanity check
+     -------------------------------------------------------------------------*/
+    if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ) ||
+        ( NULL == pEventData->pCBfnc ))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                    "%s: Invalid parameters", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+    wdiGetCurrentAntennaIndexRspCb = (WDI_AntennaDivSelRspCb)pEventData->pCBfnc;
+
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                                WDI_ANTENNA_DIVERSITY_SELECTION_REQ,
+                                sizeof(tHalAntennaDiversitySelectionReqParams),
+                                &pSendBuffer, &usDataOffset, &usSendSize))||
+       ( usSendSize < (usDataOffset +
+         sizeof(tHalAntennaDiversitySelectionReqParams) )))
+    {
+           WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                       "Unable to get send buffer in GetCurrentAntennaIndex %p",
+                       pEventData);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+    pWDICtx->wdiReqStatusCB = NULL;
+    pWDICtx->pReqStatusUserData = pEventData->pEventData;
+    halAntDivSelReq.reserved = *((wpt_uint32 *)(pEventData->pEventData));
+    wpalMemoryCopy( pSendBuffer+usDataOffset,
+                    &halAntDivSelReq,
+                    sizeof(tHalAntennaDiversitySelectionReqParams));
+
+   /*-------------------------------------------------------------------------
+     Send Get STA Request to HAL
+   -------------------------------------------------------------------------*/
+   return  WDI_SendMsg( pWDICtx, pSendBuffer, usSendSize,
+                        wdiGetCurrentAntennaIndexRspCb,
+                        pEventData->pUserData,
+                        WDI_ANTENNA_DIVERSITY_SELECTION_RSP);
+}
+
+/**
+ @brief WDI_GetCurrentAntennaIndex
+
+ @param pOemDataReqNewConfig: Req parameter for the FW
+
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_GetCurrentAntennaIndex
+(
+  void *pUserData,
+  WDI_AntennaDivSelRspCb wdiAntennaDivSelRspCb,
+  wpt_uint32 reserved
+)
+{
+   WDI_EventInfoType      wdiEventData;
+
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*------------------------------------------------------------------------
+    Sanity Check
+  ------------------------------------------------------------------------*/
+  if ( eWLAN_PAL_FALSE == gWDIInitialized )
+  {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                 "WDI API call before module is initialized - Fail request");
+      return WDI_STATUS_E_NOT_ALLOWED;
+  }
+  /*------------------------------------------------------------------------
+    Fill in Event data and post to the Main FSM
+  ------------------------------------------------------------------------*/
+  wdiEventData.wdiRequest      = WDI_ANTENNA_DIVERSITY_SELECTION_REQ;
+  wdiEventData.pEventData      = (void *)&reserved;
+  wdiEventData.uEventDataSize  = sizeof(wpt_uint32);
+  wdiEventData.pCBfnc          = wdiAntennaDivSelRspCb;
+  wdiEventData.pUserData       = pUserData;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief Process Set beacon miss penalty count command
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessBcnMissPenaltyCount
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  wpt_uint8*  pSendBuffer = NULL;
+  wpt_uint16  usDataOffset = 0;
+  wpt_uint16  usSendSize = 0;
+  tHalModifyRoamParamsIndParams halModifyRoamParams;
+  WDI_ModifyRoamParamsReqType *modifyRoamParams;
+  WDI_Status wdiStatus = WDI_STATUS_SUCCESS;
+
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+               "%s", __func__);
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+  {
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+             "%s: Invalid parameters", __func__);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+  }
+
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                                     WDI_MODIFY_ROAM_PARAMS_IND,
+                                     sizeof(tHalModifyRoamParamsIndParams),
+                          &pSendBuffer, &usDataOffset, &usSendSize))||
+       ( usSendSize < (usDataOffset + sizeof(tHalModifyRoamParamsIndParams) )))
+  {
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+              "Unable to get send buffer for Modify roam req params %p ",
+               pEventData);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+  }
+
+  modifyRoamParams = (WDI_ModifyRoamParamsReqType *)pEventData->pEventData;
+  halModifyRoamParams.param = modifyRoamParams->param;
+  halModifyRoamParams.value = modifyRoamParams->value;
+  wpalMemoryCopy( pSendBuffer+usDataOffset, &halModifyRoamParams,
+                  sizeof(halModifyRoamParams));
+  pWDICtx->pReqStatusUserData = NULL;
+  pWDICtx->pfncRspCB = NULL;
+
+  /*-------------------------------------------------------------------------
+    Send WDI_MODIFY_ROAM_PARAMS_IND to HAL
+  -------------------------------------------------------------------------*/
+  wdiStatus =  WDI_SendIndication( pWDICtx, pSendBuffer, usSendSize);
+  return (wdiStatus != WDI_STATUS_SUCCESS) ? wdiStatus:WDI_STATUS_SUCCESS_SYNC;
+
+}
+
+/**
+ @brief WDI_SetBcnMissPenaltyCount
+
+ @param params: Req parameter for the FW
+
+ @return SUCCESS or FAIL
+*/
+
+WDI_Status
+WDI_SetBcnMissPenaltyCount
+(
+    WDI_ModifyRoamParamsReqType *params
+)
+{
+  WDI_EventInfoType      wdiEventData;
+
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*------------------------------------------------------------------------
+   Sanity Check
+  ------------------------------------------------------------------------*/
+  if ( eWLAN_PAL_FALSE == gWDIInitialized )
+  {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                 "WDI API call before module is initialized - Fail request");
+      return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  /*------------------------------------------------------------------------
+    Fill in Event data and post to the Main FSM
+  ------------------------------------------------------------------------*/
+  wdiEventData.wdiRequest      = WDI_MODIFY_ROAM_PARAMS_IND;
+  wdiEventData.pEventData      = (void *)params;
+  wdiEventData.uEventDataSize  = sizeof(*params);
+  wdiEventData.pCBfnc          = NULL;
+  wdiEventData.pUserData       = NULL;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+
+} /* WDI_SetBcnMissPenaltyCount */
+
+#endif
+
+/**
+ *  WDI_ProcessSetAllowedActionFramesInd() - Process Allowed action frames
+ *                                   Indication message and post it to HAL
+ *
+ *  @pWDICtx: pointer to the WLAN DAL context
+ *  @pEventData: pointer to the event information structure
+ *
+ *  Return: WDI_Status enumeration
+ */
+WDI_Status WDI_ProcessSetAllowedActionFramesInd(WDI_ControlBlockType *pWDICtx,
+                                                  WDI_EventInfoType *pEventData)
+{
+    wpt_uint8 *pSendBuffer;
+    wpt_uint16 usDataOffset;
+    wpt_uint16 usSendSize;
+    wpt_uint16 usLen;
+    struct WDI_AllowedActionFramesInd* pwdiAllowedActionFramesInd;
+    tHalAllowedActionFrames* pAllowedActionFrames;
+    WDI_Status wdiStatus;
+
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+                                          "%s", __func__);
+
+    if ((!pEventData) || (!pEventData->pEventData))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                                          "%s: Invalid parameters", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    if ((WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(pWDICtx,
+                                        WDI_SET_ALLOWED_ACTION_FRAMES_IND,
+                                        sizeof(tHalAllowedActionFrames),
+                                        &pSendBuffer, &usDataOffset,
+                                        &usSendSize))||
+                                        (usSendSize < (usDataOffset + usLen)))
+    {
+         WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                    "Unable to get send buffer in Allowed Action Frames req %p",
+                    pEventData);
+         return WDI_STATUS_E_FAILURE;
+    }
+
+    pwdiAllowedActionFramesInd =
+                     (struct WDI_AllowedActionFramesInd*)pEventData->pEventData;
+    pAllowedActionFrames =
+                        (tHalAllowedActionFrames*)(pSendBuffer+usDataOffset);
+    pAllowedActionFrames->actionFramesBitMask =
+                         pwdiAllowedActionFramesInd->bitmask;
+    pAllowedActionFrames->reserved = pwdiAllowedActionFramesInd->reserved;
+
+    pWDICtx->pReqStatusUserData = NULL;
+    pWDICtx->pfncRspCB = NULL;
+
+    wdiStatus = WDI_SendIndication(pWDICtx, pSendBuffer, usSendSize);
+    return (wdiStatus != WDI_STATUS_SUCCESS) ?
+                                            wdiStatus:WDI_STATUS_SUCCESS_SYNC;
+}/*WDI_ProcessSetAllowedActionFramesInd*/
+
+/**
+ *  WDI_SetAllowedActionFramesInd() - Post Allowed Action Frames Indication to
+ *                                    WDI Main Event Handler
+ *  @params: pointer to the WDI_AllowedActionFramesInd structure
+ *
+ *  Return: WDI_Status enumeration
+ */
+WDI_Status WDI_SetAllowedActionFramesInd(
+                                     struct WDI_AllowedActionFramesInd  *params)
+{
+    WDI_EventInfoType wdiEventData;
+
+    if (eWLAN_PAL_FALSE == gWDIInitialized)
+    {
+        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                   "WDI API call before module is initialized - Fail req");
+        return WDI_STATUS_E_NOT_ALLOWED;
+    }
+
+    wdiEventData.wdiRequest = WDI_SET_ALLOWED_ACTION_FRAMES_IND;
+    wdiEventData.pEventData = params;
+    wdiEventData.uEventDataSize  = sizeof(*params);
+    wdiEventData.pCBfnc = NULL;
+    wdiEventData.pUserData = NULL;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
diff --git a/wlan/prima/CORE/WDI/CP/src/wlan_qct_wdi_dp.c b/wlan/prima/CORE/WDI/CP/src/wlan_qct_wdi_dp.c
index 9355787..48bf139 100644
--- a/wlan/prima/CORE/WDI/CP/src/wlan_qct_wdi_dp.c
+++ b/wlan/prima/CORE/WDI/CP/src/wlan_qct_wdi_dp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -458,7 +458,8 @@
         pBd->dpuRF = BMUWQ_BTQM_TX_MGMT; 
     }
 
-    if (ucTxFlag & WDI_USE_FW_IN_TX_PATH)
+    if (ucTxFlag & WDI_USE_FW_IN_TX_PATH ||
+            (pWDICtx->sendMgmtPktViaWQ5 && (ucType == WDI_MAC_MGMT_FRAME)))
     {
         WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
           "iType: %d SubType %d, MAC S: %08x. MAC D: %08x., Tid=%d",
@@ -891,6 +892,13 @@
    
             WDI_STATableGetStaType(pWDICtx, ucStaId, &ucSTAType);
             if(!ucUnicastDst)
+#ifdef WLAN_FEATURE_RMC
+              /*Check for RMC enabled bit if set then
+                queue frames in QID 5 else 0*/
+              if ( ucTxFlag & WDI_RMC_REQUESTED_MASK )
+                pBd->queueId = BTQM_QID5;
+              else
+#endif
                 pBd->queueId = BTQM_QID0;
 #ifndef HAL_SELF_STA_PER_BSS
             else if( ucUnicastDst && (ucStaId == pWDICtx->ucSelfStaId))
diff --git a/wlan/prima/CORE/WDI/DP/inc/wlan_qct_wdi_ds.h b/wlan/prima/CORE/WDI/DP/inc/wlan_qct_wdi_ds.h
index fea8be8..483ad65 100644
--- a/wlan/prima/CORE/WDI/DP/inc/wlan_qct_wdi_ds.h
+++ b/wlan/prima/CORE/WDI/DP/inc/wlan_qct_wdi_ds.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -168,6 +168,7 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
    wpt_uint32 offloadScanLearn;
    wpt_uint32 roamCandidateInd;
+   wpt_uint32 perRoamCndInd;
 #endif
 #ifdef WLAN_FEATURE_EXTSCAN
    wpt_uint32 extscanBuffer;
@@ -186,6 +187,7 @@
 
 typedef struct
 {
+   wpt_uint16 status;
    wpt_boolean active;
    wpt_uint64 logBuffAddress[MAX_NUM_OF_BUFFER];
    wpt_uint32 logBuffLength[MAX_NUM_OF_BUFFER];
@@ -193,6 +195,7 @@
    wpt_uint8   logType;
    /* Indicate if Last segment of log is received*/
    wpt_boolean done;
+   wpt_uint16 reasonCode;
 } WDI_DS_LoggingSessionType;
 
 WPT_STATIC WPT_INLINE WDI_DS_RxMetaInfoType* WDI_DS_ExtractRxMetaData (wpt_packet *pFrame)
@@ -214,7 +217,7 @@
 typedef void (*WDI_DS_TxCompleteCallback)(void *pContext, wpt_packet *pFrame);
 typedef void (*WDI_DS_RxPacketCallback) (void *pContext, wpt_packet *pFrame);
 typedef void (*WDI_DS_TxFlowControlCallback)(void *pContext, wpt_uint8 ac_mask);
-typedef void (*WDI_DS_RxLogCallback)(void);
+typedef void (*WDI_DS_RxLogCallback)(wpt_uint8 logType);
 
 
 
diff --git a/wlan/prima/CORE/WDI/TRP/DTS/inc/wlan_qct_wdi_dts.h b/wlan/prima/CORE/WDI/TRP/DTS/inc/wlan_qct_wdi_dts.h
index f7e74d1..363c946 100644
--- a/wlan/prima/CORE/WDI/TRP/DTS/inc/wlan_qct_wdi_dts.h
+++ b/wlan/prima/CORE/WDI/TRP/DTS/inc/wlan_qct_wdi_dts.h
@@ -93,6 +93,11 @@
    WDTS_POWER_STATE_MAX
 } WDTS_PowerStateType;
 
+typedef enum
+{
+   WDTS_LOGGING_STATUS_SUCCESS,
+   WDTS_LOGGING_STATUS_ERROR
+} WDTS_LoggingSessionStatus;
 
 typedef wpt_status (*WDTS_TxCompleteCbType)(void *pContext, wpt_packet *pFrame, wpt_status status);
 typedef wpt_status (*WDTS_RxFrameReadyCbType) (void *pContext, wpt_packet *pFrame, WDTS_ChannelType channel);
diff --git a/wlan/prima/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c b/wlan/prima/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c
index 1aebf0a..22c9a01 100644
--- a/wlan/prima/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c
+++ b/wlan/prima/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c
@@ -49,6 +49,7 @@
 #include "vos_utils.h"
 #include "vos_api.h"
 
+
 static WDTS_TransportDriverTrype gTransportDriver = {
   WLANDXE_Open, 
   WLANDXE_Start, 
@@ -605,6 +606,8 @@
   wpt_uint16                  usMPDUDOffset, usMPDULen;
   WDI_DS_RxMetaInfoType     *pRxMetadata;
   wpt_uint8                  isFcBd = 0;
+  WDI_DS_LoggingSessionType *pLoggingSession;
+  tPerPacketStats             rxStats = {0};
 
   tpSirMacFrameCtl  pMacFrameCtl;
   // Do Sanity checks
@@ -615,7 +618,9 @@
   // Normal DMA transfer does not contain RxBD
   if (WDTS_CHANNEL_RX_FW_LOG == channel)
   {
-      wpalFwLogPktSerialize(pFrame);
+      pLoggingSession = (WDI_DS_LoggingSessionType *)
+                         WDI_DS_GetLoggingSession(pContext);
+      wpalFwLogPktSerialize(pFrame, pLoggingSession->logType);
 
       return eWLAN_PAL_STATUS_SUCCESS;
   }
@@ -799,6 +804,7 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
       pRxMetadata->offloadScanLearn = WDI_RX_BD_GET_OFFLOADSCANLEARN(pBDHeader);
       pRxMetadata->roamCandidateInd = WDI_RX_BD_GET_ROAMCANDIDATEIND(pBDHeader);
+      pRxMetadata->perRoamCndInd = WDI_RX_BD_GET_PER_ROAMCANDIDATEIND(pBDHeader);
 #endif
 #ifdef WLAN_FEATURE_EXTSCAN
       pRxMetadata->extscanBuffer = WDI_RX_BD_GET_EXTSCANFULLSCANRESIND(pBDHeader);
@@ -871,6 +877,23 @@
       {
           vos_record_roam_event(e_DXE_RX_PKT_TIME, (void *)pFrame, pRxMetadata->type);
       }
+      if ((WLAN_LOG_LEVEL_ACTIVE ==
+            vos_get_ring_log_level(RING_ID_PER_PACKET_STATS)) &&
+          !(WDI_MAC_CTRL_FRAME == pRxMetadata->type))
+      {
+          vos_mem_zero(&rxStats,sizeof(tPerPacketStats));
+          /* Peer tx packet and it is an Rx packet for us */
+          rxStats.is_rx= VOS_TRUE;
+          rxStats.tid = ucTid;
+          rxStats.rssi = (pRxMetadata->rssi0 > pRxMetadata->rssi1)?
+                                pRxMetadata->rssi0 : pRxMetadata->rssi1;
+          rxStats.rate_idx = pRxMetadata->rateIndex;
+          rxStats.seq_num = pRxMetadata->currentPktSeqNo;
+          rxStats.dxe_timestamp = vos_timer_get_system_ticks();
+          rxStats.data_len =
+               vos_copy_80211_data(pFrame, rxStats.data, pRxMetadata->type);
+          wpalPerPktSerialize(&rxStats);
+      }
       // Invoke Rx complete callback
       pClientData->receiveFrameCB(pClientData->pCallbackContext, pFrame);  
   }
@@ -939,6 +962,35 @@
 
 }
 
+void WDTS_LogRxDone(void *pContext)
+{
+  WDI_DS_LoggingSessionType *pLoggingSession;
+
+  pLoggingSession = (WDI_DS_LoggingSessionType *)
+                       WDI_DS_GetLoggingSession(pContext);
+
+  if (NULL == pContext || pLoggingSession == NULL)
+  {
+    return;
+  }
+  /* check for done and Log type Mgmt frame = 0, QXDM = 1, FW Mem dump = 2 */
+  if (pLoggingSession->done && pLoggingSession->logType <= VALID_FW_LOG_TYPES)
+     vos_process_done_indication(pLoggingSession->logType,
+                                 pLoggingSession->reasonCode);
+
+
+  if (pLoggingSession->logType == QXDM_LOGGING &&
+     pLoggingSession->reasonCode)
+      pLoggingSession->logType = FATAL_EVENT;
+  ((WDI_DS_ClientDataType *)(pContext))->rxLogCB(pLoggingSession->logType);
+
+  pLoggingSession->done = 0;
+  pLoggingSession->logType = 0;
+  pLoggingSession->reasonCode = 0;
+
+  return;
+}
+
 void WDTS_MbReceiveMsg(void *pContext)
 {
   tpLoggingMailBox pLoggingMb;
@@ -952,8 +1004,28 @@
 
   for(i = 0; i < MAX_NUM_OF_BUFFER; i++)
   {
+      totalLen += pLoggingMb->logBuffLength[i];
+      // Send done indication when the logbuffer size exceeds 128KB.
+      if (totalLen > MAX_LOG_BUFFER_LENGTH || pLoggingMb->logBuffLength[i] > MAX_LOG_BUFFER_LENGTH)
+      {
+         DTI_TRACE( DTI_TRACE_LEVEL_ERROR, " %d received invalid log buffer length",
+                                              totalLen);
+         // Done using Mailbox, zero out the memory.
+         wpalMemoryZero(pLoggingMb, sizeof(tLoggingMailBox));
+         wpalMemoryZero(pLoggingSession, sizeof(WDI_DS_LoggingSessionType));
+         //Set Status as Failure
+         pLoggingSession->status = WDTS_LOGGING_STATUS_ERROR;
+         WDTS_LogRxDone(pContext);
+
+         return;
+      }
+  }
+
+  totalLen = 0;
+  for(i = 0; i < MAX_NUM_OF_BUFFER; i++)
+  {
      pLoggingSession->logBuffAddress[i] = pLoggingMb->logBuffAddress[i];
-     if (!noMem && (pLoggingMb->logBuffLength[i] <= MAX_LOG_BUFFER_LENGTH))
+     if (!noMem)
      {
         pLoggingSession->logBuffLength[i] = gTransportDriver.setupLogTransfer(
                                                pLoggingMb->logBuffAddress[i],
@@ -975,6 +1047,8 @@
 
   pLoggingSession->done = pLoggingMb->done;
   pLoggingSession->logType = pLoggingMb->logType;
+  pLoggingSession->reasonCode = pLoggingMb->reasonCode;
+  pLoggingSession->status = WDTS_LOGGING_STATUS_SUCCESS;
   // Done using Mailbox, zero out the memory.
   wpalMemoryZero(pLoggingMb, sizeof(tLoggingMailBox));
 
@@ -987,28 +1061,6 @@
   // Send Done event to upper layers, since we wont be getting any from DXE
 }
 
-void WDTS_LogRxDone(void *pContext)
-{
-  WDI_DS_LoggingSessionType *pLoggingSession;
-
-  pLoggingSession = (WDI_DS_LoggingSessionType *)
-                       WDI_DS_GetLoggingSession(pContext);
-
-  if (NULL == pContext || pLoggingSession == NULL)
-  {
-    return;
-  }
-  /* check for done and Log type Mgmt frame = 0, QXDM = 1, FW Mem dump = 2 */
-  if (pLoggingSession->done && pLoggingSession->logType <= VALID_FW_LOG_TYPES)
-     vos_process_done_indication(pLoggingSession->logType, 0);
-
-  pLoggingSession->done = 0;
-  pLoggingSession->logType = 0;
-  ((WDI_DS_ClientDataType *)(pContext))->rxLogCB();
-
-  return;
-}
-
 /* DTS open  function. 
  * On open the transport device should initialize itself.
  * Parameters:
@@ -1109,6 +1161,7 @@
   WDI_DS_TxMetaInfoType     *pTxMetadata;
   WDTS_ChannelType channel = WDTS_CHANNEL_TX_LOW_PRI;
   wpt_status status = eWLAN_PAL_STATUS_SUCCESS;
+  tPerPacketStats               txPktStat = {0};
 
   // extract metadata from PAL packet
   pTxMetadata = WDI_DS_ExtractTxMetaData(pFrame);
@@ -1143,6 +1196,20 @@
 #endif
   // Send packet to  Transport Driver. 
   status =  gTransportDriver.xmit(pDTDriverContext, pFrame, channel);
+  if ((WLAN_LOG_LEVEL_ACTIVE ==
+           vos_get_ring_log_level(RING_ID_PER_PACKET_STATS)) &&
+       !(pTxMetadata->frmType & WDI_MAC_CTRL_FRAME)){
+
+      vos_mem_zero(&txPktStat,sizeof(tPerPacketStats));
+      txPktStat.tid = pTxMetadata->fUP;
+      txPktStat.dxe_timestamp = vos_timer_get_system_ticks();
+      /*HW limitation cant get the seq number*/
+      txPktStat.seq_num = 0;
+      txPktStat.data_len =
+      vos_copy_80211_data((void *)pFrame, txPktStat.data,
+                   pTxMetadata->frmType);
+      wpalPerPktSerialize(&txPktStat);
+  }
   if (((WDI_ControlBlockType *)pContext)->roamDelayStatsEnabled)
   {
       vos_record_roam_event(e_DXE_FIRST_XMIT_TIME, (void *)pFrame, pTxMetadata->frmType);
diff --git a/wlan/prima/CORE/WDI/WPAL/inc/wlan_qct_pal_device.h b/wlan/prima/CORE/WDI/WPAL/inc/wlan_qct_pal_device.h
index 8cb3c32..bf13fe1 100644
--- a/wlan/prima/CORE/WDI/WPAL/inc/wlan_qct_pal_device.h
+++ b/wlan/prima/CORE/WDI/WPAL/inc/wlan_qct_pal_device.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -306,4 +306,10 @@
 */
 void wpalInactivateRxInterrupt(void);
 
+
+int wpal_get_int_state
+(
+   wpt_uint32                          intType
+);
+
 #endif /* WLAN_QCT_PAL_DEVICE_H*/
diff --git a/wlan/prima/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h b/wlan/prima/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h
index 027d966..e57fda9 100644
--- a/wlan/prima/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h
+++ b/wlan/prima/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h
@@ -446,7 +446,22 @@
 ---------------------------------------------------------------------------*/
 void wpalFwLogPktSerialize
 (
-   wpt_packet *pFrame
+   wpt_packet *pFrame, wpt_uint32 pktType
+);
+
+/*---------------------------------------------------------------------------
+    wpalPerPktSerialize - Serialize perpkt data to logger thread
+
+    Param:
+
+
+    Return:
+        NONE
+
+---------------------------------------------------------------------------*/
+void wpalPerPktSerialize
+(
+   void *perPktStat
 );
 
 /*---------------------------------------------------------------------------
diff --git a/wlan/prima/CORE/WDI/WPAL/src/wlan_qct_pal_device.c b/wlan/prima/CORE/WDI/WPAL/src/wlan_qct_pal_device.c
index 1c08371..3a43565 100644
--- a/wlan/prima/CORE/WDI/WPAL/src/wlan_qct_pal_device.c
+++ b/wlan/prima/CORE/WDI/WPAL/src/wlan_qct_pal_device.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -823,3 +823,28 @@
    return eWLAN_PAL_STATUS_SUCCESS;
 }
 
+/* Get Interrupt Status */
+int wpal_get_int_state
+(
+   wpt_uint32    intType
+)
+{
+   int ret;
+   ret = 0;
+
+   switch (intType)
+   {
+   case DXE_INTERRUPT_RX_READY:
+      if (gpEnv->rx_isr_enabled == 1)
+          ret = 1;
+      break;
+   case DXE_INTERRUPT_TX_COMPLE:
+      if (gpEnv->tx_isr_enabled == 1)
+          ret = 1;
+      break;
+   default:
+      break;
+   }
+
+   return ret;
+}
diff --git a/wlan/prima/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c b/wlan/prima/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c
index e5b310b..da46cba 100644
--- a/wlan/prima/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c
+++ b/wlan/prima/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c
@@ -1069,8 +1069,27 @@
 ---------------------------------------------------------------------------*/
 void wpalFwLogPktSerialize
 (
-   wpt_packet *pFrame
+   wpt_packet *pFrame, wpt_uint32 pktType
 )
 {
-    vos_logger_pkt_serialize(WPAL_TO_VOS_PKT(pFrame),LOG_PKT_TYPE_FW_LOG);
+    vos_logger_pkt_serialize(WPAL_TO_VOS_PKT(pFrame), pktType);
+}
+
+
+/*---------------------------------------------------------------------------
+    wpalPerPktSerialize - Serialize perpkt data to logger thread
+
+    Param:
+
+
+    Return:
+        NONE
+
+---------------------------------------------------------------------------*/
+void wpalPerPktSerialize
+(
+   void *perPktStat
+)
+{
+   vos_per_pkt_stats_to_user(perPktStat);
 }
diff --git a/wlan/prima/Kbuild b/wlan/prima/Kbuild
index cebcbea..b7c1f72 100644
--- a/wlan/prima/Kbuild
+++ b/wlan/prima/Kbuild
@@ -14,36 +14,39 @@
 endif
 
 ifeq ($(KERNEL_BUILD), 0)
-	# These are configurable via Kconfig for kernel-based builds
-	# Need to explicitly configure for Android-based builds
+# These are configurable via Kconfig for kernel-based builds
+# Need to explicitly configure for Android-based builds
 
-	#Flag to enable BlueTooth AMP feature
-	CONFIG_PRIMA_WLAN_BTAMP := n
+#Flag to enable BlueTooth AMP feature
+    CONFIG_PRIMA_WLAN_BTAMP := n
 
-	#Flag to enable Legacy Fast Roaming(LFR)
-	CONFIG_PRIMA_WLAN_LFR := y
+#Flag to enable Legacy Fast Roaming(LFR)
+    CONFIG_PRIMA_WLAN_LFR := y
 
-	#JB kernel has PMKSA patches, hence enabling this flag
-	CONFIG_PRIMA_WLAN_OKC := y
+#JB kernel has PMKSA patches, hence enabling this flag
+    CONFIG_PRIMA_WLAN_OKC := y
 
-	# JB kernel has CPU enablement patches, so enable
-	CONFIG_PRIMA_WLAN_11AC_HIGH_TP := y
+# JB kernel has CPU enablement patches, so enable
+    CONFIG_PRIMA_WLAN_11AC_HIGH_TP := y
 
-	#Flag to enable TDLS feature
-	CONFIG_QCOM_TDLS := y
+#Flag to enable TDLS feature
+    CONFIG_QCOM_TDLS := y
 
-	#Flag to enable Fast Transition (11r) feature
-	CONFIG_QCOM_VOWIFI_11R := y
+#Flag to enable Fast Transition (11r) feature
+    CONFIG_QCOM_VOWIFI_11R := y
 
-	#Flag to enable Protected Managment Frames (11w) feature
-	ifneq ($(CONFIG_PRONTO_WLAN),)
-	CONFIG_WLAN_FEATURE_11W := y
-	endif
+#Flag to enable Protected Managment Frames (11w) feature
+ifneq ($(CONFIG_PRONTO_WLAN),)
+    CONFIG_WLAN_FEATURE_11W := y
+    endif
 
-	#Flag to enable new Linux Regulatory implementation
-	CONFIG_ENABLE_LINUX_REG := y
+#Flag to enable new Linux Regulatory implementation
+    CONFIG_ENABLE_LINUX_REG := y
 
-endif
+#Flag to enable offload packets feature
+    CONFIG_WLAN_OFFLOAD_PACKETS := y
+
+    endif
 
 # To enable CONFIG_QCOM_ESE_UPLOAD, dependent config
 # CONFIG_QCOM_ESE must be enabled.
@@ -196,6 +199,7 @@
 		$(MAC_SRC_DIR)/pe/lim/limProcessProbeRspFrame.o \
 		$(MAC_SRC_DIR)/pe/lim/limProcessSmeReqMessages.o \
 		$(MAC_SRC_DIR)/pe/lim/limPropExtsUtils.o \
+		$(MAC_SRC_DIR)/pe/lim/limRMC.o \
 		$(MAC_SRC_DIR)/pe/lim/limRoamingAlgo.o \
 		$(MAC_SRC_DIR)/pe/lim/limScanResultUtils.o \
 		$(MAC_SRC_DIR)/pe/lim/limSecurityUtils.o \
@@ -547,6 +551,7 @@
 		-DWLAN_FEATURE_GTK_OFFLOAD \
 		-DWLAN_WAKEUP_EVENTS \
 	        -DWLAN_KD_READY_NOTIFIER \
+		-DWLAN_FEATURE_RMC \
 		-DWLAN_NL80211_TESTMODE \
 		-DFEATURE_WLAN_BATCH_SCAN \
 		-DFEATURE_WLAN_LPHB \
@@ -557,7 +562,9 @@
                 -DWLAN_DXE_LOW_RESOURCE_TIMER \
                 -DWLAN_LOGGING_SOCK_SVC_ENABLE \
                 -DWLAN_FEATURE_LINK_LAYER_STATS \
-                -DWLAN_FEATURE_EXTSCAN
+                -DWLAN_FEATURE_EXTSCAN \
+                -DFEATURE_EXT_LL_STAT \
+                -DWLAN_VOWIFI_DEBUG
 
 ifneq ($(CONFIG_PRONTO_WLAN),)
 CDEFINES += -DWCN_PRONTO
@@ -571,6 +578,7 @@
 		-DSME_TRACE_RECORD \
 		-DPE_DEBUG_LOGW \
 		-DPE_DEBUG_LOGE \
+                -DDXE_TRACE \
 		-DDEBUG
 endif
 
@@ -667,6 +675,10 @@
 # Fix build for GCC 4.7
 EXTRA_CFLAGS += -Wno-maybe-uninitialized -Wno-unused-function
 
+ifeq ($(CONFIG_WLAN_OFFLOAD_PACKETS),y)
+CDEFINES += -DWLAN_FEATURE_OFFLOAD_PACKETS
+endif
+
 KBUILD_CPPFLAGS += $(CDEFINES)
 
 # Module information used by KBuild framework
diff --git a/wlan/prima/Kconfig b/wlan/prima/Kconfig
index 5ed8eb1..9306175 100644
--- a/wlan/prima/Kconfig
+++ b/wlan/prima/Kconfig
@@ -49,4 +49,8 @@
 	bool "Enable linux regulatory feature"
 	default n
 
+config WLAN_OFFLOAD_PACKETS
+	bool "Enable offload packets feature"
+	default n
+
 endif # PRIMA_WLAN || PRONTO_WLAN
diff --git a/wlan/prima/Makefile b/wlan/prima/Makefile
index ff8bd6d..7bc89cc 100644
--- a/wlan/prima/Makefile
+++ b/wlan/prima/Makefile
@@ -1,20 +1,11 @@
 default: all
 
-KBUILD_OPTIONS := WLAN_ROOT=$(PWD)
+KBUILD_OPTIONS := WLAN_ROOT=$(WLAN_ROOT)
 KBUILD_OPTIONS += MODNAME=wlan
-BUILD_CROSS_COMPILE=$(BUILD_ROOT_DIR)/prebuilts/gcc/linux-x86/arm/arm-eabi-4.8/bin/arm-eabi-
-#BUILD_CROSS_COMPILE=/opt/toolchains/arm-eabi-4.7/bin/arm-eabi-
-
-#CFLAGS = -Wno-implicit
-#obj-$(CONFIG_PRONTO_WLAN)		= wlan.ko
-#obj-$(CONFIG_PRIMA_WLAN)		= wlan.ko
-#obj-y		= wlan.ko
-
 
 all::
 	$(MAKE) -C $(KERNEL_SOURCE) $(KBUILD_OPTIONS) $(EXTRA_CFLAGS) ARCH=$(ARCH) \
-		SUBDIRS=$(CURDIR) CROSS_COMPILE=$(BUILD_CROSS_COMPILE) modules
-#CC=${CC} modules
+		SUBDIRS=$(CURDIR) CROSS_COMPILE=$(CROSS_COMPILE) modules
 
 modules_install:
 	$(MAKE) INSTALL_MOD_STRIP=1 -C $(KERNEL_SRC) M=$(shell pwd) modules_install
diff --git a/wlan/prima/firmware_bin/WCNSS_qcom_cfg.ini b/wlan/prima/firmware_bin/WCNSS_qcom_cfg.ini
index e9d6727..97b61e9 100644
--- a/wlan/prima/firmware_bin/WCNSS_qcom_cfg.ini
+++ b/wlan/prima/firmware_bin/WCNSS_qcom_cfg.ini
@@ -465,6 +465,18 @@
 #Default is set to 0 (disable)
 gEnableRtsCtsHtVht=0
 
+#Enable delACK
+gEnableDelAck=1
+
+#Compute interval for delack
+gTcpDelAckComputeInterval=2000
+
+#Delack set higher limit
+gTcpDelAckThresholdHigh=17000
+
+#Delack set lower limit
+gTcpDelAckThresholdLow=12000
+
 END
 
 # Note: Configuration parser would not read anything past the END marker
diff --git a/wlan/prima/prima/Kbuild b/wlan/prima/prima/Kbuild
deleted file mode 100644
index cebcbea..0000000
--- a/wlan/prima/prima/Kbuild
+++ /dev/null
@@ -1,675 +0,0 @@
-# We can build either as part of a standalone Kernel build or part
-# of an Android build.  Determine which mechanism is being used
-ifeq ($(MODNAME),)
-	KERNEL_BUILD := 1
-else
-	KERNEL_BUILD := 0
-endif
-
-ifeq ($(KERNEL_BUILD),1)
-	# These are provided in Android-based builds
-	# Need to explicitly define for Kernel-based builds
-	MODNAME := wlan
-	WLAN_ROOT := drivers/staging/prima
-endif
-
-ifeq ($(KERNEL_BUILD), 0)
-	# These are configurable via Kconfig for kernel-based builds
-	# Need to explicitly configure for Android-based builds
-
-	#Flag to enable BlueTooth AMP feature
-	CONFIG_PRIMA_WLAN_BTAMP := n
-
-	#Flag to enable Legacy Fast Roaming(LFR)
-	CONFIG_PRIMA_WLAN_LFR := y
-
-	#JB kernel has PMKSA patches, hence enabling this flag
-	CONFIG_PRIMA_WLAN_OKC := y
-
-	# JB kernel has CPU enablement patches, so enable
-	CONFIG_PRIMA_WLAN_11AC_HIGH_TP := y
-
-	#Flag to enable TDLS feature
-	CONFIG_QCOM_TDLS := y
-
-	#Flag to enable Fast Transition (11r) feature
-	CONFIG_QCOM_VOWIFI_11R := y
-
-	#Flag to enable Protected Managment Frames (11w) feature
-	ifneq ($(CONFIG_PRONTO_WLAN),)
-	CONFIG_WLAN_FEATURE_11W := y
-	endif
-
-	#Flag to enable new Linux Regulatory implementation
-	CONFIG_ENABLE_LINUX_REG := y
-
-endif
-
-# To enable CONFIG_QCOM_ESE_UPLOAD, dependent config
-# CONFIG_QCOM_ESE must be enabled.
-CONFIG_QCOM_ESE := n
-CONFIG_QCOM_ESE_UPLOAD := n
-
-# Feature flags which are not (currently) configurable via Kconfig
-
-#Whether to build debug version
-BUILD_DEBUG_VERSION := 1
-
-#Enable this flag to build driver in diag version
-BUILD_DIAG_VERSION := 1
-
-#Do we panic on bug?  default is to warn
-PANIC_ON_BUG := 1
-
-#Re-enable wifi on WDI timeout
-RE_ENABLE_WIFI_ON_WDI_TIMEOUT := 0
-
-ifeq ($(CONFIG_CFG80211),y)
-HAVE_CFG80211 := 1
-else
-ifeq ($(CONFIG_CFG80211),m)
-HAVE_CFG80211 := 1
-else
-HAVE_CFG80211 := 0
-endif
-endif
-
-############ BAP ############
-BAP_DIR :=	CORE/BAP
-BAP_INC_DIR :=	$(BAP_DIR)/inc
-BAP_SRC_DIR :=	$(BAP_DIR)/src
-
-BAP_INC := 	-I$(WLAN_ROOT)/$(BAP_INC_DIR) \
-		-I$(WLAN_ROOT)/$(BAP_SRC_DIR)
-
-BAP_OBJS := 	$(BAP_SRC_DIR)/bapApiData.o \
-		$(BAP_SRC_DIR)/bapApiDebug.o \
-		$(BAP_SRC_DIR)/bapApiExt.o \
-		$(BAP_SRC_DIR)/bapApiHCBB.o \
-		$(BAP_SRC_DIR)/bapApiInfo.o \
-		$(BAP_SRC_DIR)/bapApiLinkCntl.o \
-		$(BAP_SRC_DIR)/bapApiLinkSupervision.o \
-		$(BAP_SRC_DIR)/bapApiStatus.o \
-		$(BAP_SRC_DIR)/bapApiTimer.o \
-		$(BAP_SRC_DIR)/bapModule.o \
-		$(BAP_SRC_DIR)/bapRsn8021xAuthFsm.o \
-		$(BAP_SRC_DIR)/bapRsn8021xPrf.o \
-		$(BAP_SRC_DIR)/bapRsn8021xSuppRsnFsm.o \
-		$(BAP_SRC_DIR)/bapRsnAsfPacket.o \
-		$(BAP_SRC_DIR)/bapRsnSsmAesKeyWrap.o \
-		$(BAP_SRC_DIR)/bapRsnSsmEapol.o \
-		$(BAP_SRC_DIR)/bapRsnSsmReplayCtr.o \
-		$(BAP_SRC_DIR)/bapRsnTxRx.o \
-		$(BAP_SRC_DIR)/btampFsm.o \
-		$(BAP_SRC_DIR)/btampHCI.o
-
-############ DXE ############
-DXE_DIR :=	CORE/DXE
-DXE_INC_DIR :=	$(DXE_DIR)/inc
-DXE_SRC_DIR :=	$(DXE_DIR)/src
-
-DXE_INC := 	-I$(WLAN_ROOT)/$(DXE_INC_DIR) \
-		-I$(WLAN_ROOT)/$(DXE_SRC_DIR)
-
-DXE_OBJS = 	$(DXE_SRC_DIR)/wlan_qct_dxe.o \
-		$(DXE_SRC_DIR)/wlan_qct_dxe_cfg_i.o
-
-############ HDD ############
-HDD_DIR :=	CORE/HDD
-HDD_INC_DIR :=	$(HDD_DIR)/inc
-HDD_SRC_DIR :=	$(HDD_DIR)/src
-
-HDD_INC := 	-I$(WLAN_ROOT)/$(HDD_INC_DIR) \
-		-I$(WLAN_ROOT)/$(HDD_SRC_DIR)
-
-HDD_OBJS := 	$(HDD_SRC_DIR)/bap_hdd_main.o \
-		$(HDD_SRC_DIR)/wlan_hdd_assoc.o \
-		$(HDD_SRC_DIR)/wlan_hdd_cfg.o \
-		$(HDD_SRC_DIR)/wlan_hdd_debugfs.o \
-		$(HDD_SRC_DIR)/wlan_hdd_dev_pwr.o \
-		$(HDD_SRC_DIR)/wlan_hdd_dp_utils.o \
-		$(HDD_SRC_DIR)/wlan_hdd_early_suspend.o \
-		$(HDD_SRC_DIR)/wlan_hdd_ftm.o \
-		$(HDD_SRC_DIR)/wlan_hdd_hostapd.o \
-		$(HDD_SRC_DIR)/wlan_hdd_main.o \
-		$(HDD_SRC_DIR)/wlan_hdd_mib.o \
-		$(HDD_SRC_DIR)/wlan_hdd_oemdata.o \
-		$(HDD_SRC_DIR)/wlan_hdd_scan.o \
-		$(HDD_SRC_DIR)/wlan_hdd_softap_tx_rx.o \
-		$(HDD_SRC_DIR)/wlan_hdd_tx_rx.o \
-                $(HDD_SRC_DIR)/wlan_hdd_trace.o \
-		$(HDD_SRC_DIR)/wlan_hdd_wext.o \
-		$(HDD_SRC_DIR)/wlan_hdd_wmm.o \
-		$(HDD_SRC_DIR)/wlan_hdd_wowl.o
-
-ifeq ($(HAVE_CFG80211),1)
-HDD_OBJS +=	$(HDD_SRC_DIR)/wlan_hdd_cfg80211.o \
-		$(HDD_SRC_DIR)/wlan_hdd_p2p.o
-endif
-
-ifeq ($(CONFIG_QCOM_TDLS),y)
-HDD_OBJS +=	$(HDD_SRC_DIR)/wlan_hdd_tdls.o
-endif
-
-############ MAC ############
-MAC_DIR :=	CORE/MAC
-MAC_INC_DIR :=	$(MAC_DIR)/inc
-MAC_SRC_DIR :=	$(MAC_DIR)/src
-
-MAC_INC := 	-I$(WLAN_ROOT)/$(MAC_INC_DIR) \
-		-I$(WLAN_ROOT)/$(MAC_SRC_DIR)/dph \
-		-I$(WLAN_ROOT)/$(MAC_SRC_DIR)/include \
-		-I$(WLAN_ROOT)/$(MAC_SRC_DIR)/pe/include \
-		-I$(WLAN_ROOT)/$(MAC_SRC_DIR)/pe/lim
-
-MAC_CFG_OBJS := $(MAC_SRC_DIR)/cfg/cfgApi.o \
-		$(MAC_SRC_DIR)/cfg/cfgDebug.o \
-		$(MAC_SRC_DIR)/cfg/cfgParamName.o \
-		$(MAC_SRC_DIR)/cfg/cfgProcMsg.o \
-		$(MAC_SRC_DIR)/cfg/cfgSendMsg.o
-
-MAC_DPH_OBJS :=	$(MAC_SRC_DIR)/dph/dphHashTable.o
-
-MAC_LIM_OBJS := $(MAC_SRC_DIR)/pe/lim/limAIDmgmt.o \
-		$(MAC_SRC_DIR)/pe/lim/limAdmitControl.o \
-		$(MAC_SRC_DIR)/pe/lim/limApi.o \
-		$(MAC_SRC_DIR)/pe/lim/limAssocUtils.o \
-		$(MAC_SRC_DIR)/pe/lim/limDebug.o \
-		$(MAC_SRC_DIR)/pe/lim/limFT.o \
-		$(MAC_SRC_DIR)/pe/lim/limIbssPeerMgmt.o \
-		$(MAC_SRC_DIR)/pe/lim/limLinkMonitoringAlgo.o \
-		$(MAC_SRC_DIR)/pe/lim/limLogDump.o \
-		$(MAC_SRC_DIR)/pe/lim/limP2P.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessActionFrame.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessAssocReqFrame.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessAssocRspFrame.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessAuthFrame.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessBeaconFrame.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessCfgUpdates.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessDeauthFrame.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessDisassocFrame.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessLmmMessages.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessMessageQueue.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessMlmReqMessages.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessMlmRspMessages.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessProbeReqFrame.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessProbeRspFrame.o \
-		$(MAC_SRC_DIR)/pe/lim/limProcessSmeReqMessages.o \
-		$(MAC_SRC_DIR)/pe/lim/limPropExtsUtils.o \
-		$(MAC_SRC_DIR)/pe/lim/limRoamingAlgo.o \
-		$(MAC_SRC_DIR)/pe/lim/limScanResultUtils.o \
-		$(MAC_SRC_DIR)/pe/lim/limSecurityUtils.o \
-		$(MAC_SRC_DIR)/pe/lim/limSendManagementFrames.o \
-		$(MAC_SRC_DIR)/pe/lim/limSendMessages.o \
-		$(MAC_SRC_DIR)/pe/lim/limSendSmeRspMessages.o \
-		$(MAC_SRC_DIR)/pe/lim/limSerDesUtils.o \
-		$(MAC_SRC_DIR)/pe/lim/limSession.o \
-		$(MAC_SRC_DIR)/pe/lim/limSessionUtils.o \
-		$(MAC_SRC_DIR)/pe/lim/limSmeReqUtils.o \
-		$(MAC_SRC_DIR)/pe/lim/limStaHashApi.o \
-		$(MAC_SRC_DIR)/pe/lim/limTimerUtils.o \
-		$(MAC_SRC_DIR)/pe/lim/limTrace.o \
-		$(MAC_SRC_DIR)/pe/lim/limUtils.o
-
-ifeq ($(CONFIG_QCOM_ESE),y)
-ifneq ($(CONFIG_QCOM_ESE_UPLOAD),y)
-MAC_LIM_OBJS += $(MAC_SRC_DIR)/pe/lim/limProcessEseFrame.o
-endif
-endif
-
-ifeq ($(CONFIG_QCOM_TDLS),y)
-MAC_LIM_OBJS += $(MAC_SRC_DIR)/pe/lim/limProcessTdls.o
-endif
-
-MAC_PMM_OBJS := $(MAC_SRC_DIR)/pe/pmm/pmmAP.o \
-		$(MAC_SRC_DIR)/pe/pmm/pmmApi.o \
-		$(MAC_SRC_DIR)/pe/pmm/pmmDebug.o
-
-MAC_SCH_OBJS := $(MAC_SRC_DIR)/pe/sch/schApi.o \
-		$(MAC_SRC_DIR)/pe/sch/schBeaconGen.o \
-		$(MAC_SRC_DIR)/pe/sch/schBeaconProcess.o \
-		$(MAC_SRC_DIR)/pe/sch/schDebug.o \
-		$(MAC_SRC_DIR)/pe/sch/schMessage.o
-
-MAC_RRM_OBJS :=	$(MAC_SRC_DIR)/pe/rrm/rrmApi.o
-
-MAC_OBJS := 	$(MAC_CFG_OBJS) \
-		$(MAC_DPH_OBJS) \
-		$(MAC_LIM_OBJS) \
-		$(MAC_PMM_OBJS) \
-		$(MAC_SCH_OBJS) \
-		$(MAC_RRM_OBJS)
-
-############ SAP ############
-SAP_DIR :=	CORE/SAP
-SAP_INC_DIR :=	$(SAP_DIR)/inc
-SAP_SRC_DIR :=	$(SAP_DIR)/src
-
-SAP_INC := 	-I$(WLAN_ROOT)/$(SAP_INC_DIR) \
-		-I$(WLAN_ROOT)/$(SAP_SRC_DIR)
-
-SAP_OBJS :=	$(SAP_SRC_DIR)/sapApiLinkCntl.o \
-		$(SAP_SRC_DIR)/sapChSelect.o \
-		$(SAP_SRC_DIR)/sapFsm.o \
-		$(SAP_SRC_DIR)/sapModule.o
-
-############ SME ############
-SME_DIR :=	CORE/SME
-SME_INC_DIR :=	$(SME_DIR)/inc
-SME_SRC_DIR :=	$(SME_DIR)/src
-
-SME_INC := 	-I$(WLAN_ROOT)/$(SME_INC_DIR) \
-		-I$(WLAN_ROOT)/$(SME_SRC_DIR)/csr
-
-SME_CCM_OBJS := $(SME_SRC_DIR)/ccm/ccmApi.o \
-		$(SME_SRC_DIR)/ccm/ccmLogDump.o
-
-SME_CSR_OBJS := $(SME_SRC_DIR)/csr/csrApiRoam.o \
-		$(SME_SRC_DIR)/csr/csrApiScan.o \
-		$(SME_SRC_DIR)/csr/csrCmdProcess.o \
-		$(SME_SRC_DIR)/csr/csrLinkList.o \
-		$(SME_SRC_DIR)/csr/csrLogDump.o \
-		$(SME_SRC_DIR)/csr/csrNeighborRoam.o \
-		$(SME_SRC_DIR)/csr/csrUtil.o
-
-ifeq ($(CONFIG_QCOM_ESE),y)
-ifneq ($(CONFIG_QCOM_ESE_UPLOAD),y)
-SME_CSR_OBJS += $(SME_SRC_DIR)/csr/csrEse.o
-endif
-endif
-
-ifeq ($(CONFIG_QCOM_TDLS),y)
-SME_CSR_OBJS += $(SME_SRC_DIR)/csr/csrTdlsProcess.o
-endif
-
-SME_PMC_OBJS := $(SME_SRC_DIR)/pmc/pmcApi.o \
-		$(SME_SRC_DIR)/pmc/pmc.o \
-		$(SME_SRC_DIR)/pmc/pmcLogDump.o
-
-SME_QOS_OBJS := $(SME_SRC_DIR)/QoS/sme_Qos.o
-
-SME_CMN_OBJS := $(SME_SRC_DIR)/sme_common/sme_Api.o \
-		$(SME_SRC_DIR)/sme_common/sme_FTApi.o \
-		$(SME_SRC_DIR)/sme_common/sme_Trace.o
-
-SME_BTC_OBJS := $(SME_SRC_DIR)/btc/btcApi.o
-
-SME_OEM_DATA_OBJS := $(SME_SRC_DIR)/oemData/oemDataApi.o
-
-SME_P2P_OBJS = $(SME_SRC_DIR)/p2p/p2p_Api.o
-
-SME_RRM_OBJS := $(SME_SRC_DIR)/rrm/sme_rrm.o
-
-SME_NAN_OBJS = $(SME_SRC_DIR)/nan/nan_Api.o
-
-
-SME_OBJS :=	$(SME_BTC_OBJS) \
-		$(SME_CCM_OBJS) \
-		$(SME_CMN_OBJS) \
-		$(SME_CSR_OBJS) \
-		$(SME_OEM_DATA_OBJS) \
-		$(SME_P2P_OBJS) \
-		$(SME_PMC_OBJS) \
-		$(SME_QOS_OBJS) \
-		$(SME_RRM_OBJS) \
-		$(SME_NAN_OBJS)
-
-############ SVC ############
-SVC_DIR :=	CORE/SVC
-SVC_INC_DIR :=	$(SVC_DIR)/inc
-SVC_SRC_DIR :=	$(SVC_DIR)/src
-
-SVC_INC := 	-I$(WLAN_ROOT)/$(SVC_INC_DIR) \
-		-I$(WLAN_ROOT)/$(SVC_DIR)/external
-
-BTC_SRC_DIR :=	$(SVC_SRC_DIR)/btc
-BTC_OBJS :=	$(BTC_SRC_DIR)/wlan_btc_svc.o
-
-NLINK_SRC_DIR := $(SVC_SRC_DIR)/nlink
-NLINK_OBJS :=	$(NLINK_SRC_DIR)/wlan_nlink_srv.o
-
-PTT_SRC_DIR :=	$(SVC_SRC_DIR)/ptt
-PTT_OBJS :=	$(PTT_SRC_DIR)/wlan_ptt_sock_svc.o
-
-WLAN_LOGGING_SRC_DIR := $(SVC_SRC_DIR)/logging
-WLAN_LOGGING_OBJS := $(WLAN_LOGGING_SRC_DIR)/wlan_logging_sock_svc.o
-
-SVC_OBJS :=	$(BTC_OBJS) \
-		$(NLINK_OBJS) \
-		$(PTT_OBJS) \
-                $(WLAN_LOGGING_OBJS)
-
-############ SYS ############
-SYS_DIR :=	CORE/SYS
-
-SYS_INC := 	-I$(WLAN_ROOT)/$(SYS_DIR)/common/inc \
-		-I$(WLAN_ROOT)/$(SYS_DIR)/legacy/src/pal/inc \
-		-I$(WLAN_ROOT)/$(SYS_DIR)/legacy/src/platform/inc \
-		-I$(WLAN_ROOT)/$(SYS_DIR)/legacy/src/system/inc \
-		-I$(WLAN_ROOT)/$(SYS_DIR)/legacy/src/utils/inc
-
-SYS_COMMON_SRC_DIR := $(SYS_DIR)/common/src
-SYS_LEGACY_SRC_DIR := $(SYS_DIR)/legacy/src
-SYS_OBJS :=	$(SYS_COMMON_SRC_DIR)/wlan_qct_sys.o \
-		$(SYS_LEGACY_SRC_DIR)/pal/src/palApiComm.o \
-		$(SYS_LEGACY_SRC_DIR)/pal/src/palTimer.o \
-		$(SYS_LEGACY_SRC_DIR)/platform/src/VossWrapper.o \
-		$(SYS_LEGACY_SRC_DIR)/system/src/macInitApi.o \
-		$(SYS_LEGACY_SRC_DIR)/system/src/sysEntryFunc.o \
-		$(SYS_LEGACY_SRC_DIR)/utils/src/dot11f.o \
-		$(SYS_LEGACY_SRC_DIR)/utils/src/logApi.o \
-		$(SYS_LEGACY_SRC_DIR)/utils/src/logDump.o \
-		$(SYS_LEGACY_SRC_DIR)/utils/src/macTrace.o \
-		$(SYS_LEGACY_SRC_DIR)/utils/src/parserApi.o \
-		$(SYS_LEGACY_SRC_DIR)/utils/src/utilsApi.o \
-		$(SYS_LEGACY_SRC_DIR)/utils/src/utilsParser.o
-
-############ TL ############
-TL_DIR :=	CORE/TL
-TL_INC_DIR :=	$(TL_DIR)/inc
-TL_SRC_DIR :=	$(TL_DIR)/src
-
-TL_INC := 	-I$(WLAN_ROOT)/$(TL_INC_DIR) \
-		-I$(WLAN_ROOT)/$(TL_SRC_DIR)
-
-TL_OBJS := 	$(TL_SRC_DIR)/wlan_qct_tl.o \
-		$(TL_SRC_DIR)/wlan_qct_tl_ba.o \
-		$(TL_SRC_DIR)/wlan_qct_tl_hosupport.o \
-               $(TL_SRC_DIR)/wlan_qct_tl_trace.o
-
-############ VOSS ############
-VOSS_DIR :=	CORE/VOSS
-VOSS_INC_DIR :=	$(VOSS_DIR)/inc
-VOSS_SRC_DIR :=	$(VOSS_DIR)/src
-
-VOSS_INC := 	-I$(WLAN_ROOT)/$(VOSS_INC_DIR) \
-		-I$(WLAN_ROOT)/$(VOSS_SRC_DIR)
-
-VOSS_OBJS :=    $(VOSS_SRC_DIR)/vos_api.o \
-		$(VOSS_SRC_DIR)/vos_event.o \
-		$(VOSS_SRC_DIR)/vos_getBin.o \
-		$(VOSS_SRC_DIR)/vos_list.o \
-		$(VOSS_SRC_DIR)/vos_lock.o \
-		$(VOSS_SRC_DIR)/vos_memory.o \
-		$(VOSS_SRC_DIR)/vos_mq.o \
-		$(VOSS_SRC_DIR)/vos_nvitem.o \
-		$(VOSS_SRC_DIR)/vos_packet.o \
-		$(VOSS_SRC_DIR)/vos_sched.o \
-		$(VOSS_SRC_DIR)/vos_threads.o \
-		$(VOSS_SRC_DIR)/vos_timer.o \
-		$(VOSS_SRC_DIR)/vos_trace.o \
-		$(VOSS_SRC_DIR)/vos_types.o \
-                $(VOSS_SRC_DIR)/vos_utils.o \
-                $(VOSS_SRC_DIR)/wlan_nv_parser.o \
-                $(VOSS_SRC_DIR)/wlan_nv_stream_read.o \
-                $(VOSS_SRC_DIR)/wlan_nv_template_builtin.o
-
-ifeq ($(BUILD_DIAG_VERSION),1)
-VOSS_OBJS += $(VOSS_SRC_DIR)/vos_diag.o
-endif
-
-############ WDA ############
-WDA_DIR :=	CORE/WDA
-WDA_INC_DIR :=	$(WDA_DIR)/inc
-WDA_SRC_DIR :=	$(WDA_DIR)/src
-
-WDA_INC := 	-I$(WLAN_ROOT)/$(WDA_INC_DIR) \
-		-I$(WLAN_ROOT)/$(WDA_INC_DIR)/legacy \
-		-I$(WLAN_ROOT)/$(WDA_SRC_DIR)
-
-WDA_OBJS :=	$(WDA_SRC_DIR)/wlan_qct_wda.o \
-		$(WDA_SRC_DIR)/wlan_qct_wda_debug.o \
-		$(WDA_SRC_DIR)/wlan_qct_wda_ds.o \
-		$(WDA_SRC_DIR)/wlan_qct_wda_legacy.o \
-		$(WDA_SRC_DIR)/wlan_nv.o
-
-############ WDI ############
-WDI_DIR :=	CORE/WDI
-
-WDI_CP_INC :=	-I$(WLAN_ROOT)/$(WDI_DIR)/CP/inc/
-
-WDI_CP_SRC_DIR := $(WDI_DIR)/CP/src
-WDI_CP_OBJS :=	$(WDI_CP_SRC_DIR)/wlan_qct_wdi.o \
-		$(WDI_CP_SRC_DIR)/wlan_qct_wdi_dp.o \
-		$(WDI_CP_SRC_DIR)/wlan_qct_wdi_sta.o
-
-WDI_DP_INC := -I$(WLAN_ROOT)/$(WDI_DIR)/DP/inc/
-
-WDI_DP_SRC_DIR := $(WDI_DIR)/DP/src
-WDI_DP_OBJS :=	$(WDI_DP_SRC_DIR)/wlan_qct_wdi_bd.o \
-		$(WDI_DP_SRC_DIR)/wlan_qct_wdi_ds.o
-
-WDI_TRP_INC :=	-I$(WLAN_ROOT)/$(WDI_DIR)/TRP/CTS/inc/ \
-		-I$(WLAN_ROOT)/$(WDI_DIR)/TRP/DTS/inc/
-
-WDI_TRP_CTS_SRC_DIR :=	$(WDI_DIR)/TRP/CTS/src
-WDI_TRP_CTS_OBJS :=	$(WDI_TRP_CTS_SRC_DIR)/wlan_qct_wdi_cts.o
-
-WDI_TRP_DTS_SRC_DIR :=	$(WDI_DIR)/TRP/DTS/src
-WDI_TRP_DTS_OBJS :=	$(WDI_TRP_DTS_SRC_DIR)/wlan_qct_wdi_dts.o
-
-WDI_TRP_OBJS :=	$(WDI_TRP_CTS_OBJS) \
-		$(WDI_TRP_DTS_OBJS)
-
-WDI_WPAL_INC := -I$(WLAN_ROOT)/$(WDI_DIR)/WPAL/inc
-
-WDI_WPAL_SRC_DIR := $(WDI_DIR)/WPAL/src
-WDI_WPAL_OBJS := $(WDI_WPAL_SRC_DIR)/wlan_qct_pal_api.o \
-		$(WDI_WPAL_SRC_DIR)/wlan_qct_pal_device.o \
-		$(WDI_WPAL_SRC_DIR)/wlan_qct_pal_msg.o \
-		$(WDI_WPAL_SRC_DIR)/wlan_qct_pal_packet.o \
-		$(WDI_WPAL_SRC_DIR)/wlan_qct_pal_sync.o \
-		$(WDI_WPAL_SRC_DIR)/wlan_qct_pal_timer.o \
-		$(WDI_WPAL_SRC_DIR)/wlan_qct_pal_trace.o
-
-WDI_INC :=	$(WDI_CP_INC) \
-		$(WDI_DP_INC) \
-		$(WDI_TRP_INC) \
-		$(WDI_WPAL_INC)
-
-WDI_OBJS :=	$(WDI_CP_OBJS) \
-		$(WDI_DP_OBJS) \
-		$(WDI_TRP_OBJS) \
-		$(WDI_WPAL_OBJS)
-
-
-RIVA_INC :=	-I$(WLAN_ROOT)/riva/inc
-
-LINUX_INC :=	-Iinclude/linux
-
-INCS :=		$(BAP_INC) \
-		$(DXE_INC) \
-		$(HDD_INC) \
-		$(LINUX_INC) \
-		$(MAC_INC) \
-		$(RIVA_INC) \
-		$(SAP_INC) \
-		$(SME_INC) \
-		$(SVC_INC) \
-		$(SYS_INC) \
-		$(TL_INC) \
-		$(VOSS_INC) \
-		$(WDA_INC) \
-		$(WDI_INC)
-
-OBJS :=		$(BAP_OBJS) \
-		$(DXE_OBJS) \
-		$(HDD_OBJS) \
-		$(MAC_OBJS) \
-		$(SAP_OBJS) \
-		$(SME_OBJS) \
-		$(SVC_OBJS) \
-		$(SYS_OBJS) \
-		$(TL_OBJS) \
-		$(VOSS_OBJS) \
-		$(WDA_OBJS) \
-		$(WDI_OBJS)
-
-EXTRA_CFLAGS += $(INCS)
-EXTRA_CFLAGS += -fno-pic
-
-CDEFINES :=	-DANI_BUS_TYPE_PLATFORM=1 \
-		-DANI_LITTLE_BYTE_ENDIAN \
-		-DANI_LITTLE_BIT_ENDIAN \
-		-DQC_WLAN_CHIPSET_PRIMA \
-		-DINTEGRATION_READY \
-		-DDOT11F_LITTLE_ENDIAN_HOST \
-		-DGEN6_ONWARDS \
-		-DANI_COMPILER_TYPE_GCC \
-		-DANI_OS_TYPE_ANDROID=6 \
-		-DANI_LOGDUMP \
-		-DWLAN_PERF \
-		-DPTT_SOCK_SVC_ENABLE \
-		-Wall\
-		-D__linux__ \
-		-DMSM_PLATFORM \
-		-DHAL_SELF_STA_PER_BSS=1 \
-		-DWLAN_FEATURE_VOWIFI_11R \
-		-DWLAN_FEATURE_NEIGHBOR_ROAMING \
-		-DWLAN_FEATURE_NEIGHBOR_ROAMING_DEBUG \
-		-DWLAN_FEATURE_VOWIFI_11R_DEBUG \
-		-DFEATURE_WLAN_WAPI \
-		-DFEATURE_OEM_DATA_SUPPORT\
-		-DSOFTAP_CHANNEL_RANGE \
-		-DWLAN_AP_STA_CONCURRENCY \
-		-DFEATURE_WLAN_SCAN_PNO \
-		-DWLAN_FEATURE_PACKET_FILTERING \
-		-DWLAN_FEATURE_VOWIFI \
-		-DWLAN_FEATURE_11AC \
-		-DWLAN_FEATURE_P2P_DEBUG \
-		-DWLAN_ENABLE_AGEIE_ON_SCAN_RESULTS \
-		-DWLANTL_DEBUG\
-		-DWLAN_NS_OFFLOAD \
-		-DWLAN_ACTIVEMODE_OFFLOAD_FEATURE \
-		-DWLAN_FEATURE_HOLD_RX_WAKELOCK \
-		-DWLAN_SOFTAP_VSTA_FEATURE \
-		-DWLAN_FEATURE_ROAM_SCAN_OFFLOAD \
-		-DWLAN_FEATURE_GTK_OFFLOAD \
-		-DWLAN_WAKEUP_EVENTS \
-	        -DWLAN_KD_READY_NOTIFIER \
-		-DWLAN_NL80211_TESTMODE \
-		-DFEATURE_WLAN_BATCH_SCAN \
-		-DFEATURE_WLAN_LPHB \
-                -DFEATURE_WLAN_PAL_TIMER_DISABLE \
-                -DFEATURE_WLAN_PAL_MEM_DISABLE \
-                -DFEATURE_WLAN_CH144 \
-                -DWLAN_BUG_ON_SKB_ERROR \
-                -DWLAN_DXE_LOW_RESOURCE_TIMER \
-                -DWLAN_LOGGING_SOCK_SVC_ENABLE \
-                -DWLAN_FEATURE_LINK_LAYER_STATS \
-                -DWLAN_FEATURE_EXTSCAN
-
-ifneq ($(CONFIG_PRONTO_WLAN),)
-CDEFINES += -DWCN_PRONTO
-CDEFINES += -DWCN_PRONTO_V1
-endif
-
-ifeq ($(BUILD_DEBUG_VERSION),1)
-CDEFINES +=	-DWLAN_DEBUG \
-		-DTRACE_RECORD \
-		-DLIM_TRACE_RECORD \
-		-DSME_TRACE_RECORD \
-		-DPE_DEBUG_LOGW \
-		-DPE_DEBUG_LOGE \
-		-DDEBUG
-endif
-
-ifeq ($(CONFIG_SLUB_DEBUG_ON),y)
-CDEFINES += -DTIMER_MANAGER
-CDEFINES += -DMEMORY_DEBUG
-endif
-
-ifeq ($(HAVE_CFG80211),1)
-CDEFINES += -DWLAN_FEATURE_P2P
-CDEFINES += -DWLAN_FEATURE_WFD
-ifeq ($(CONFIG_QCOM_VOWIFI_11R),y)
-CDEFINES += -DKERNEL_SUPPORT_11R_CFG80211
-CDEFINES += -DUSE_80211_WMMTSPEC_FOR_RIC
-endif
-endif
-
-ifeq ($(CONFIG_QCOM_ESE),y)
-CDEFINES += -DFEATURE_WLAN_ESE
-ifeq ($(CONFIG_QCOM_ESE_UPLOAD),y)
-CDEFINES += -DFEATURE_WLAN_ESE_UPLOAD
-endif
-endif
-
-#normally, TDLS negative behavior is not needed
-ifeq ($(CONFIG_QCOM_TDLS),y)
-CDEFINES += -DFEATURE_WLAN_TDLS
-CDEFINES += -DCONFIG_TDLS_IMPLICIT
-endif
-
-ifeq ($(CONFIG_PRIMA_WLAN_BTAMP),y)
-CDEFINES += -DWLAN_BTAMP_FEATURE
-endif
-
-ifeq ($(CONFIG_PRIMA_WLAN_LFR),y)
-CDEFINES += -DFEATURE_WLAN_LFR
-endif
-
-ifeq ($(CONFIG_PRIMA_WLAN_OKC),y)
-CDEFINES += -DFEATURE_WLAN_OKC
-endif
-
-ifeq ($(CONFIG_PRIMA_WLAN_11AC_HIGH_TP),y)
-CDEFINES += -DWLAN_FEATURE_11AC_HIGH_TP
-endif
-
-ifeq ($(BUILD_DIAG_VERSION),1)
-CDEFINES += -DFEATURE_WLAN_DIAG_SUPPORT
-CDEFINES += -DFEATURE_WLAN_DIAG_SUPPORT_CSR
-CDEFINES += -DFEATURE_WLAN_DIAG_SUPPORT_LIM
-endif
-
-# enable the MAC Address auto-generation feature
-CDEFINES += -DWLAN_AUTOGEN_MACADDR_FEATURE
-
-ifeq ($(CONFIG_WLAN_FEATURE_11W),y)
-CDEFINES += -DWLAN_FEATURE_11W
-endif
-
-ifeq ($(PANIC_ON_BUG),1)
-CDEFINES += -DPANIC_ON_BUG
-endif
-
-ifeq ($(RE_ENABLE_WIFI_ON_WDI_TIMEOUT),1)
-CDEFINES += -DWDI_RE_ENABLE_WIFI_ON_WDI_TIMEOUT
-endif
-
-ifeq ($(KERNEL_BUILD),1)
-CDEFINES += -DWLAN_OPEN_SOURCE
-endif
-
-ifeq ($(findstring opensource, $(WLAN_ROOT)), opensource)
-CDEFINES += -DWLAN_OPEN_SOURCE
-endif
-
-ifeq ($(CONFIG_ENABLE_LINUX_REG), y)
-CDEFINES += -DCONFIG_ENABLE_LINUX_REG
-endif
-
-CDEFINES += -DFEATURE_WLAN_CH_AVOID
-CDEFINES += -DWLAN_FEATURE_AP_HT40_24G
-
-# Some kernel include files are being moved.  Check to see if
-# the old version of the files are present
-
-ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/mach-msm/include/mach/msm_smd.h),)
-CDEFINES += -DEXISTS_MSM_SMD
-endif
-
-ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/mach-msm/include/mach/msm_smsm.h),)
-CDEFINES += -DEXISTS_MSM_SMSM
-endif
-
-# Fix build for GCC 4.7
-EXTRA_CFLAGS += -Wno-maybe-uninitialized -Wno-unused-function
-
-KBUILD_CPPFLAGS += $(CDEFINES)
-
-# Module information used by KBuild framework
-obj-$(CONFIG_PRIMA_WLAN) += $(MODNAME).o
-obj-$(CONFIG_PRONTO_WLAN) += $(MODNAME).o
-$(MODNAME)-y := $(OBJS)
diff --git a/wlan/prima/riva/inc/halLegacyPalTypes.h b/wlan/prima/riva/inc/halLegacyPalTypes.h
index 3dd3f33..75808b6 100644
--- a/wlan/prima/riva/inc/halLegacyPalTypes.h
+++ b/wlan/prima/riva/inc/halLegacyPalTypes.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -55,6 +55,6 @@
 
 typedef byte      tANI_BYTE;
 typedef boolean   tANI_BOOLEAN;
-typedef uint32    tANI_TIMESTAMP;
+typedef unsigned long   tANI_TIMESTAMP;
 
 #endif /*__LEGACYPALTYPES_H__*/
diff --git a/wlan/prima/riva/inc/wlan_hal_cfg.h b/wlan/prima/riva/inc/wlan_hal_cfg.h
index b1a0fb3..9540b3c 100644
--- a/wlan/prima/riva/inc/wlan_hal_cfg.h
+++ b/wlan/prima/riva/inc/wlan_hal_cfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -159,7 +159,7 @@
 #define QWLAN_HAL_CFG_ENABLE_DETECT_PS_SUPPORT          101
 #define QWLAN_HAL_CFG_AP_LINK_MONITOR_TIMEOUT           102
 #define QWLAN_HAL_CFG_BTC_DWELL_TIME_MULTIPLIER         103
-#define QWLAN_HAL_CFG_ENABLE_TDLS_OXYGEN_MODE           104
+#define QWLAN_HAL_CFG_ENABLE_TDLS_MODE                  104
 #define QWLAN_HAL_CFG_ENABLE_NAT_KEEP_ALIVE_FILTER      105
 #define QWLAN_HAL_CFG_ENABLE_SAP_OBSS_PROT              106
 #define QWLAN_HAL_CFG_PSPOLL_DATA_RECEP_TIMEOUT         107
@@ -225,7 +225,7 @@
 #define QWLAN_HAL_CFG_BTC_STATIC_OPP_WLAN_ACTIVE_BT_LEN          167
 #define QWLAN_HAL_CFG_BTC_SAP_STATIC_OPP_WLAN_ACTIVE_WLAN_LEN    168
 #define QWLAN_HAL_CFG_BTC_SAP_STATIC_OPP_WLAN_ACTIVE_BT_LEN      169
-#define QWLAN_HAL_CFG_RMCAST_FIXED_RATE                 170
+#define QWLAN_HAL_CFG_RMC_FIXED_RATE                    170
 #define QWLAN_HAL_CFG_ASD_PROBE_INTERVAL                171
 #define QWLAN_HAL_CFG_ASD_TRIGGER_THRESHOLD             172
 #define QWLAN_HAL_CFG_ASD_RTT_RSSI_HYST_THRESHOLD       173
@@ -273,13 +273,14 @@
 #define QWLAN_HAL_CFG_LINK_FAIL_TX_CNT                       215
 #define QWLAN_HAL_CFG_TOGGLE_ARP_BDRATES                     216
 #define QWLAN_HAL_CFG_OPTIMIZE_CA_EVENT                      217
+#define QWLAN_HAL_CFG_EXT_SCAN_CONC_MODE                     218
+#define QWLAN_HAL_CFG_BAR_WAKEUP_HOST_DISABLE                219
 #define QWLAN_HAL_CFG_SAR_BOFFSET_CORRECTION_ENABLE          220
 
-#define QWLAN_HAL_CFG_MAX_PARAMS                             219
-
+#define QWLAN_HAL_CFG_MAX_PARAMS                             221
 
 /* Total number of Integer CFGs. This is used while allocating the memory for TLV */
-#define QWLAN_HAL_CFG_INTEGER_PARAM                     219
+#define QWLAN_HAL_CFG_INTEGER_PARAM                     221
 
 /*-------------------------------------------------------------------------
   Configuration Parameter min, max, defaults
@@ -444,6 +445,14 @@
 #define QWLAN_HAL_CFG_FIXED_RATE_STAMAX                        226
 #define QWLAN_HAL_CFG_FIXED_RATE_STADEF                        QWLAN_HAL_CFG_FIXED_RATE_AUTO
 
+/* QWLAN_HAL_CFG_RMC_FIXED_RATE
+ * Follwing rates in user configuration are mapped to TPE rates
+ * Mapping is defined in the gHalUserFixedRateCfgToTpeRateTable
+ */
+#define QWLAN_HAL_CFG_RMC_FIXED_RATE_STAMIN                 0
+#define QWLAN_HAL_CFG_RMC_FIXED_RATE_STAMAX                 226
+#define QWLAN_HAL_CFG_RMC_FIXED_RATE_STADEF                 QWLAN_HAL_CFG_FIXED_RATE_24MBPS
+
 /* QWLAN_HAL_CFG_RETRYRATE_POLICY */
 #define QWLAN_HAL_CFG_RETRYRATE_POLICY_STAMIN         0
 #define QWLAN_HAL_CFG_RETRYRATE_POLICY_STAMAX         255
@@ -880,11 +889,10 @@
 #define QWLAN_HAL_CFG_BTC_DWELL_TIME_MULTIPLIER_MAX    300
 #define QWLAN_HAL_CFG_BTC_DWELL_TIME_MULTIPLIER_DEF    300
 
-/* QWLAN_HAL_CFG_ENABLE_TDLS_OXYGEN_MODE */
-#define QWLAN_HAL_CFG_ENABLE_TDLS_OXYGEN_MODE_MIN    0
-#define QWLAN_HAL_CFG_ENABLE_TDLS_OXYGEN_MODE_MAX    1
-#define QWLAN_HAL_CFG_ENABLE_TDLS_OXYGEN_MODE_DEF    0
-
+/* QWLAN_HAL_CFG_ENABLE_TDLS_MODE */
+#define QWLAN_HAL_CFG_ENABLE_TDLS_MODE_MIN    0
+#define QWLAN_HAL_CFG_ENABLE_TDLS_MODE_MAX    1
+#define QWLAN_HAL_CFG_ENABLE_TDLS_MODE_DEF    0
 /* QWLAN_HAL_CFG_ENABLE_NAT_KEEP_ALIVE_FILTER */
 #define QWLAN_HAL_CFG_ENABLE_NAT_KEEP_ALIVE_FILTER_MIN   0
 #define QWLAN_HAL_CFG_ENABLE_NAT_KEEP_ALIVE_FILTER_MAX   1
@@ -1046,7 +1054,7 @@
 /* QWLAN_HAL_CFG_ENABLE_DYNAMIC_RA_START_RATE */
 #define QWLAN_HAL_CFG_ENABLE_DYNAMIC_RA_START_RATE_DEF 0
 #define QWLAN_HAL_CFG_ENABLE_DYNAMIC_RA_START_RATE_MIN 0
-#define QWLAN_HAL_CFG_ENABLE_DYNAMIC_RA_START_RATE_MAX 300
+#define QWLAN_HAL_CFG_ENABLE_DYNAMIC_RA_START_RATE_MAX 65535
 
 /* QWLAN_HAL_CFG_BTC_FAST_WLAN_CONN_PREF */
 #define QWLAN_HAL_CFG_BTC_FAST_WLAN_CONN_PREF_DEF 1
@@ -1086,4 +1094,13 @@
 #define QWLAN_HAL_CFG_OPTIMIZE_CA_EVENT_ENABLE   1
 #define QWLAN_HAL_CFG_OPTIMIZE_CA_EVENT_DEFAULT  0
 
+#define QWLAN_HAL_CFG_EXT_SCAN_CONC_MODE_DEF 1
+#define QWLAN_HAL_CFG_EXT_SCAN_CONC_MODE_MIN 0
+#define QWLAN_HAL_CFG_EXT_SCAN_CONC_MODE_MAX 2
+
+/* QWLAN_HAL_CFG_BAR_WAKEUP_HOST_DISABLE */
+#define QWLAN_HAL_CFG_BAR_WAKEUP_HOST_DISABLE_MIN 0
+#define QWLAN_HAL_CFG_BAR_WAKEUP_HOST_DISABLE_MAX 1
+#define QWLAN_HAL_CFG_BAR_WAKEUP_HOST_DISABLE_DEF 0
+
 #endif //__WLAN_HAL_CFG_H__
diff --git a/wlan/prima/riva/inc/wlan_hal_msg.h b/wlan/prima/riva/inc/wlan_hal_msg.h
index d5ddc27..820f0ac 100644
--- a/wlan/prima/riva/inc/wlan_hal_msg.h
+++ b/wlan/prima/riva/inc/wlan_hal_msg.h
@@ -1,29 +1,30 @@
 
-/* Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
-* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
-
-*
-*
-* Permission to use, copy, modify, and/or distribute this software for
-* any purpose with or without fee is hereby granted, provided that the
-* above copyright notice and this permission notice appear in all
-* copies.
-*
-* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
-* WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
-* WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
-* AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
-* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
-* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
-* TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-* PERFORMANCE OF THIS SOFTWARE.
-*/
+/*
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+ *
+ *
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
 
 /*
-* This file was originally distributed by Qualcomm Atheros, Inc.
-* under proprietary terms before Copyright ownership was assigned
-* to the Linux Foundation.
-*/
+ * This file was originally distributed by Qualcomm Atheros, Inc.
+ * under proprietary terms before Copyright ownership was assigned
+ * to the Linux Foundation.
+ */
 
 /*==========================================================================
  *
@@ -127,7 +128,8 @@
 #define WLAN_HAL_EXT_SCAN_MAX_CHANNELS               16
 #define WLAN_HAL_EXT_SCAN_MAX_BUCKETS                16
 #define WLAN_HAL_EXT_SCAN_MAX_HOTLIST_APS            128
-#define WLAN_HAL_EXT_SCAN_MAX_SIG_CHANGE_APS         64
+#define WLAN_HAL_EXT_SCAN_MAX_HOTLIST_SSIDS          8
+
 #define WLAN_HAL_EXT_SCAN_MAX_RSSI_SAMPLE_SIZE       8
 
 /* For Logging enhancement feature currently max 2 address will be passed */
@@ -139,7 +141,8 @@
 {
     MGMT_FRAME_LOGS    = 0,
     QXDM_LOGGING       = 1,
-    FW_MEMORY_DUMP     = 2
+    FW_MEMORY_DUMP     = 2,
+    FATAL_EVENT        = 3
 }tHalFrameLoggingType;
 
 /* Log size */
@@ -448,10 +451,9 @@
    WLAN_HAL_SET_MAX_TX_POWER_PER_BAND_REQ   = 217,
    WLAN_HAL_SET_MAX_TX_POWER_PER_BAND_RSP   = 218,
 
-   /* Reliable Multicast using Leader Based Protocol */
-   WLAN_HAL_LBP_LEADER_REQ                  = 219,
-   WLAN_HAL_LBP_LEADER_RSP                  = 220,
-   WLAN_HAL_LBP_UPDATE_IND                  = 221,
+   WLAN_HAL_RMC_RULER_REQ                  = 219,
+   WLAN_HAL_RMC_RULER_RSP                  = 220,
+   WLAN_HAL_RMC_UPDATE_IND                  = 221,
 
    /* Batchscan */
    WLAN_HAL_BATCHSCAN_SET_REQ               = 222,
@@ -568,6 +570,41 @@
    WLAN_HAL_FW_LOGGING_DXE_DONE_IND         = 311,
    WLAN_HAL_LOST_LINK_PARAMETERS_IND        = 312,
    WLAN_HAL_SEND_FREQ_RANGE_CONTROL_IND     = 313,
+
+   WLAN_HAL_SSID_HOTLIST_SET_REQ            = 314,
+   WLAN_HAL_SSID_HOTLIST_SET_RSP            = 315,
+   WLAN_HAL_SSID_HOTLIST_RESET_REQ          = 316,
+   WLAN_HAL_SSID_HOTLIST_RESET_RSP          = 317,
+
+   WLAN_HAL_SSID_HOTLIST_RESULT_IND         = 318,
+
+   /* WFD Session Information to start/stop Scan */
+   WLAN_HAL_HIGH_PRIORITY_DATA_INFO_REQ     = 319,
+
+   WLAN_HAL_START_RSSI_MONITORING_REQ       = 321,
+   WLAN_HAL_START_RSSI_MONITORING_RSP       = 322,
+   WLAN_HAL_RSSI_MONITORING_IND             = 323,
+   WLAN_HAL_STOP_RSSI_MONITORING_REQ        = 324,
+   WLAN_HAL_STOP_RSSI_MONITORING_RSP        = 325,
+
+   //RTT3 SUPPORT
+   WLAN_HAL_START_OEM_DATA_REQ_IND_NEW      = 326,
+   WLAN_HAL_START_OEM_DATA_RSP_IND_NEW      = 327,
+
+   WLAN_HAL_WIFI_CONFIG_SET_PARAMS_REQ      = 328,
+   WLAN_HAL_WIFI_CONFIG_SET_PARAMS_RSP      = 329,
+
+   WLAN_HAL_ANTENNA_DIVERSITY_SELECTION_REQ  = 330,
+   WLAN_HAL_ANTENNA_DIVERSITY_SELECTION_RSP  = 331,
+   WLAN_HAL_MODIFY_ROAM_PARAMS_IND           = 332,
+   WLAN_HAL_SET_ALLOWED_ACTION_FRAMES_IND    = 333,
+
+   /* PER based roaming support */
+   WLAN_HAL_SET_PER_ROAM_CONFIG_REQ          = 334,
+   WLAN_HAL_SET_PER_ROAM_CONFIG_RSP          = 335,
+   WLAN_HAL_PER_ROAM_SCAN_TRIGGER_REQ        = 336,
+   WLAN_HAL_PER_ROAM_SCAN_TRIGGER_RSP        = 337,
+
    WLAN_HAL_MSG_MAX = WLAN_HAL_MSG_TYPE_MAX_ENUM_SIZE
 }tHalHostMsgType;
 
@@ -792,7 +829,8 @@
     HAL_GLOBAL_CLASS_B_STATS_INFO    = 0x00000004,
     HAL_GLOBAL_CLASS_C_STATS_INFO    = 0x00000008,
     HAL_GLOBAL_CLASS_D_STATS_INFO    = 0x00000010,
-    HAL_PER_STA_STATS_INFO           = 0x00000020
+    HAL_PER_STA_STATS_INFO           = 0x00000020,
+    HAL_PER_TX_PKT_STATS_INFO        = 0x00000040
 }eHalStatsMask;
 
 /* BT-AMP events type */
@@ -816,6 +854,7 @@
     PE_GLOBAL_CLASS_C_STATS_INFO    = 0x00000008,
     PE_GLOBAL_CLASS_D_STATS_INFO    = 0x00000010,
     PE_PER_STA_STATS_INFO           = 0x00000020,
+    PE_PER_TX_PKT_STATS_INFO        = 0x00000040,
     PE_STATS_TYPE_MAX = WLAN_HAL_MAX_ENUM_SIZE //This and beyond are invalid values
 }ePEStatsMask;
 
@@ -991,6 +1030,14 @@
     tANI_U32 contention_num_samples;     // num of data pkts used for contention statistics
 } wifi_wmm_ac_stat;
 
+typedef PACKED_PRE struct PACKED_POST
+{
+    tANI_U64            average_tsf_offset;
+    tANI_U32            leaky_ap_avg_num_frames_leaked;
+    tANI_U32            leaky_ap_guard_time;
+    tANI_U32            leaky_ap_detected;
+} wifi_iface_leaky_ap_info;
+
 /* Interface statistics - corresponding to 2nd most LSB in wifi statistics bitmap  for getting statistics */
 typedef PACKED_PRE struct PACKED_POST
 {
@@ -1003,6 +1050,7 @@
     tANI_U32            rssi_data;                                  // access Point Data Frames RSSI (averaged) from connected AP
     tANI_U32            rssi_ack;                                   // access Point ACK RSSI (averaged) from connected AP
     wifi_wmm_ac_stat    AccessclassStats[WIFI_AC_MAX];              // per ac data packet statistics
+    wifi_iface_leaky_ap_info leakyApInfo;
 } wifi_iface_stat;
 
 /* Peer statistics - corresponding to 3rd most LSB in wifi statistics bitmap  for getting statistics */
@@ -2850,6 +2898,44 @@
    tStartOemDataRspParams    startOemDataRspParams;
 } tStartOemDataRspMsg, *tpStartOemDataRspMsg;
 
+#ifndef NEW_OEM_DATA_REQ_SIZE
+#define NEW_OEM_DATA_REQ_SIZE 292
+#endif
+
+#ifndef NEW_OEM_DATA_RSP_SIZE
+#define NEW_OEM_DATA_RSP_SIZE 2100
+#endif
+
+/*-------------------------------------------------------------------------
+WLAN_HAL_START_OEM_DATA_REQ_IND_NEW------------------------------------
+--------------------------------------------------------------------------*/
+typedef PACKED_PRE struct PACKED_POST
+{
+   tSirMacAddr selfMacAddr;
+   tANI_U8 reserved[2];
+   tANI_U8   oemDataReq[NEW_OEM_DATA_REQ_SIZE];
+} tStartOemDataReqParamsNew, *tpStartOemDataReqParamsNew;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader  header;
+   tStartOemDataReqParamsNew  startOemDataReqParams;
+} tStartOemDataReqMsgNew, *tpStartOemDataReqMsgNew;
+
+/*-------------------------------------------------------------------------
+WLAN_HAL_START_OEM_DATA_RSP_IND_NEW------------------------------------
+--------------------------------------------------------------------------*/
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U8  oemDataRsp[NEW_OEM_DATA_RSP_SIZE];
+} tStartOemDataRspParamsNew, *tpStartOemDataRspParamsNew;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader  header;
+   tStartOemDataRspParamsNew    startOemDataReqParams;
+} tStartOemDataRspMsgNew, *tpStartOemDataRspMsgNew;
+
 #endif
 
 /*---------------------------------------------------------------------------
@@ -3203,6 +3289,15 @@
                                     //is transmitted
 }tAniPerStaStatsInfo, *tpAniPerStaStatsInfo;
 
+// The following stats are averaged over the time between two consecutive GET_STATS_REQ messages.
+typedef PACKED_PRE struct PACKED_POST
+{
+    tANI_U32 lastTxRate;           // 802.11 data rate at which the last data frame is transmitted.
+    tANI_U32  txAvgRetry;           // Average number of retries per 10 packets.
+    tANI_U32 reserved;
+    tANI_U32 reserved1;
+}tAniPerTxPktStatsInfo, *tpAniPerTxPktStatsInfo;
+
 typedef PACKED_PRE struct PACKED_POST
 {
    /* Success or Failure */
@@ -6770,9 +6865,17 @@
     WPS_PRBRSP_TMPL        = 48,
     BCN_IE_FLT_DELTA       = 49,
     TDLS_OFF_CHANNEL       = 51,
+    RTT3                   = 52,
     MGMT_FRAME_LOGGING     = 53,
     ENHANCED_TXBD_COMPLETION = 54,
     LOGGING_ENHANCEMENT    = 55,
+    EXT_SCAN_ENHANCED      = 56,
+    MEMORY_DUMP_SUPPORTED  = 57,
+    PER_PKT_STATS_SUPPORTED  = 58,
+    EXT_LL_STAT              = 60,
+    WIFI_CONFIG            = 61,
+    ANTENNA_DIVERSITY_SELECTION  = 62,
+    PER_BASED_ROAMING      = 63,
     MAX_FEATURE_SUPPORTED  = 128,
 } placeHolderInCapBitmap;
 
@@ -7563,61 +7666,152 @@
 
 
 /*---------------------------------------------------------------------------
-* WLAN_HAL_TX_FAIL_IND
-*--------------------------------------------------------------------------*/
-// Northbound indication from FW to host on weak link detection
+ * WLAN_HAL_RMC_RULER_REQ
+ *-------------------------------------------------------------------------*/
+
+#define HAL_MAX_RMC_SESSIONS 2
+
+#define HAL_NUM_MAX_RULERS 8
+
+typedef enum
+{
+   WLAN_HAL_SUGGEST_RULER,
+   WLAN_HAL_BECOME_RULER,
+   WLAN_HAL_RULER_CMD_MAX = WLAN_HAL_MAX_ENUM_SIZE
+}tRulerReqCmdType, tRulerRspCmdType;
+
 typedef PACKED_PRE struct PACKED_POST
 {
-   // Sequence number increases by 1 whenever the device driver
-   // sends a notification event. This is cleared as 0 when the
-   // JOIN IBSS commamd is issued
-    tANI_U16 seqNo;
-    tANI_U16 staId;
-    tANI_U8 macAddr[HAL_MAC_ADDR_LEN];
-} tHalTXFailIndParams, *tpHalTXFailIndParams;
+   tRulerReqCmdType cmd;
+
+   /* MAC address of MCAST Transmitter (source) */
+   tSirMacAddr mcastTransmitter;
+
+   /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+   tSirMacAddr mcastGroup;
+
+   /* Optional black list for cmd = WLAN_HAL_SUGGEST_RULER */
+   tSirMacAddr blacklist[HAL_NUM_MAX_RULERS];
+}  tHalRmcRulerReqParams, *tpHalRmcRulerReqParams;
 
 typedef PACKED_PRE struct PACKED_POST
 {
     tHalMsgHeader header;
-    tHalTXFailIndParams txFailIndParams;
-}  tHalTXFailIndMsg, *tpHalTXFailIndMsg;
+   tHalRmcRulerReqParams rulerReqParams;
+}  tHalRmcRulerReqMsg, *tpHalRmcRulerReqMsg;
 
 /*---------------------------------------------------------------------------
-* WLAN_HAL_TX_FAIL_MONITOR_IND
-*--------------------------------------------------------------------------*/
-// Southbound message from Host to monitor the Tx failures
+ * WLAN_HAL_RMC_RULER_RSP
+ *-------------------------------------------------------------------------*/
 typedef PACKED_PRE struct PACKED_POST
 {
-    // tx_fail_count = 0 should disable the TX Fail monitor, non-zero value should enable it.
-    tANI_U8 tx_fail_count;
-} tTXFailMonitorInfo, *tpTXFailMonitorInfo;
+   /* success or failure */
+   tANI_U32 status;
+
+   /*  Command Type */
+   tRulerRspCmdType cmd;
+
+   /* MAC address of MCAST Transmitter (source) */
+   tSirMacAddr mcastTransmitter;
+
+   /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+   tSirMacAddr mcastGroup;
+
+   /* List of candidates for cmd = WLAN_HAL_SUGGEST_RULER*/
+   tSirMacAddr ruler[HAL_NUM_MAX_RULERS];
+
+}  tHalRmcRulerRspParams, *tpHalRmcRulerRspParams;
 
 typedef PACKED_PRE struct PACKED_POST
 {
     tHalMsgHeader  header;
-    tTXFailMonitorInfo txFailMonitor;
-} tTXFailMonitorInd, *tpTXFailMonitorInd;
+   tHalRmcRulerRspParams rulerRspParams;
+}  tHalRmcRulerRspMsg, *tpHalRmcRulerRspMsg;
 
 /*---------------------------------------------------------------------------
-* WLAN_HAL_IP_FORWARD_TABLE_UPDATE_IND
-*--------------------------------------------------------------------------*/
-typedef PACKED_PRE struct PACKED_POST
+ * WLAN_HAL_RMC_UPDATE_IND
+ *-------------------------------------------------------------------------*/
+typedef enum
 {
-   tANI_U8 destIpv4Addr[HAL_IPV4_ADDR_LEN];
-   tANI_U8 nextHopMacAddr[HAL_MAC_ADDR_LEN];
-} tDestIpNextHopMacPair;
+   WLAN_HAL_RULER_ACCEPTED,    //Host-->FW
+   WLAN_HAL_RULER_CANCELED,    //Host-->FW
+   WLAN_HAL_RULER_PICK_NEW,    //FW-->Host
+   WLAN_HAL_RULER_IND_MAX = WLAN_HAL_MAX_ENUM_SIZE
+}tRmcUpdateIndType;
+
+typedef enum
+{
+   WLAN_HAL_RMC_RULER_ROLE,
+   WLAN_HAL_RMC_TRANSMITTER_ROLE,
+   WLAN_HAL_RMC_ROLE_MAX = WLAN_HAL_MAX_ENUM_SIZE
+}tRmcRoleType;
 
 typedef PACKED_PRE struct PACKED_POST
 {
-   tANI_U8 numEntries;
-   tDestIpNextHopMacPair destIpMacPair[1];
-} tWlanIpForwardTableUpdateIndParam;
+   tRmcUpdateIndType indication;
+
+   /* Role of the entity generating this indication */
+   tRmcRoleType role;
+
+   /* MAC address of MCAST Transmitter (source) */
+   tSirMacAddr mcastTransmitter;
+
+   /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+   tSirMacAddr mcastGroup;
+
+   tSirMacAddr mcastRuler;
+
+   /* Candidate list for indication = WLAN_HAL_RULER_PICK_NEW */
+   tSirMacAddr ruler[HAL_NUM_MAX_RULERS];
+}  tHalRmcUpdateIndParams, *tpHalRmcUpdateIndParams;
 
 typedef PACKED_PRE struct PACKED_POST
 {
    tHalMsgHeader header;
-   tWlanIpForwardTableUpdateIndParam ipForwardTableParams;
-} tWlanIpForwardTableUpdateInd;
+   tHalRmcUpdateIndParams rulerIndParams;
+}  tHalRmcUpdateInd, *tpHalRmcUpdateInd;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U8  staIdx;       // Station Idx;
+   tANI_U32 txRate;       // Legacy transmit rate, in units of 500 kbit/sec,
+                          // for the most recently transmitted frame
+   tANI_U32 mcsIndex;     // mcs index for HT20 and HT40 rates
+   tANI_U32 txRateFlags;  // to differentiate between HT20 and
+                          // HT40 rates; short and long guard interval
+   tANI_S8  rssi;         // RSSI of the last received beacon
+}tHalIbssPeerParams, *tpHalIbssPeerParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U32           status;             // success or failure
+   tANI_U8            numOfPeers;         // Number of Peers for
+                                          // which stats are being reported
+   tHalIbssPeerParams ibssPeerParams[1];  // Stats of peer in IBSS
+}tHalIbssPeerInfoRspParams, *tpHalIbssPeerInfoRspParams;
+
+// WLAN_HAL_GET_IBSS_PEER_INFO_RSP
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalIbssPeerInfoRspParams ibssPeerInfoRspParams;
+}tHalIbssPeerInfoRsp, *tpHalIbssPeerInfoRsp;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U8         bssIdx;           // Bss Index
+   tANI_BOOLEAN    allPeerInfoReqd;  // If set, all IBSS peers stats are reported
+   tANI_U8         staIdx;           // If allPeerInfoReqd is not set,
+                                     // only stats of peer with
+                                     // staIdx is reported
+}tHalIbssPeerInfoReqParams, *tpHalIbssPeerInfoReqParams;
+
+// WLAN_HAL_GET_IBSS_PEER_INFO_REQ
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalIbssPeerInfoReqParams ibssPeerInfoReqParams;
+}tHalIbssPeerInfoReq, *tpHalIbssPeerInfoReq;
 
 /*---------------------------------------------------------------------------
  * WLAN_HAL_ROAM_OFFLOAD_SYNCH_IND
@@ -7745,8 +7939,7 @@
 /*---------------------------------------------------------------------------
  WLAN_HAL_RATE_UPDATE_IND
  *-------------------------------------------------------------------------*/
-
-typedef PACKED_PRE struct PACKED_POST
+ typedef PACKED_PRE struct PACKED_POST
 {
     /* 0 implies UCAST RA, positive value implies fixed rate, -1 implies ignore this param */
     tANI_S32 ucastDataRate; //unit Mbpsx10
@@ -7758,18 +7951,18 @@
     tSirMacAddr bssid;
 
     /* 0 implies MCAST RA, positive value implies fixed rate, -1 implies ignore */
-    tANI_S32 reliableMcastDataRate; //unit Mbpsx10
+    tANI_S32 rmcDataRate; //unit Mbpsx10
 
     /* TX flag to differentiate between HT20, HT40 etc */
-    tTxRateInfoFlags reliableMcastDataRateTxFlag;
+    tTxRateInfoFlags rmcDataRateTxFlag;
 
-    /* Default (non-reliable) MCAST(or BCAST)  fixed rate in 2.4 GHz, 0 implies ignore */
+    /* Default (non-RMC) MCAST(or BCAST)  fixed rate in 2.4 GHz, 0 implies ignore */
     tANI_U32 mcastDataRate24GHz; //unit Mbpsx10
 
     /* TX flag to differentiate between HT20, HT40 etc */
     tTxRateInfoFlags mcastDataRate24GHzTxFlag;
 
-    /*  Default (non-reliable) MCAST(or BCAST) fixed rate in 5 GHz, 0 implies ignore */
+    /*  Default (non-RMC) MCAST(or BCAST) fixed rate in 5 GHz, 0 implies ignore */
     tANI_U32 mcastDataRate5GHz; //unit Mbpsx10
 
     /* TX flag to differentiate between HT20, HT40 etc */
@@ -7784,6 +7977,42 @@
 }  tHalRateUpdateInd, * tpHalRateUpdateInd;
 
 /*---------------------------------------------------------------------------
+* WLAN_HAL_TX_FAIL_IND
+*--------------------------------------------------------------------------*/
+// Northbound indication from FW to host on weak link detection
+typedef PACKED_PRE struct PACKED_POST
+{
+   // Sequence number increases by 1 whenever the device driver
+   // sends a notification event. This is cleared as 0 when the
+   // JOIN IBSS commamd is issued
+    tANI_U16 seqNo;
+    tANI_U16 staId;
+    tANI_U8 macAddr[HAL_MAC_ADDR_LEN];
+} tHalTXFailIndParams, *tpHalTXFailIndParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    tHalMsgHeader header;
+    tHalTXFailIndParams txFailIndParams;
+}  tHalTXFailIndMsg, *tpHalTXFailIndMsg;
+
+/*---------------------------------------------------------------------------
+* WLAN_HAL_TX_FAIL_MONITOR_IND
+*--------------------------------------------------------------------------*/
+// Southbound message from Host to monitor the Tx failures
+typedef PACKED_PRE struct PACKED_POST
+{
+    // tx_fail_count = 0 should disable the TX Fail monitor, non-zero value should enable it.
+    tANI_U8 tx_fail_count;
+} tTXFailMonitorInfo, *tpTXFailMonitorInfo;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    tHalMsgHeader  header;
+    tTXFailMonitorInfo txFailMonitor;
+} tTXFailMonitorInd, *tpTXFailMonitorInd;
+
+/*---------------------------------------------------------------------------
  * WLAN_HAL_AVOID_FREQ_RANGE_IND
  *-------------------------------------------------------------------------*/
 
@@ -7890,6 +8119,22 @@
    tHalBcnMissRateRspParams bcnMissRateRspParams;
 }tHalBcnMissRateRspMsg, *tpHalBcnMissRateRspMsg;
 
+/*---------------------------------------------------------------------------
+ * WLAN_HAL_SET_ALLOWED_ACTION_FRAMES_IND
+ *-------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U32  actionFramesBitMask;
+   tANI_U32  reserved;
+}tHalAllowedActionFrames, *tpHalAllowedActionFrames;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalAllowedActionFrames allowedActionFrames;
+}tHalAllowedActionFramesReqInd, *tpHalAllowedActionFramesReqInd;
+
 /*--------------------------------------------------------------------------
 * WLAN_HAL_LL_SET_STATS_REQ
 *---------------------------------------------------------------------------*/
@@ -8023,6 +8268,16 @@
    EXT_SCAN_CHANNEL_BAND_MAX          = WLAN_HAL_MAX_ENUM_SIZE
 } tExtScanChannelBandMask;
 
+#define WLAN_HAL_EXT_SCAN_MAX_HOTLIST_SSIDS                    8
+#define WLAN_HAL_EXT_SCAN_MAX_AP_CACHE_PER_SCAN                32
+
+#define WLAN_HAL_EXT_SCAN_FLAG_INTERRUPTED                             1
+
+#define WLAN_HAL_EXT_SCAN_REPORT_EVENTS_BUFFER_FULL     0
+#define WLAN_HAL_EXT_SCAN_REPORT_EVENTS_EACH_SCAN       1
+#define WLAN_HAL_EXT_SCAN_REPORT_EVENTS_FULL_RESULTS    2
+#define WLAN_HAL_EXT_SCAN_REPORT_EVENTS_NO_BATCH        4
+
 typedef PACKED_PRE struct PACKED_POST
 {
     tANI_U32 channel;       // frequency
@@ -8039,16 +8294,26 @@
    tExtScanChannelBandMask channelBand;
    /* period (milliseconds) for each bucket defines the periodicity of bucket */
    tANI_U32 period;
-   /* 0 => normal reporting (reporting rssi history only,
-           when rssi history buffer is % full)
-    * 1 => same as 0 + report a scan completion event after scanning this bucket
-    * 2 => same as 1 + forward scan results (beacons/probe responses + IEs) in
-           real time to HAL (Required for L = P0)
-    * 3 => same as 2 + forward scan results (beacons/probe responses + IEs) in
-           real time to host (Not required for L =  P3) */
+   /*  This is a bit field; which defines following bits -
+       *  REPORT_EVENTS_BUFFER_FULL  => report only when scan history
+           is % full
+       *  REPORT_EVENTS_EACH_SCAN	  => report a scan completion event
+           after scan
+       *  REPORT_EVENTS_FULL_RESULTS => forward scan results
+           (beacons/probe responses + IEs) in real time to HAL, in addition
+           to completion events
+           Note: To keep backward compatibility, fire completion events
+           regardless of REPORT_EVENTS_EACH_SCAN.
+       *  REPORT_EVENTS_NO_BATCH	  => controls batching,
+           0 => batching, 1 => no batching
+       */
    tANI_U8 reportEvents;
    /* number of channels */
    tANI_U8 numChannels;
+   // new Exponential Scan params
+   tANI_U32 max_period;
+   tANI_U32 exponent;
+   tANI_U32 step_count;
    /* if channels to scan. In the TLV channelList[] */
    tExtScanChannelSpec channelList[WLAN_HAL_EXT_SCAN_MAX_CHANNELS];
 }tExtScanBucketData, *tpExtScanBucketData;
@@ -8064,7 +8329,9 @@
       (keep the most significant, i.e. stronger RSSI) */
    tANI_U32 maxApPerScan;
    /* in %, when buffer is this much full, wake up host */
-   tANI_U32 reportThreshold;
+   tANI_U32 reportThresholdPercent;
+   /* in number of scans, wake up AP after these many scans */
+   tANI_U32 reportThresholdNumScans;
    /* This will be off channel minimum time */
    tANI_U16 neighborScanChannelMinTime;
    /* This will be out off channel max time */
@@ -8131,7 +8398,7 @@
    tANI_U32      maxScanReportingThreshold;
 
    tANI_U32      maxHotlistAPs;
-   tANI_U32      maxSignificantWifiChangeAPs;
+   tANI_U32      maxHotlistSSIDs;
 
    tANI_U32      maxBssidHistoryEntries;
 }tHalExtScanGetCapRsp, *tpHalExtScanGetCapRsp;
@@ -8194,8 +8461,20 @@
    tANI_U32 rttSd;               // standard deviation in rtt - not expected
    tANI_U16 beaconPeriod;        // period advertised in the beacon
    tANI_U16 capability;          // capabilities advertised in the beacon
+   tANI_U16 ieLength;            // size of the ie_data blob
+   tANI_U8  ieData[1];           // blob of all the information elements found in the beacon
 } tHalExtScanResultParams, *tpHalExtScanResultParams;
 
+/* Get the GSCAN cached scan results */
+typedef struct {
+   tANI_U16 scan_id;      // a unique identifier for the scan unit
+   tANI_U8  flags;        // a bitmask with additional
+                          // information about scan
+   tANI_U8  num_results;  // number of bssids retrieved by the scan
+   tHalExtScanResultParams results[WLAN_HAL_EXT_SCAN_MAX_AP_CACHE_PER_SCAN];
+                          // scan results - one for each bssid
+} tHalExtScanCachedResultParams, *tpHalExtScanCachedResultParams;
+
 typedef PACKED_PRE struct PACKED_POST
 {
    tHalMsgHeader header;
@@ -8277,10 +8556,6 @@
    tHalExtScanResAvailableInd extScanResAvailableInd;
 }tHalExtScanResAvailableIndMsg, *tpHalExtScanResAvailableIndMsg;
 
-/*---------------------------------------------------------------------------
- * WLAN_HAL_SIG_RSSI_SET_REQ
- *-------------------------------------------------------------------------*/
-
 typedef PACKED_PRE struct PACKED_POST
 {
    /* AP BSSID */
@@ -8290,105 +8565,8 @@
    tANI_S32 lowRssiThreshold;
    /* high threshold - used in L for significant rssi - used in L for hotlist */
    tANI_S32 highRssiThreshold;
-   /* channel hint */
-   tANI_U32 channel;
 } tApThresholdParams, *tpApThresholdParams;
 
-typedef PACKED_PRE struct PACKED_POST
-{
-   tANI_U32 requestId;
-   tANI_U8 sessionId;
-   /* number of samples for averaging RSSI */
-   tANI_U32 rssiSampleSize;
-   /* number of missed samples to confirm AP loss */
-   tANI_U32 lostApSampleSize;
-   /* number of APs breaching threshold required for firmware to generate event */
-   tANI_U32 minBreaching;
-   /* number of significant APs */
-   tANI_U32 numAp;
-   /* significant APs */
-   tApThresholdParams ap[WLAN_HAL_EXT_SCAN_MAX_SIG_CHANGE_APS];
-} tHalSigRssiSetReq, *tpHalSigRssiSetReq;
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   tHalMsgHeader header;
-   tHalSigRssiSetReq extScanSigRssiReq;
-}tHalSigRssiSetReqMsg, *tpHalSigRssiSetReqMsg;
-
-/*---------------------------------------------------------------------------
- * WLAN_HAL_SIG_RSSI_SET_RSP
- *-------------------------------------------------------------------------*/
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   tANI_U32 requestId;
-   tANI_U32 status;
-}tHalSigRssiSetRsp, *tpHalSigRssiSetRsp;
-
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   tHalMsgHeader header;
-   tHalSigRssiSetRsp sigRssiSetRsp;
-}tHalSigRssiSetRspMsg, *tpHalSigRssiSetRspMsg;
-
-/*---------------------------------------------------------------------------
- * WLAN_HAL_SIG_RSSI_RESET_REQ
- *-------------------------------------------------------------------------*/
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   tANI_U32 requestId;
-}tHalSigRssiResetReq, *tpHalSigRssiResetReq;
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   tHalMsgHeader header;
-   tHalSigRssiResetReq sigRssiResetReq;
-}tHalSigRssiResetReqMsg, *tpHalSigRssiResetReqMsg;
-
-/*---------------------------------------------------------------------------
- * WLAN_HAL_SIG_RSSI_RESET_RSP
- *-------------------------------------------------------------------------*/
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   tANI_U32 requestId;
-   tANI_U32 status;
-}tHalSigRssiResetRsp, *tpHalSigRssiResetRsp;
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   tHalMsgHeader header;
-   tHalSigRssiResetRsp sigRssiResetRsp;
-}tHalSigRssiResetRspMsg, *tpHalSigRssiResetRspMsg;
-
-/*---------------------------------------------------------------------------
- * WLAN_HAL_SIG_RSSI_RESULT_IND
- *-------------------------------------------------------------------------*/
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   // BSSID
-   tSirMacAddr bssid;
-   // channel frequency in MHz
-   tANI_U32 channel;
-   // number of rssi samples
-   tANI_U8 numRssi;
-   // RSSI history in db
-   tANI_S32 rssi[WLAN_HAL_EXT_SCAN_MAX_RSSI_SAMPLE_SIZE];
-} tHalSigRssiResultParams, *tpHalSigRssiResultParams;
-
-typedef PACKED_PRE struct PACKED_POST
-{
-   tHalMsgHeader header;
-   tANI_U32 requestId;
-   tANI_U32 numSigRssiBss;
-   tANI_BOOLEAN moreData;
-   tANI_U8 sigRssiResult[1];
-}tHalSigRssiResultIndMsg, *tpHalSigRssiResultIndMsg;
-
 /*---------------------------------------------------------------------------
  * WLAN_HAL_BSSID_HOTLIST_SET_REQ
  *-------------------------------------------------------------------------*/
@@ -8397,8 +8575,9 @@
 {
    tANI_U32 requestId;
    tANI_U8 sessionId;
+   tANI_U32 lostBssidSampleSize;
    // number of hotlist APs
-   tANI_U32 numAp;
+   tANI_U32 numBssid;
    // hotlist APs
    tApThresholdParams ap[WLAN_HAL_EXT_SCAN_MAX_HOTLIST_APS];
 } tHalBssidHotlistSetReq, *tpHalBssidHotlistSetReq;
@@ -8469,6 +8648,116 @@
    tANI_U8 bssHotlist[1];
 }tHalHotlistResultIndMsg, *tpHalHotlistResultIndMsg;
 
+/*---------------------------------------------------------------------------
+ * WLAN_HAL_SSID_HOTLIST_SET_REQ
+ *-------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   /* SSID */
+   char ssid [32+1];
+   /* low threshold - used in L for significant_change - not used in L for
+         hotlist*/
+   tANI_S32 lowRssiThreshold;
+   /* high threshold - used in L for significant rssi - used in L for hotlist */
+   tANI_S32 highRssiThreshold;
+   /* band */
+   tANI_U32 band;
+ } tSsidThresholdParams, *tpSsidThresholdParams;
+
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U32 requestId;
+   tANI_U8 sessionId;
+   tANI_U32 lostSsidSampleSize;
+   // number of hotlist SSIDs
+   tANI_U32 numSsid;
+   // hotlist SSIDs
+   tSsidThresholdParams ssid[WLAN_HAL_EXT_SCAN_MAX_HOTLIST_SSIDS];
+} tHalSsidHotlistSetReq, *tpHalSsidHotlistSetReq;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalSsidHotlistSetReq ssidHotlistSetReq;
+}tHalSsidHotlistSetReqMsg, *tpHalSsidHotlistSetReqMsg;
+
+/*---------------------------------------------------------------------------
+ * WLAN_HAL_SSID_HOTLIST_SET_RSP
+ *-------------------------------------------------------------------------*/
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U32 requestId;
+   tANI_U32 status;
+}tHalSsidHotlistSetRsp, *tpHalSsidHotlistSetRsp;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalSsidHotlistSetRsp hotlistSetRsp;
+}tHalSsidHotlistSetRspMsg, *tpHalSsidHotlistSetRspMsg;
+
+/*---------------------------------------------------------------------------
+ * WLAN_HAL_SSID_HOTLIST_RESET_REQ
+ *-------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U32 requestId;
+}tHalSsidHotlistResetReq, *tpHalSsidHotlistResetReq;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalSsidHotlistResetReq hotlistResetReq;
+}tHalSsidHotlistResetReqMsg, *tpHalSsidHotlistResetReqMsg;
+
+/*---------------------------------------------------------------------------
+ * WLAN_HAL_SSID_HOTLIST_RESET_RSP
+ *-------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U32 requestId;
+   tANI_U32 status;
+}tHalSsidHotlistResetRsp, *tpHalSsidHotlistResetRsp;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalSsidHotlistResetRsp hotlistResetRsp;
+}tHalSsidHotlistResetRspMsg, *tpHalSsidHotlistResetRspMsg;
+
+/*---------------------------------------------------------------------------
+ * WLAN_HAL_SSID_HOTLIST_RESULT_IND
+ *-------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tANI_U32 requestId;
+   tANI_BOOLEAN ssid_found;
+   tANI_U32 numHotlistSsid;
+   tANI_BOOLEAN moreData;
+   tANI_U8 ssidHotlist[1];  // pointer to list of type tHalExtScanResultParams
+}tHalSsidHotlistResultIndMsg, *tpHalSsidHotlistResultIndMsg;
+
+/*---------------------------------------------------------------------------
+ * WLAN_HAL_HIGH_PRIORITY_DATA_INFO_REQ
+ *-------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_BOOLEAN  pause; // 1 -> pause, 0 -> unpause
+   tANI_U32      reserved; //reserved for future use
+}tHalHighPriorityDataInfoInd, *tpHalHighPriorityDataInfoInd;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalHighPriorityDataInfoInd highPriorityDataInfoInd;
+}tHalHighPriorityDataInfoIndMsg, *tpHalHighPriorityDataInfoIndMsg;
 
 /*---------------------------------------------------------------------------
   *WLAN_HAL_MAC_SPOOFED_SCAN_REQ
@@ -8628,12 +8917,79 @@
     tANI_U8 logMailBoxVer;
     /* Qshrink is enabled */
     tANI_BOOLEAN logCompressEnabled;
+    /* fw_dump_max_size is used to tell fwr mem dump size */
+    tANI_U32 fw_dump_max_size;
     /* Reserved for future purpose */
-    tANI_U32 reserved0;
     tANI_U32 reserved1;
     tANI_U32 reserved2;
 } tFWLoggingInitResp, * tpFWLoggingInitResp;
 
+
+typedef PACKED_PRE struct PACKED_POST {
+   tANI_U32     request_id;
+   tSirMacAddr  bssId;
+   tANI_S8      min_rssi;
+   tANI_S8      max_rssi;
+} tHalStartRssiMonitoringReqParams, * tpHalStartRssiMonitoringReqParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalStartRssiMonitoringReqParams   startRssiMonitoringReqParams;
+}tHalStartRssimonitoringReq, * tpHalStartRssimonitoringReq;
+
+//Following structure will be used for WLAN_HAL_START_RSSI_MONITORING_RSP
+typedef PACKED_PRE struct PACKED_POST {
+   tANI_U32 request_id;
+   tANI_U32 status;
+}  tHalStartRssimonitoringRspParams, * tpHalStartRssimonitoringRspParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalStartRssimonitoringRspParams startRssimonitoringRspParams;
+}tHalStartRssimonitoringRsp, * tpHalStartRssimonitoringRsp;
+
+//Following structures will be used for WLAN_HAL_RSSI_MONITORING_IND
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U32     request_id;
+   tSirMacAddr  bssId;
+   tANI_S8      rssi;
+} tHalRssiMonitorIndParams, * tpHalRssiMonitorIndParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalRssiMonitorIndParams RssiMonitorIndParams;
+}tHalRssiMonitorInd, * tpHalRssiMonitorInd;
+
+
+//Following structures will be used for WLAN_HAL_STOP_RSSI_MONITORING_REQ
+typedef PACKED_PRE struct PACKED_POST {
+   tANI_U32 request_id;
+   tSirMacAddr  bssId;
+} tHalStopRssiMonitoringParams, * tpHalStopRssiMonitoringParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalStopRssiMonitoringParams   stopRssiMonitoringParams;
+}tHalStopRssimonitoringReq, * tpHalStopRssimonitoringReq;
+
+//Following structures will be used for WLAN_HAL_STOP_RSSI_MONITORING_RSP
+typedef PACKED_PRE struct PACKED_POST {
+   tANI_U32 request_id;
+   tANI_U32 status;
+} tHalStopRssimonitoringRspParams, * tpHalStopRssimonitoringRspParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalStopRssimonitoringRspParams stopRssimonitoringRspParams;
+}tHalStopRssimonitoringRsp, * tpHalStopRssimonitoringRsp;
+
+
 typedef PACKED_PRE struct PACKED_POST
 {
     tHalMsgHeader         header;
@@ -8641,11 +8997,100 @@
 }  tFWLoggingInitRespMsg,  * tpFWLoggingInitRespMsg;
 
 /*---------------------------------------------------------------------------
+ *   WLAN_HAL_SET_PER_ROAM_CONFIG_REQ
+ *---------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST {
+    tANI_U32 request_id;
+    tANI_U32 isPERRoamCCAEnabled;
+    tANI_U32 rateUpThreshold;
+    tANI_U32 rateDownThreshold;
+    tANI_U32 waitPeriodForNextPERScan;
+    tANI_U32 PERtimerThreshold;
+    tANI_U32 PERroamTriggerPercent;
+    tANI_U32 reserved;
+} tPerRoamConfigParams, * tpPerRoamConfigParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tPerRoamConfigParams   perRoamConfigParams;
+}  tSetPerRoamConfigReq, * tpSetPerRoamConfigReq;
+
+/*---------------------------------------------------------------------------
+ *   WLAN_HAL_SET_PER_ROAM_CONFIG_RSP
+ *---------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    /* Success or Failure */
+    tANI_U32   status;
+} tConfigPerRoamRspParams, * tpConfigPerRoamRspParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tConfigPerRoamRspParams configPerRoamRspParams;
+}  tSetPerRoamConfigRsp, * tpSetPerRoamConfigRsp;
+
+/*---------------------------------------------------------------------------
+ *   WLAN_HAL_PER_ROAM_SCAN_TRIGGER_REQ
+ *---------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST {
+    bool                roamScanReq;
+} tStartRoamScanTriggerParams, * tpStartRoamScanTriggerParams;
+
+typedef PACKED_PRE struct PACKED_POST {
+
+   tHalMsgHeader header;
+   tStartRoamScanTriggerParams startRoamScanTriggerParams;
+}  tStartRoamScanReq, *tpStartRoamScanReq;
+
+/*---------------------------------------------------------------------------
+ *     WLAN_HAL_PER_ROAM_SCAN_TRIGGER_RSP
+ *---------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    /* Success /Failure / Nil result */
+    tANI_U32   status;
+} tConfigRoamScanRspParams, * tpConfigRoamScanRspParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tConfigRoamScanRspParams configRoamScanRspParams;
+}  tSetRoamScanConfigRsp, * tpSetRoamScanConfigRsp;
+
+
+#define PER_ROAM_MAX_AP_CNT 30
+#define PER_ROAM_MAX_CANDIDATE_CNT 15
+
+/* Candidate Information to be shared in the Candidate Indication,
+ * similar to what is sent in legacy roaming with following additional info
+ */
+
+typedef PACKED_PRE struct PACKED_POST {
+    tANI_U8    channelNumber;
+    tANI_U8    channelCCA;
+    tANI_U8    otherApCount;
+    tANI_S8    otherApRssi[PER_ROAM_MAX_AP_CNT];
+} tCandidateChannelInfo, * tpCandidateChannelInfo;
+
+typedef PACKED_PRE struct PACKED_POST {
+    tANI_U32    candidateCount;
+    tCandidateChannelInfo  channelInfo[PER_ROAM_MAX_CANDIDATE_CNT];
+} tPerRoamScanResult, * tpPerRoamScanResult;
+
+
+/*---------------------------------------------------------------------------
  * WLAN_HAL_FW_LOGGING_DXE_DONE_IND
  *-------------------------------------------------------------------------*/
 typedef PACKED_PRE struct PACKED_POST
 {
-    tANI_U32 status;
+    tANI_U16 status;
+    tANI_U16 doneIndicationForSource;
     tANI_U32 logBuffLength[MAX_NUM_OF_BUFFER];
     tANI_U64 logBuffAddress[MAX_NUM_OF_BUFFER];
 } tFWLoggingDxeDoneInd, * tpFWLoggingDxeDoneInd;
@@ -8679,6 +9124,35 @@
 }tLoggingMailBox, *tpLoggingMailBox;
 
 /*---------------------------------------------------------------------------
+ *WLAN_HAL_FW_MEMORY_DUMP_REQ
+ *--------------------------------------------------------------------------*/
+typedef PACKED_PRE struct PACKED_POST
+{
+    tANI_U32        reserved;
+}tHalFwMemoryDumpReqType, * tpHalFwMemoryDumpReqType;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    tHalMsgHeader           header;
+    tHalFwMemoryDumpReqType tFwMemoryDumpReqParam;
+} tHalFwMemoryDumpReqMsg,   * tpHalFwMemoryDumpReqMsg;
+
+/*---------------------------------------------------------------------------
+ * WLAN_HAL_FW_MEMORY_DUMP_RSP
+ *-------------------------------------------------------------------------*/
+typedef PACKED_PRE struct PACKED_POST
+{
+    tANI_U32   status;
+} tHalFwMemoryDumpRespType, * tpHalFwMemoryDumpRespType;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    tHalMsgHeader             header;
+    tHalFwMemoryDumpRespType  tFwMemoryDumpResp;
+}  tHalFwMemoryDumpRespMsg,   * tpHalFwMemoryDumpRespMsg;
+
+
+/*---------------------------------------------------------------------------
 * WLAN_HAL_ENABLE_MONITOR_MODE_REQ
 *-------------------------------------------------------------------------*/
 
@@ -8766,6 +9240,67 @@
   tANI_U8   status;
 }tHalAvoidFreqRangeCtrlParam, *tpHalAvoidFreqRangeCtrlParam;
 
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U8  paramType;
+   tANI_U32 paramValue;
+   tSirMacAddr bssid;
+} tSetWifiConfigParams, *tpSetWifiConfigParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader               header;
+   tSetWifiConfigParams        wifiConfigParams;
+} tSetWifiConfigParamsReq, *tpSetWifiConfigParamsReq;
+
+typedef PACKED_PRE struct PACKED_POST {
+   tANI_U32 status;
+} tHalSetWifiConfigRspParams, * tpHalSetWifiConfigRspParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+
+  tHalSetWifiConfigRspParams setWifiConfigRspParams;
+} tHalSetWifiConfigRsp, *tpHalSetWifiConfigRsp;
+
+/*---------------------------------------------------------------------------
+* WLAN_HAL_ANTENNA_DIVERSITY_SELECTION_REQ
+*-------------------------------------------------------------------------*/
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U32 reserved;
+} tHalAntennaDiversitySelectionReqParams, *tpHalAntennaDiversitySelectionReqParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalAntennaDiversitySelectionReqParams AntDivSelReqParams;
+}tHalAntennaDiversitySelectionReqMsg;
+
+/*---------------------------------------------------------------------------
+* WLAN_HAL_ANTENNA_DIVERSITY_SELECTION_RSP
+*-------------------------------------------------------------------------*/
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tANI_U16 status;
+   tANI_U32 selectedAntennaId;
+   tANI_U32 reserved;
+} tHalAntennaDiversitySelectionRspParams, *tpHalAntennaDiversitySelectionRspParams;
+
+/* WDI_MODIFY_ROAM_PARAMS_IND */
+typedef PACKED_PRE struct PACKED_POST {
+   tANI_U8 param;
+   tANI_U32 value;
+} tHalModifyRoamParamsIndParams, *tpHalModifyRoamParamsIndParams;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+   tHalMsgHeader header;
+   tHalModifyRoamParamsIndParams  modifyRoamParamsReqParams;
+} tHalModifyRoamParamsInd, *tpHalModifyRoamParamsInd;
+
 #if defined(__ANI_COMPILER_PRAGMA_PACK_STACK)
 #pragma pack(pop)
 #elif defined(__ANI_COMPILER_PRAGMA_PACK)
diff --git a/wlan/prima/riva/inc/wlan_nv.h b/wlan/prima/riva/inc/wlan_nv.h
index e0f9d52..b99666c 100644
--- a/wlan/prima/riva/inc/wlan_nv.h
+++ b/wlan/prima/riva/inc/wlan_nv.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -229,7 +229,10 @@
     RF_SUBBAND_INVALID = 0x7FFFFFFF  /* define as 4 bytes data */
 }eRfSubBand;
 
-#define HT_40MINUS_INDEX 4
+struct chan_to_ht_40_index_map {
+   uint16 ht_40_minus_index;
+   uint16 ht_40_plus_index;
+};
 
 typedef enum
 {