Release 4.0.0.62B

Add Release 4.0.0.62B next set of changes. These are additional
changes on top of 4.0.0.62/62A that were changed between qcacld-2.0
and qcacld-new switch-over.
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.c b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
index c9949d3..55ccd5f 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.c
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
@@ -332,7 +332,7 @@
 		 * that has to be delivered to UMAC
 		 */
 		rx_packet =
-			(vos_pkt_t *)vos_mem_malloc(sizeof(vos_pkt_t));
+			(vos_pkt_t *)adf_os_mem_alloc(NULL, sizeof(vos_pkt_t));
 
 		if(rx_packet == NULL) {
 			TLSHIM_LOGE("Rx Packet Mem Alloc Failed");
@@ -912,22 +912,17 @@
 {
 	tp_wma_handle wma_handle;
 	t_wma_trigger_uapsd_params uapsd_params;
+	struct txrx_tl_shim_ctx *tl_shim;
 
 	ENTER();
 
 	wma_handle = vos_get_context(VOS_MODULE_ID_WDA, vos_ctx);
+	tl_shim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
 
 	uapsd_params.wmm_ac = ac;
 	uapsd_params.user_priority = pri;
 	uapsd_params.service_interval = srvc_int;
-
-	/*
-	 * Since Delayed Interval is not available
-	 * use suspend interval for delayed interval
-	 * for now.
-	 * TODO: Need to pass Delayed Interval as well
-	 */
-	uapsd_params.delay_interval = sus_int;
+	uapsd_params.delay_interval = tl_shim->delay_interval;
 	uapsd_params.suspend_interval = sus_int;
 
 	if(VOS_STATUS_SUCCESS !=
@@ -1024,10 +1019,23 @@
 /*
  * Return the data rssi for the given peer.
  */
-VOS_STATUS WLANTL_GetRssi(void *vos_ctx, u_int8_t sta_id, v_S7_t *rssi)
+VOS_STATUS WLANTL_GetRssi(void *vos_ctx, u_int8_t sta_id, v_S7_t *rssi, void *pGetRssiReq)
 {
-	/* TBD */
-	return VOS_STATUS_SUCCESS;
+	tp_wma_handle wma_handle;
+
+	ENTER();
+
+	wma_handle = vos_get_context(VOS_MODULE_ID_WDA, vos_ctx);
+
+	if(VOS_STATUS_SUCCESS !=
+		wma_send_snr_request(wma_handle, pGetRssiReq))
+	{
+		TLSHIM_LOGE("Failed to Trigger wma stats request");
+		return VOS_STATUS_E_FAILURE;
+	}
+	/* dont send success, otherwise call back
+	 * will released with out values */
+	return VOS_STATUS_E_BUSY;
 }
 
 /*
@@ -1267,6 +1275,7 @@
 	 */
 
 	tl_shim->ip_checksum_offload = tl_cfg->ip_checksum_offload;
+	tl_shim->delay_interval = tl_cfg->uDelayedTriggerFrmInt;
 	return status;
 }
 
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.h b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
index d7d2dfc..e896e53 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.h
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
@@ -70,6 +70,7 @@
 	v_BOOL_t ip_checksum_offload;
 	u_int8_t   *last_beacon_data;
 	u_int32_t   last_beacon_len;
+	u_int32_t delay_interval;
 };
 
 /*
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c
index 4ebf051..c38f657 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -826,7 +826,7 @@
 		txrx_ops->tx.std = vdev->tx = ol_tx_hl;
 		txrx_ops->tx.non_std = ol_tx_non_std_hl;
 	} else {
-        txrx_ops->tx.std = vdev->tx = OL_TX_LL;
+		txrx_ops->tx.std = vdev->tx = OL_TX_LL;
 		txrx_ops->tx.non_std = ol_tx_non_std_ll;
 	}
 }
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
index cbc9889..9da0bd1 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
@@ -709,7 +709,6 @@
 
 };
 
-
 struct ol_rx_reorder_array_elem_t {
 	adf_nbuf_t head;
 	adf_nbuf_t tail;
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 2864e3a..447b1d2 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -48,6 +48,6 @@
 #define QWLAN_VERSION_EXTRA            ""
 #define QWLAN_VERSION_BUILD            62
 
-#define QWLAN_VERSIONSTR               "4.0.0.62"
+#define QWLAN_VERSIONSTR               "4.0.0.62B"
 
 #endif /* QWLAN_VERSION_H */
diff --git a/CORE/MAC/src/pe/lim/limProcessActionFrame.c b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
index 4311a11..7fb9f72 100644
--- a/CORE/MAC/src/pe/lim/limProcessActionFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
@@ -57,8 +57,9 @@
 #include "rrmApi.h"
 #endif
 #include "limSessionUtils.h"
+#include "limRMC.h"
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include "ccxApi.h"
 #endif
 #include "wlan_qct_wda.h"
@@ -271,7 +272,6 @@
     tANI_U32                val;
     tANI_U32                frameLen;
     tANI_U32                nStatus;
-    eHalStatus              status;
 
     pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo);
     pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
@@ -281,11 +281,11 @@
     if (!psessionEntry->lim11hEnable)
         return;
 
-    status = palAllocateMemory( pMac->hHdd, (void **)&pChannelSwitchFrame, sizeof(*pChannelSwitchFrame));
-    if (eHAL_STATUS_SUCCESS != status)
+    pChannelSwitchFrame = vos_mem_malloc(sizeof(*pChannelSwitchFrame));
+    if (NULL == pChannelSwitchFrame)
     {
         limLog(pMac, LOGE,
-            FL("palAllocateMemory failed, status = %d "), status);
+            FL("AllocateMemory failed"));
         return;
     }
 
@@ -298,7 +298,7 @@
             FL( "Failed to unpack and parse an 11h-CHANSW Request (0x%08x, %d bytes):"),
             nStatus,
             frameLen);
-        palFreeMemory(pMac->hHdd, pChannelSwitchFrame);
+        vos_mem_free(pChannelSwitchFrame);
         return;
     }
     else if(DOT11F_WARNED( nStatus ))
@@ -309,14 +309,14 @@
             frameLen);
     }
 
-    if (palEqualMemory( pMac->hHdd,(tANI_U8 *) &psessionEntry->bssId,
-                  (tANI_U8 *) &pHdr->sa,
-                  sizeof(tSirMacAddr)))
+    if (vos_mem_compare((tANI_U8 *) &psessionEntry->bssId,
+                        (tANI_U8 *) &pHdr->sa,
+                        sizeof(tSirMacAddr)))
     {
         #if 0
         if (wlan_cfgGetInt(pMac, WNI_CFG_BEACON_INTERVAL, &val) != eSIR_SUCCESS)
         {
-            palFreeMemory(pMac->hHdd, pChannelSwitchFrame);
+            vos_mem_free(pChannelSwitchFrame);
             limLog(pMac, LOGP, FL("could not retrieve Beacon interval"));
             return;
         }
@@ -388,7 +388,7 @@
         PELOG1(limLog(pMac, LOG1, FL("Could not start channel switch"));)
     }
 
-    palFreeMemory(pMac->hHdd, pChannelSwitchFrame);
+    vos_mem_free(pChannelSwitchFrame);
     return;
 } /*** end limProcessChannelSwitchActionFrame() ***/
 
@@ -403,7 +403,6 @@
     tDot11fOperatingMode    *pOperatingModeframe;
     tANI_U32                frameLen;
     tANI_U32                nStatus;
-    eHalStatus              status;
     tpDphHashNode           pSta;
     tANI_U16                aid;
     tANI_U8  operMode;
@@ -413,11 +412,11 @@
     frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
 
     PELOG3(limLog(pMac, LOG3, FL("Received Operating Mode action frame"));)
-    status = palAllocateMemory( pMac->hHdd, (void **)&pOperatingModeframe, sizeof(*pOperatingModeframe));
-    if (eHAL_STATUS_SUCCESS != status)
+    pOperatingModeframe = vos_mem_malloc(sizeof(*pOperatingModeframe));
+    if (NULL == pOperatingModeframe)
     {
         limLog(pMac, LOGE,
-            FL("palAllocateMemory failed, status = %d "), status);
+            FL("AllocateMemory failed"));
         return;
     }
 
@@ -430,7 +429,7 @@
             FL( "Failed to unpack and parse an 11h-CHANSW Request (0x%08x, %d bytes):"),
             nStatus,
             frameLen);
-        palFreeMemory(pMac->hHdd, pOperatingModeframe);
+        vos_mem_free(pOperatingModeframe);
         return;
     }
     else if(DOT11F_WARNED( nStatus ))
@@ -477,7 +476,7 @@
         limCheckVHTOpModeChange( pMac, psessionEntry, 
                                  (pOperatingModeframe->OperatingMode.chanWidth), pSta->staIndex);
     }
-    palFreeMemory(pMac->hHdd, pOperatingModeframe);
+    vos_mem_free(pOperatingModeframe);
     return;
 }
 
@@ -490,7 +489,6 @@
     tDot11fVHTGidManagementActionFrame    *pGidManagementframe;
     tANI_U32                frameLen;
     tANI_U32                nStatus;
-    eHalStatus              status;
     tpDphHashNode           pSta;
     tANI_U16                aid;
     tANI_U32                membership = 0;
@@ -504,11 +502,11 @@
     frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
 
     PELOG3(limLog(pMac, LOG3, FL("Received GID Management action frame"));)
-    status = palAllocateMemory( pMac->hHdd, (void **)&pGidManagementframe, sizeof(*pGidManagementframe));
-    if (eHAL_STATUS_SUCCESS != status)
+    pGidManagementframe = vos_mem_malloc(sizeof(*pGidManagementframe));
+    if (NULL == pGidManagementframe)
     {
         limLog(pMac, LOGE,
-            FL("palAllocateMemory failed, status = %d "), status);
+            FL("AllocateMemory failed"));
         return;
     }
 
@@ -521,7 +519,7 @@
             FL( "Failed to unpack and parse an GidManagement Action frame (0x%08x, %d bytes):"),
             nStatus,
             frameLen);
-        palFreeMemory(pMac->hHdd, pGidManagementframe);
+        vos_mem_free(pGidManagementframe);
         return;
     }
     else if(DOT11F_WARNED( nStatus ))
@@ -594,7 +592,7 @@
                                  userPosition, pSta->staIndex);
     }
 out:
-    palFreeMemory(pMac->hHdd, pGidManagementframe);
+    vos_mem_free(pGidManagementframe);
     return;
 }
 
@@ -717,7 +715,12 @@
         psessionEntry->ccxContext.tsm.tid = addts.tspec.tsinfo.traffic.userPrio;
         vos_mem_copy(&psessionEntry->ccxContext.tsm.tsmInfo,
                                          &addts.tsmIE,sizeof(tSirMacCCXTSMIE));
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+        limSendSmeTsmIEInd(pMac, psessionEntry, addts.tsmIE.tsid,
+                           addts.tsmIE.state, addts.tsmIE.msmt_interval);
+#else
         limActivateTSMStatsTimer(pMac, psessionEntry);
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
     }
 #endif
     /* Since AddTS response was successful, check for the PSB flag
@@ -815,13 +818,21 @@
         return;   //Error handling. send the response with error status. need to send DelTS to tear down the TSPEC status.
     }
     if((addts.tspec.tsinfo.traffic.accessPolicy != SIR_MAC_ACCESSPOLICY_EDCA) ||
-       ((upToAc(addts.tspec.tsinfo.traffic.userPrio) < MAX_NUM_AC) &&
-       (psessionEntry->gLimEdcaParams[upToAc(addts.tspec.tsinfo.traffic.userPrio)].aci.acm)))
+       ((upToAc(addts.tspec.tsinfo.traffic.userPrio) < MAX_NUM_AC)))
     {
 #ifdef FEATURE_WLAN_CCX
-        retval = limSendHalMsgAddTs(pMac, pSta->staIndex, tspecInfo->idx, addts.tspec, psessionEntry->peSessionId, addts.tsmIE.msmt_interval);
+        retval = limSendHalMsgAddTs(pMac,
+                                    pSta->staIndex,
+                                    tspecInfo->idx,
+                                    addts.tspec,
+                                    psessionEntry->peSessionId,
+                                    addts.tsmIE.msmt_interval);
 #else
-        retval = limSendHalMsgAddTs(pMac, pSta->staIndex, tspecInfo->idx, addts.tspec, psessionEntry->peSessionId);
+        retval = limSendHalMsgAddTs(pMac,
+                                    pSta->staIndex,
+                                    tspecInfo->idx,
+                                    addts.tspec,
+                                    psessionEntry->peSessionId);
 #endif
         if(eSIR_SUCCESS != retval)
         {
@@ -920,7 +931,7 @@
     if ((tsinfo->traffic.accessPolicy == SIR_MAC_ACCESSPOLICY_EDCA))
     {
     
-        if ((upToAc(tsinfo->traffic.userPrio) >= MAX_NUM_AC) || (! psessionEntry->gLimEdcaParams[upToAc(tsinfo->traffic.userPrio)].aci.acm))
+        if (upToAc(tsinfo->traffic.userPrio) >= MAX_NUM_AC)
         {
             limLog(pMac, LOGW, FL("DelTs with UP %d has no AC - ignoring request"),
                    tsinfo->traffic.userPrio);
@@ -928,6 +939,10 @@
         }
     }
 
+    if ((psessionEntry->limSystemRole != eLIM_AP_ROLE) &&
+        (psessionEntry->limSystemRole != eLIM_BT_AMP_AP_ROLE))
+        limSendSmeDeltsInd(pMac, &delts, aid,psessionEntry);
+
     // try to delete the TS
     if (eSIR_SUCCESS != limAdmitControlDeleteTS(pMac, pSta->assocId, tsinfo, &tsStatus, &tspecIdx))
     {
@@ -943,7 +958,12 @@
     else
     {
       //send message to HAL to delete TS
-      if(eSIR_SUCCESS != limSendHalMsgDelTs(pMac, pSta->staIndex, tspecIdx, delts, psessionEntry->peSessionId))
+      if(eSIR_SUCCESS != limSendHalMsgDelTs(pMac,
+                                            pSta->staIndex,
+                                            tspecIdx,
+                                            delts,
+                                            psessionEntry->peSessionId,
+                                            psessionEntry->bssId))
       {
         limLog(pMac, LOGW, FL("DelTs with UP %d failed in limSendHalMsgDelTs - ignoring request"),
                          tsinfo->traffic.userPrio);
@@ -1039,11 +1059,13 @@
         limLog(pMac, LOGE, FL("Self entry missing in Hash Table "));
 
     PELOG1(limLog(pMac, LOG1, FL("DeleteTS succeeded"));)
-    if((psessionEntry->limSystemRole != eLIM_AP_ROLE)&&(psessionEntry->limSystemRole != eLIM_BT_AMP_AP_ROLE))
-      limSendSmeDeltsInd(pMac, &delts, aid,psessionEntry);
 
 #ifdef FEATURE_WLAN_CCX
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+    limSendSmeTsmIEInd(pMac, psessionEntry, 0, 0, 0);
+#else
     limDeactivateAndChangeTimer(pMac,eLIM_TSM_TIMER);
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
 #endif
 
 }
@@ -1186,11 +1208,11 @@
     pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
     frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
 
-    if ( eHAL_STATUS_SUCCESS !=
-        palAllocateMemory( pMac->hHdd, (void **)&pMeasReqFrame, sizeof( tSirMacMeasReqActionFrame ) ) )
+    pMeasReqFrame = vos_mem_malloc(sizeof( tSirMacMeasReqActionFrame ));
+    if (NULL == pMeasReqFrame)
     {
         limLog(pMac, LOGE,
-            FL("limProcessMeasurementRequestFrame: palAllocateMemory failed "));
+            FL("limProcessMeasurementRequestFrame: AllocateMemory failed "));
         return;
     }
 
@@ -1252,10 +1274,10 @@
 
     PELOG1(limLog(pMac, LOG1, FL("****LIM: Processing TPC Request from peer ****"));)
 
-    if ( eHAL_STATUS_SUCCESS !=
-        palAllocateMemory( pMac->hHdd, (void **)&pTpcReqFrame, sizeof( tSirMacTpcReqActionFrame ) ) )
+    pTpcReqFrame = vos_mem_malloc(sizeof( tSirMacTpcReqActionFrame ));
+    if (NULL == pTpcReqFrame)
     {
-        PELOGE(limLog(pMac, LOGE, FL("palAllocateMemory failed "));)
+        PELOGE(limLog(pMac, LOGE, FL("AllocateMemory failed "));)
         return;
     }
 
@@ -1394,6 +1416,7 @@
     pHdr = WDA_GET_RX_MAC_HEADER( pRxPacketInfo );
     pBody = WDA_GET_RX_MPDU_DATA( pRxPacketInfo );
     frameLen = WDA_GET_RX_PAYLOAD_LEN( pRxPacketInfo );
+    val = 0;
 
     // Unpack the received frame
     nStatus = dot11fUnpackAddBAReq( pMac, pBody, frameLen, &frmAddBAReq );
@@ -1426,7 +1449,7 @@
     {
         limLog( pMac, LOGE,
             FL( "STA context not found - ignoring ADDBA from " ));
-        limPrintMacAddr( pMac, pHdr->sa, LOGW );
+        limPrintMacAddr( pMac, pHdr->sa, LOGE );
 
         // FIXME - Should we do this?
         status = eSIR_MAC_INABLITY_TO_CONFIRM_ASSOC_STATUS;
@@ -1446,6 +1469,23 @@
     }
 #endif //WLAN_SOFTAP_VSTA_FEATURE
 
+    if (wlan_cfgGetInt(pMac, WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC, &val) !=
+                    eSIR_SUCCESS)
+    {
+        limLog(pMac, LOGE,
+               FL("Unable to get WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC"));
+        val = 0;
+    }
+    if ((SIR_BAND_2_4_GHZ == limGetRFBand(psessionEntry->currentOperChannel)) &&
+                    val)
+    {
+        limLog( pMac, LOGW,
+            FL( "BTC disabled aggregation - ignoring ADDBA from " ));
+        limPrintMacAddr( pMac, pHdr->sa, LOGW );
+
+        status = eSIR_MAC_REQ_DECLINED_STATUS;
+        goto returnAfterError;
+    }
 
     // Now, validate the ADDBA Req
     if( eSIR_MAC_SUCCESS_STATUS !=
@@ -1502,7 +1542,7 @@
   {
       frmAddBAReq.AddBAParameterSet.bufferSize = val;
   }
-  limLog( pMac, LOGE, FL( "ADDBAREQ NUMBUFF %d" ),
+  limLog( pMac, LOG1, FL( "ADDBAREQ NUMBUFF %d" ),
                         frmAddBAReq.AddBAParameterSet.bufferSize);
 
   if( eSIR_SUCCESS != limPostMsgAddBAReq( pMac,
@@ -1933,16 +1973,16 @@
      pBody = WDA_GET_RX_MPDU_DATA( pRxPacketInfo );
      frameLen = WDA_GET_RX_PAYLOAD_LEN( pRxPacketInfo );
 
-     if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                 (void **)&pFrm, sizeof(tDot11fNeighborReportResponse)))
+     pFrm = vos_mem_malloc(sizeof(tDot11fNeighborReportResponse));
+     if (NULL == pFrm)
      {
-         limLog(pMac, LOGE, FL("Unable to PAL allocate memory in __limProcessNeighborReport") );
+         limLog(pMac, LOGE, FL("Unable to allocate memory in __limProcessNeighborReport") );
          return;
      }
 
-     if( psessionEntry == NULL )
+     if(psessionEntry == NULL)
      {
-          palFreeMemory(pMac->hHdd, pFrm);
+          vos_mem_free(pFrm);
           return;
      }
 
@@ -1953,7 +1993,7 @@
           limLog( pMac, LOGE, FL( "Failed to unpack and parse a Neighbor report response (0x%08x, %d bytes):"),
                     nStatus, frameLen );
           PELOG2(sirDumpBuf( pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen );)
-          palFreeMemory(pMac->hHdd, pFrm);
+          vos_mem_free(pFrm);
           return;
      }else if ( DOT11F_WARNED( nStatus ) ) {
           limLog(pMac, LOGW, FL( "There were warnings while unpacking a Neighbor report response (0x%08x, %d bytes):"),
@@ -1964,7 +2004,7 @@
      //Call rrm function to handle the request.
      rrmProcessNeighborReportResponse( pMac, pFrm, psessionEntry ); 
      
-     palFreeMemory(pMac->hHdd, pFrm);
+     vos_mem_free(pFrm);
 }
 
 #endif
@@ -2012,7 +2052,7 @@
       Category       : 1 byte
       Action         : 1 byte
       Transaction ID : 2 bytes */
-    vos_mem_copy( &transId[0], &pBody[2], 2 );
+    vos_mem_copy(&transId[0], &pBody[2], 2);
 
     //Send 11w SA query response action frame
     if (limSendSaQueryResponseFrame(pMac,
@@ -2269,7 +2309,8 @@
         }
         break;
 #endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR) \
+    || defined (WLAN_FEATURE_RELIABLE_MCAST)
         case SIR_MAC_ACTION_VENDOR_SPECIFIC_CATEGORY:
             {
               tpSirMacVendorSpecificFrameHdr pVendorSpecific = (tpSirMacVendorSpecificFrameHdr) pActionHdr;
@@ -2282,9 +2323,10 @@
 
               //Check if it is a vendor specific action frame.
               if ((eLIM_STA_ROLE == psessionEntry->limSystemRole) &&
-                  (VOS_TRUE == palEqualMemory(pMac->hHdd, psessionEntry->selfMacAddr,
+                  (VOS_TRUE == vos_mem_compare(psessionEntry->selfMacAddr,
                     &pHdr->da[0], sizeof(tSirMacAddr))) &&
-                  IS_WES_MODE_ENABLED(pMac) && palEqualMemory( pMac->hHdd, pVendorSpecific->Oui, Oui, 3))
+                    IS_WES_MODE_ENABLED(pMac) &&
+                    vos_mem_compare(pVendorSpecific->Oui, Oui, 3))
               {
                   PELOGE( limLog( pMac, LOGW, FL("Received Vendor specific action frame, OUI %x %x %x"),
                          pVendorSpecific->Oui[0], pVendorSpecific->Oui[1], pVendorSpecific->Oui[2]);)
@@ -2294,6 +2336,57 @@
                     (tANI_U8*)pHdr, frameLen + sizeof(tSirMacMgmtHdr), 0,
                     WDA_GET_RX_CH( pRxPacketInfo ), psessionEntry, 0);
               }
+#if defined (WLAN_FEATURE_RELIABLE_MCAST)
+              else if ((eLIM_STA_IN_IBSS_ROLE == psessionEntry->limSystemRole) &&
+                  ((VOS_TRUE == vos_mem_compare(SIR_MAC_RMC_MCAST_ADDRESS,
+                    &pHdr->da[0], sizeof(tSirMacAddr))) ||
+                   (VOS_TRUE == vos_mem_compare(psessionEntry->selfMacAddr,
+                     &pHdr->da[0], sizeof(tSirMacAddr)))) &&
+                   vos_mem_compare(pVendorSpecific->Oui, SIR_MAC_RMC_OUI, 3))
+              {
+                  tANI_U8 MagicCode[] =
+                         { 0x4f, 0x58, 0x59, 0x47, 0x45, 0x4e }; /* "OXYGEN" */
+                  tpSirMacOxygenNetworkFrameHdr pOxygenHdr =
+                             (tpSirMacOxygenNetworkFrameHdr) pActionHdr;
+
+                  if (vos_mem_compare(pOxygenHdr->MagicCode,
+                      MagicCode, sizeof(MagicCode)) &&
+                      pOxygenHdr->version == SIR_MAC_RMC_VER )
+                  {
+                      switch (pOxygenHdr->actionID)
+                      {
+                          default:
+                              PELOGE(limLog(pMac, LOGE,
+                                 FL("Action RMC actionID %d not handled"),
+                                     pOxygenHdr->actionID);)
+                              break;
+                          case SIR_MAC_RMC_LEADER_INFORM_SELECTED:
+                              PELOG1(limLog(pMac, LOG1,
+                                 FL("Action RMC LEADER_INFORM_SELECTED."));)
+                              limProcessRMCMessages(pMac,
+                                 eLIM_RMC_OTA_LEADER_INFORM_SELECTED,
+                                 (tANI_U32 *)pRxPacketInfo);
+                              break;
+                          case SIR_MAC_RMC_LEADER_INFORM_CANCELLED:
+                              PELOG1(limLog(pMac, LOG1,
+                                 FL("Action RMC LEADER_INFORM_CANCELLED."));)
+                              limProcessRMCMessages(pMac,
+                                 eLIM_RMC_OTA_LEADER_INFORM_CANCELLED,
+                                 (tANI_U32 *)pRxPacketInfo);
+                              break;
+                      }
+                  }
+                  else
+                  {
+                      limLog( pMac, LOGE,
+                         FL("Dropping the vendor specific action frame in IBSS "
+                             "mode because of Oxygen Magic mismatch "
+                             MAC_ADDRESS_STR " or Version mismatch = %d"),
+                             MAC_ADDR_ARRAY(pOxygenHdr->MagicCode),
+                             pOxygenHdr->version );
+                  }
+              }
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
               else
               {
                  limLog( pMac, LOGE, FL("Dropping the vendor specific action frame because of( "
@@ -2306,7 +2399,8 @@
               }
            }
            break;
-#endif
+#endif /* WLAN_FEATURE_VOWIFI_11R || FEATURE_WLAN_CCX ||
+          FEATURE_WLAN_LFR || WLAN_FEATURE_RELIABLE_MCAST */
     case SIR_MAC_ACTION_PUBLIC_USAGE:
         switch(pActionHdr->actionID) {
         case SIR_MAC_ACTION_VENDOR_SPECIFIC:
@@ -2320,7 +2414,7 @@
               frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
 
               //Check if it is a P2P public action frame.
-              if( palEqualMemory( pMac->hHdd, pPubAction->Oui, P2POui, 4 ) )
+              if (vos_mem_compare(pPubAction->Oui, P2POui, 4))
               {
                  /* Forward to the SME to HDD to wpa_supplicant */
                  // type is ACTION
@@ -2457,7 +2551,7 @@
                 frameLen = WDA_GET_RX_PAYLOAD_LEN(pBd);
 
                 //Check if it is a P2P public action frame.
-                if( palEqualMemory( pMac->hHdd, pActionHdr->Oui, P2POui, 4 ) )
+                if (vos_mem_compare(pActionHdr->Oui, P2POui, 4))
                 {
                   /* Forward to the SME to HDD to wpa_supplicant */
                   // type is ACTION
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index aedfe69..711e3c8 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -190,6 +190,7 @@
     tANI_U8    *wpsIe = NULL;
     tSirMacRateSet  basicRates;
     tANI_U8 i = 0, j = 0;
+    tANI_BOOLEAN pmfConnection = eANI_BOOLEAN_FALSE;
 
     limGetPhyMode(pMac, &phyMode, psessionEntry);
 
@@ -227,7 +228,7 @@
 
     sirDumpBuf(pMac, SIR_LIM_MODULE_ID, LOG2, (tANI_U8 *) pBody, framelen);
 
-    if( palEqualMemory( pMac->hHdd,  (tANI_U8* ) pHdr->sa, (tANI_U8 *) pHdr->da,
+    if (vos_mem_compare((tANI_U8* ) pHdr->sa, (tANI_U8 *) pHdr->da,
                         (tANI_U8) (sizeof(tSirMacAddr))))
     {
         limSendAssocRspMgmtFrame(pMac,
@@ -251,12 +252,13 @@
     }
 
     // Allocate memory for the Assoc Request frame
-    if ( palAllocateMemory(pMac->hHdd, (void **)&pAssocReq, sizeof(*pAssocReq)) != eHAL_STATUS_SUCCESS)
+    pAssocReq = vos_mem_malloc(sizeof(*pAssocReq));
+    if (NULL == pAssocReq)
     {
-        limLog(pMac, LOGP, FL("PAL Allocate Memory failed in AssocReq"));
+        limLog(pMac, LOGP, FL("Allocate Memory failed in AssocReq"));
         return;
     }
-    palZeroMemory( pMac->hHdd, (void *)pAssocReq , sizeof(*pAssocReq));
+    vos_mem_set((void *)pAssocReq , sizeof(*pAssocReq), 0);
 
     // Parse Assoc Request frame
     if (subType == LIM_ASSOC)
@@ -272,13 +274,14 @@
         goto error;
     }
 
-    if ( palAllocateMemory(pMac->hHdd, (void **)&pAssocReq->assocReqFrame, framelen) != eHAL_STATUS_SUCCESS) 
+    pAssocReq->assocReqFrame = vos_mem_malloc(framelen);
+    if ( NULL == pAssocReq->assocReqFrame )
     {
         limLog(pMac, LOGE, FL("Unable to allocate memory for the assoc req, length=%d from "),framelen);
         goto error;
     }
     
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pAssocReq->assocReqFrame,
+    vos_mem_copy((tANI_U8 *) pAssocReq->assocReqFrame,
                   (tANI_U8 *) pBody, framelen);
     pAssocReq->assocReqFrameLength = framelen;    
 
@@ -305,7 +308,7 @@
                         pHdr->sa,
                         subType, 0,psessionEntry);
 
-        limLog(pMac, LOGW, FL("local caps 0x%x received 0x%x"), localCapabilities, pAssocReq->capabilityInfo);
+        limLog(pMac, LOGW, FL("local caps mismatch received caps"));
 
         // Log error
         if (subType == LIM_ASSOC)
@@ -622,8 +625,8 @@
     } // End if on HT caps turned on in lim.
 
     /* Clear the buffers so that frame parser knows that there isn't a previously decoded IE in these buffers */
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&Dot11fIERSN, sizeof( Dot11fIERSN ) );
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&Dot11fIEWPA, sizeof( Dot11fIEWPA ) );
+    vos_mem_set((tANI_U8*)&Dot11fIERSN, sizeof( Dot11fIERSN ), 0);
+    vos_mem_set((tANI_U8*)&Dot11fIEWPA, sizeof( Dot11fIEWPA ), 0);
 
     /* if additional IE is present, check if it has WscIE */
     if( pAssocReq->addIEPresent && pAssocReq->addIE.length )
@@ -637,8 +640,8 @@
             && psessionEntry->pLimStartBssReq->rsnIE.length)
         {
             limLog(pMac, LOGE,
-                   FL("AP supports RSN enabled authentication"));
-
+                   FL("RSN enabled auth, Re/Assoc req from STA: "MAC_ADDRESS_STR),
+                       MAC_ADDR_ARRAY(pHdr->sa));
             if(pAssocReq->rsnPresent)
             {
                 if(pAssocReq->rsn.length)
@@ -653,7 +656,8 @@
                     if(SIR_MAC_OUI_VERSION_1 == Dot11fIERSN.version)
                     {
                         /* check the groupwise and pairwise cipher suites */
-                        if(eSIR_SUCCESS != (status = limCheckRxRSNIeMatch(pMac, Dot11fIERSN, psessionEntry, pAssocReq->HTCaps.present) ) )
+                        if(eSIR_SUCCESS != (status = limCheckRxRSNIeMatch(pMac, Dot11fIERSN, psessionEntry,
+                                                                          pAssocReq->HTCaps.present, &pmfConnection)))
                         {
                             /* some IE is not properly sent */
                             /* received Association req frame with RSN IE but length is 0 */
@@ -845,35 +849,46 @@
             goto error;
         } // if (pStaDs->mlmStaContext.mlmState != eLIM_MLM_LINK_ESTABLISHED_STATE)
 
-        /**
-         * STA sent Re/Association Request frame while already in
+           /* STA sent association Request frame while already in
+            * 'associated' state and no change in the capability
+            *  so drop the frame */
+        if ((VOS_TRUE == vos_mem_compare(&pStaDs->mlmStaContext.capabilityInfo,
+                                          &pAssocReq->capabilityInfo,
+                                          sizeof(tSirMacCapabilityInfo)))&&
+                                         (subType == LIM_ASSOC))
+        {
+            limLog(pMac, LOGE, FL(" Received Assoc req in state %X STAid=%d"),
+                                       pStaDs->mlmStaContext.mlmState,peerIdx);
+            goto error;
+        }
+        else
+        {
+         /**
+         * STA sent Re/association Request frame while already in
          * 'associated' state. Update STA capabilities and
          * send Association response frame with same AID
          */
+            pStaDs->mlmStaContext.capabilityInfo = pAssocReq->capabilityInfo;
+            if (pStaPreAuthContext &&
+                (pStaPreAuthContext->mlmState ==
+                                           eLIM_MLM_AUTHENTICATED_STATE))
+            {
+                /// STA has triggered pre-auth again
+                authType = pStaPreAuthContext->authType;
+                limDeletePreAuthNode(pMac, pHdr->sa);
+            }
+            else
+                authType = pStaDs->mlmStaContext.authType;
 
-        pStaDs->mlmStaContext.capabilityInfo = pAssocReq->capabilityInfo;
-
-        if (pStaPreAuthContext &&
-            (pStaPreAuthContext->mlmState ==
-                                       eLIM_MLM_AUTHENTICATED_STATE))
-        {
-            /// STA has triggered pre-auth again
-            authType = pStaPreAuthContext->authType;
-            limDeletePreAuthNode(pMac, pHdr->sa);
+            updateContext = true;
+            if (dphInitStaState(pMac, pHdr->sa, peerIdx, true, &psessionEntry->dph.dphHashTable)
+                                      == NULL)
+            {
+                limLog(pMac, LOGE, FL("could not Init STAid=%d"), peerIdx);
+                goto  error;
+            }
         }
-        else
-            authType = pStaDs->mlmStaContext.authType;
-
-        updateContext = true;
-
-        if (dphInitStaState(pMac, pHdr->sa, peerIdx, true, &psessionEntry->dph.dphHashTable) == NULL)   
-        {
-            limLog(pMac, LOGE, FL("could not Init STAid=%d"), peerIdx);
-            goto  error;
-        }
-
-
-        goto sendIndToSme;
+       goto sendIndToSme;
     } // end if (lookup for STA in perStaDs fails)
 
 
@@ -1118,13 +1133,12 @@
                              subType, true, authType, peerIdx, true,
                              (tSirResultCodes) eSIR_MAC_UNSPEC_FAILURE_STATUS, psessionEntry);
 
-        /*return it from here rather than goto error statement.This is done as the memory is getting free twice*/
-        return;
-        //goto error;
+        pAssocReq = psessionEntry->parsedAssocReq[pStaDs->assocId];
+        goto error;
     }
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &pStaDs->mlmStaContext.propRateSet,
-                  (tANI_U8 *) &(pAssocReq->propIEinfo.propRates),
+    vos_mem_copy((tANI_U8 *) &pStaDs->mlmStaContext.propRateSet,
+                 (tANI_U8 *) &(pAssocReq->propIEinfo.propRates),
                   pAssocReq->propIEinfo.propRates.numPropRates + 1);
 
     /// Add STA context at MAC HW (BMU, RHP & TFP)
@@ -1163,14 +1177,21 @@
                  * STA when UPASD is not supported.
                  */
                 limLog( pMac, LOGE, FL( "AP do not support UPASD REASSOC Failed" ));
+                /* During wlan fuzz tests for softAP when mal-formed assoc req is
+                 * sent to AP due to delSTA is not done in firmnware UMAC is
+                 * stuck in some bad state.if we set this flag delsta will happen
+                 * and UMAC will recover*/
+                if (updateContext)
+                {
+                    pStaDs->mlmStaContext.updateContext = 1;
+                }
                 limRejectAssociation(pMac, pHdr->sa,
                                      subType, true, authType, peerIdx, true,
                                      (tSirResultCodes) eSIR_MAC_WME_REFUSED_STATUS, psessionEntry);
 
 
-                /*return it from here rather than goto error statement.This is done as the memory is getting free twice in this uapsd scenario*/
-                return;
-                //goto error;
+                pAssocReq = psessionEntry->parsedAssocReq[pStaDs->assocId];
+                goto error;
             }
             else
             {
@@ -1194,6 +1215,10 @@
     if (pAssocReq->propIEinfo.aniIndicator)
         pStaDs->aniPeer = 1;
 
+#ifdef WLAN_FEATURE_11W
+    pStaDs->rmfEnabled = (pmfConnection) ? 1 : 0;
+#endif
+
     // BTAMP: Storing the parsed assoc request in the psessionEntry array
     psessionEntry->parsedAssocReq[pStaDs->assocId] = pAssocReq;
 
@@ -1219,9 +1244,8 @@
                                   true, pStaDs->mlmStaContext.authType, pStaDs->assocId, true,
                                   (tSirResultCodes) eSIR_MAC_UNSPEC_FAILURE_STATUS, psessionEntry);
 
-            /*return it from here rather than goto error statement.This is done as the memory is getting free twice*/
-            return;
-            //goto error;
+            pAssocReq = psessionEntry->parsedAssocReq[pStaDs->assocId];
+            goto error;
         }
     }
     else
@@ -1243,6 +1267,7 @@
 
                 //Restoring the state back.
                 pStaDs->mlmStaContext.mlmState = mlmPrevState;
+                pAssocReq = psessionEntry->parsedAssocReq[pStaDs->assocId];
                 goto error;
             }
         }
@@ -1258,6 +1283,7 @@
 
                     //Restoring the state back.
                     pStaDs->mlmStaContext.mlmState = mlmPrevState;
+                    pAssocReq = psessionEntry->parsedAssocReq[pStaDs->assocId];
                     goto error;
             }
 
@@ -1272,15 +1298,11 @@
     {
         if ( pAssocReq->assocReqFrame ) 
         {
-            palFreeMemory(pMac->hHdd, pAssocReq->assocReqFrame);
+            vos_mem_free(pAssocReq->assocReqFrame);
             pAssocReq->assocReqFrame = NULL;
         }
 
-        if (palFreeMemory(pMac->hHdd, pAssocReq) != eHAL_STATUS_SUCCESS) 
-        {
-            limLog(pMac, LOGP, FL("PalFree Memory failed "));
-            return;
-        }
+        vos_mem_free(pAssocReq);
     }
 
     /* If it is not duplicate Assoc request then only make to Null */
@@ -1342,18 +1364,21 @@
     {
         temp  = sizeof(tLimMlmAssocInd);
 
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmAssocInd, temp))
+        pMlmAssocInd = vos_mem_malloc(temp);
+        if (NULL == pMlmAssocInd)
         {
             limReleasePeerIdx(pMac, pStaDs->assocId, psessionEntry);
-            limLog(pMac, LOGP, FL("palAllocateMemory failed for pMlmAssocInd"));
+            limLog(pMac, LOGP, FL("AllocateMemory failed for pMlmAssocInd"));
             return;
         }
-        palZeroMemory( pMac->hHdd, pMlmAssocInd, temp);
+        vos_mem_set(pMlmAssocInd, temp ,0);
 
-        palCopyMemory( pMac->hHdd,(tANI_U8 *)pMlmAssocInd->peerMacAddr,(tANI_U8 *)pStaDs->staAddr,sizeof(tSirMacAddr));
+        vos_mem_copy((tANI_U8 *)pMlmAssocInd->peerMacAddr,
+                     (tANI_U8 *)pStaDs->staAddr, sizeof(tSirMacAddr));
  
         pMlmAssocInd->aid    = pStaDs->assocId;
-        palCopyMemory( pMac->hHdd, (tANI_U8 *)&pMlmAssocInd->ssId,(tANI_U8 *)&(pAssocReq->ssId), pAssocReq->ssId.length + 1);
+        vos_mem_copy((tANI_U8 *)&pMlmAssocInd->ssId,
+                     (tANI_U8 *)&(pAssocReq->ssId), pAssocReq->ssId.length + 1);
         pMlmAssocInd->sessionId = psessionEntry->peSessionId;
         pMlmAssocInd->authType =  pStaDs->mlmStaContext.authType;
  
@@ -1371,10 +1396,9 @@
             pMlmAssocInd->rsnIE.length = 2 + pAssocReq->rsn.length;
             pMlmAssocInd->rsnIE.rsnIEdata[0] = SIR_MAC_RSN_EID;
             pMlmAssocInd->rsnIE.rsnIEdata[1] = pAssocReq->rsn.length;
-            palCopyMemory( pMac->hHdd, 
-                           &pMlmAssocInd->rsnIE.rsnIEdata[2],
-                           pAssocReq->rsn.info,
-                           pAssocReq->rsn.length);
+            vos_mem_copy(&pMlmAssocInd->rsnIE.rsnIEdata[2],
+                         pAssocReq->rsn.info,
+                         pAssocReq->rsn.length);
         }
 
         // Fill in 802.11h related info
@@ -1395,15 +1419,14 @@
             if((pMlmAssocInd->rsnIE.length + pAssocReq->wpa.length) >= SIR_MAC_MAX_IE_LENGTH)
             {
                 PELOGE(limLog(pMac, LOGE, FL("rsnIEdata index out of bounds %d"), pMlmAssocInd->rsnIE.length);)
-                palFreeMemory(pMac->hHdd, pMlmAssocInd);
+                vos_mem_free(pMlmAssocInd);
                 return;
             }
             pMlmAssocInd->rsnIE.rsnIEdata[pMlmAssocInd->rsnIE.length] = SIR_MAC_WPA_EID;
             pMlmAssocInd->rsnIE.rsnIEdata[pMlmAssocInd->rsnIE.length + 1] = pAssocReq->wpa.length;
-            palCopyMemory( pMac->hHdd,
-                           &pMlmAssocInd->rsnIE.rsnIEdata[pMlmAssocInd->rsnIE.length + 2],
-                           pAssocReq->wpa.info,
-                           pAssocReq->wpa.length);
+            vos_mem_copy(&pMlmAssocInd->rsnIE.rsnIEdata[pMlmAssocInd->rsnIE.length + 2],
+                         pAssocReq->wpa.info,
+                         pAssocReq->wpa.length);
             pMlmAssocInd->rsnIE.length += 2 + pAssocReq->wpa.length;
         }
 
@@ -1411,10 +1434,9 @@
        pMlmAssocInd->addIE.length = 0;
        if (pAssocReq->addIEPresent)
        {
-            palCopyMemory( pMac->hHdd,
-                           &pMlmAssocInd->addIE.addIEdata,
-                           pAssocReq->addIE.addIEdata,
-                           pAssocReq->addIE.length);
+            vos_mem_copy(&pMlmAssocInd->addIE.addIEdata,
+                          pAssocReq->addIE.addIEdata,
+                          pAssocReq->addIE.length);
 
             pMlmAssocInd->addIE.length = pAssocReq->addIE.length;
        }
@@ -1446,26 +1468,30 @@
         pMlmAssocInd->beaconLength = psessionEntry->bcnLen;
 
         limPostSmeMessage(pMac, LIM_MLM_ASSOC_IND, (tANI_U32 *) pMlmAssocInd);
-        palFreeMemory( pMac->hHdd, pMlmAssocInd);
+        vos_mem_free(pMlmAssocInd);
     }
     else
     {
         // If its of Reassociation Request, then post LIM_MLM_REASSOC_IND 
         temp  = sizeof(tLimMlmReassocInd);
 
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmReassocInd, temp))
+        pMlmReassocInd = vos_mem_malloc(temp);
+        if (NULL == pMlmReassocInd)
         {
-            limLog(pMac, LOGP, FL("call to palAllocateMemory failed for pMlmReassocInd"));
+            limLog(pMac, LOGP, FL("call to AllocateMemory failed for pMlmReassocInd"));
             limReleasePeerIdx(pMac, pStaDs->assocId, psessionEntry);
             return;
         }
-        palZeroMemory( pMac->hHdd, pMlmReassocInd, temp);
+        vos_mem_set(pMlmReassocInd, temp, 0);
 
-        palCopyMemory( pMac->hHdd,(tANI_U8 *) pMlmReassocInd->peerMacAddr, (tANI_U8 *)pStaDs->staAddr, sizeof(tSirMacAddr));
-        palCopyMemory( pMac->hHdd,(tANI_U8 *) pMlmReassocInd->currentApAddr, (tANI_U8 *)&(pAssocReq->currentApAddr), sizeof(tSirMacAddr));
+        vos_mem_copy((tANI_U8 *) pMlmReassocInd->peerMacAddr,
+                     (tANI_U8 *)pStaDs->staAddr, sizeof(tSirMacAddr));
+        vos_mem_copy((tANI_U8 *) pMlmReassocInd->currentApAddr,
+                     (tANI_U8 *)&(pAssocReq->currentApAddr), sizeof(tSirMacAddr));
         pMlmReassocInd->aid = pStaDs->assocId;
         pMlmReassocInd->authType = pStaDs->mlmStaContext.authType;
-        palCopyMemory( pMac->hHdd,(tANI_U8 *)&pMlmReassocInd->ssId, (tANI_U8 *)&(pAssocReq->ssId), pAssocReq->ssId.length + 1);
+        vos_mem_copy((tANI_U8 *)&pMlmReassocInd->ssId,
+                     (tANI_U8 *)&(pAssocReq->ssId), pAssocReq->ssId.length + 1);
 
         if (pAssocReq->propIEinfo.aniIndicator)
             pStaDs->aniPeer = 1;
@@ -1482,7 +1508,8 @@
             pMlmReassocInd->rsnIE.length = 2 + pAssocReq->rsn.length;
             pMlmReassocInd->rsnIE.rsnIEdata[0] = SIR_MAC_RSN_EID;
             pMlmReassocInd->rsnIE.rsnIEdata[1] = pAssocReq->rsn.length;
-            palCopyMemory( pMac->hHdd, &pMlmReassocInd->rsnIE.rsnIEdata[2], pAssocReq->rsn.info, pAssocReq->rsn.length);
+            vos_mem_copy(&pMlmReassocInd->rsnIE.rsnIEdata[2],
+                          pAssocReq->rsn.info, pAssocReq->rsn.length);
         }
 
         // 802.11h support
@@ -1517,20 +1544,18 @@
             limLog(pMac, LOG2, FL("Received WPA IE length in Assoc Req is %d"), pAssocReq->wpa.length);
             pMlmReassocInd->rsnIE.rsnIEdata[pMlmReassocInd->rsnIE.length] = SIR_MAC_WPA_EID;
             pMlmReassocInd->rsnIE.rsnIEdata[pMlmReassocInd->rsnIE.length + 1] = pAssocReq->wpa.length;
-            palCopyMemory( pMac->hHdd,
-                           &pMlmReassocInd->rsnIE.rsnIEdata[pMlmReassocInd->rsnIE.length + 2],
-                           pAssocReq->wpa.info,
-                           pAssocReq->wpa.length);
+            vos_mem_copy(&pMlmReassocInd->rsnIE.rsnIEdata[pMlmReassocInd->rsnIE.length + 2],
+                          pAssocReq->wpa.info,
+                          pAssocReq->wpa.length);
             pMlmReassocInd->rsnIE.length += 2 + pAssocReq->wpa.length;
         }
 
        pMlmReassocInd->addIE.length = 0;
        if (pAssocReq->addIEPresent)
        {
-            palCopyMemory( pMac->hHdd,
-                           &pMlmReassocInd->addIE.addIEdata,
-                           pAssocReq->addIE.addIEdata,
-                           pAssocReq->addIE.length);
+            vos_mem_copy(&pMlmReassocInd->addIE.addIEdata,
+                         pAssocReq->addIE.addIEdata,
+                         pAssocReq->addIE.length);
 
             pMlmReassocInd->addIE.length = pAssocReq->addIE.length;
        }
@@ -1562,7 +1587,7 @@
         pMlmReassocInd->beaconLength = psessionEntry->bcnLen;
 
         limPostSmeMessage(pMac, LIM_MLM_REASSOC_IND, (tANI_U32 *) pMlmReassocInd);
-        palFreeMemory( pMac->hHdd, pMlmReassocInd);
+        vos_mem_free(pMlmReassocInd);
     }
 
     return;
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c
index 5197df9..253693a 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limProcessAssocRspFrame.cc contains the code
  * for processing Re/Association Response Frame.
@@ -53,7 +52,7 @@
 #include "limStaHashApi.h"
 #include "limSendMessages.h"
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include "ccxApi.h"
 #endif
 
@@ -153,11 +152,11 @@
           pStaDs->htMaxRxAMpduFactor = pAssocRsp->VHTCaps.maxAMPDULenExp;
        }
 
-       if (limPopulateOwnRateSet(pMac, &pStaDs->supportedRates, 
+       if (limPopulatePeerRateSet(pMac, &pStaDs->supportedRates,
                                 pAssocRsp->HTCaps.supportedMCSSet,
-                                false,psessionEntry , &pAssocRsp->VHTCaps) != eSIR_SUCCESS) 
+                                false,psessionEntry , &pAssocRsp->VHTCaps) != eSIR_SUCCESS)
 #else
-       if (limPopulateOwnRateSet(pMac, &pStaDs->supportedRates, pAssocRsp->HTCaps.supportedMCSSet, false,psessionEntry) != eSIR_SUCCESS) 
+       if (limPopulatePeerRateSet(pMac, &pStaDs->supportedRates, pAssocRsp->HTCaps.supportedMCSSet, false,psessionEntry) != eSIR_SUCCESS)
 #endif
        {
            limLog(pMac, LOGP, FL("could not get rateset and extended rate set"));
@@ -262,8 +261,8 @@
     pmmResetPmmState(pMac);
 
     // Update the current Bss Information
-    palCopyMemory( pMac->hHdd, psessionEntry->bssId,
-                  psessionEntry->limReAssocbssId, sizeof(tSirMacAddr));
+    vos_mem_copy(psessionEntry->bssId,
+                 psessionEntry->limReAssocbssId, sizeof(tSirMacAddr));
     psessionEntry->currentOperChannel = psessionEntry->limReassocChannelId;
     psessionEntry->htSecondaryChannelOffset = psessionEntry->reAssocHtSupportedChannelWidthSet;
     psessionEntry->htRecommendedTxWidthSet = psessionEntry->reAssocHtRecommendedTxWidthSet;
@@ -272,8 +271,8 @@
     psessionEntry->limCurrentBssQosCaps = psessionEntry->limReassocBssQosCaps;
     psessionEntry->limCurrentBssPropCap = psessionEntry->limReassocBssPropCap;
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &psessionEntry->ssId,
-                  (tANI_U8 *) &psessionEntry->limReassocSSID,
+    vos_mem_copy((tANI_U8 *) &psessionEntry->ssId,
+                 (tANI_U8 *) &psessionEntry->limReassocSSID,
                   psessionEntry->limReassocSSID.length+1);
     
     // Store assigned AID for TIM processing
@@ -328,10 +327,10 @@
     /* Update PE session Id*/
     mlmAssocCnf.sessionId = psessionEntry->peSessionId;
 
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                (void **)&pBeaconStruct, sizeof(tSchBeaconStruct)))
+    pBeaconStruct = vos_mem_malloc(sizeof(tSchBeaconStruct));
+    if (NULL == pBeaconStruct)
     {
-        limLog(pMac, LOGE, FL("Unable to PAL allocate memory in limProcessAssocRspFrame") );
+        limLog(pMac, LOGE, FL("Unable to allocate memory in limProcessAssocRspFrame") );
         return;
     }
 
@@ -344,7 +343,7 @@
                FL("received Re/Assoc response frame on role %d "),
                psessionEntry->limSystemRole);
 
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+        vos_mem_free(pBeaconStruct);
         return;
     }
 
@@ -374,7 +373,7 @@
                FL("received Re/Assoc rsp frame in unexpected state"));
             limPrintMlmState(pMac, LOGE, psessionEntry->limMlmState);
         }
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+        vos_mem_free(pBeaconStruct);
         return;
     }
 #if 0
@@ -383,7 +382,7 @@
     {
         /// Could not get BSSID from CFG. Log error.
         limLog(pMac, LOGP, FL("could not retrieve BSSID"));
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+        vos_mem_free(pBeaconStruct);
         return;
     }
 #endif //TO SUPPORT BT-AMP
@@ -391,7 +390,7 @@
 
     if (subType == LIM_ASSOC)
     {
-        if (!palEqualMemory( pMac->hHdd,pHdr->sa, currentBssId, sizeof(tSirMacAddr)) )
+        if (!vos_mem_compare(pHdr->sa, currentBssId, sizeof(tSirMacAddr)))
         {
             /**
              * Received Association Response frame from an entity
@@ -403,13 +402,13 @@
             PELOGW(limLog(pMac, LOGW,
                    FL("received AssocRsp frame from unexpected peer "MAC_ADDRESS_STR),
                    MAC_ADDR_ARRAY(pHdr->sa));)
-            palFreeMemory(pMac->hHdd, pBeaconStruct);
+            vos_mem_free(pBeaconStruct);
             return;
         }
     }
     else
     {
-        if ( !palEqualMemory( pMac->hHdd,pHdr->sa, psessionEntry->limReAssocbssId, sizeof(tSirMacAddr)) )
+        if (!vos_mem_compare(pHdr->sa, psessionEntry->limReAssocbssId, sizeof(tSirMacAddr)))
         {
             /**
              * Received Reassociation Response frame from an entity
@@ -421,23 +420,24 @@
             PELOGW(limLog(pMac, LOGW,
                    FL("received ReassocRsp frame from unexpected peer "MAC_ADDRESS_STR),
                    MAC_ADDR_ARRAY(pHdr->sa));)
-            palFreeMemory(pMac->hHdd, pBeaconStruct);
+            vos_mem_free(pBeaconStruct);
 
             return;
         }
     }
 
-   if ( palAllocateMemory(pMac->hHdd, (void **)&pAssocRsp, sizeof(*pAssocRsp)) != eHAL_STATUS_SUCCESS) {
-        limLog(pMac, LOGP, FL("Pal Allocate Memory failed in AssocRsp"));
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+   pAssocRsp = vos_mem_malloc(sizeof(*pAssocRsp));
+   if (NULL == pAssocRsp)
+   {
+        limLog(pMac, LOGP, FL("Allocate Memory failed in AssocRsp"));
+        vos_mem_free(pBeaconStruct);
 
         return;
     }
    
    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
-             FL("Assoc Resp Frame Received: BSSID %02x:%02x:%02x:%02x:%02x:%02x (Rssi %d)"),
-             pHdr->bssId[0], pHdr->bssId[1], pHdr->bssId[2],
-             pHdr->bssId[3], pHdr->bssId[4], pHdr->bssId[5],
+             FL("Re/Assoc Resp Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"),
+             MAC_ADDR_ARRAY(pHdr->bssId),
              (uint)abs((tANI_S8)WDA_GET_RX_RSSI_DB(pRxPacketInfo)));
 
     // Get pointer to Re/Association Response frame body
@@ -447,12 +447,9 @@
     if (sirConvertAssocRespFrame2Struct(
                         pMac, pBody, frameLen, pAssocRsp) == eSIR_FAILURE) 
     {
-        if (palFreeMemory(pMac->hHdd, pAssocRsp) != eHAL_STATUS_SUCCESS) 
-        {
-            limLog(pMac, LOGP, FL("PalFree Memory failed "));
-        }
+        vos_mem_free(pAssocRsp);
         PELOGE(limLog(pMac, LOGE, FL("Parse error Assoc resp subtype %d, length=%d"), frameLen,subType);)
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+        vos_mem_free(pBeaconStruct);
 
         return;
     }
@@ -460,7 +457,7 @@
     if(!pAssocRsp->suppRatesPresent)
     {
         PELOGE(limLog(pMac, LOGW, FL("assoc response does not have supported rate set"));)
-        palCopyMemory(pMac->hHdd, &pAssocRsp->supportedRates,
+        vos_mem_copy(&pAssocRsp->supportedRates,
                       &psessionEntry->rateSet, sizeof(tSirMacRateSet));
     }
 
@@ -468,37 +465,41 @@
 
     if( psessionEntry->assocRsp != NULL )
     {
-        palFreeMemory(pMac->hHdd, psessionEntry->assocRsp);
+        vos_mem_free(psessionEntry->assocRsp);
         psessionEntry->assocRsp = NULL;
     }
-    if( (palAllocateMemory(pMac->hHdd, (void**)&psessionEntry->assocRsp, frameLen)) != eHAL_STATUS_SUCCESS)
+
+    psessionEntry->assocRsp = vos_mem_malloc(frameLen);
+    if (NULL == psessionEntry->assocRsp)
     {
         PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc response, len = %d"), frameLen);)
     }
     else
     {
         //Store the Assoc response. This is sent to csr/hdd in join cnf response. 
-        palCopyMemory(pMac->hHdd, psessionEntry->assocRsp, pBody, frameLen);
+        vos_mem_copy(psessionEntry->assocRsp, pBody, frameLen);
         psessionEntry->assocRspLen = frameLen;
     }
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
     if (psessionEntry->ricData != NULL) 
     {
-        palFreeMemory(pMac->hHdd, psessionEntry->ricData);
+        vos_mem_free(psessionEntry->ricData);
         psessionEntry->ricData = NULL;
     }
     if(pAssocRsp->ricPresent)
     {
         psessionEntry->RICDataLen = pAssocRsp->num_RICData * sizeof(tDot11fIERICDataDesc);
-        if( (palAllocateMemory(pMac->hHdd, (void**)&psessionEntry->ricData, psessionEntry->RICDataLen)) != eHAL_STATUS_SUCCESS)
+        psessionEntry->ricData = vos_mem_malloc(psessionEntry->RICDataLen);
+        if ( NULL == psessionEntry->ricData )
         {
             PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc response"));)
             psessionEntry->RICDataLen = 0; 
         }
         else
         {
-            palCopyMemory(pMac->hHdd, psessionEntry->ricData, &pAssocRsp->RICData[0], psessionEntry->RICDataLen);
+            vos_mem_copy(psessionEntry->ricData,
+                         &pAssocRsp->RICData[0], psessionEntry->RICDataLen);
         }
     }
     else
@@ -511,20 +512,22 @@
 #ifdef FEATURE_WLAN_CCX    
     if (psessionEntry->tspecIes != NULL) 
     {
-        palFreeMemory(pMac->hHdd, psessionEntry->tspecIes);
+        vos_mem_free(psessionEntry->tspecIes);
         psessionEntry->tspecIes = NULL;
     }
     if(pAssocRsp->tspecPresent)
     {
         psessionEntry->tspecLen = pAssocRsp->num_tspecs * sizeof(tDot11fIEWMMTSPEC);
-        if( (palAllocateMemory(pMac->hHdd, (void**)&psessionEntry->tspecIes, psessionEntry->tspecLen)) != eHAL_STATUS_SUCCESS)
+        psessionEntry->tspecIes = vos_mem_malloc(psessionEntry->tspecLen);
+        if ( NULL == psessionEntry->tspecIes )
         {
             PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc response"));)
             psessionEntry->tspecLen = 0; 
         }
         else
         {
-            palCopyMemory(pMac->hHdd, psessionEntry->tspecIes, &pAssocRsp->TSPECInfo[0], psessionEntry->tspecLen);
+            vos_mem_copy(psessionEntry->tspecIes,
+                         &pAssocRsp->TSPECInfo[0], psessionEntry->tspecLen);
         }
         PELOG1(limLog(pMac, LOG1, FL(" Tspec EID present in assoc rsp "));)
     }
@@ -548,8 +551,8 @@
         // Log error
         limLog(pMac, LOGE,
                FL("received Re/AssocRsp frame with IBSS capability"));
-        palFreeMemory(pMac->hHdd, pAssocRsp);
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+        vos_mem_free(pAssocRsp);
+        vos_mem_free(pBeaconStruct);
 
         return;
     }
@@ -560,8 +563,8 @@
          * Could not get Capabilities value
          * from CFG. Log error.
          */         
-        palFreeMemory(pMac->hHdd, pAssocRsp);
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+        vos_mem_free(pAssocRsp);
+        vos_mem_free(pBeaconStruct);
 
         limLog(pMac, LOGP, FL("could not retrieve Capabilities value"));
         return;
@@ -576,7 +579,7 @@
         pMac->lim.reAssocRetryAttempt = 0;
         if ((NULL != pMac->lim.pSessionEntry) && (NULL != pMac->lim.pSessionEntry->pLimMlmReassocRetryReq))
         {
-            palFreeMemory( pMac->hHdd, pMac->lim.pSessionEntry->pLimMlmReassocRetryReq);
+            vos_mem_free(pMac->lim.pSessionEntry->pLimMlmReassocRetryReq);
             pMac->lim.pSessionEntry->pLimMlmReassocRetryReq = NULL;
         }
 #endif
@@ -597,8 +600,8 @@
         if (pAssocRsp->propIEinfo.loadBalanceInfoPresent)
         {
             mlmAssocCnf.resultCode = eSIR_SME_TRANSFER_STA;
-            palCopyMemory( pMac->hHdd, pMac->lim.gLimAlternateRadio.bssId,
-                          pAssocRsp->propIEinfo.alternateRadio.bssId, sizeof(tSirMacAddr));
+            vos_mem_copy(pMac->lim.gLimAlternateRadio.bssId,
+                         pAssocRsp->propIEinfo.alternateRadio.bssId, sizeof(tSirMacAddr));
             pMac->lim.gLimAlternateRadio.channelId =
                           pAssocRsp->propIEinfo.alternateRadio.channelId;
         }else
@@ -639,8 +642,8 @@
                                 psessionEntry->selfMacAddr, NULL, NULL) != eSIR_SUCCESS)
             {
                 PELOGE(limLog(pMac, LOGE, FL("Set link state to POSTASSOC failed"));)
-                palFreeMemory(pMac->hHdd, pBeaconStruct);
-                palFreeMemory(pMac->hHdd, pAssocRsp);
+                vos_mem_free(pBeaconStruct);
+                vos_mem_free(pAssocRsp);
                 return;
             }
     }
@@ -662,7 +665,15 @@
                             psessionEntry->ccxContext.tsm.tid = pAssocRsp->TSPECInfo[cnt].user_priority;
                             vos_mem_copy(&psessionEntry->ccxContext.tsm.tsmInfo,
                                     &pAssocRsp->tsmIE, sizeof(tSirMacCCXTSMIE));
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+                            limSendSmeTsmIEInd(pMac,
+                                               psessionEntry,
+                                               pAssocRsp->tsmIE.tsid,
+                                               pAssocRsp->tsmIE.state,
+                                               pAssocRsp->tsmIE.msmt_interval);
+#else
                             limActivateTSMStatsTimer(pMac, psessionEntry);
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
                             if(psessionEntry->ccxContext.tsm.tsmInfo.state) {
                                 psessionEntry->ccxContext.tsm.tsmMetrics.RoamingCount++;
                             }
@@ -677,7 +688,7 @@
 #endif
         if (psessionEntry->pLimMlmJoinReq)
         {
-            palFreeMemory( pMac->hHdd, psessionEntry->pLimMlmJoinReq);
+            vos_mem_free(psessionEntry->pLimMlmJoinReq);
             psessionEntry->pLimMlmJoinReq = NULL;
         }
 
@@ -725,7 +736,7 @@
                 limSendEdcaParams(pMac, psessionEntry->gLimEdcaParamsActive, pStaDs->bssId, eANI_BOOLEAN_FALSE);
             }
             limAddFTStaSelf(pMac, (pAssocRsp->aid & 0x3FFF), psessionEntry);
-            palFreeMemory(pMac->hHdd, pBeaconStruct);
+            vos_mem_free(pBeaconStruct);
 
             return;
         }
@@ -763,7 +774,7 @@
             if (limCleanupRxPath(pMac, pStaDs,psessionEntry) != eSIR_SUCCESS)
                 goto assocReject;
         }
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+        vos_mem_free(pBeaconStruct);
 
         return;
     }
@@ -799,8 +810,8 @@
 
         limPostSmeMessage(pMac, LIM_MLM_ASSOC_CNF,
                               (tANI_U32 *) &mlmAssocCnf);
-        palFreeMemory(pMac->hHdd, pAssocRsp); 
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+        vos_mem_free(pAssocRsp);
+        vos_mem_free(pBeaconStruct);
 
         return;
     }
@@ -826,14 +837,17 @@
         else
             psessionEntry->beaconParams.fShortPreamble = true;
     }
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_CONNECTED, psessionEntry, 0, 0);
+#endif
 
 
      //Update the BSS Entry, this entry was added during preassoc.
     if( eSIR_SUCCESS == limStaSendAddBss( pMac, pAssocRsp,  pBeaconStruct,
                    &psessionEntry->pLimJoinReq->bssDescription, true, psessionEntry))  
     {
-        palFreeMemory(pMac->hHdd, pAssocRsp);   
-        palFreeMemory(pMac->hHdd, pBeaconStruct);
+        vos_mem_free(pAssocRsp);
+        vos_mem_free(pBeaconStruct);
         return;
     }
     else
@@ -856,7 +870,7 @@
 
         if (psessionEntry->pLimMlmJoinReq)
         {
-            palFreeMemory( pMac->hHdd, psessionEntry->pLimMlmJoinReq);
+            vos_mem_free(psessionEntry->pLimMlmJoinReq);
             psessionEntry->pLimMlmJoinReq = NULL;
         }
 
@@ -880,8 +894,8 @@
     /* notify TL that association is failed so that TL can flush the cached frame  */
     WLANTL_AssocFailed (psessionEntry->staId);
 
-    palFreeMemory(pMac->hHdd, pBeaconStruct);
-    palFreeMemory(pMac->hHdd, pAssocRsp);      
+    vos_mem_free(pBeaconStruct);
+    vos_mem_free(pAssocRsp);
     return;
 } /*** end limProcessAssocRspFrame() ***/
 
diff --git a/CORE/MAC/src/pe/lim/limProcessAuthFrame.c b/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
index 2ee8d07..c519400 100644
--- a/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limProcessAuthFrame.cc contains the code
  * for processing received Authentication Frame.
@@ -188,9 +187,8 @@
     }
 
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
-              FL("Auth Frame Received: BSSID %02x:%02x:%02x:%02x:%02x:%02x (Rssi %d)"),
-              pHdr->bssId[0], pHdr->bssId[1], pHdr->bssId[2],
-              pHdr->bssId[3], pHdr->bssId[4], pHdr->bssId[5],
+              FL("Auth Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"),
+              MAC_ADDR_ARRAY(pHdr->bssId),
               (uint)abs((tANI_S8)WDA_GET_RX_RSSI_DB(pRxPacketInfo)));
 
     pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
@@ -433,7 +431,7 @@
                 {   
                     tpSirKeys pKey;
                     pKey =  &psessionEntry->WEPKeyMaterial[keyId].key[0];              
-                    palCopyMemory( pMac->hHdd, defaultKey, pKey->key, pKey->keyLength);
+                    vos_mem_copy(defaultKey, pKey->key, pKey->keyLength);
                     val = pKey->keyLength;
                 }                   
                 else                              
@@ -558,27 +556,30 @@
                 tLimMlmDeauthReq        *pMlmDeauthReq = NULL;
                 pMlmDisassocReq = pMac->lim.limDisassocDeauthCnfReq.pMlmDisassocReq;
                 if (pMlmDisassocReq &&
-                        (palEqualMemory( pMac->hHdd,(tANI_U8 *) pHdr->sa,
+                        (vos_mem_compare((tANI_U8 *) pHdr->sa,
                                          (tANI_U8 *) &pMlmDisassocReq->peerMacAddr,
-                                         sizeof(tSirMacAddr))))
+                                          sizeof(tSirMacAddr))))
                 {
-                    PELOGE(limLog(pMac, LOGP, FL("\nTODO:Ack for disassoc frame is pending"
-                                    "Issue delsta for %02x:%02x:%02x:%02x:%02x:%02x"),
+                    PELOGE(limLog(pMac, LOGE, FL("\nTODO:Ack for disassoc "
+                                "frame is pending Issue delsta for"
+                                " %02x:%02x:%02x:%02x:%02x:%02x"),
                                 pMlmDisassocReq->peerMacAddr[0],
                                 pMlmDisassocReq->peerMacAddr[1],
                                 pMlmDisassocReq->peerMacAddr[2],
                                 pMlmDisassocReq->peerMacAddr[3],
                                 pMlmDisassocReq->peerMacAddr[4],
                                 pMlmDisassocReq->peerMacAddr[5]);)
+                    limProcessDisassocAckTimeout(pMac);
                 }
                 pMlmDeauthReq = pMac->lim.limDisassocDeauthCnfReq.pMlmDeauthReq;
                 if (pMlmDeauthReq &&
-                        (palEqualMemory( pMac->hHdd,(tANI_U8 *) pHdr->sa,
+                        (vos_mem_compare((tANI_U8 *) pHdr->sa,
                                          (tANI_U8 *) &pMlmDeauthReq->peerMacAddr,
                                          sizeof(tSirMacAddr))))
                 {
-                    PELOGE(limLog(pMac, LOGP, FL("\nTODO:Ack for disassoc frame is pending"
-                                    "Issue delsta for %02x:%02x:%02x:%02x:%02x:%02x"),
+                    PELOGE(limLog(pMac, LOGE, FL("\nTODO:Ack for deauth frame "
+                                "is pending Issue delsta for "
+                                "%02x:%02x:%02x:%02x:%02x:%02x"),
                                 pMlmDeauthReq->peerMacAddr[0],
                                 pMlmDeauthReq->peerMacAddr[1],
                                 pMlmDeauthReq->peerMacAddr[2],
@@ -586,6 +587,7 @@
                                 pMlmDeauthReq->peerMacAddr[4],
                                 pMlmDeauthReq->peerMacAddr[5]
                                 );)
+                    limProcessDeauthAckTimeout(pMac);
                 }
             }
 
@@ -627,7 +629,7 @@
 
                         if (pStaDs->valid)
                         {
-                             if (palEqualMemory( pMac->hHdd,(tANI_U8 *) &pStaDs->staAddr,
+                             if (vos_mem_compare((tANI_U8 *) &pStaDs->staAddr,
                                       (tANI_U8 *) &(pHdr->sa), (tANI_U8) (sizeof(tSirMacAddr))) )
                                   break;
                         }
@@ -708,10 +710,9 @@
                         PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %x peer "), pAuthNode);
                         limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
-                        palCopyMemory( pMac->hHdd,
-                                     (tANI_U8 *) pAuthNode->peerMacAddr,
-                                     pHdr->sa,
-                                     sizeof(tSirMacAddr));
+                        vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
+                                      pHdr->sa,
+                                      sizeof(tSirMacAddr));
 
                         pAuthNode->mlmState =
                         eLIM_MLM_AUTHENTICATED_STATE;
@@ -738,8 +739,7 @@
 
                         /// Send Auth indication to SME
 
-                        palCopyMemory( pMac->hHdd,
-                                     (tANI_U8 *) mlmAuthInd.peerMacAddr,
+                        vos_mem_copy((tANI_U8 *) mlmAuthInd.peerMacAddr,
                                      (tANI_U8 *) pHdr->sa,
                                      sizeof(tSirMacAddr));
                         mlmAuthInd.authType = (tAniAuthType)
@@ -814,10 +814,9 @@
                                 return;
                             }
 
-                            palCopyMemory( pMac->hHdd,
-                                         (tANI_U8 *) pAuthNode->peerMacAddr,
-                                         pHdr->sa,
-                                         sizeof(tSirMacAddr));
+                            vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
+                                          pHdr->sa,
+                                          sizeof(tSirMacAddr));
 
                             pAuthNode->mlmState =
                             eLIM_MLM_WT_AUTH_FRAME3_STATE;
@@ -875,10 +874,9 @@
                             
                             pChallenge = pAuthNode->challengeText;
 
-                            palCopyMemory( pMac->hHdd,
-                                           pChallenge,
-                                          (tANI_U8 *) challengeTextArray,
-                                          sizeof(challengeTextArray));
+                            vos_mem_copy(pChallenge,
+                                        (tANI_U8 *) challengeTextArray,
+                                         sizeof(challengeTextArray));
 
                             /**
                              * Sending Authenticaton frame with challenge.
@@ -892,8 +890,7 @@
                             eSIR_MAC_SUCCESS_STATUS;
                             authFrame.type   = SIR_MAC_CHALLENGE_TEXT_EID;
                             authFrame.length = SIR_MAC_AUTH_CHALLENGE_LENGTH;
-                            palCopyMemory( pMac->hHdd,
-                                         authFrame.challengeText,
+                            vos_mem_copy(authFrame.challengeText,
                                          pAuthNode->challengeText,
                                          SIR_MAC_AUTH_CHALLENGE_LENGTH);
 
@@ -981,9 +978,9 @@
                 return;
             }
 
-            if ( !palEqualMemory( pMac->hHdd,(tANI_U8 *) pHdr->sa,
-                          (tANI_U8 *) &pMac->lim.gpLimMlmAuthReq->peerMacAddr,
-                          sizeof(tSirMacAddr)) )
+            if ( !vos_mem_compare((tANI_U8 *) pHdr->sa,
+                                  (tANI_U8 *) &pMac->lim.gpLimMlmAuthReq->peerMacAddr,
+                                  sizeof(tSirMacAddr)) )
             {
                 /**
                  * Received Authentication frame from an entity
@@ -1058,8 +1055,7 @@
                     PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %x peer "), pAuthNode);)
                     PELOG1(limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
-                    palCopyMemory( pMac->hHdd,
-                                 (tANI_U8 *) pAuthNode->peerMacAddr,
+                    vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
                                  pMac->lim.gpLimMlmAuthReq->peerMacAddr,
                                  sizeof(tSirMacAddr));
                     pAuthNode->fTimerStarted = 0;
@@ -1174,7 +1170,7 @@
                                 ((tpSirMacAuthFrameBody) plainBody)->authStatusCode = eSIR_MAC_SUCCESS_STATUS;
                                 ((tpSirMacAuthFrameBody) plainBody)->type   = SIR_MAC_CHALLENGE_TEXT_EID;
                                 ((tpSirMacAuthFrameBody) plainBody)->length = SIR_MAC_AUTH_CHALLENGE_LENGTH;
-                                palCopyMemory( pMac->hHdd, (tANI_U8 *) ((tpSirMacAuthFrameBody) plainBody)->challengeText,
+                                vos_mem_copy((tANI_U8 *) ((tpSirMacAuthFrameBody) plainBody)->challengeText,
                                               pRxAuthFrameBody->challengeText,
                                               SIR_MAC_AUTH_CHALLENGE_LENGTH);
 
@@ -1214,7 +1210,7 @@
                             {
                                 tpSirKeys pKey;
                                 pKey =  &psessionEntry->WEPKeyMaterial[keyId].key[0];
-                                palCopyMemory( pMac->hHdd, defaultKey, pKey->key, pKey->keyLength);
+                                vos_mem_copy(defaultKey, pKey->key, pKey->keyLength);
                             }
                             else
                             if (wlan_cfgGetStr(pMac, (tANI_U16) (WNI_CFG_WEP_DEFAULT_KEY_1 + keyId),
@@ -1252,7 +1248,7 @@
                                 ((tpSirMacAuthFrameBody) plainBody)->authStatusCode = eSIR_MAC_SUCCESS_STATUS;
                                 ((tpSirMacAuthFrameBody) plainBody)->type   = SIR_MAC_CHALLENGE_TEXT_EID;
                                 ((tpSirMacAuthFrameBody) plainBody)->length = SIR_MAC_AUTH_CHALLENGE_LENGTH;
-                                palCopyMemory( pMac->hHdd, (tANI_U8 *) ((tpSirMacAuthFrameBody) plainBody)->challengeText,
+                                vos_mem_copy((tANI_U8 *) ((tpSirMacAuthFrameBody) plainBody)->challengeText,
                                               pRxAuthFrameBody->challengeText,
                                               SIR_MAC_AUTH_CHALLENGE_LENGTH);
 
@@ -1433,9 +1429,9 @@
                  * Authentication frame3
                  */
 
-                if (palEqualMemory( pMac->hHdd,pRxAuthFrameBody->challengeText,
-                              pAuthNode->challengeText,
-                              SIR_MAC_AUTH_CHALLENGE_LENGTH))
+                if (vos_mem_compare(pRxAuthFrameBody->challengeText,
+                                    pAuthNode->challengeText,
+                                    SIR_MAC_AUTH_CHALLENGE_LENGTH))
                 {
                     /// Challenge match. STA is autheticated !
 
@@ -1460,10 +1456,9 @@
                                          LIM_NO_WEP_IN_FC,psessionEntry);
 
                     /// Send Auth indication to SME
-                    palCopyMemory( pMac->hHdd,
-                                 (tANI_U8 *) mlmAuthInd.peerMacAddr,
+                    vos_mem_copy((tANI_U8 *) mlmAuthInd.peerMacAddr,
                                  (tANI_U8 *) pHdr->sa,
-                                 sizeof(tSirMacAddr));
+                                  sizeof(tSirMacAddr));
                     mlmAuthInd.authType = (tAniAuthType)
                                           pRxAuthFrameBody->authAlgoNumber;
                     mlmAuthInd.sessionId = psessionEntry->smeSessionId;
@@ -1540,9 +1535,9 @@
                 return;
             }
 
-            if ( !palEqualMemory( pMac->hHdd,(tANI_U8 *) pHdr->sa,
-                          (tANI_U8 *) &pMac->lim.gpLimMlmAuthReq->peerMacAddr,
-                          sizeof(tSirMacAddr)) )
+            if ( !vos_mem_compare((tANI_U8 *) pHdr->sa,
+                                  (tANI_U8 *) &pMac->lim.gpLimMlmAuthReq->peerMacAddr,
+                                  sizeof(tSirMacAddr)) )
             {
                 /**
                  * Received Authentication frame from an entity
@@ -1597,8 +1592,7 @@
                 PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %x peer "), pAuthNode);
                 limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
-                palCopyMemory( pMac->hHdd,
-                             (tANI_U8 *) pAuthNode->peerMacAddr,
+                vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
                              pMac->lim.gpLimMlmAuthReq->peerMacAddr,
                              sizeof(tSirMacAddr));
                 pAuthNode->fTimerStarted = 0;
@@ -1671,9 +1665,8 @@
     frameLen = WDA_GET_RX_PAYLOAD_LEN(pBd);
 
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
-              FL("Auth Frame Received: BSSID %02x:%02x:%02x:%02x:%02x:%02x (Rssi %d)"),
-              pHdr->bssId[0], pHdr->bssId[1], pHdr->bssId[2],
-              pHdr->bssId[3], pHdr->bssId[4], pHdr->bssId[5],
+              FL("Auth Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"),
+              MAC_ADDR_ARRAY(pHdr->bssId),
               (uint)abs((tANI_S8)WDA_GET_RX_RSSI_DB(pBd)));
 
     // Check for the operating channel and see what needs to be done next.
@@ -1704,8 +1697,8 @@
 #endif
 
     // Check that its the same bssId we have for preAuth
-    if (!palEqualMemory( pMac->hHdd, pMac->ft.ftPEContext.pFTPreAuthReq->preAuthbssId,
-        pHdr->bssId, sizeof( tSirMacAddr )))
+    if (!vos_mem_compare(pMac->ft.ftPEContext.pFTPreAuthReq->preAuthbssId,
+                         pHdr->bssId, sizeof( tSirMacAddr )))
     {
         // In this case SME if indeed has triggered a 
         // pre auth it will time out.
diff --git a/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c b/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c
index 6d220d5..251d54c 100644
--- a/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limProcessBeaconFrame.cc contains the code
  * for processing Received Beacon Frame.
@@ -108,10 +107,10 @@
         || pMac->fScanOffload
         )
     {
-        if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                    (void **)&pBeacon, sizeof(tSchBeaconStruct)))
+        pBeacon = vos_mem_malloc(sizeof(tSchBeaconStruct));
+        if ( NULL == pBeacon )
         {
-            limLog(pMac, LOGE, FL("Unable to PAL allocate memory in limProcessBeaconFrame") );
+            limLog(pMac, LOGE, FL("Unable to allocate memory in limProcessBeaconFrame") );
             return;
         }
 
@@ -125,7 +124,7 @@
                    FL("Received invalid Beacon in state %X"),
                    psessionEntry->limMlmState);
             limPrintMlmState(pMac, LOGW,  psessionEntry->limMlmState);
-            palFreeMemory(pMac->hHdd, pBeacon);
+            vos_mem_free(pBeacon);
             return;
         }
 
@@ -134,7 +133,8 @@
         if ((!psessionEntry->lastBeaconDtimPeriod) &&
             (sirCompareMacAddr( psessionEntry->bssId, pBeacon->bssid)))
         {
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&psessionEntry->lastBeaconTimeStamp, ( tANI_U8* )pBeacon->timeStamp, sizeof(tANI_U64) );
+            vos_mem_copy(( tANI_U8* )&psessionEntry->lastBeaconTimeStamp,
+                         ( tANI_U8* )pBeacon->timeStamp, sizeof(tANI_U64) );
             psessionEntry->lastBeaconDtimCount = pBeacon->tim.dtimCount;
             psessionEntry->lastBeaconDtimPeriod= pBeacon->tim.dtimPeriod;
             psessionEntry->currentBssBeaconCnt++;
@@ -153,14 +153,14 @@
         if ((pMac->lim.gLimMlmState  == eLIM_MLM_WT_PROBE_RESP_STATE) ||
             (pMac->lim.gLimMlmState  == eLIM_MLM_PASSIVE_SCAN_STATE))
         {
-            //If we are scanning for P2P, only accept probe rsp
-            if((pMac->lim.gLimHalScanState != eLIM_HAL_SCANNING_STATE) || (NULL == pMac->lim.gpLimMlmScanReq) 
-               || !pMac->lim.gpLimMlmScanReq->p2pSearch )
-            {
-                limCheckAndAddBssDescription(pMac, pBeacon, pRxPacketInfo, 
-                       ((pMac->lim.gLimHalScanState == eLIM_HAL_SCANNING_STATE) ? eANI_BOOLEAN_TRUE : eANI_BOOLEAN_FALSE), 
-                       eANI_BOOLEAN_FALSE);
-            }
+            limCheckAndAddBssDescription(pMac, pBeacon, pRxPacketInfo,
+                  ((pMac->lim.gLimHalScanState == eLIM_HAL_SCANNING_STATE) ?
+                    eANI_BOOLEAN_TRUE : eANI_BOOLEAN_FALSE),
+                    eANI_BOOLEAN_FALSE);
+            /* Calling dfsChannelList which will convert DFS channel
+             * to Active channel for x secs if this channel is DFS channel */
+             limSetDFSChannelList(pMac, pBeacon->channelNumber,
+                                    &pMac->lim.dfschannelList);
         }
         else if (pMac->lim.gLimMlmState == eLIM_MLM_LEARN_STATE)
         {
@@ -169,25 +169,27 @@
         {
             if( psessionEntry->beacon != NULL )
             {
-                palFreeMemory(pMac->hHdd, psessionEntry->beacon);
+                vos_mem_free(psessionEntry->beacon);
                 psessionEntry->beacon = NULL;
              }
              psessionEntry->bcnLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
-             if( (palAllocateMemory(pMac->hHdd, (void**)&psessionEntry->beacon, psessionEntry->bcnLen)) != eHAL_STATUS_SUCCESS)
+             psessionEntry->beacon = vos_mem_malloc(psessionEntry->bcnLen);
+             if ( NULL == psessionEntry->beacon )
              {
                 PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store beacon"));)
               }
               else
               {
                 //Store the Beacon/ProbeRsp. This is sent to csr/hdd in join cnf response. 
-                palCopyMemory(pMac->hHdd, psessionEntry->beacon, WDA_GET_RX_MPDU_DATA(pRxPacketInfo), psessionEntry->bcnLen);
+                vos_mem_copy(psessionEntry->beacon, WDA_GET_RX_MPDU_DATA(pRxPacketInfo),
+                             psessionEntry->bcnLen);
 
                }
              
              // STA in WT_JOIN_BEACON_STATE (IBSS)
             limCheckAndAnnounceJoinSuccess(pMac, pBeacon, pHdr,psessionEntry);
         } // if (pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE)
-        palFreeMemory(pMac->hHdd, pBeacon);
+        vos_mem_free(pBeacon);
     } // if ((pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) || ...
     else
     {
@@ -260,10 +262,10 @@
         (pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE) ||
         (pMac->lim.gLimMlmState == eLIM_MLM_LEARN_STATE))
     {
-        if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                    (void **)&pBeacon, sizeof(tSchBeaconStruct)))
+        pBeacon = vos_mem_malloc(sizeof(tSchBeaconStruct));
+        if ( NULL == pBeacon )
         {
-            limLog(pMac, LOGE, FL("Unable to PAL allocate memory in limProcessBeaconFrameNoSession") );
+            limLog(pMac, LOGE, FL("Unable to allocate memory in limProcessBeaconFrameNoSession") );
             return;
         }
 
@@ -272,24 +274,24 @@
             // Received wrongly formatted/invalid Beacon. Ignore and move on. 
             limLog(pMac, LOGW, FL("Received invalid Beacon in global MLM state %X"), pMac->lim.gLimMlmState);
             limPrintMlmState(pMac, LOGW,  pMac->lim.gLimMlmState);
-            palFreeMemory(pMac->hHdd, pBeacon);
+            vos_mem_free(pBeacon);
             return;
         }
 
         if ( (pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) ||
              (pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE) )
         {
-            //If we are scanning for P2P, only accept probe rsp
-            if((pMac->lim.gLimHalScanState != eLIM_HAL_SCANNING_STATE) || (NULL == pMac->lim.gpLimMlmScanReq) 
-               || !pMac->lim.gpLimMlmScanReq->p2pSearch )
-            {
-                limCheckAndAddBssDescription(pMac, pBeacon, pRxPacketInfo, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_FALSE);
-            }
+            limCheckAndAddBssDescription(pMac, pBeacon, pRxPacketInfo,
+                                         eANI_BOOLEAN_TRUE, eANI_BOOLEAN_FALSE);
+            /* Calling dfsChannelList which will convert DFS channel
+             * to Active channel for x secs if this channel is DFS channel */
+            limSetDFSChannelList(pMac, pBeacon->channelNumber,
+                                    &pMac->lim.dfschannelList);
         }
         else if (pMac->lim.gLimMlmState == eLIM_MLM_LEARN_STATE)
         {
         }  // end of eLIM_MLM_LEARN_STATE)       
-        palFreeMemory(pMac->hHdd, pBeacon);
+        vos_mem_free(pBeacon);
     } // end of (eLIM_MLM_WT_PROBE_RESP_STATE) || (eLIM_MLM_PASSIVE_SCAN_STATE)
     else
     {
diff --git a/CORE/MAC/src/pe/lim/limProcessCfgUpdates.c b/CORE/MAC/src/pe/lim/limProcessCfgUpdates.c
index 4d2869d..e1e3b5c 100644
--- a/CORE/MAC/src/pe/lim/limProcessCfgUpdates.c
+++ b/CORE/MAC/src/pe/lim/limProcessCfgUpdates.c
@@ -140,7 +140,7 @@
 
     if(( pesessionEntry != NULL ) && (pesessionEntry->limSystemRole == eLIM_AP_ROLE )){
         if (pesessionEntry->gLimProtectionControl == WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE )
-            palZeroMemory( pMac->hHdd, (void *)&pesessionEntry->cfgProtection , sizeof(tCfgProtection));
+            vos_mem_set((void *)&pesessionEntry->cfgProtection, sizeof(tCfgProtection), 0);
         else{
             limLog(pMac, LOG1, FL(" frm11a = %d, from11b = %d, frm11g = %d, "
                                     "ht20 = %d, nongf = %d, lsigTxop = %d, "
@@ -170,8 +170,8 @@
         return;
     }
 
-    if(pMac->lim.gLimProtectionControl == WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
-        palZeroMemory( pMac->hHdd, (void *)&pMac->lim.cfgProtection , sizeof(tCfgProtection));
+    if (pMac->lim.gLimProtectionControl == WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
+        vos_mem_set((void *)&pMac->lim.cfgProtection, sizeof(tCfgProtection), 0);
     else
         {
             pMac->lim.cfgProtection.fromlla = (val >> WNI_CFG_PROTECTION_ENABLED_FROM_llA) & 1;
@@ -367,7 +367,7 @@
         status = limPostMsgApi(pMac, &msg);
 
         if (status != TX_SUCCESS)
-            PELOGE(limLog(pMac, LOGE, FL("Failed limPostMsgApi"), status);)
+            PELOGE(limLog(pMac, LOGE, FL("Failed limPostMsgApi %u"), status);)
         break;
     }
     case WNI_CFG_GREENFIELD_CAPABILITY:
@@ -547,8 +547,8 @@
             tpSirPowerSaveCfg pPowerSaveConfig;
 
             /* Allocate and fill in power save configuration. */
-            if (palAllocateMemory(pMac->hHdd, (void **)&pPowerSaveConfig,
-                                  sizeof(tSirPowerSaveCfg)) != eHAL_STATUS_SUCCESS)
+            pPowerSaveConfig = vos_mem_malloc(sizeof(tSirPowerSaveCfg));
+            if ( NULL == pPowerSaveConfig )
             {
                 PELOGE(limLog(pMac, LOGE, FL("LIM: Cannot allocate memory for power save configuration"));)
                 break;
@@ -557,7 +557,7 @@
             /* This context should be valid if power-save configuration message has been already dispathed 
              * during initialization process. Re-using the present configuration mask
              */
-            palCopyMemory(pMac->hHdd, pPowerSaveConfig, (tANI_U8 *)&pMac->pmm.gPmmCfg, sizeof(tSirPowerSaveCfg));
+            vos_mem_copy(pPowerSaveConfig, (tANI_U8 *)&pMac->pmm.gPmmCfg, sizeof(tSirPowerSaveCfg));
 
             if ( (pmmSendPowerSaveCfg(pMac, pPowerSaveConfig)) != eSIR_SUCCESS)
             {
@@ -601,6 +601,28 @@
         pMac->lim.gLimAssocStaLimit = (tANI_U16)val1;
         break;
 
+    case WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC:
+        if (wlan_cfgGetInt
+           (pMac, WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC, &val1) !=
+                 eSIR_SUCCESS)
+        {
+            limLog(pMac, LOGE,
+                 FL( "Unable to get WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC"));
+            break;
+        }
+        if (val1)
+        {
+            limLog(pMac, LOGW,
+                FL("BTC requested to disable all RX BA sessions"));
+            limDelPerBssBASessionsBtc(pMac);
+        }
+        else
+        {
+            limLog(pMac, LOGW,
+                FL("Resetting the WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC"));
+        }
+        break;
+
     default:
             break;
     }
diff --git a/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c b/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c
index 09e0ee0..2cbdfb0 100644
--- a/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limProcessDeauthFrame.cc contains the code
  * for processing Deauthentication Frame.
@@ -92,8 +91,19 @@
 
     if ((eLIM_STA_ROLE == psessionEntry->limSystemRole) && (eLIM_SME_WT_DEAUTH_STATE == psessionEntry->limSmeState))
     {
-       MTRACE(macTrace(pMac, TRACE_CODE_INFO_LOG, 0, eLOG_PROC_DEAUTH_FRAME_SCENARIO));
-       return;
+        /*Every 15th deauth frame will be logged in kmsg*/
+        if(!(pMac->lim.deauthMsgCnt & 0xF))
+        {
+            PELOGE(limLog(pMac, LOGE,
+             FL("received Deauth frame in DEAUTH_WT_STATE"
+                "(already processing previously received DEAUTH frame).."
+                "Dropping this.. Deauth Failed %d \n "),++pMac->lim.deauthMsgCnt);)
+        }
+        else
+        {
+            pMac->lim.deauthMsgCnt++;
+        }
+        return;
     }
 
     if (limIsGroupAddr(pHdr->sa))
@@ -143,7 +153,7 @@
       
     if (limCheckDisassocDeauthAckPending(pMac, (tANI_U8*)pHdr->sa))
     {
-        PELOGW(limLog(pMac, LOGE, 
+        PELOGW(limLog(pMac, LOGW,
                     FL("Ignore the Deauth received, while waiting for ack of disassoc/deauth"));)
         limCleanUpDisassocDeauthReq(pMac,(tANI_U8*)pHdr->sa, 1);
         return;
@@ -197,11 +207,11 @@
     else
     {
         // Received Deauth frame in either IBSS
-        // or un-known role. Log error and ignore it
-        limLog(pMac, LOGE,
+        // or un-known role. Log and ignore it
+        limLog(pMac, LOG1,
            FL("received Deauth frame with reasonCode %d in role %d from "),
            reasonCode, psessionEntry->limSystemRole);
-          limPrintMacAddr(pMac, pHdr->sa, LOGE);
+          limPrintMacAddr(pMac, pHdr->sa, LOG1);
 
         return;
     }
@@ -259,7 +269,7 @@
             PELOGE(limLog(pMac, LOGE, FL("received DeAuth from an AP other than we're trying to join. Ignore. "));)
             if (limSearchPreAuthList(pMac, pHdr->sa))
             {
-                PELOGE(limLog(pMac, LOGE, FL("Preauth entry exist. Deleting... "));)
+                PELOG1(limLog(pMac, LOG1, FL("Preauth entry exist. Deleting... "));)
                 limDeletePreAuthNode(pMac, pHdr->sa);
             }
             return;
@@ -295,10 +305,9 @@
 
                     case eLIM_MLM_AUTHENTICATED_STATE:
                         /// Issue Deauth Indication to SME.
-                        palCopyMemory( pMac->hHdd,
-                               (tANI_U8 *) &mlmDeauthInd.peerMacAddr,
-                               pHdr->sa,
-                               sizeof(tSirMacAddr));
+                        vos_mem_copy((tANI_U8 *) &mlmDeauthInd.peerMacAddr,
+                                     pHdr->sa,
+                                     sizeof(tSirMacAddr));
                         mlmDeauthInd.reasonCode = reasonCode;
 
                         psessionEntry->limMlmState = eLIM_MLM_IDLE_STATE;
@@ -321,7 +330,7 @@
 
                        if (psessionEntry->pLimMlmJoinReq)
                         {
-                            palFreeMemory( pMac->hHdd, psessionEntry->pLimMlmJoinReq);
+                            vos_mem_free(psessionEntry->pLimMlmJoinReq);
                             psessionEntry->pLimMlmJoinReq = NULL;
                         }
 
@@ -347,6 +356,14 @@
                         
                         return;
 
+                    case eLIM_MLM_WT_ADD_STA_RSP_STATE:
+                         psessionEntry->fDeauthReceived = true;
+                         PELOGW(limLog(pMac, LOGW,
+                            FL("Received Deauth frame with Reason Code %d from Peer"),
+                                  reasonCode);
+                         limPrintMacAddr(pMac, pHdr->sa, LOGW);)
+                         return ;
+
                     case eLIM_MLM_IDLE_STATE:
                     case eLIM_MLM_LINK_ESTABLISHED_STATE:
 #ifdef FEATURE_WLAN_TDLS
@@ -435,7 +452,7 @@
     pStaDs->mlmStaContext.cleanupTrigger = eLIM_PEER_ENTITY_DEAUTH;
 
     /// Issue Deauth Indication to SME.
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmDeauthInd.peerMacAddr,
+    vos_mem_copy((tANI_U8 *) &mlmDeauthInd.peerMacAddr,
                   pStaDs->staAddr,
                   sizeof(tSirMacAddr));
     mlmDeauthInd.reasonCode    = (tANI_U8) pStaDs->mlmStaContext.disassocReason;
@@ -458,7 +475,7 @@
             limDeletePreAuthNode(pMac, pHdr->sa);
 
         if (psessionEntry->limAssocResponseData) {
-            palFreeMemory(pMac->hHdd, psessionEntry->limAssocResponseData);
+            vos_mem_free(psessionEntry->limAssocResponseData);
             psessionEntry->limAssocResponseData = NULL;                            
         }
 
@@ -473,7 +490,12 @@
                eSIR_MAC_UNSPEC_FAILURE_STATUS, psessionEntry);
         return;
     }
-
+    /* reset the deauthMsgCnt here since we are able to Process
+     * the deauth frame and sending up the indication as well */
+    if(pMac->lim.deauthMsgCnt != 0)
+    {
+        pMac->lim.deauthMsgCnt = 0;
+    }
     /// Deauthentication from peer MAC entity
     limPostSmeMessage(pMac, LIM_MLM_DEAUTH_IND, (tANI_U32 *) &mlmDeauthInd);
 
diff --git a/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c b/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
index 10dba19..1bb7746 100644
--- a/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limProcessDisassocFrame.cc contains the code
  * for processing Disassocation Frame.
@@ -152,7 +151,7 @@
 
     if (limCheckDisassocDeauthAckPending(pMac, (tANI_U8*)pHdr->sa))
     {
-        PELOGW(limLog(pMac, LOGE, 
+        PELOGW(limLog(pMac, LOGW,
                     FL("Ignore the DisAssoc received, while waiting for ack of disassoc/deauth"));)
         limCleanUpDisassocDeauthReq(pMac,(tANI_U8*)pHdr->sa, 1);
         return;
@@ -236,8 +235,7 @@
                 {
                     limLog(pMac, LOGW,
                         FL("Ignoring disassoc frame due to upcoming "
-                           "channel switch, from"),
-                        reasonCode);
+                           "channel switch, from"));
                     limPrintMacAddr(pMac, pHdr->sa, LOGW);
                     return;
                 }
@@ -256,18 +254,18 @@
     else
     {
         // Received Disassociation frame in either IBSS
-        // or un-known role. Log error and ignore it
-        limLog(pMac, LOGE,
+        // or un-known role. Log and ignore it
+        limLog(pMac, LOG1,
                FL("received Disassoc frame with invalid reasonCode %d in role %d in sme state %d from "),
                reasonCode, psessionEntry->limSystemRole, psessionEntry->limSmeState);
-        limPrintMacAddr(pMac, pHdr->sa, LOGE);
+        limPrintMacAddr(pMac, pHdr->sa, LOG1);
 
         return;
     }
 
     // Disassociation from peer MAC entity
 
-   PELOGE(limLog(pMac, LOGE,
+   PELOG1(limLog(pMac, LOG1,
            FL("Received Disassoc frame from sta with assocId=%d with reasonCode=%d. Peer MAC is "MAC_ADDRESS_STR),
            pStaDs->assocId, reasonCode, MAC_ADDR_ARRAY(pHdr->sa));)
 
@@ -302,9 +300,9 @@
     pStaDs->mlmStaContext.disassocReason = (tSirMacReasonCodes) reasonCode;
 
     // Issue Disassoc Indication to SME.
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmDisassocInd.peerMacAddr,
-                  (tANI_U8 *) pStaDs->staAddr,
-                  sizeof(tSirMacAddr));
+    vos_mem_copy((tANI_U8 *) &mlmDisassocInd.peerMacAddr,
+                 (tANI_U8 *) pStaDs->staAddr,
+                 sizeof(tSirMacAddr));
     mlmDisassocInd.reasonCode =
         (tANI_U8) pStaDs->mlmStaContext.disassocReason;
     mlmDisassocInd.disassocTrigger = eLIM_PEER_ENTITY_DISASSOC;
@@ -322,7 +320,7 @@
         PELOGE(limLog(pMac, LOGE, FL("received Disassoc from AP while waiting for Reassoc Rsp"));)
      
         if (psessionEntry->limAssocResponseData) {
-            palFreeMemory(pMac->hHdd, psessionEntry->limAssocResponseData);
+            vos_mem_free(psessionEntry->limAssocResponseData);
             psessionEntry->limAssocResponseData = NULL;                            
         }
 
diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index fc5d2a0..7df9def 100644
--- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -61,7 +61,7 @@
 #if defined WLAN_FEATURE_VOWIFI
 #include "rrmApi.h"
 #endif
-#if defined FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include "ccxApi.h"
 #endif
 
@@ -73,6 +73,8 @@
 #include "wmmApsd.h"
 #endif
 
+#include "limRMC.h"
+
 #include "vos_types.h"
 #include "vos_packet.h"
 #include "vos_memory.h"
@@ -444,7 +446,7 @@
             {   
                 if (pLimMgmtRegistration->matchLen <= framelen)
                 {
-                    if (palEqualMemory(pMac, pLimMgmtRegistration->matchData,
+                    if (vos_mem_compare(pLimMgmtRegistration->matchData,
                                        pBody, pLimMgmtRegistration->matchLen))
                     {
                          /* found match! */
@@ -533,9 +535,14 @@
     fcOffset = (v_U8_t)WDA_GET_RX_MPDU_HEADER_OFFSET(pRxPacketInfo);
     fc = pHdr->fc;
 
-    limLog( pMac, LOG4, FL("ProtVersion %d, Type %d, Subtype %d rateIndex=%d"),
-            fc.protVer, fc.type, fc.subType, WDA_GET_RX_MAC_RATE_IDX(pRxPacketInfo));
-   
+#ifdef WLAN_DUMP_MGMTFRAMES
+    limLog( pMac, LOGE, FL("ProtVersion %d, Type %d, Subtype %d rateIndex=%d"),
+            fc.protVer, fc.type, fc.subType,
+            WDA_GET_RX_MAC_RATE_IDX(pRxPacketInfo));
+    VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, pHdr,
+                       WDA_GET_RX_MPDU_HEADER_LEN(pRxPacketInfo));
+#endif
+
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
     if ( WDA_GET_ROAMCANDIDATEIND(pRxPacketInfo))
     {
@@ -564,7 +571,7 @@
         goto end;
     }
 #endif //WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
     if (fc.type == SIR_MAC_DATA_FRAME && isFrmFt) 
     {
 #if 0 // CCX TBD Need to PORT
@@ -591,8 +598,6 @@
 #else
         printk("%s: Need to port handling of IAPP frames to PRIMA for CCX", __func__);
 #endif
-
-
     } else
 #endif
     /* Added For BT-AMP Support */
@@ -807,7 +812,7 @@
                 }
             }     
 #endif
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
              /* We accept data frame (IAPP frame) only if Session is
               * present and ccx connection is established on that
               * session
@@ -850,9 +855,8 @@
     tSirRetStatus rc = eSIR_SUCCESS;
     tAbortScanParams *pAbortScanParams;
 
-    if (eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,
-                                                 (void**) &pAbortScanParams,
-                                                 sizeof(tAbortScanParams)))
+    pAbortScanParams = vos_mem_malloc(sizeof(tAbortScanParams));
+    if (NULL == pAbortScanParams)
     {
         limLog(pMac, LOGP, FL("Memory allocation failed for AbortScanParams"));
         return eHAL_STATUS_FAILURE;
@@ -866,9 +870,8 @@
     rc = wdaPostCtrlMsg(pMac, &msg);
     if (rc != eSIR_SUCCESS)
     {
-        limLog(pMac, LOGE, FL("wdaPostCtrlMsg() return failure"),
-               pMac);
-        palFreeMemory(pMac->hHdd, (tANI_U8 *)pAbortScanParams);
+        limLog(pMac, LOGE, FL("wdaPostCtrlMsg() return failure"));
+        vos_mem_free(pAbortScanParams);
         return eHAL_STATUS_FAILURE;
     }
 
@@ -987,7 +990,7 @@
 
     if(NULL != pMac->lim.gpLimMlmOemDataReq)
     {
-        palFreeMemory(pMac->hHdd, pMac->lim.gpLimMlmOemDataReq);
+        vos_mem_free(pMac->lim.gpLimMlmOemDataReq);
         pMac->lim.gpLimMlmOemDataReq = NULL;
     }
 
@@ -1004,7 +1007,6 @@
 {
     tpLimMlmOemDataRsp mlmOemDataRsp = NULL;
 #ifndef QCA_WIFI_2_0
-    eHalStatus status = eHAL_STATUS_SUCCESS;
     tpStartOemDataRsp oemDataRsp = NULL;
 #endif
 
@@ -1014,8 +1016,8 @@
 #ifndef QCA_WIFI_2_0
     oemDataRsp = (tpStartOemDataRsp)(body);
 
-    status = palAllocateMemory(pMac->hHdd, (void**)(&mlmOemDataRsp), sizeof(tLimMlmOemDataRsp));
-    if(status != eHAL_STATUS_SUCCESS)
+    mlmOemDataRsp = vos_mem_malloc(sizeof(tLimMlmOemDataRsp));
+    if ( NULL == mlmOemDataRsp )
     {
         limLog(pMac, LOGP, FL("could not allocate memory for mlmOemDataRsp"));
         return;
@@ -1023,10 +1025,11 @@
 
     //copy the memory into tLimMlmOemDataRsp and free the tStartOemDataRsp
     //the structures tStartOemDataRsp and tLimMlmOemDataRsp have the same structure
-    palCopyMemory(pMac->hHdd, (void*)(mlmOemDataRsp), (void*)(oemDataRsp), sizeof(tLimMlmOemDataRsp));
+    vos_mem_copy((void*)(mlmOemDataRsp), (void*)(oemDataRsp),
+                  sizeof(tLimMlmOemDataRsp));
 
     //Now free the incoming memory
-    palFreeMemory(pMac->hHdd, (void*)(oemDataRsp));
+    vos_mem_free(oemDataRsp);
 
     limResumeLink(pMac, limOemDataRspHandleResumeLinkRsp, (tANI_U32*)mlmOemDataRsp);
 #else
@@ -1079,7 +1082,7 @@
 #endif
     if(pMac->gDriverType == eDRIVER_TYPE_MFG)
     {
-        palFreeMemory(pMac->hHdd, (tANI_U8 *)limMsg->bodyptr);
+        vos_mem_free(limMsg->bodyptr);
         limMsg->bodyptr = NULL;
         return;
     }
@@ -1177,7 +1180,8 @@
                  * and next time when we try to process the msg, we will try to use 'BD' as 
                  * 'Vos Pkt' which will cause a crash
                  */
-                palCopyMemory(pMac, (tANI_U8*)&limMsgNew, (tANI_U8*)limMsg, sizeof(tSirMsgQ));
+                vos_mem_copy((tANI_U8*)&limMsgNew, (tANI_U8*)limMsg,
+                             sizeof(tSirMsgQ));
                 pVosPkt = (vos_pkt_t *)limMsgNew.bodyptr;
                 vos_pkt_get_packet_length(pVosPkt, &pktLen);
 
@@ -1245,6 +1249,7 @@
         case eWNI_SME_TDLS_SEND_MGMT_REQ:
         case eWNI_SME_TDLS_ADD_STA_REQ:
         case eWNI_SME_TDLS_DEL_STA_REQ:
+        case eWNI_SME_TDLS_LINK_ESTABLISH_REQ:
 #endif
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
         case eWNI_SME_TDLS_DISCOVERY_START_REQ:
@@ -1257,7 +1262,7 @@
             break;
 
         case eWNI_SME_SCAN_ABORT_IND:
-        {
+          {
             tSirMbMsg *pMsg = limMsg->bodyptr;
             tANI_U8 sessionId;
             if (pMsg)
@@ -1267,8 +1272,8 @@
                vos_mem_free((v_VOID_t *)limMsg->bodyptr);
                limMsg->bodyptr = NULL;
             }
-         }
-         break;
+          }
+          break;
         case eWNI_SME_START_REQ:
         case eWNI_SME_SYS_READY_IND:
 #ifndef WNI_ASKEY_NON_SUPPORT_FEATURE
@@ -1319,6 +1324,7 @@
         case eWNI_SME_DEL_STA_SELF_REQ:
         case eWNI_SME_REGISTER_MGMT_FRAME_REQ:
         case eWNI_SME_UPDATE_NOA:
+        case eWNI_SME_CLEAR_DFS_CHANNEL_LIST:
         case eWNI_SME_STA_STAT_REQ:
         case eWNI_SME_AGGR_STAT_REQ:
         case eWNI_SME_GLOBAL_STAT_REQ:
@@ -1327,6 +1333,9 @@
 #if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
         case eWNI_SME_GET_ROAM_RSSI_REQ:
 #endif
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+        case eWNI_SME_GET_TSM_STATS_REQ:
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
             // These messages are from HDD
             limProcessNormalHddMsg(pMac, limMsg, false);   //no need to response to hdd
             break;
@@ -1352,25 +1361,36 @@
         case eWNI_PMC_SMPS_STATE_IND :
         {
             if(limMsg->bodyptr){
-            palFreeMemory(pMac->hHdd, (tANI_U8 *)limMsg->bodyptr);
+            vos_mem_free(limMsg->bodyptr);
             limMsg->bodyptr = NULL;
             }
         }
             break;
         case eWNI_SME_SEND_ACTION_FRAME_IND:
             limSendP2PActionFrame(pMac, limMsg);
-            palFreeMemory(pMac->hHdd, (tANI_U8 *)limMsg->bodyptr);
+            vos_mem_free(limMsg->bodyptr);
             limMsg->bodyptr = NULL;
             break;
         case eWNI_SME_ABORT_REMAIN_ON_CHAN_IND:
         {
             tSirMbMsgP2p *pMbMsg = (tSirMbMsgP2p *)limMsg->bodyptr;
             limAbortRemainOnChan(pMac, pMbMsg->sessionId);
-            palFreeMemory(pMac->hHdd, (tANI_U8 *)limMsg->bodyptr);
+            vos_mem_free(limMsg->bodyptr);
             limMsg->bodyptr = NULL;
             break;
         }
 
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+        case eWNI_SME_ENABLE_RMC_REQ:
+        case eWNI_SME_DISABLE_RMC_REQ:
+            /*
+             * These messages are from HDD
+             * No need to response to hdd
+             */
+            limProcessSmeReqMessages(pMac,limMsg);
+            break;
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
         case SIR_HAL_P2P_NOA_START_IND:
         {
             tpPESession psessionEntry = &pMac->lim.gpSession[0];
@@ -1389,7 +1409,8 @@
                     (psessionEntry->pePersona == VOS_P2P_GO_MODE))
                 { //Save P2P NOA start attributes for P2P Go persona
                     p2pGOExists = 1;
-                    palCopyMemory(pMac->hHdd, &psessionEntry->p2pGoPsNoaStartInd, limMsg->bodyptr, sizeof(tSirP2PNoaStart));
+                    vos_mem_copy(&psessionEntry->p2pGoPsNoaStartInd, limMsg->bodyptr,
+                                 sizeof(tSirP2PNoaStart));
                     if (psessionEntry->p2pGoPsNoaStartInd.status != eHAL_STATUS_SUCCESS)
                     {
                         limLog(pMac, LOGW, FL("GO NOA start failure status %d reported by FW."
@@ -1408,11 +1429,45 @@
 
             /* We received the NOA start indication. Now we can send down the SME request which requires off-channel operation */
             limProcessRegdDefdSmeReqAfterNOAStart(pMac);
-            palFreeMemory(pMac->hHdd, (tANI_U8 *)limMsg->bodyptr);
+            vos_mem_free(limMsg->bodyptr);
             limMsg->bodyptr = NULL;
          }
             break;
+#ifdef FEATURE_WLAN_TDLS
+        case SIR_HAL_TDLS_IND:
+        {
+            tSirTdlsInd  *pTdlsInd = (tpSirTdlsInd)limMsg->bodyptr ;
+            tpDphHashNode pStaDs = NULL ;
+            tpPESession psessionEntry = NULL;
+            tANI_U8             sessionId;
+            if((psessionEntry = peFindSessionByStaId(pMac,pTdlsInd->staIdx,&sessionId))== NULL)
+            {
+               limLog(pMac, LOG1, FL("session does not exist for given bssId\n"));
+               vos_mem_free(limMsg->bodyptr);
+               limMsg->bodyptr = NULL;
+               return;
+            }
+            if ((pStaDs = dphGetHashEntry(pMac, pTdlsInd->assocId, &psessionEntry->dph.dphHashTable)) == NULL)
+            {
+               limLog(pMac, LOG1, FL("pStaDs Does not exist for given staId\n"));
+               vos_mem_free(limMsg->bodyptr);
+               limMsg->bodyptr = NULL;
+               return;
+            }
 
+            if ((STA_ENTRY_TDLS_PEER == pStaDs->staType))
+            {
+                limLog(pMac, LOGE,
+                       FL("received TDLS Indication from the Firmware with Reason Code %d "),
+                       pTdlsInd->reasonCode);
+                limSendSmeTDLSDelStaInd(pMac, pStaDs, psessionEntry,
+                                        pTdlsInd->reasonCode);
+            }
+            vos_mem_free(limMsg->bodyptr);
+            limMsg->bodyptr = NULL;
+         }
+         break;
+#endif
         case SIR_HAL_P2P_NOA_ATTR_IND:
             {
                 tpPESession psessionEntry = &pMac->lim.gpSession[0];  
@@ -1426,9 +1481,9 @@
                         (psessionEntry->pePersona == VOS_P2P_GO_MODE))
                     { //Save P2P attributes for P2P Go persona
                     
-                        palCopyMemory(pMac->hHdd,&psessionEntry->p2pGoPsUpdate, limMsg->bodyptr,sizeof(tSirP2PNoaAttr));
-                        
-                        
+                        vos_mem_copy(&psessionEntry->p2pGoPsUpdate, limMsg->bodyptr,
+                                     sizeof(tSirP2PNoaAttr));
+
                         limLog(pMac, LOG2, FL(" &psessionEntry->bssId%02x:%02x:%02x:%02x:%02x:%02x ctWin=%d oppPsFlag=%d"),
                                      psessionEntry->bssId[0],
                                      psessionEntry->bssId[1],
@@ -1451,7 +1506,7 @@
                 }
                 
             }
-            palFreeMemory(pMac->hHdd, (tANI_U8 *)limMsg->bodyptr);
+            vos_mem_free(limMsg->bodyptr);
             limMsg->bodyptr = NULL;
             
             break;
@@ -1467,7 +1522,7 @@
             {  
                 limProcessChannelSwitchTimeout(pMac);
             }
-            palFreeMemory(pMac->hHdd, (tANI_U8 *)limMsg->bodyptr);
+            vos_mem_free(limMsg->bodyptr);
             limMsg->bodyptr = NULL;
             break;
 
@@ -1497,12 +1552,12 @@
             else
                 limHandleMissedBeaconInd(pMac, limMsg);
 
-            palFreeMemory(pMac->hHdd, (tANI_U8 *)limMsg->bodyptr);
+            vos_mem_free(limMsg->bodyptr);
             limMsg->bodyptr = NULL;
             break;
         case WDA_MIC_FAILURE_IND:
            limMicFailureInd(pMac, limMsg);
-           palFreeMemory(pMac->hHdd, (tANI_U8 *)limMsg->bodyptr);
+           vos_mem_free(limMsg->bodyptr);
            limMsg->bodyptr = NULL;
            break;
     
@@ -1513,10 +1568,16 @@
             break;
 #ifdef FEATURE_WLAN_CCX
         case SIR_LIM_CCX_TSM_TIMEOUT:
+#ifndef FEATURE_WLAN_CCX_UPLOAD
             limProcessTsmTimeoutHandler(pMac,limMsg);
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
             break;
         case WDA_TSM_STATS_RSP:
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+            limSendSmePECcxTsmRsp(pMac, (tAniGetTsmStatsRsp *)limMsg->bodyptr);
+#else
             limProcessHalCcxTsmRsp(pMac, limMsg);
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
             break;
 #endif
         case WDA_ADD_TS_RSP:
@@ -1530,7 +1591,7 @@
             limProcessAddBaInd(pMac, limMsg);
             break;
         case SIR_LIM_DEL_BA_ALL_IND:
-            limDelAllBASessions(pMac);  // refer notes and change
+            limDelAllBASessions(pMac);
             break;
         case SIR_LIM_DEL_BA_IND:
             limProcessMlmHalBADeleteInd( pMac, limMsg );
@@ -1564,6 +1625,7 @@
         case SIR_LIM_INSERT_SINGLESHOT_NOA_TIMEOUT:
         case SIR_LIM_DISASSOC_ACK_TIMEOUT:
         case SIR_LIM_DEAUTH_ACK_TIMEOUT:
+        case SIR_LIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE:
             // These timeout messages are handled by MLM sub module
 
             limProcessMlmReqMessages(pMac,
@@ -1958,11 +2020,76 @@
 #endif
         }
         break;
+#ifdef FEATURE_WLAN_TDLS
+        case WDA_SET_TDLS_LINK_ESTABLISH_REQ_RSP:
+        {
+            tpPESession     psessionEntry;
+            tANI_U8         sessionId;
+            tTdlsLinkEstablishParams *pTdlsLinkEstablishParams;
+            pTdlsLinkEstablishParams = (tTdlsLinkEstablishParams*) limMsg->bodyptr;
+
+            if((psessionEntry = peFindSessionByStaId(pMac,
+                                                     pTdlsLinkEstablishParams->staIdx,
+                                                     &sessionId))== NULL)
+            {
+                limLog(pMac, LOGE, FL("session %u  does not exist.\n"), sessionId);
+                /* Still send the eWNI_SME_TDLS_LINK_ESTABLISH_RSP message to SME
+                   with session id as zero and status as FAILURE so, that message
+                   queued in SME queue can be freed to prevent the SME cmd buffer leak */
+                limSendSmeTdlsLinkEstablishReqRsp(pMac,
+                                                  0,
+                                                  NULL,
+                                                  NULL,
+                                                  eSIR_FAILURE);
+            }
+            else
+            {
+                limSendSmeTdlsLinkEstablishReqRsp(pMac,
+                                                  psessionEntry->smeSessionId,
+                                                  NULL,
+                                                  NULL,
+                                                  pTdlsLinkEstablishParams->status) ;
+            }
+            vos_mem_free((v_VOID_t *)(limMsg->bodyptr));
+            limMsg->bodyptr = NULL;
+            break;
+        }
+#endif
 
     case WDA_RX_SCAN_EVENT:
         limProcessRxScanEvent(pMac, limMsg->bodyptr);
         break;
 
+    case WDA_IBSS_PEER_INACTIVITY_IND:
+    {
+       limProcessIbssPeerInactivity(pMac, limMsg->bodyptr);
+       vos_mem_free((v_VOID_t *)(limMsg->bodyptr));
+       limMsg->bodyptr = NULL;
+       break;
+    }
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+    case WDA_RMC_BECOME_LEADER:
+        limProcessRMCMessages(pMac, eLIM_RMC_BECOME_LEADER_RESP,
+                          (void *)limMsg->bodyptr);
+        vos_mem_free((v_VOID_t*)limMsg->bodyptr);
+        limMsg->bodyptr = NULL;
+        break ;
+
+    case WDA_RMC_LEADER_SELECT_RESP:
+        limProcessRMCMessages(pMac, eLIM_RMC_LEADER_SELECT_RESP,
+                          (void *)limMsg->bodyptr);
+        vos_mem_free((v_VOID_t*)limMsg->bodyptr);
+        limMsg->bodyptr = NULL;
+        break ;
+
+    case WDA_RMC_UPDATE_IND:
+        limProcessRMCMessages(pMac, eLIM_RMC_LEADER_PICK_NEW,
+                          (void *)limMsg->bodyptr);
+        vos_mem_free((v_VOID_t*)limMsg->bodyptr);
+        limMsg->bodyptr = NULL;
+        break ;
+#endif /* defined WLAN_FEATURE_RELIABLE_MCAST */
+
     default:
         vos_mem_free((v_VOID_t*)limMsg->bodyptr);
         limMsg->bodyptr = NULL;
@@ -2020,7 +2147,7 @@
     {
         while ((readMsg = limReadDeferredMsgQ(pMac)) != NULL)
         {
-            palCopyMemory( pMac->hHdd, (tANI_U8*) &limMsg,
+            vos_mem_copy((tANI_U8*) &limMsg,
                     (tANI_U8*) readMsg, sizeof(tSirMsgQ));
             size--; 
             limProcessMessages(pMac, &limMsg);
@@ -2089,7 +2216,7 @@
             limLogSessionStates(pMac);
             limPrintMsgName(pMac, LOGE, pLimMsg->type);
             // Release body
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pLimMsg->bodyptr);
+            vos_mem_free(pLimMsg->bodyptr);
         }
     }
     else
@@ -2109,7 +2236,7 @@
         {
             // Release body
             // limProcessSmeReqMessage consumed the buffer. We can free it.
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pLimMsg->bodyptr);
+            vos_mem_free(pLimMsg->bodyptr);
         }
     }
 }
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index 22b2159..66de9c2 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -57,7 +57,9 @@
 #ifdef WLAN_FEATURE_VOWIFI_11R
 #include <limFT.h>
 #endif
-
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM
+#include "vos_diag_core_log.h"
+#endif
 
 
 // MLM REQ processing function templates
@@ -155,6 +157,8 @@
         case SIR_LIM_REMAIN_CHN_TIMEOUT:    limProcessRemainOnChnTimeout(pMac); break;
         case SIR_LIM_INSERT_SINGLESHOT_NOA_TIMEOUT:   
                                             limProcessInsertSingleShotNOATimeout(pMac); break;
+        case SIR_LIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE:
+                                            limConvertActiveChannelToPassiveChannel(pMac); break;
         case SIR_LIM_DISASSOC_ACK_TIMEOUT:  limProcessDisassocAckTimeout(pMac); break;
         case SIR_LIM_DEAUTH_ACK_TIMEOUT:    limProcessDeauthAckTimeout(pMac); break;
         case LIM_MLM_ADDBA_REQ:             limProcessMlmAddBAReq( pMac, Msg->bodyptr ); break;
@@ -592,6 +596,133 @@
 
 
 
+
+/* limCovertChannelScanType()
+ *
+ *FUNCTION:
+ * This function is called to get the list, change the channel type and set again.
+ *
+ *LOGIC:
+ *
+ *ASSUMPTIONS:
+ * NA
+ *
+ *NOTE: If a channel is ACTIVE, this function will make it as PASSIVE
+ *      If a channel is PASSIVE, this fucntion will make it as ACTIVE
+ * NA
+ *
+ * @param  pMac    - Pointer to Global MAC structure
+ *         channelNum - Channel which need to be convert
+           PassiveToActive - Boolean flag to convert channel
+ *
+ * @return None
+ */
+
+
+void limCovertChannelScanType(tpAniSirGlobal pMac,tANI_U8 channelNum, tANI_BOOLEAN passiveToActive)
+{
+
+    tANI_U32 i;
+    tANI_U8  channelPair[WNI_CFG_SCAN_CONTROL_LIST_LEN];
+    tANI_U32 len = WNI_CFG_SCAN_CONTROL_LIST_LEN;
+    if (wlan_cfgGetStr(pMac, WNI_CFG_SCAN_CONTROL_LIST, channelPair, &len)
+                    != eSIR_SUCCESS)
+    {
+        PELOGE(limLog(pMac, LOGE, FL("Unable to get scan control list"));)
+        return ;
+    }
+    if (len > WNI_CFG_SCAN_CONTROL_LIST_LEN)
+    {
+        limLog(pMac, LOGE, FL("Invalid scan control list length:%d"), len);
+        return ;
+    }
+    for (i=0; (i+1) < len; i+=2)
+    {
+        if (channelPair[i] == channelNum)
+        {
+             if ((eSIR_PASSIVE_SCAN == channelPair[i+1]) && TRUE == passiveToActive)
+             {
+                 PELOG1(limLog(pMac, LOG1, FL("Channel %d changed from Passive to Active"),
+                                 channelNum);)
+                 channelPair[i+1] = eSIR_ACTIVE_SCAN;
+                 break ;
+             }
+             if ((eSIR_ACTIVE_SCAN == channelPair[i+1]) && FALSE == passiveToActive)
+             {
+                 PELOG1(limLog(pMac, LOG1, FL("Channel %d changed from Active to Passive"),
+                                 channelNum);)
+                 channelPair[i+1] = eSIR_PASSIVE_SCAN;
+                 break ;
+             }
+       }
+    }
+
+    cfgSetStrNotify(pMac, WNI_CFG_SCAN_CONTROL_LIST, (tANI_U8 *)channelPair, len, FALSE);
+    return ;
+}
+
+
+
+
+/* limSetDFSChannelList()
+ *
+ *FUNCTION:
+ * This function is called to convert DFS channel list to active channel list when any
+ * beacon is present on that channel. This function store time for passive channels
+ * which help to know that for how much time channel has been passive.
+ *
+ *LOGIC:
+ *
+ *ASSUMPTIONS:
+ * NA
+ *
+ *NOTE: If a channel is ACTIVE, it won't store any time
+ *      If a channel is PAssive, it will store time as timestamp
+ * NA
+ *
+ * @param  pMac    - Pointer to Global MAC structure
+ *         dfsChannelList - DFS channel list.
+ * @return None
+ */
+
+void limSetDFSChannelList(tpAniSirGlobal pMac,tANI_U8 channelNum, tSirDFSChannelList *dfsChannelList)
+{
+
+    tANI_BOOLEAN passiveToActive = TRUE;
+    if ((1 <= channelNum) && (165 >= channelNum))
+    {
+       if (eANI_BOOLEAN_TRUE == limIsconnectedOnDFSChannel(channelNum))
+       {
+          if (dfsChannelList->timeStamp[channelNum] == 0)
+          {
+             //Received first beacon; Convert DFS channel to Active channel.
+             PELOG1(limLog(pMac, LOG1, FL("Received first beacon on DFS channel: %d"), channelNum);)
+             limCovertChannelScanType(pMac,channelNum, passiveToActive);
+          }
+          dfsChannelList->timeStamp[channelNum] = vos_timer_get_system_time();
+       }
+       else
+       {
+          PELOG1(limLog(pMac, LOG1, FL("Channel %d is Active"), channelNum);)
+          return;
+       }
+       if (!tx_timer_running(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer))
+       {
+          tx_timer_activate(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer);
+       }
+    }
+    else
+    {
+       PELOGE(limLog(pMac, LOGE, FL("Invalid Channel: %d"), channelNum);)
+       return;
+    }
+
+    return;
+}
+
+
+
+
 /*
 * Creates a Raw frame to be sent before every Scan, if required.
 * If only infra link is active (mlmState = Link Estb), then send Data Null
@@ -694,21 +825,21 @@
     tpInitScanParams        pInitScanParam;
     tSirRetStatus           rc = eSIR_SUCCESS;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pInitScanParam,
-                sizeof(*pInitScanParam)))
+    pInitScanParam = vos_mem_malloc(sizeof(*pInitScanParam));
+    if ( NULL == pInitScanParam )
     {
-        PELOGW(limLog(pMac, LOGW, FL("palAllocateMemory() failed"));)
+        PELOGW(limLog(pMac, LOGW, FL("AllocateMemory() failed"));)
         goto error;
     }
     
     /*Initialize the pInitScanParam with 0*/
-    palZeroMemory( pMac->hHdd, (tANI_U8 *)pInitScanParam, sizeof(*pInitScanParam));
+    vos_mem_set((tANI_U8 *)pInitScanParam, sizeof(*pInitScanParam), 0);
 
     msg.type = WDA_INIT_SCAN_REQ;
     msg.bodyptr = pInitScanParam;
     msg.bodyval = 0;
 
-    palZeroMemory( pMac->hHdd, (tANI_U8 *)&pInitScanParam->macMgmtHdr, sizeof(tSirMacMgmtHdr));
+    vos_mem_set((tANI_U8 *)&pInitScanParam->macMgmtHdr, sizeof(tSirMacMgmtHdr), 0);
     if (nextState == eLIM_HAL_INIT_LEARN_WAIT_STATE)
     {
         pInitScanParam->notifyBss = TRUE;
@@ -774,7 +905,7 @@
     }
 
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-    palFreeMemory(pMac->hHdd, (void *)pInitScanParam);
+    vos_mem_free(pInitScanParam);
     PELOGW(limLog(pMac, LOGW, FL("wdaPostCtrlMsg failed, error code %d"), rc);)
 
 error:
@@ -818,11 +949,10 @@
     if(pMac->lim.gLimHalScanState != eLIM_HAL_START_SCAN_WAIT_STATE) 
     { 
 
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, 
-                    (void **)&pStartScanParam,
-                    sizeof(*pStartScanParam)))
+        pStartScanParam = vos_mem_malloc(sizeof(*pStartScanParam));
+        if ( NULL == pStartScanParam )
         {
-            PELOGW(limLog(pMac, LOGW, FL("palAllocateMemory() failed"));)
+            PELOGW(limLog(pMac, LOGW, FL("AllocateMemory() failed"));)
                 goto error;
         }
 
@@ -844,7 +974,7 @@
         }
 
         SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-        palFreeMemory(pMac->hHdd, (void *)pStartScanParam);
+        vos_mem_free(pStartScanParam);
         PELOGW(limLog(pMac, LOGW, FL("wdaPostCtrlMsg failed, error code %d"), rc);)
 
 error:
@@ -877,16 +1007,20 @@
 
     /**
      * The End scan request to be sent only if End Scan is not already requested or
-     * Start scan is not already requestd
+     * Start scan is not already requestd.
+     * after finish scan rsp from firmware host is sending endscan request so adding
+     * check for IDLE SCAN STATE also added to avoid this issue
      */
     if((pMac->lim.gLimHalScanState != eLIM_HAL_END_SCAN_WAIT_STATE)  &&
-            (pMac->lim.gLimHalScanState != eLIM_HAL_START_SCAN_WAIT_STATE))
-    { 
-
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pEndScanParam,
-                    sizeof(*pEndScanParam)))
+       (pMac->lim.gLimHalScanState != eLIM_HAL_IDLE_SCAN_STATE)  &&
+       (pMac->lim.gLimHalScanState == eLIM_HAL_SCANNING_STATE)  &&
+       (pMac->lim.gLimHalScanState != eLIM_HAL_FINISH_SCAN_WAIT_STATE)  &&
+       (pMac->lim.gLimHalScanState != eLIM_HAL_START_SCAN_WAIT_STATE))
+    {
+        pEndScanParam = vos_mem_malloc(sizeof(*pEndScanParam));
+        if ( NULL == pEndScanParam )
         {
-            PELOGW(limLog(pMac, LOGW, FL("palAllocateMemory() failed"));)
+            PELOGW(limLog(pMac, LOGW, FL("AllocateMemory() failed"));)
                 goto error;
         }
 
@@ -906,7 +1040,7 @@
         }
 
         SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-        palFreeMemory(pMac->hHdd, (void *)pEndScanParam);
+        vos_mem_free(pEndScanParam);
         PELOGW(limLog(pMac, LOGW, FL("wdaPostCtrlMsg failed, error code %d"), rc);)
 
             error:
@@ -971,11 +1105,10 @@
             return;
     }
 
-
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pFinishScanParam,
-                sizeof(*pFinishScanParam)))
+    pFinishScanParam = vos_mem_malloc(sizeof(*pFinishScanParam));
+    if ( NULL == pFinishScanParam )
     {
-        PELOGW(limLog(pMac, LOGW, FL("palAllocateMemory() failed"));)
+        PELOGW(limLog(pMac, LOGW, FL("AllocateMemory() failed"));)
             goto error;
     }
 
@@ -985,7 +1118,7 @@
     
     peGetResumeChannel(pMac, &pFinishScanParam->currentOperChannel, &pFinishScanParam->cbState);
 
-    palZeroMemory( pMac->hHdd, (tANI_U8 *)&pFinishScanParam->macMgmtHdr, sizeof(tSirMacMgmtHdr));
+    vos_mem_set((tANI_U8 *)&pFinishScanParam->macMgmtHdr, sizeof(tSirMacMgmtHdr), 0);
 
     if (nextState == eLIM_HAL_FINISH_LEARN_WAIT_STATE)
     {
@@ -1027,7 +1160,7 @@
         return;
     }
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-    palFreeMemory(pMac->hHdd, (void *)pFinishScanParam);
+    vos_mem_free(pFinishScanParam);
     PELOGW(limLog(pMac, LOGW, FL("wdaPostCtrlMsg failed, error code %d"), rc);)
 
         error:
@@ -1240,18 +1373,23 @@
 
     reqLen = sizeof(tStartOemDataReq);
 
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, (void**)&pStartOemDataReq, reqLen))
+    pStartOemDataReq = vos_mem_malloc(reqLen);
+    if ( NULL == pStartOemDataReq )
     {
         PELOGE(limLog(pMac, LOGE,  FL("OEM_DATA: Could not allocate memory for pStartOemDataReq"));)
         goto error;
     }
 
-    palZeroMemory(pMac->hHdd, (tANI_U8*)(pStartOemDataReq), reqLen);
+    vos_mem_set((tANI_U8*)(pStartOemDataReq), reqLen, 0);
 
     //Now copy over the information to the OEM DATA REQ to HAL
-    palCopyMemory(pMac->hHdd, pStartOemDataReq->selfMacAddr, pMac->lim.gpLimMlmOemDataReq->selfMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy(pStartOemDataReq->selfMacAddr,
+                 pMac->lim.gpLimMlmOemDataReq->selfMacAddr,
+                 sizeof(tSirMacAddr));
 
-    palCopyMemory(pMac->hHdd, pStartOemDataReq->oemDataReq, pMac->lim.gpLimMlmOemDataReq->oemDataReq, OEM_DATA_REQ_SIZE);
+    vos_mem_copy(pStartOemDataReq->oemDataReq,
+                 pMac->lim.gpLimMlmOemDataReq->oemDataReq,
+                 OEM_DATA_REQ_SIZE);
 
     //Create the message to be passed to HAL
     msg.type = WDA_START_OEM_DATA_REQ;
@@ -1268,14 +1406,15 @@
     }
 
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-    palFreeMemory(pMac->hHdd, (void*)pStartOemDataReq);
+    vos_mem_free(pStartOemDataReq);
     PELOGE(limLog(pMac, LOGE,  FL("OEM_DATA: posting WDA_START_OEM_DATA_REQ to HAL failed"));)
 
 error:
     pMac->lim.gLimMlmState = pMac->lim.gLimPrevMlmState;
     MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, NO_SESSION, pMac->lim.gLimMlmState));
 
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, (void**)(&pMlmOemDataRsp), sizeof(tLimMlmOemDataRsp)))
+    pMlmOemDataRsp = vos_mem_malloc(sizeof(tLimMlmOemDataRsp));
+    if ( NULL == pMlmOemDataRsp )
     {
         limLog(pMac->hHdd, LOGP, FL("OEM_DATA: memory allocation for pMlmOemDataRsp failed under suspend link failure"));
         return;
@@ -1283,7 +1422,7 @@
 
     if(NULL != pMac->lim.gpLimMlmOemDataReq)
     {
-        palFreeMemory(pMac->hHdd, pMac->lim.gpLimMlmOemDataReq);
+        vos_mem_free(pMac->lim.gpLimMlmOemDataReq);
         pMac->lim.gpLimMlmOemDataReq = NULL;
     }
 
@@ -1316,19 +1455,20 @@
     pMac->lim.gLimMlmState = pMac->lim.gLimPrevMlmState;
     MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, NO_SESSION, pMac->lim.gLimMlmState));
 
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, (void**)(&pMlmOemDataRsp), sizeof(tLimMlmOemDataRsp)))
+    pMlmOemDataRsp = vos_mem_malloc(sizeof(tLimMlmOemDataRsp));
+    if ( NULL == pMlmOemDataRsp )
     {
         limLog(pMac->hHdd, LOGP, FL("OEM_DATA: memory allocation for pMlmOemDataRsp failed under suspend link failure"));
         return;
     }
 
-    if(NULL != pMac->lim.gpLimMlmOemDataReq)
+    if (NULL != pMac->lim.gpLimMlmOemDataReq)
     {
-        palFreeMemory(pMac->hHdd, pMac->lim.gpLimMlmOemDataReq);
+        vos_mem_free(pMac->lim.gpLimMlmOemDataReq);
         pMac->lim.gpLimMlmOemDataReq = NULL;
     }
 
-    palZeroMemory(pMac->hHdd, pMlmOemDataRsp, sizeof(tLimMlmOemDataRsp));
+    vos_mem_set(pMlmOemDataRsp, sizeof(tLimMlmOemDataRsp), 0);
 
     limPostSmeMessage(pMac, LIM_MLM_OEM_DATA_CNF, (tANI_U32*)pMlmOemDataRsp);
 
@@ -1389,8 +1529,8 @@
     wlan_cfgGetInt(pMac, WNI_CFG_DOT11_MODE, &selfStaDot11Mode);
     pSta->staType = STA_ENTRY_SELF; // Identifying self
 
-    palCopyMemory( pMac->hHdd,  pSta->bssId,   pBssid,  sizeof( tSirMacAddr ));
-    palCopyMemory( pMac->hHdd,  pSta->staMac, psessionEntry->selfMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy(pSta->bssId, pBssid, sizeof( tSirMacAddr ));
+    vos_mem_copy(pSta->staMac, psessionEntry->selfMacAddr, sizeof(tSirMacAddr));
 
     /* Configuration related parameters to be changed to support BT-AMP */
 
@@ -1495,24 +1635,24 @@
 
     // Package WDA_ADD_BSS_REQ message parameters
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                               (void **) &pAddBssParams, sizeof( tAddBssParams )))
+    pAddBssParams = vos_mem_malloc(sizeof( tAddBssParams ));
+    if ( NULL == pAddBssParams )
     {
-        limLog( pMac, LOGE, FL( "Unable to PAL allocate memory during ADD_BSS" ));
+        limLog( pMac, LOGE, FL( "Unable to allocate memory during ADD_BSS" ));
         // Respond to SME with LIM_MLM_START_CNF
         return eSIR_SME_HAL_SEND_MESSAGE_FAIL;
     }
 
-    palZeroMemory(pMac->hHdd, pAddBssParams, sizeof(tAddBssParams));
+    vos_mem_set(pAddBssParams, sizeof(tAddBssParams), 0);
 
     // Fill in tAddBssParams members
-    palCopyMemory( pMac->hHdd,  pAddBssParams->bssId, pMlmStartReq->bssId,
+    vos_mem_copy(pAddBssParams->bssId, pMlmStartReq->bssId,
                    sizeof( tSirMacAddr ));
 
     // Fill in tAddBssParams selfMacAddr
-    palCopyMemory ( pMac->hHdd,  pAddBssParams->selfMacAddr, 
-                    psessionEntry->selfMacAddr,
-                   sizeof( tSirMacAddr ));
+    vos_mem_copy (pAddBssParams->selfMacAddr,
+                  psessionEntry->selfMacAddr,
+                  sizeof( tSirMacAddr ));
     
     pAddBssParams->bssType = pMlmStartReq->bssType;
     if ((pMlmStartReq->bssType == eSIR_IBSS_MODE) || 
@@ -1534,8 +1674,8 @@
     pAddBssParams->cfParamSet.cfpDurRemaining   = pMlmStartReq->cfParamSet.cfpDurRemaining;
 
     pAddBssParams->rateSet.numRates = pMlmStartReq->rateSet.numRates;
-    palCopyMemory( pMac->hHdd,  pAddBssParams->rateSet.rate,
-                   pMlmStartReq->rateSet.rate, pMlmStartReq->rateSet.numRates );
+    vos_mem_copy(pAddBssParams->rateSet.rate,
+                 pMlmStartReq->rateSet.rate, pMlmStartReq->rateSet.numRates);
 
     pAddBssParams->nwType = pMlmStartReq->nwType;
 
@@ -1555,9 +1695,9 @@
     pAddBssParams->sessionId            = pMlmStartReq->sessionId; 
 
     //Send the SSID to HAL to enable SSID matching for IBSS
-    palCopyMemory( pMac->hHdd, &(pAddBssParams->ssId.ssId),
-        pMlmStartReq->ssId.ssId,
-        pMlmStartReq->ssId.length);
+    vos_mem_copy(&(pAddBssParams->ssId.ssId),
+                 pMlmStartReq->ssId.ssId,
+                 pMlmStartReq->ssId.length);
     pAddBssParams->ssId.length = pMlmStartReq->ssId.length;
     pAddBssParams->bHiddenSSIDEn = pMlmStartReq->ssidHidden;
     limLog( pMac, LOGE, FL( "TRYING TO HIDE SSID %d" ),pAddBssParams->bHiddenSSIDEn);
@@ -1586,6 +1726,11 @@
     pAddBssParams->extSetStaKeyParamValid = 0;
 #endif
 
+#ifdef WLAN_FEATURE_11W
+    pAddBssParams->rmfEnabled = (psessionEntry->gStartBssRSNIe.RSN_Cap[0] >> 7) & 0x1;
+    limLog( pMac, LOG1, FL("PMF capable value for BSS is %d"), pAddBssParams->rmfEnabled);
+#endif
+
     //
     // FIXME_GEN4
     // A global counter (dialog token) is required to keep track of
@@ -1601,7 +1746,7 @@
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
         limLog( pMac, LOGE, FL("Posting ADD_BSS_REQ to HAL failed, reason=%X"), retCode );
-        palFreeMemory(pMac->hHdd,(void *)pAddBssParams);
+        vos_mem_free(pAddBssParams);
         return eSIR_SME_HAL_SEND_MESSAGE_FAIL;
     }
 
@@ -1680,7 +1825,7 @@
 
    
     
-    palCopyMemory( pMac->hHdd, pMac->lim.gLimCurrentBssId,
+    vos_mem_copy(  pMac->lim.gLimCurrentBssId,
                    pMlmStartReq->bssId,
                    sizeof(tSirMacAddr));
     #endif //TO SUPPORT BT-AMP
@@ -1741,7 +1886,7 @@
      mlmStartCnf.sessionId = pMlmStartReq->sessionId;
     
     /// Free up buffer allocated for LimMlmScanReq
-    palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf);
+    vos_mem_free(pMsgBuf);
 
     //
     // Respond immediately to LIM, only if MLME has not been
@@ -1828,7 +1973,7 @@
     {
         PELOGE(limLog(pMac, LOGE,
                FL("Sending START_SCAN from LIM while one req is pending"));)
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf);
+        vos_mem_free(pMsgBuf);
         /*Send back a failure*/        
         mlmScanCnf.resultCode = eSIR_SME_SCAN_FAILED;
         mlmScanCnf.scanResultLength = 0;
@@ -1908,7 +2053,7 @@
 
         /// Free up buffer allocated for
         /// pMac->lim.gLimMlmScanReq
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf);
+        vos_mem_free(pMsgBuf);
 
         /// Return Scan confirm with INVALID_PARAMETERS
 
@@ -1959,13 +2104,14 @@
         limPrintMlmState(pMac, LOGW, pMac->lim.gLimMlmState);
 
         /// Free up buffer allocated
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf);
+        vos_mem_free(pMsgBuf);
 
         /// Return Meas confirm with INVALID_PARAMETERS
-        if(eHAL_STATUS_SUCCESS == palAllocateMemory(pMac->hHdd, (void**)&pMlmOemDataRsp, sizeof(tLimMlmOemDataRsp)))
+        pMlmOemDataRsp = vos_mem_malloc(sizeof(tLimMlmOemDataRsp));
+        if ( pMlmOemDataRsp != NULL)
         {
             limPostSmeMessage(pMac, LIM_MLM_OEM_DATA_CNF, (tANI_U32*)pMlmOemDataRsp);
-            palFreeMemory(pMac->hHdd, pMlmOemDataRsp);
+            vos_mem_free(pMlmOemDataRsp);
         }
         else
         {
@@ -2118,7 +2264,7 @@
     {
         #if 0
         if (pMac->lim.gpLimMlmJoinReq)
-            palFreeMemory( pMac->hHdd, pMac->lim.gpLimMlmJoinReq);
+            vos_mem_free(pMac->lim.gpLimMlmJoinReq);
         #endif //TO SUPPORT BT-AMP , review 23sep
 
         /// Hold onto Join request parameters
@@ -2262,7 +2408,7 @@
              (((pStaDs = dphGetHashEntry(pMac, DPH_STA_HASH_INDEX_PEER, &psessionEntry->dph.dphHashTable)) != NULL) &&
               (pMac->lim.gpLimMlmAuthReq->authType ==
                                    pStaDs->mlmStaContext.authType)) &&
-             (palEqualMemory( pMac->hHdd,pMac->lim.gpLimMlmAuthReq->peerMacAddr,
+             (vos_mem_compare(pMac->lim.gpLimMlmAuthReq->peerMacAddr,
                         currentBssId,
                         sizeof(tSirMacAddr)) )) ||
             (((preAuthNode =
@@ -2354,16 +2500,16 @@
     }
 
 end:
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmAuthCnf.peerMacAddr,
-                  (tANI_U8 *) &pMac->lim.gpLimMlmAuthReq->peerMacAddr,
-                  sizeof(tSirMacAddr));
+    vos_mem_copy((tANI_U8 *) &mlmAuthCnf.peerMacAddr,
+                 (tANI_U8 *) &pMac->lim.gpLimMlmAuthReq->peerMacAddr,
+                 sizeof(tSirMacAddr));
 
     mlmAuthCnf.authType = pMac->lim.gpLimMlmAuthReq->authType;
     mlmAuthCnf.sessionId = sessionId;
 
     /// Free up buffer allocated
     /// for pMac->lim.gLimMlmAuthReq
-    palFreeMemory( pMac->hHdd, pMac->lim.gpLimMlmAuthReq);
+    vos_mem_free( pMac->lim.gpLimMlmAuthReq);
     pMac->lim.gpLimMlmAuthReq = NULL;
     limPostSmeMessage(pMac, LIM_MLM_AUTH_CNF, (tANI_U32 *) &mlmAuthCnf);
 } /*** limProcessMlmAuthReq() ***/
@@ -2407,7 +2553,7 @@
     if( (psessionEntry = peFindSessionBySessionId(pMac,pMlmAssocReq->sessionId) )== NULL) 
     {
         limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmAssocReq);
+        vos_mem_free(pMlmAssocReq);
         return;
     }
 
@@ -2423,7 +2569,7 @@
     
     if ( (psessionEntry->limSystemRole != eLIM_AP_ROLE && psessionEntry->limSystemRole != eLIM_BT_AMP_AP_ROLE) &&
          (psessionEntry->limMlmState == eLIM_MLM_AUTHENTICATED_STATE || psessionEntry->limMlmState == eLIM_MLM_JOINED_STATE) &&
-         (palEqualMemory(pMac->hHdd,pMlmAssocReq->peerMacAddr, currentBssId, sizeof(tSirMacAddr))) )
+         (vos_mem_compare(pMlmAssocReq->peerMacAddr, currentBssId, sizeof(tSirMacAddr))) )
     {
 
         /// map the session entry pointer to the AssocFailureTimer 
@@ -2488,7 +2634,7 @@
     mlmAssocCnf.sessionId = pMlmAssocReq->sessionId;
 
     /// Free up buffer allocated for assocReq
-    palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmAssocReq);
+    vos_mem_free(pMlmAssocReq);
 
     limPostSmeMessage(pMac, LIM_MLM_ASSOC_CNF, (tANI_U32 *) &mlmAssocCnf);
 } /*** limProcessMlmAssocReq() ***/
@@ -2533,7 +2679,7 @@
     if((psessionEntry = peFindSessionBySessionId(pMac,pMlmReassocReq->sessionId)) == NULL)
     {
         PELOGE(limLog(pMac, LOGE,FL("Session Does not exist for given sessionId"));)
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmReassocReq);
+        vos_mem_free(pMlmReassocReq);
         return;
     }
     
@@ -2541,7 +2687,7 @@
          (psessionEntry->limMlmState == eLIM_MLM_LINK_ESTABLISHED_STATE))
     {
         if (psessionEntry->pLimMlmReassocReq)
-            palFreeMemory( pMac->hHdd, psessionEntry->pLimMlmReassocReq);
+            vos_mem_free(psessionEntry->pLimMlmReassocReq);
 
         /* Hold Re-Assoc request as part of Session, knock-out pMac */
         /// Hold onto Reassoc request parameters
@@ -2551,7 +2697,7 @@
         pAuthNode = limSearchPreAuthList(pMac, psessionEntry->limReAssocbssId);
 
         if (!pAuthNode &&
-            (!palEqualMemory( pMac->hHdd,pMlmReassocReq->peerMacAddr,
+            (!vos_mem_compare(pMlmReassocReq->peerMacAddr,
                        psessionEntry->bssId,
                        sizeof(tSirMacAddr)) ))
         {
@@ -2638,7 +2784,7 @@
     /* Update PE sessio Id*/
     mlmReassocCnf.sessionId = pMlmReassocReq->sessionId;
     /// Free up buffer allocated for reassocReq
-    palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmReassocReq);
+    vos_mem_free(pMlmReassocReq);
     psessionEntry->pLimReAssocReq = NULL;
 
     limPostSmeMessage(pMac, LIM_MLM_REASSOC_CNF, (tANI_U32 *) &mlmReassocCnf);
@@ -2691,7 +2837,7 @@
     {
         case eLIM_STA_ROLE:
         case eLIM_BT_AMP_STA_ROLE:    
-            if ( !palEqualMemory( pMac->hHdd,pMlmDisassocReq->peerMacAddr,
+            if ( !vos_mem_compare(pMlmDisassocReq->peerMacAddr,
                           currentBssId,
                           sizeof(tSirMacAddr)) )
             {
@@ -2765,10 +2911,27 @@
          */
         pStaDs->mlmStaContext.mlmState   = eLIM_MLM_WT_DEL_STA_RSP_STATE;
 
-        limSendDisassocMgmtFrame(pMac,
+        /* If the reason for disassociation is inactivity of STA, then
+           dont wait for acknowledgement */
+        if ((pMlmDisassocReq->reasonCode == eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON) &&
+            (psessionEntry->limSystemRole == eLIM_AP_ROLE))
+        {
+
+             limSendDisassocMgmtFrame(pMac,
+                                 pMlmDisassocReq->reasonCode,
+                                 pMlmDisassocReq->peerMacAddr,
+                                 psessionEntry, FALSE);
+
+             /* Send Disassoc CNF and receive path cleanup */
+             limSendDisassocCnf(pMac);
+        }
+        else
+        {
+             limSendDisassocMgmtFrame(pMac,
                                  pMlmDisassocReq->reasonCode,
                                  pMlmDisassocReq->peerMacAddr,
                                  psessionEntry, TRUE);
+        }
     }
     else
     {
@@ -2781,15 +2944,15 @@
            goto end;
        }
        // Free up buffer allocated for mlmDisassocReq
-       palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDisassocReq);
+       vos_mem_free(pMlmDisassocReq);
     }
 
     return;
 
 end:
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmDisassocCnf.peerMacAddr,
-                  (tANI_U8 *) pMlmDisassocReq->peerMacAddr,
-                  sizeof(tSirMacAddr));
+    vos_mem_copy((tANI_U8 *) &mlmDisassocCnf.peerMacAddr,
+                 (tANI_U8 *) pMlmDisassocReq->peerMacAddr,
+                 sizeof(tSirMacAddr));
     mlmDisassocCnf.aid = pMlmDisassocReq->aid;
     mlmDisassocCnf.disassocTrigger = pMlmDisassocReq->disassocTrigger;
     
@@ -2797,7 +2960,7 @@
     mlmDisassocCnf.sessionId = pMlmDisassocReq->sessionId;
 
     /// Free up buffer allocated for mlmDisassocReq
-    palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDisassocReq);
+    vos_mem_free(pMlmDisassocReq);
 
     limPostSmeMessage(pMac,
                       LIM_MLM_DISASSOC_CNF,
@@ -2814,22 +2977,22 @@
     pMlmDeauthReq = pMac->lim.limDisassocDeauthCnfReq.pMlmDeauthReq;
     if (
             (pMlmDisassocReq &&
-             (palEqualMemory( pMac->hHdd,(tANI_U8 *) staMac,
+             (vos_mem_compare((tANI_U8 *) staMac,
                               (tANI_U8 *) &pMlmDisassocReq->peerMacAddr,
                               sizeof(tSirMacAddr)))) 
             ||
             (pMlmDeauthReq &&
-             (palEqualMemory( pMac->hHdd,(tANI_U8 *) staMac,
+             (vos_mem_compare((tANI_U8 *) staMac,
                               (tANI_U8 *) &pMlmDeauthReq->peerMacAddr,
-                              sizeof(tSirMacAddr))))
+                               sizeof(tSirMacAddr))))
        )
     {
-        PELOGE(limLog(pMac, LOGE,FL("Disassoc/Deauth ack pending"));)
+        PELOG1(limLog(pMac, LOG1, FL("Disassoc/Deauth ack pending"));)
         return eANI_BOOLEAN_TRUE;
     }
      else
      {
-        PELOGE(limLog(pMac, LOGE,FL("Disassoc/Deauth Ack not pending"));)
+        PELOG1(limLog(pMac, LOG1, FL("Disassoc/Deauth Ack not pending"));)
         return eANI_BOOLEAN_FALSE;
      }
 }
@@ -2842,7 +3005,7 @@
     tLimMlmDeauthReq        *pMlmDeauthReq;
     pMlmDisassocReq = pMac->lim.limDisassocDeauthCnfReq.pMlmDisassocReq;
     if (pMlmDisassocReq &&
-            (palEqualMemory( pMac->hHdd,(tANI_U8 *) staMac,
+            (vos_mem_compare((tANI_U8 *) staMac,
                              (tANI_U8 *) &pMlmDisassocReq->peerMacAddr,
                              sizeof(tSirMacAddr))))
     {
@@ -2856,14 +3019,14 @@
             {
                 limDeactivateAndChangeTimer(pMac, eLIM_DISASSOC_ACK_TIMER);
             }
-            palFreeMemory(pMac->hHdd, (tANI_U8 *) pMlmDisassocReq);
+            vos_mem_free(pMlmDisassocReq);
             pMac->lim.limDisassocDeauthCnfReq.pMlmDisassocReq = NULL;
         }
     }
 
     pMlmDeauthReq = pMac->lim.limDisassocDeauthCnfReq.pMlmDeauthReq;
     if (pMlmDeauthReq &&
-            (palEqualMemory( pMac->hHdd,(tANI_U8 *) staMac,
+            (vos_mem_compare((tANI_U8 *) staMac,
                              (tANI_U8 *) &pMlmDeauthReq->peerMacAddr,
                              sizeof(tSirMacAddr))))
     {
@@ -2877,7 +3040,7 @@
             {
                 limDeactivateAndChangeTimer(pMac, eLIM_DEAUTH_ACK_TIMER);
             }
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDeauthReq);
+            vos_mem_free(pMlmDeauthReq);
             pMac->lim.limDisassocDeauthCnfReq.pMlmDeauthReq = NULL;
         }
     }
@@ -2965,7 +3128,7 @@
     {
     
         PELOGE(limLog(pMac, LOGE, FL("session does not exist for given sessionId"));)
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDeauthReq);
+        vos_mem_free(pMlmDeauthReq);
         return;
     }
     #if 0
@@ -2994,7 +3157,7 @@
                 case eLIM_MLM_AUTHENTICATED_STATE:
                 case eLIM_MLM_WT_ASSOC_RSP_STATE:
                 case eLIM_MLM_LINK_ESTABLISHED_STATE:
-                    if (!palEqualMemory( pMac->hHdd,pMlmDeauthReq->peerMacAddr,
+                    if (!vos_mem_compare(pMlmDeauthReq->peerMacAddr,
                                   currentBssId,
                                   sizeof(tSirMacAddr)) )
                     {
@@ -3059,7 +3222,7 @@
             break;
 
         case eLIM_STA_IN_IBSS_ROLE:
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDeauthReq);
+            vos_mem_free(pMlmDeauthReq);
 
             return;
 
@@ -3144,16 +3307,16 @@
     return;
 
 end:
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmDeauthCnf.peerMacAddr,
-                  (tANI_U8 *) pMlmDeauthReq->peerMacAddr,
-                  sizeof(tSirMacAddr));
+    vos_mem_copy((tANI_U8 *) &mlmDeauthCnf.peerMacAddr,
+                 (tANI_U8 *) pMlmDeauthReq->peerMacAddr,
+                 sizeof(tSirMacAddr));
     mlmDeauthCnf.deauthTrigger = pMlmDeauthReq->deauthTrigger;
     mlmDeauthCnf.aid           = pMlmDeauthReq->aid;
     mlmDeauthCnf.sessionId = pMlmDeauthReq->sessionId;
 
     // Free up buffer allocated
     // for mlmDeauthReq
-    palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDeauthReq);
+    vos_mem_free(pMlmDeauthReq);
 
     limPostSmeMessage(pMac,
                       LIM_MLM_DEAUTH_CNF,
@@ -3286,8 +3449,8 @@
       //if TDLS is enabled.
 #ifndef FEATURE_WLAN_TDLS
         if((!limIsAddrBC( pMlmSetKeysReq->peerMacAddr ) ) &&
-          (!palEqualMemory( pMac->hHdd,pMlmSetKeysReq->peerMacAddr,
-                         currentBssId, sizeof(tSirMacAddr))) ){
+          (!vos_mem_compare(pMlmSetKeysReq->peerMacAddr,
+                            currentBssId, sizeof(tSirMacAddr))) ){
             limLog( pMac, LOGW, FL("Received MLM_SETKEYS_REQ with invalid BSSID"));
         limPrintMacAddr( pMac, pMlmSetKeysReq->peerMacAddr, LOGW );
 
@@ -3444,7 +3607,7 @@
     {
         PELOGE(limLog(pMac, LOGE,
                     FL("session does not exist for given sessionId"));)
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf );
+        vos_mem_free(pMsgBuf);
         return;
     }
 
@@ -3452,7 +3615,7 @@
     if( pMac->lim.gpLimMlmRemoveKeyReq != NULL )
     {
         // Free any previous requests.
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMac->lim.gpLimMlmRemoveKeyReq);
+        vos_mem_free(pMac->lim.gpLimMlmRemoveKeyReq);
         pMac->lim.gpLimMlmRemoveKeyReq = NULL;
     }
     // Hold onto the RemoveKeys request parameters
@@ -3471,10 +3634,10 @@
     {
         case eLIM_STA_ROLE:
         case eLIM_BT_AMP_STA_ROLE:
-        if(( limIsAddrBC( pMlmRemoveKeyReq->peerMacAddr ) != true ) &&
-          (!palEqualMemory( pMac->hHdd,pMlmRemoveKeyReq->peerMacAddr,
-                         currentBssId,
-                         sizeof(tSirMacAddr))))
+        if (( limIsAddrBC( pMlmRemoveKeyReq->peerMacAddr ) != true ) &&
+           (!vos_mem_compare(pMlmRemoveKeyReq->peerMacAddr,
+                            currentBssId,
+                            sizeof(tSirMacAddr))))
         {
             limLog( pMac, LOGW,
             FL("Received MLM_REMOVEKEY_REQ with invalid BSSID"));
@@ -3586,8 +3749,10 @@
     }
 #endif
 
-    
-    if (pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE)
+    /*do not process if we are in finish scan wait state i.e.
+    scan is aborted or finished*/
+    if (pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE &&
+        pMac->lim.gLimHalScanState != eLIM_HAL_FINISH_SCAN_WAIT_STATE)
     {
         PELOG1(limLog(pMac, LOG1, FL("Scanning : min channel timeout occurred"));)
 
@@ -3614,6 +3779,9 @@
             }
         }
 
+        limLog(pMac, LOGW,
+           FL("Sending End Scan req from MIN_CH_TIMEOUT in state %X ch-%d"),
+           pMac->lim.gLimMlmState,channelNum);
         limSendHalEndScanReq(pMac, channelNum, eLIM_HAL_END_SCAN_WAIT_STATE);
     }
     else
@@ -3624,8 +3792,8 @@
          * Log error.
          */
         limLog(pMac, LOGW,
-           FL("received unexpected MIN channel timeout in state %X"),
-           pMac->lim.gLimMlmState);
+           FL("received unexpected MIN channel timeout in mlme state %X and hal scan State %X"),
+           pMac->lim.gLimMlmState,pMac->lim.gLimHalScanState);
         limPrintMlmState(pMac, LOGE, pMac->lim.gLimMlmState);
     }
 } /*** limProcessMinChannelTimeout() ***/
@@ -3654,9 +3822,11 @@
 {
     tANI_U8 channelNum;
 
-    
-    if (pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE ||
-        pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE)
+    /*do not process if we are in finish scan wait state i.e.
+     scan is aborted or finished*/
+    if ((pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE ||
+        pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE) &&
+        pMac->lim.gLimHalScanState != eLIM_HAL_FINISH_SCAN_WAIT_STATE)
     {
         PELOG1(limLog(pMac, LOG1, FL("Scanning : Max channel timed out"));)
         /**
@@ -3682,6 +3852,9 @@
                channelNum = 1;
             }
         }
+        limLog(pMac, LOGW,
+           FL("Sending End Scan req from MAX_CH_TIMEOUT in state %X on ch-%d"),
+           pMac->lim.gLimMlmState,channelNum);
         limSendHalEndScanReq(pMac, channelNum, eLIM_HAL_END_SCAN_WAIT_STATE);
     }
     else
@@ -3692,8 +3865,8 @@
          * Log error.
          */
         limLog(pMac, LOGW,
-           FL("received unexpected MAX channel timeout in state %X"),
-           pMac->lim.gLimMlmState);
+           FL("received unexpected MAX channel timeout in mlme state %X and hal scan state %X"),
+           pMac->lim.gLimMlmState, pMac->lim.gLimHalScanState);
         limPrintMlmState(pMac, LOGW, pMac->lim.gLimMlmState);
     }
 } /*** limProcessMaxChannelTimeout() ***/
@@ -3814,6 +3987,9 @@
     tLimMlmJoinCnf  mlmJoinCnf;
     tSirMacAddr bssid;
     tANI_U32 len;
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT_LIM
+    vos_log_rssi_pkt_type *pRssiLog = NULL;
+#endif //FEATURE_WLAN_DIAG_SUPPORT_LIM
     
     //fetch the sessionEntry based on the sessionId
     tpPESession psessionEntry;
@@ -3823,7 +3999,17 @@
         limLog(pMac, LOGE, FL("Session Does not exist for given sessionID"));
         return;
     }
-        
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT_LIM
+    WLAN_VOS_DIAG_LOG_ALLOC(pRssiLog,
+                            vos_log_rssi_pkt_type, LOG_WLAN_RSSI_UPDATE_C);
+    if (pRssiLog)
+    {
+        pRssiLog->rssi = psessionEntry->rssi;
+    }
+    WLAN_VOS_DIAG_LOG_REPORT(pRssiLog);
+#endif //FEATURE_WLAN_DIAG_SUPPORT_LIM
+
     if (psessionEntry->limMlmState == eLIM_MLM_WT_JOIN_BEACON_STATE)
     {
         len = sizeof(tSirMacAddr);
@@ -3843,7 +4029,10 @@
         /**
          * Issue MLM join confirm with timeout reason code
          */
-        PELOGE(limLog(pMac, LOGE,  FL(" Join Failure Timeout occurred."));)
+        PELOGE(limLog(pMac, LOGE,  FL(" In state eLIM_MLM_WT_JOIN_BEACON_STATE."));)
+        PELOGE(limLog(pMac, LOGE,  FL(" Join Failure Timeout occurred for session %d with BSS "),
+                                        psessionEntry->peSessionId);
+                                        limPrintMacAddr(pMac, psessionEntry->bssId, LOGE);)
 
         mlmJoinCnf.resultCode = eSIR_SME_JOIN_TIMEOUT_RESULT_CODE;
         mlmJoinCnf.protStatusCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
@@ -3860,7 +4049,7 @@
         // Freeup buffer allocated to join request
         if (psessionEntry->pLimMlmJoinReq)
         {
-            palFreeMemory( pMac->hHdd, psessionEntry->pLimMlmJoinReq);
+            vos_mem_free(psessionEntry->pLimMlmJoinReq);
             psessionEntry->pLimMlmJoinReq = NULL;
         }
         
@@ -3908,16 +4097,17 @@
 
     if((psessionEntry = peFindSessionBySessionId(pMac, pMac->lim.limTimers.gLimPeriodicJoinProbeReqTimer.sessionId))== NULL)
     {
-        limLog(pMac, LOGE,FL("session does not exist for given SessionId"));
+        limLog(pMac, LOGE,FL("session does not exist for given SessionId : %d"),
+                              pMac->lim.limTimers.gLimPeriodicJoinProbeReqTimer.sessionId);
         return;
     }
 
     if((VOS_TRUE == tx_timer_running(&pMac->lim.limTimers.gLimJoinFailureTimer)) && 
                           (psessionEntry->limMlmState == eLIM_MLM_WT_JOIN_BEACON_STATE))
     {
-        palCopyMemory( pMac->hHdd, ssId.ssId,
-            psessionEntry->ssId.ssId,
-            psessionEntry->ssId.length);
+        vos_mem_copy(ssId.ssId,
+                     psessionEntry->ssId.ssId,
+                     psessionEntry->ssId.length);
         ssId.length = psessionEntry->ssId.length;
 
         limSendProbeReqMgmtFrame( pMac, &ssId,
@@ -3960,13 +4150,25 @@
 {
     //fetch the sessionEntry based on the sessionId
     tpPESession psessionEntry;
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT_LIM
+    vos_log_rssi_pkt_type *pRssiLog = NULL;
+#endif //FEATURE_WLAN_DIAG_SUPPORT_LIM
 
     if((psessionEntry = peFindSessionBySessionId(pMac, pMac->lim.limTimers.gLimAuthFailureTimer.sessionId))== NULL) 
     {
         limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
         return;
     }
-    
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT_LIM
+    WLAN_VOS_DIAG_LOG_ALLOC(pRssiLog,
+                            vos_log_rssi_pkt_type, LOG_WLAN_RSSI_UPDATE_C);
+    if (pRssiLog)
+    {
+        pRssiLog->rssi = psessionEntry->rssi;
+    }
+    WLAN_VOS_DIAG_LOG_REPORT(pRssiLog);
+#endif //FEATURE_WLAN_DIAG_SUPPORT_LIM
+
     switch (psessionEntry->limMlmState)
     {
         case eLIM_MLM_WT_AUTH_FRAME2_STATE:
@@ -4095,6 +4297,9 @@
 
     tLimMlmAssocCnf     mlmAssocCnf;
     tpPESession         psessionEntry;
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT_LIM
+    vos_log_rssi_pkt_type *pRssiLog = NULL;
+#endif //FEATURE_WLAN_DIAG_SUPPORT_LIM
     
     //to fetch the lim/mlm state based on the sessionId, use the below sessionEntry
     tANI_U8 sessionId;
@@ -4113,7 +4318,16 @@
         limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
         return;
     }
-    
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT_LIM
+    WLAN_VOS_DIAG_LOG_ALLOC(pRssiLog,
+                            vos_log_rssi_pkt_type, LOG_WLAN_RSSI_UPDATE_C);
+    if (pRssiLog)
+    {
+        pRssiLog->rssi = psessionEntry->rssi;
+    }
+    WLAN_VOS_DIAG_LOG_REPORT(pRssiLog);
+#endif //FEATURE_WLAN_DIAG_SUPPORT_LIM
+
     /**
      * Expected Re/Association Response frame
      * not received within Re/Association Failure Timeout.
@@ -4164,7 +4378,7 @@
             // MLM state machine
             if (psessionEntry->pLimMlmJoinReq)
             {
-                palFreeMemory( pMac->hHdd, psessionEntry->pLimMlmJoinReq);
+                vos_mem_free(psessionEntry->pLimMlmJoinReq);
                 psessionEntry->pLimMlmJoinReq = NULL;
             }
 
@@ -4242,7 +4456,7 @@
     // Free up pMac->lim.gLimMlmScanReq
     if( NULL != pMac->lim.gpLimMlmScanReq )
     {
-        palFreeMemory( pMac->hHdd, pMac->lim.gpLimMlmScanReq);
+        vos_mem_free(pMac->lim.gpLimMlmScanReq);
         pMac->lim.gpLimMlmScanReq = NULL;
     }
 
@@ -4283,7 +4497,7 @@
   {
       PELOGE(limLog(pMac, LOGE,
                FL("session does not exist for given sessionId"));)
-      palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf );
+      vos_mem_free(pMsgBuf);
       return;
   }
   
@@ -4300,22 +4514,21 @@
   if( eSIR_SUCCESS != status )
   {
     // Allocate for LIM_MLM_ADDBA_CNF
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                                     (void **) &pMlmAddBACnf,
-                                     sizeof( tLimMlmAddBACnf )))
+
+    pMlmAddBACnf = vos_mem_malloc(sizeof( tLimMlmAddBACnf ));
+    if ( NULL == pMlmAddBACnf )
     {
       limLog( pMac, LOGP,
-          FL("palAllocateMemory failed with error code %d"));
-      palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf );
+          FL("AllocateMemory failed"));
+      vos_mem_free(pMsgBuf);
       return;
     }
     else
     {
-        palZeroMemory( pMac->hHdd, (void *) pMlmAddBACnf, sizeof( tLimMlmAddBACnf ));
-        palCopyMemory( pMac->hHdd,
-          (void *) pMlmAddBACnf->peerMacAddr,
-          (void *) pMlmAddBAReq->peerMacAddr,
-          sizeof( tSirMacAddr ));
+        vos_mem_set((void *) pMlmAddBACnf, sizeof( tLimMlmAddBACnf ), 0);
+        vos_mem_copy((void *) pMlmAddBACnf->peerMacAddr,
+                     (void *) pMlmAddBAReq->peerMacAddr,
+                     sizeof( tSirMacAddr ));
 
       pMlmAddBACnf->baDialogToken = pMlmAddBAReq->baDialogToken;
       pMlmAddBACnf->baTID = pMlmAddBAReq->baTID;
@@ -4339,7 +4552,7 @@
   }
 
   // Free the buffer allocated for tLimMlmAddBAReq
-  palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf );
+  vos_mem_free(pMsgBuf);
 
 }
 
@@ -4376,7 +4589,7 @@
     {
         PELOGE(limLog(pMac, LOGE,
                   FL("session does not exist for given session ID"));)
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf );
+        vos_mem_free(pMsgBuf);
         return;
     }
   
@@ -4402,7 +4615,7 @@
 
 
   // Free the buffer allocated for tLimMlmAddBARsp
-  palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf );
+  vos_mem_free(pMsgBuf);
 
 }
 
@@ -4438,7 +4651,7 @@
     if((psessionEntry = peFindSessionBySessionId(pMac,pMlmDelBAReq->sessionId))== NULL)
     {
         PELOGE(limLog(pMac, LOGE,FL("session does not exist for given bssId"));)
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf );
+        vos_mem_free(pMsgBuf);
         return;
     }
 
@@ -4470,22 +4683,21 @@
   //
 
   // Allocate for LIM_MLM_DELBA_CNF
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                                   (void **) &pMlmDelBACnf,
-                                   sizeof( tLimMlmDelBACnf )))
+
+  pMlmDelBACnf = vos_mem_malloc(sizeof( tLimMlmDelBACnf ));
+  if ( NULL == pMlmDelBACnf )
   {
-    limLog( pMac, LOGP, FL("palAllocateMemory failed"));
-    palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf );
+    limLog( pMac, LOGP, FL("AllocateMemory failed"));
+    vos_mem_free(pMsgBuf);
     return;
   }
   else
   {
-    palZeroMemory( pMac->hHdd, (void *) pMlmDelBACnf, sizeof( tLimMlmDelBACnf ));
+    vos_mem_set((void *) pMlmDelBACnf, sizeof( tLimMlmDelBACnf ), 0);
 
-    palCopyMemory( pMac->hHdd,
-        (void *) pMlmDelBACnf,
-        (void *) pMlmDelBAReq,
-        sizeof( tLimMlmDelBAReq ));
+    vos_mem_copy((void *) pMlmDelBACnf,
+                 (void *) pMlmDelBAReq,
+                 sizeof( tLimMlmDelBAReq ));
 
     // Update DELBA result code
     pMlmDelBACnf->delBAReasonCode = pMlmDelBAReq->delBAReasonCode;
@@ -4499,7 +4711,7 @@
   }
 
   // Free the buffer allocated for tLimMlmDelBAReq
-  palFreeMemory( pMac->hHdd, (tANI_U8 *) pMsgBuf );
+  vos_mem_free(pMsgBuf);
 
 }
 
@@ -4581,7 +4793,7 @@
     if (isEnteringMimoPS(pMac->lim.gHTMIMOPSState, state)) {    
         tSirMacAddr             macAddr;      
         /** Obtain the AP's Mac Address */    
-        palCopyMemory(pMac ->hHdd, (tANI_U8 *)macAddr, psessionEntry->bssId, sizeof(tSirMacAddr)); 
+        vos_mem_copy((tANI_U8 *)macAddr, psessionEntry->bssId, sizeof(tSirMacAddr));
         /** Send Action Frame with the corresponding mode */       
         retStatus = limSendSMPowerStateFrame(pMac, macAddr, state);       
         if (retStatus != eSIR_SUCCESS) {         
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
index 5c7fb4f..7e3a12e 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
@@ -565,22 +565,23 @@
              */
             authMode = eSIR_SHARED_KEY;
             // Trigger MAC based Authentication
-            if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmAuthReq, sizeof(tLimMlmAuthReq)))
+            pMlmAuthReq = vos_mem_malloc(sizeof(tLimMlmAuthReq));
+            if ( NULL == pMlmAuthReq )
             {
                 // Log error
                 limLog(pMac, LOGP,
-                   FL("call to palAllocateMemory failed for mlmAuthReq"));
+                   FL("call to AllocateMemory failed for mlmAuthReq"));
                 return;
             }
-            palZeroMemory( pMac->hHdd, (tANI_U8 *) pMlmAuthReq, sizeof(tLimMlmAuthReq));
+            vos_mem_set((tANI_U8 *) pMlmAuthReq, sizeof(tLimMlmAuthReq), 0);
             val = sizeof(tSirMacAddr);
             if (psessionEntry->limSmeState == eLIM_SME_WT_AUTH_STATE)
             {
                 sirCopyMacAddr(pMlmAuthReq->peerMacAddr,psessionEntry->bssId);
             }
             else
-                palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMlmAuthReq->peerMacAddr,
-                              (tANI_U8 *) &pMac->lim.gLimPreAuthPeerAddr,
+                vos_mem_copy((tANI_U8 *) &pMlmAuthReq->peerMacAddr,
+                             (tANI_U8 *) &pMac->lim.gLimPreAuthPeerAddr,
                               sizeof(tSirMacAddr));
             pMlmAuthReq->authType = authMode;
             /* Update PE session Id*/
@@ -646,11 +647,12 @@
              */
             PELOG1(limLog(pMac, LOG1,
                    FL("*** Authenticated with BSS ***"));)
-            if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmAssocReq, sizeof(tLimMlmAssocReq)))
+            pMlmAssocReq = vos_mem_malloc(sizeof(tLimMlmAssocReq));
+            if ( NULL == pMlmAssocReq )
             {
                 // Log error
                 limLog(pMac, LOGP,
-                   FL("call to palAllocateMemory failed for mlmAssocReq"));
+                   FL("call to AllocateMemory failed for mlmAssocReq"));
                 return;
             }
             val = sizeof(tSirMacAddr);
@@ -885,7 +887,7 @@
                 return;
     }
     if (psessionEntry->pLimReAssocReq) {
-        palFreeMemory( pMac->hHdd, psessionEntry->pLimReAssocReq);
+        vos_mem_free(psessionEntry->pLimReAssocReq);
         psessionEntry->pLimReAssocReq = NULL;
     }
 
@@ -970,11 +972,12 @@
     }
     /// Inform Host of STA reassociation
     len = sizeof(tSirSmeReassocInd);
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeReassocInd, len))
+    pSirSmeReassocInd = vos_mem_malloc(len);
+    if ( NULL == pSirSmeReassocInd )
     {
         // Log error
         limLog(pMac, LOGP,
-           FL("call to palAllocateMemory failed for eWNI_SME_REASSOC_IND"));
+           FL("call to AllocateMemory failed for eWNI_SME_REASSOC_IND"));
         return;
 
     }
@@ -1001,7 +1004,7 @@
     {
         limLog( pMac, LOGP, FL("MLM ReAssocInd: Station context no longer valid (aid %d)"),
                 ((tpLimMlmReassocInd) pMsgBuf)->aid);
-        palFreeMemory(pMac->hHdd, pSirSmeReassocInd);
+        vos_mem_free(pSirSmeReassocInd);
         return;
     }
 
@@ -1044,11 +1047,12 @@
            PELOGE(limLog(pMac, LOGE,FL("Buffer is Pointing to NULL"));)
            return;
     }
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeAuthInd, sizeof(tSirSmeAuthInd)))
+    pSirSmeAuthInd = vos_mem_malloc(sizeof(tSirSmeAuthInd));
+    if ( NULL == pSirSmeAuthInd )
     {
         // Log error
         limLog(pMac, LOGP,
-           FL("call to palAllocateMemory failed for eWNI_SME_AUTH_IND"));
+           FL("call to AllocateMemory failed for eWNI_SME_AUTH_IND"));
     }
     limCopyU16((tANI_U8 *) &pSirSmeAuthInd->messageType, eWNI_SME_AUTH_IND);
     limAuthIndSerDes(pMac, (tpLimMlmAuthInd) pMsgBuf,
@@ -1082,27 +1086,29 @@
     pSirSmeAssocInd->beaconLength = psessionEntry->bcnLen;    
 
     // Fill in peerMacAddr
-    palCopyMemory( pMac->hHdd, pSirSmeAssocInd->peerMacAddr, pAssocInd->peerMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy(pSirSmeAssocInd->peerMacAddr, pAssocInd->peerMacAddr,
+                 sizeof(tSirMacAddr));
+
     // Fill in aid
     pSirSmeAssocInd->aid = pAssocInd->aid;
     // Fill in bssId
-    palCopyMemory( pMac->hHdd, pSirSmeAssocInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
+    vos_mem_copy(pSirSmeAssocInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
     // Fill in staId
     //pSirSmeAssocInd->staId = psessionEntry->staId;
     // Fill in authType
     pSirSmeAssocInd->authType = pAssocInd->authType;
     // Fill in ssId
-    palCopyMemory( pMac->hHdd,  (tANI_U8*)&pSirSmeAssocInd->ssId,
-                                (tANI_U8 *) &(pAssocInd->ssId), pAssocInd->ssId.length + 1);
+    vos_mem_copy((tANI_U8*)&pSirSmeAssocInd->ssId,
+                 (tANI_U8 *) &(pAssocInd->ssId), pAssocInd->ssId.length + 1);
     pSirSmeAssocInd->rsnIE.length = pAssocInd->rsnIE.length;
-    palCopyMemory( pMac->hHdd, (tANI_U8*) &pSirSmeAssocInd->rsnIE.rsnIEdata,
-                                (tANI_U8 *) &(pAssocInd->rsnIE.rsnIEdata),
-                                pAssocInd->rsnIE.length);
+    vos_mem_copy((tANI_U8*) &pSirSmeAssocInd->rsnIE.rsnIEdata,
+                 (tANI_U8 *) &(pAssocInd->rsnIE.rsnIEdata),
+                  pAssocInd->rsnIE.length);
 
     pSirSmeAssocInd->addIE.length = pAssocInd->addIE.length;
-    palCopyMemory( pMac->hHdd, (tANI_U8*) &pSirSmeAssocInd->addIE.addIEdata,
-                                (tANI_U8 *) &(pAssocInd->addIE.addIEdata),
-                                pAssocInd->addIE.length);
+    vos_mem_copy((tANI_U8*) &pSirSmeAssocInd->addIE.addIEdata,
+                 (tANI_U8 *) &(pAssocInd->addIE.addIEdata),
+                 pAssocInd->addIE.length);
 
     // Copy the new TITAN capabilities
     pSirSmeAssocInd->spectrumMgtIndicator = pAssocInd->spectrumMgtIndicator;
@@ -1111,9 +1117,9 @@
         pSirSmeAssocInd->powerCap.minTxPower = pAssocInd->powerCap.minTxPower;
         pSirSmeAssocInd->powerCap.maxTxPower = pAssocInd->powerCap.maxTxPower;
         pSirSmeAssocInd->supportedChannels.numChnl = pAssocInd->supportedChannels.numChnl;
-        palCopyMemory( pMac->hHdd, (tANI_U8*) &pSirSmeAssocInd->supportedChannels.channelList,
+        vos_mem_copy((tANI_U8*) &pSirSmeAssocInd->supportedChannels.channelList,
                      (tANI_U8 *) &(pAssocInd->supportedChannels.channelList),
-                     pAssocInd->supportedChannels.numChnl);
+                      pAssocInd->supportedChannels.numChnl);
     }
     // Fill in WmmInfo
     pSirSmeAssocInd->wmmEnabledSta = pAssocInd->WmmStaInfoPresent;
@@ -1159,11 +1165,12 @@
     }
     /// Inform Host of STA association
     len = sizeof(tSirSmeAssocInd);
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeAssocInd, len))
+    pSirSmeAssocInd = vos_mem_malloc(len);
+    if ( NULL == pSirSmeAssocInd )
     {
         // Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for eWNI_SME_ASSOC_IND"));
+               FL("call to AllocateMemory failed for eWNI_SME_ASSOC_IND"));
         return;
     }
 
@@ -1178,7 +1185,7 @@
     {   // good time to panic...
         limLog(pMac, LOGE, FL("MLM AssocInd: Station context no longer valid (aid %d)"),
                ((tpLimMlmAssocInd) pMsgBuf)->aid);
-        palFreeMemory(pMac->hHdd, pSirSmeAssocInd);
+        vos_mem_free(pSirSmeAssocInd);
 
         return;
     }
@@ -1202,19 +1209,22 @@
 //tANI_U32 *pMsgBuf;
 {
     tpSirSmeAssocCnf     pSmeAssoccnf;
-    if(!palAllocateMemory(pMac->hHdd,(void **)&pSmeAssoccnf,sizeof(tSirSmeAssocCnf)))
-        PELOGE(limLog(pMac, LOGE, FL("palAllocateMemory failed for pSmeAssoccnf "));)
+    pSmeAssoccnf = vos_mem_malloc(sizeof(tSirSmeAssocCnf));
+    if ( NULL == pSmeAssoccnf )
+        PELOGE(limLog(pMac, LOGE, FL("AllocateMemory failed for pSmeAssoccnf "));)
     pSmeAssoccnf->messageType = eWNI_SME_ASSOC_CNF;
     pSmeAssoccnf->length = sizeof(tSirSmeAssocCnf);
-    palCopyMemory( pMac->hHdd,pSmeAssoccnf->peerMacAddr,((tpLimMlmAssocInd)pMsgBuf)->peerMacAddr,6);
+    vos_mem_copy(pSmeAssoccnf->peerMacAddr,
+                ((tpLimMlmAssocInd)pMsgBuf)->peerMacAddr, 6);
     pSmeAssoccnf->statusCode = eSIR_SME_SUCCESS;
     pSmeAssoccnf->aid = ((tpLimMlmAssocInd)pMsgBuf)->aid;
-    palCopyMemory( pMac->hHdd, pSmeAssoccnf->alternateBssId,pSmeAssoccnf->peerMacAddr,sizeof(tSirMacAddr));
+    vos_mem_copy(pSmeAssoccnf->alternateBssId,
+                 pSmeAssoccnf->peerMacAddr, sizeof(tSirMacAddr));
     pSmeAssoccnf->alternateChannelId = 6;
-    palCopyMemory( pMac->hHdd,pSmeAssoccnf->bssId,psessionEntry->selfMacAddr,6);
+    vos_mem_copy(pSmeAssoccnf->bssId, psessionEntry->selfMacAddr, 6);
     pMsgBuf = (tANI_U32)pSmeAssoccnf;
     __limProcessSmeAssocCnfNew(pMac, eWNI_SME_ASSOC_CNF, pMsgBuf);
-    palFreeMemory(pMac->hHdd,pSmeAssoccnf);
+    vos_mem_free(pSmeAssoccnf);
 }
 #endif
 
@@ -1714,13 +1724,13 @@
             pStaDs->mlmStaContext.protStatusCode = protStatusCode;
             //Done: 7-27-2009. JIM_FIX_ME: at the end of limCleanupRxPath, make sure PE is sending eWNI_SME_JOIN_RSP to SME
             limCleanupRxPath(pMac, pStaDs, psessionEntry);
-            palFreeMemory( pMac->hHdd, psessionEntry->pLimJoinReq);
+            vos_mem_free(psessionEntry->pLimJoinReq);
             psessionEntry->pLimJoinReq = NULL;
             return;
         }
     }
 
-    palFreeMemory( pMac->hHdd, psessionEntry->pLimJoinReq);
+    vos_mem_free(psessionEntry->pLimJoinReq);
     psessionEntry->pLimJoinReq = NULL;
     //Delete teh session if JOIN failure occurred.
     if(resultCode != eSIR_SME_SUCCESS)
@@ -1848,9 +1858,16 @@
         limLog( pMac, LOGE, FL( "Encountered NULL Pointer" ));
         return;
     }
-    if( eHAL_STATUS_SUCCESS == pAddStaParams->status )
+    if (true == psessionEntry->fDeauthReceived)
     {
-        if( eLIM_MLM_WT_ADD_STA_RSP_STATE != psessionEntry->limMlmState)
+      PELOGE(limLog(pMac, LOGE,
+           FL("Received Deauth frame in ADD_STA_RESP state"));)
+       pAddStaParams->status = eHAL_STATUS_FAILURE;
+    }
+
+    if ( eHAL_STATUS_SUCCESS == pAddStaParams->status )
+    {
+        if ( eLIM_MLM_WT_ADD_STA_RSP_STATE != psessionEntry->limMlmState)
         {
             //TODO: any response to be sent out here ?
             limLog( pMac, LOGE,
@@ -1915,11 +1932,15 @@
 end:
     if( 0 != limMsgQ->bodyptr )
     {
-      palFreeMemory( pMac->hHdd, (void *) pAddStaParams );
+      vos_mem_free(pAddStaParams);
     }
     /* Updating PE session Id*/
     mlmAssocCnf.sessionId = psessionEntry->peSessionId;
     limPostSmeMessage( pMac, mesgType, (tANI_U32 *) &mlmAssocCnf );
+    if (true == psessionEntry->fDeauthReceived)
+    {
+       psessionEntry->fDeauthReceived = false;
+    }
     return;
 }
 void limProcessMlmDelBssRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,tpPESession psessionEntry)
@@ -1958,8 +1979,7 @@
         if ( eSIR_SUCCESS != limSendExcludeUnencryptInd(pMac, TRUE, psessionEntry) )
         {
             limLog( pMac, LOGE,
-                    FL( "Could not send down Exclude Unencrypted Indication!" ),
-                    psessionEntry->limMlmState );
+                    FL( "Could not send down Exclude Unencrypted Indication!" ) );
         }
     }
 #endif
@@ -2012,7 +2032,7 @@
    end:
      if( 0 != limMsgQ->bodyptr )
      {
-        palFreeMemory( pMac->hHdd, (void *) pDelBssParams );
+        vos_mem_free(pDelBssParams);
      }
     if(pStaDs == NULL)
           return;
@@ -2043,7 +2063,7 @@
     {
         limLog(pMac, LOGE,FL("Session entry passed is NULL"));
         if(pDelBss != NULL)
-            palFreeMemory( pMac->hHdd, (void *) pDelBss );
+            vos_mem_free(pDelBss);
         return;
     }
 
@@ -2098,7 +2118,7 @@
     peDeleteSession(pMac, psessionEntry);
 
     if(pDelBss != NULL)
-        palFreeMemory( pMac->hHdd, (void *) pDelBss );
+        vos_mem_free(pDelBss);
 }
 
 void limProcessMlmDelStaRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ )
@@ -2117,7 +2137,7 @@
     {
         limLog(pMac, LOGP,FL("Session Does not exist or invalid body pointer in message"));
         if(pDeleteStaParams != NULL)
-            palFreeMemory( pMac->hHdd, (void *) pDeleteStaParams );
+            vos_mem_free(pDeleteStaParams);
         return;
     }
 
@@ -2147,7 +2167,7 @@
         limLog( pMac, LOGE,
              FL( "DPH Entry for STA %X missing."), pDelStaParams->assocId);
         statusCode = eSIR_SME_REFUSED;
-        palFreeMemory( pMac->hHdd, (void *) pDelStaParams );
+        vos_mem_free(pDelStaParams);
 
         return;
     }
@@ -2172,7 +2192,7 @@
         limPrintMacAddr(pMac, pStaDs->staAddr, LOG1);
        if(eLIM_MLM_WT_ASSOC_DEL_STA_RSP_STATE == pStaDs->mlmStaContext.mlmState)
        {
-            palFreeMemory( pMac->hHdd, (void *) pDelStaParams );
+            vos_mem_free(pDelStaParams);
             if (limAddSta(pMac, pStaDs, false, psessionEntry) != eSIR_SUCCESS)
             {
                 PELOGE(limLog(pMac, LOGE,
@@ -2208,7 +2228,7 @@
         statusCode = eSIR_SME_REFUSED;
     }
     end:
-    palFreeMemory( pMac->hHdd, (void *) pDelStaParams );
+    vos_mem_free(pDelStaParams);
     if(eLIM_MLM_WT_ASSOC_DEL_STA_RSP_STATE != pStaDs->mlmStaContext.mlmState)
     {
        limPrepareAndSendDelStaCnf(pMac, pStaDs, statusCode,psessionEntry);
@@ -2251,7 +2271,7 @@
         //we must complete all cleanup related to delSta before calling limDelBSS.
         if( 0 != limMsgQ->bodyptr )
         {
-            palFreeMemory( pMac->hHdd, (void *) pDelStaParams );
+            vos_mem_free(pDelStaParams);
         }
         statusCode = (tSirResultCodes) limDelBss(pMac, pStaDs, 0,psessionEntry);
         return;
@@ -2264,7 +2284,7 @@
 end:
     if( 0 != limMsgQ->bodyptr )
     {
-        palFreeMemory( pMac->hHdd, (void *) pDelStaParams );
+        vos_mem_free(pDelStaParams);
     }
     return;
 }
@@ -2332,7 +2352,7 @@
 end:
     if( 0 != limMsgQ->bodyptr )
     {
-        palFreeMemory( pMac->hHdd, (void *) pAddStaParams );
+        vos_mem_free(pAddStaParams);
     }
     return;
 }
@@ -2388,7 +2408,7 @@
     {
         PELOGE(limLog(pMac, LOGE,FL("session does not exist for given sessionId"));)
         if( NULL != pAddBssParams )
-            palFreeMemory( pMac->hHdd, (void *) pAddBssParams );
+            vos_mem_free(pAddBssParams);
         return;
     }
     /* Update PE session Id*/
@@ -2401,6 +2421,8 @@
             goto end;
         // Set MLME state
         psessionEntry->limMlmState = eLIM_MLM_BSS_STARTED_STATE;
+        psessionEntry->chainMask = pAddBssParams->chainMask;
+        psessionEntry->smpsMode = pAddBssParams->smpsMode;
         MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId,  psessionEntry->limMlmState));
         if( eSIR_IBSS_MODE == pAddBssParams->bssType )
         {
@@ -2413,7 +2435,7 @@
             limResetHBPktCount( psessionEntry );
             limHeartBeatDeactivateAndChangeTimer(pMac, psessionEntry);
             MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE, psessionEntry->peSessionId, eLIM_HEART_BEAT_TIMER));
-            if (limActivateHearBeatTimer(pMac) != TX_SUCCESS)
+            if (limActivateHearBeatTimer(pMac, psessionEntry) != TX_SUCCESS)
                 limLog(pMac, LOGP, FL("could not activate Heartbeat timer"));
         }
         psessionEntry->bssIdx     = (tANI_U8) pAddBssParams->bssIdx;
@@ -2454,7 +2476,7 @@
     limPostSmeMessage( pMac, LIM_MLM_START_CNF, (tANI_U32 *) &mlmStartCnf );
     end:
     if( 0 != limMsgQ->bodyptr )
-        palFreeMemory( pMac->hHdd, (void *) pAddBssParams );
+        vos_mem_free(pAddBssParams);
 }
 
 
@@ -2521,7 +2543,7 @@
         /* Timer related functions are not modified for BT-AMP : To be Done */
         limHeartBeatDeactivateAndChangeTimer(pMac, psessionEntry);
         MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE, psessionEntry->peSessionId, eLIM_HEART_BEAT_TIMER));
-        if (limActivateHearBeatTimer(pMac) != TX_SUCCESS)
+        if (limActivateHearBeatTimer(pMac, psessionEntry) != TX_SUCCESS)
             limLog(pMac, LOGP, FL("could not activate Heartbeat timer"));
         psessionEntry->bssIdx     = (tANI_U8) pAddBssParams->bssIdx;
         psessionEntry->limSystemRole = eLIM_STA_IN_IBSS_ROLE;
@@ -2564,7 +2586,7 @@
     limPostSmeMessage( pMac, LIM_MLM_START_CNF, (tANI_U32 *) &mlmStartCnf );
     end:
     if( 0 != limMsgQ->bodyptr )
-        palFreeMemory( pMac->hHdd, (void *) pAddBssParams );
+        vos_mem_free(pAddBssParams);
 }
 
 static void
@@ -2611,11 +2633,12 @@
                 authMode = cfgAuthType;
 
             // Trigger MAC based Authentication
-            if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmAuthReq, sizeof(tLimMlmAuthReq)))
+            pMlmAuthReq = vos_mem_malloc(sizeof(tLimMlmAuthReq));
+            if ( NULL == pMlmAuthReq )
             {
                 // Log error
                 limLog(pMac, LOGP,
-                       FL("call to palAllocateMemory failed for mlmAuthReq"));
+                       FL("call to AllocateMemory failed for mlmAuthReq"));
                 return;
             }
             #if 0
@@ -2674,46 +2697,36 @@
 #ifdef WLAN_FEATURE_VOWIFI_11R
 /*------------------------------------------------------------------------------------------
  *
- * Function to handle callback after setting link state to post assoc.
+ * Function to handle WDA_ADD_BSS_RSP, in FT reassoc state.
+ * Function to Send ReAssociation Request.
  *
  *
  *------------------------------------------------------------------------------------------
  */
-void limSetLinkStateForPostAssocCallback(tpAniSirGlobal pMac, void *msgParam )
+static inline void
+limProcessStaMlmAddBssRspFT(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ, tpPESession psessionEntry)
 {
     tLimMlmReassocCnf       mlmReassocCnf; // keep sme 
-    tSetLinkCbackParams * pCbackParams = (tSetLinkCbackParams *)msgParam;
-    tpPESession psessionEntry = NULL;
-    tpAddBssParams pAddBssParams = NULL;
     tpDphHashNode pStaDs    = NULL;
     tpAddStaParams pAddStaParams = NULL;
-    tLimMlmReassocReq * pMlmReassocReq = NULL;
     tANI_U32 listenInterval = WNI_CFG_LISTEN_INTERVAL_STADEF;
-
+    tpAddBssParams pAddBssParams = (tpAddBssParams) limMsgQ->bodyptr;
     /* Sanity Checks */
-    if (pCbackParams == NULL)
-    {
-        PELOGE(limLog(pMac, LOGE, FL("Invalid parameters"));)
-        goto end;
-    }
-
-    pAddBssParams = (tpAddBssParams)(pCbackParams->cbackDataPtr);
 
     if (pAddBssParams == NULL)
     {
         PELOGE(limLog(pMac, LOGE, FL("Invalid parameters"));)
         goto end;
     }
-
     if((psessionEntry = peFindSessionBySessionId(pMac,pAddBssParams->sessionId))== NULL)
     {
         limLog( pMac, LOGE, FL( "Session Does not exist for given sessionId" ));
         goto end;
     }
-
-    pMlmReassocReq = (tLimMlmReassocReq *)(psessionEntry->pLimMlmReassocReq);
-
-    limPrintMacAddr(pMac, pAddBssParams->bssId, LOG1);
+    if ( eLIM_MLM_WT_ADD_BSS_RSP_FT_REASSOC_STATE != psessionEntry->limMlmState )
+    {
+        goto end;
+    }
 
     if ((pStaDs = dphAddHashEntry(pMac, pAddBssParams->bssId, DPH_STA_HASH_INDEX_PEER,
         &psessionEntry->dph.dphHashTable)) == NULL)
@@ -2746,9 +2759,12 @@
     if(NULL == pMac->lim.pSessionEntry->pLimMlmReassocRetryReq)
     {
         /* Take a copy of reassoc request for retrying */
-        if ( !HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pMac->lim.pSessionEntry->pLimMlmReassocRetryReq, sizeof(tLimMlmReassocReq))) ) goto end;
-        palZeroMemory(pMac->hHdd, pMac->lim.pSessionEntry->pLimMlmReassocRetryReq, sizeof(tLimMlmReassocReq));
-        palCopyMemory( pMac->hHdd,pMac->lim.pSessionEntry->pLimMlmReassocRetryReq, psessionEntry->pLimMlmReassocReq, sizeof(tLimMlmReassocReq));
+        pMac->lim.pSessionEntry->pLimMlmReassocRetryReq = vos_mem_malloc(sizeof(tLimMlmReassocReq));
+        if ( NULL == pMac->lim.pSessionEntry->pLimMlmReassocRetryReq ) goto end;
+        vos_mem_set(pMac->lim.pSessionEntry->pLimMlmReassocRetryReq, sizeof(tLimMlmReassocReq), 0);
+        vos_mem_copy(pMac->lim.pSessionEntry->pLimMlmReassocRetryReq,
+                     psessionEntry->pLimMlmReassocReq,
+                     sizeof(tLimMlmReassocReq));
     }
     pMac->lim.reAssocRetryAttempt = 0;
 #endif
@@ -2773,20 +2789,20 @@
     rrmCacheMgmtTxPower( pMac, pAddBssParams->txMgmtPower, psessionEntry );
 #endif
 
-    if( eHAL_STATUS_SUCCESS !=
-        palAllocateMemory( pMac->hHdd, (void **) &pAddStaParams, sizeof( tAddStaParams )))
+    pAddStaParams = vos_mem_malloc(sizeof( tAddStaParams ));
+    if ( NULL == pAddStaParams )
     {
-        limLog( pMac, LOGP, FL( "Unable to PAL allocate memory during ADD_STA" ));
+        limLog( pMac, LOGP, FL( "Unable to allocate memory during ADD_STA" ));
         goto end;
     }
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pAddStaParams, sizeof(tAddStaParams));
+    vos_mem_set((tANI_U8 *) pAddStaParams, sizeof(tAddStaParams), 0);
 
     /// Add STA context at MAC HW (BMU, RHP & TFP)
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pAddStaParams->staMac,
-                  (tANI_U8 *) psessionEntry->selfMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy((tANI_U8 *) pAddStaParams->staMac,
+                 (tANI_U8 *) psessionEntry->selfMacAddr, sizeof(tSirMacAddr));
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pAddStaParams->bssId,
-                psessionEntry->bssId, sizeof(tSirMacAddr));
+    vos_mem_copy((tANI_U8 *) pAddStaParams->bssId,
+                  psessionEntry->bssId, sizeof(tSirMacAddr));
 
     // Update this when we get reassoc rsp , with success.
     // pAddStaParams->assocId = psessionEntry->limAID;
@@ -2804,9 +2820,9 @@
 
     pAddStaParams->shortPreambleSupported = (tANI_U8)psessionEntry->beaconParams.fShortPreamble;
 #ifdef WLAN_FEATURE_11AC
-    limPopulateOwnRateSet(pMac, &pAddStaParams->supportedRates, NULL, false,psessionEntry, NULL);
+    limPopulatePeerRateSet(pMac, &pAddStaParams->supportedRates, NULL, false,psessionEntry, NULL);
 #else
-    limPopulateOwnRateSet(pMac, &pAddStaParams->supportedRates, NULL, false,psessionEntry);
+    limPopulatePeerRateSet(pMac, &pAddStaParams->supportedRates, NULL, false,psessionEntry);
 #endif
 
     if( psessionEntry->htCapability)
@@ -2850,30 +2866,28 @@
     // Lets save this for when we receive the Reassoc Rsp
     pMac->ft.ftPEContext.pAddStaReq = pAddStaParams;
 
-    if (pCbackParams != NULL)
+    if (pAddBssParams != NULL)
     {
-        if (pCbackParams->cbackDataPtr != NULL)
-        {
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pCbackParams->cbackDataPtr);        
-        }
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pCbackParams);        
+        vos_mem_free(pAddBssParams);
+        pAddBssParams = NULL;
+        limMsgQ->bodyptr = NULL;
     }
     return;
 
 end:
     // Free up buffer allocated for reassocReq
-    if (pMlmReassocReq != NULL)
+    if (psessionEntry != NULL)
+    if (psessionEntry->pLimMlmReassocReq != NULL)
     {
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmReassocReq);
+        vos_mem_free(psessionEntry->pLimMlmReassocReq);
+        psessionEntry->pLimMlmReassocReq = NULL;
     }
 
-    if (pCbackParams != NULL)
+    if (pAddBssParams != NULL)
     {
-        if (pCbackParams->cbackDataPtr != NULL)
-        {
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pCbackParams->cbackDataPtr);        
-        }
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pCbackParams);        
+        vos_mem_free(pAddBssParams);
+        pAddBssParams = NULL;
+        limMsgQ->bodyptr = NULL;
     }
 
     mlmReassocCnf.resultCode = eSIR_SME_FT_REASSOC_FAILURE;
@@ -2886,75 +2900,7 @@
 
     limPostSmeMessage(pMac, LIM_MLM_REASSOC_CNF, (tANI_U32 *) &mlmReassocCnf);
 }
-/*------------------------------------------------------------------------------------------
- *
- * Function to handle WDA_ADD_BSS_RSP, in FT reassoc state.
- *
- *
- *------------------------------------------------------------------------------------------
- */
-static inline void
-limProcessStaMlmAddBssRspFT(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ, tpPESession psessionEntry)
-{
-    tSetLinkCbackParams * pCbackParam = NULL;
-    tAddBssParams * pAddBssCbackInfo = NULL;
-    tLimMlmReassocCnf       mlmReassocCnf;
-    tpAddBssParams pAddBssParams = (tpAddBssParams) limMsgQ->bodyptr;
-
-    if ( eLIM_MLM_WT_ADD_BSS_RSP_FT_REASSOC_STATE != psessionEntry->limMlmState )
-    {
-        goto end;
-    }
-
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **) &pCbackParam, sizeof( tSetLinkCbackParams )))
-    {
-        PELOGE(limLog(pMac, LOGE,  FL("Could not allocate memory for LinkState callback params"));)
-        goto end;
-    }
-
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **) &pAddBssCbackInfo, sizeof( tAddBssParams )))
-    {
-        PELOGE(limLog(pMac, LOGE,  FL("Could not allocate memory for Add BSS info callback param"));)
-        goto end;
-    }
-
-    vos_mem_copy(pAddBssCbackInfo, pAddBssParams, sizeof(tAddBssParams));
-
-    pCbackParam->cbackDataPtr = (void*)pAddBssCbackInfo;
-
-    // Set the filter state to post assoc and send out re-assoc request OTA only after response is received
-    if (limSetLinkState(pMac, eSIR_LINK_POSTASSOC_STATE,
-            pAddBssParams->bssId, psessionEntry->selfMacAddr,
-            (tpSetLinkStateCallback)limSetLinkStateForPostAssocCallback, 
-                        (void *)pCbackParam) != eSIR_SUCCESS)
-    {
-        PELOGE(limLog(pMac, LOGE,  FL("Failed to set the LinkState"));)
-        goto end;
-    }
-
-    return;
-
-end:
-
-    if (pCbackParam != NULL)
-    {
-        if (pCbackParam->cbackDataPtr != NULL)
-        {
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pCbackParam->cbackDataPtr);        
-        }
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pCbackParam);        
-    }
-
-    mlmReassocCnf.resultCode = eSIR_SME_FT_REASSOC_FAILURE;
-    mlmReassocCnf.protStatusCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
-    /* Update PE sessio Id*/
-    mlmReassocCnf.sessionId = psessionEntry->peSessionId;
-
-    limPostSmeMessage(pMac, LIM_MLM_REASSOC_CNF, (tANI_U32 *) &mlmReassocCnf);
-}
 #endif /* WLAN_FEATURE_VOWIFI_11R */
-
-
 /**
  * limProcessStaMlmAddBssRsp()
  *
@@ -3089,7 +3035,7 @@
     }
     end:
     if( 0 != limMsgQ->bodyptr )
-        palFreeMemory( pMac->hHdd,(void *) pAddBssParams );
+        vos_mem_free(pAddBssParams);
 }
 
 
@@ -3146,7 +3092,7 @@
     {
         limLog( pMac, LOGE, FL( "Session Does not exist for given sessionId" ));
             if( NULL != pAddBssParams )
-                palFreeMemory( pMac->hHdd, (void *) pAddBssParams );
+                vos_mem_free(pAddBssParams);
         return;
     }
     /* update PE session Id*/
@@ -3165,7 +3111,7 @@
                   psessionEntry->limMlmState );
                 mlmStartCnf.resultCode = eSIR_SME_BSS_ALREADY_STARTED_OR_JOINED;
                 if( 0 != limMsgQ->bodyptr )
-                    palFreeMemory( pMac->hHdd, (void *) pAddBssParams );
+                    vos_mem_free(pAddBssParams);
                 limPostSmeMessage( pMac, LIM_MLM_START_CNF, (tANI_U32 *) &mlmStartCnf );
             }
             else if ((psessionEntry->bssType == eSIR_BTAMP_AP_MODE)||(psessionEntry->bssType == eSIR_BTAMP_STA_MODE))
@@ -3191,8 +3137,7 @@
         if ( eSIR_SUCCESS != limSendExcludeUnencryptInd(pMac, FALSE, psessionEntry) )
         {
             limLog( pMac, LOGE,
-                    FL( "Could not send down Exclude Unencrypted Indication!" ),
-                    psessionEntry->limMlmState );
+                    FL( "Could not send down Exclude Unencrypted Indication!" ) );
         }
     }
 #endif
@@ -3239,7 +3184,7 @@
     tANI_U8  sessionId = 0;
     tpPESession  psessionEntry;
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-    palZeroMemory( pMac->hHdd, (void *)&mlmSetKeysCnf, sizeof( tLimMlmSetKeysCnf ));
+    vos_mem_set((void *)&mlmSetKeysCnf, sizeof( tLimMlmSetKeysCnf ), 0);
    //BTAMP
     if( NULL == limMsgQ->bodyptr )
     {
@@ -3250,7 +3195,7 @@
     if((psessionEntry = peFindSessionBySessionId(pMac, sessionId))== NULL)
     {
         PELOGE(limLog(pMac, LOGE,FL("session does not exist for given sessionId"));)
-        palFreeMemory( pMac->hHdd, (void *) limMsgQ->bodyptr );
+        vos_mem_free(limMsgQ->bodyptr);
         return;
     }
     if( eLIM_MLM_WT_SET_STA_KEY_STATE != psessionEntry->limMlmState )
@@ -3263,7 +3208,7 @@
     else
       mlmSetKeysCnf.resultCode = (tANI_U16) (((tpSetStaKeyParams) limMsgQ->bodyptr)->status);
 
-    palFreeMemory( pMac->hHdd, (void *) limMsgQ->bodyptr );
+    vos_mem_free(limMsgQ->bodyptr);
     // Restore MLME state
     psessionEntry->limMlmState = psessionEntry->limPrevMlmState;
     MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId, psessionEntry->limMlmState));
@@ -3273,9 +3218,11 @@
         // Prepare and Send LIM_MLM_SETKEYS_CNF
         if( NULL != lpLimMlmSetKeysReq )
         {
-            palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmSetKeysCnf.peerMacAddr, (tANI_U8 *) lpLimMlmSetKeysReq->peerMacAddr, sizeof(tSirMacAddr) );
+            vos_mem_copy((tANI_U8 *) &mlmSetKeysCnf.peerMacAddr,
+                         (tANI_U8 *) lpLimMlmSetKeysReq->peerMacAddr,
+                          sizeof(tSirMacAddr));
             // Free the buffer cached for the global pMac->lim.gpLimMlmSetKeysReq
-            palFreeMemory(pMac->hHdd, (tANI_U8 *) pMac->lim.gpLimMlmSetKeysReq);
+            vos_mem_free(pMac->lim.gpLimMlmSetKeysReq);
             pMac->lim.gpLimMlmSetKeysReq = NULL;
         }
         mlmSetKeysCnf.sessionId = sessionId;
@@ -3290,7 +3237,7 @@
     tANI_U8           sessionId = 0;
     tpPESession  psessionEntry;
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-    palZeroMemory( pMac->hHdd, (void *)&mlmSetKeysCnf, sizeof( tLimMlmSetKeysCnf ));
+    vos_mem_set((void *)&mlmSetKeysCnf, sizeof( tLimMlmSetKeysCnf ), 0);
    //BTAMP
     if( NULL == limMsgQ->bodyptr )
     {
@@ -3301,7 +3248,7 @@
     if((psessionEntry = peFindSessionBySessionId(pMac, sessionId))== NULL)
     {
         PELOGE(limLog(pMac, LOGE,FL("session does not exist for given sessionId"));)
-        palFreeMemory( pMac->hHdd, (void *) limMsgQ->bodyptr );
+        vos_mem_free( limMsgQ->bodyptr );
         return;
     }
     if( eLIM_MLM_WT_SET_BSS_KEY_STATE == psessionEntry->limMlmState )
@@ -3328,7 +3275,7 @@
     else
       mlmSetKeysCnf.resultCode = resultCode;
 
-    palFreeMemory( pMac->hHdd, (void *) limMsgQ->bodyptr );
+    vos_mem_free(limMsgQ->bodyptr);
     // Restore MLME state
     psessionEntry->limMlmState = psessionEntry->limPrevMlmState;
 
@@ -3341,9 +3288,11 @@
         // Prepare and Send LIM_MLM_SETKEYS_CNF
         if( NULL != lpLimMlmSetKeysReq )
         {
-            palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmSetKeysCnf.peerMacAddr, (tANI_U8 *) lpLimMlmSetKeysReq->peerMacAddr, sizeof(tSirMacAddr) );
+            vos_mem_copy((tANI_U8 *) &mlmSetKeysCnf.peerMacAddr,
+                         (tANI_U8 *) lpLimMlmSetKeysReq->peerMacAddr,
+                         sizeof(tSirMacAddr));
             // Free the buffer cached for the global pMac->lim.gpLimMlmSetKeysReq
-            palFreeMemory(pMac->hHdd, (tANI_U8 *) pMac->lim.gpLimMlmSetKeysReq);
+            vos_mem_free(pMac->lim.gpLimMlmSetKeysReq);
             pMac->lim.gpLimMlmSetKeysReq = NULL;
         }
         limPostSmeMessage(pMac, LIM_MLM_SETKEYS_CNF, (tANI_U32 *) &mlmSetKeysCnf);
@@ -3373,7 +3322,7 @@
     tANI_U8              sessionId = 0;
     tpPESession  psessionEntry;
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-    palZeroMemory( pMac->hHdd, (void *) &mlmRemoveCnf, sizeof( tLimMlmRemoveKeyCnf ));
+    vos_mem_set((void *) &mlmRemoveCnf, sizeof( tLimMlmRemoveKeyCnf ), 0);
 
     if( NULL == limMsgQ->bodyptr )
     {
@@ -3416,7 +3365,7 @@
     // Need to inspect tSirMsgQ.reserved for a valid Dialog token!
     //
 
-    palFreeMemory( pMac->hHdd, (void *) limMsgQ->bodyptr );
+    vos_mem_free(limMsgQ->bodyptr);
 
     // Restore MLME state
     psessionEntry->limMlmState = psessionEntry->limPrevMlmState;
@@ -3430,10 +3379,11 @@
     // Prepare and Send LIM_MLM_REMOVEKEY_CNF
         if( NULL != lpLimMlmRemoveKeyReq )
     {
-            palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmRemoveCnf.peerMacAddr, (tANI_U8 *) lpLimMlmRemoveKeyReq->peerMacAddr,
-                      sizeof( tSirMacAddr ));
+            vos_mem_copy((tANI_U8 *) &mlmRemoveCnf.peerMacAddr,
+                         (tANI_U8 *) lpLimMlmRemoveKeyReq->peerMacAddr,
+                         sizeof( tSirMacAddr ));
         // Free the buffer cached for the global pMac->lim.gpLimMlmRemoveKeyReq
-        palFreeMemory(pMac->hHdd, (tANI_U8 *) pMac->lim.gpLimMlmRemoveKeyReq);
+        vos_mem_free(pMac->lim.gpLimMlmRemoveKeyReq);
         pMac->lim.gpLimMlmRemoveKeyReq = NULL;
     }
         limPostSmeMessage( pMac, LIM_MLM_REMOVEKEY_CNF, (tANI_U32 *) &mlmRemoveCnf );
@@ -3457,20 +3407,32 @@
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
     pInitScanParam = (tpInitScanParams) body;
     status = pInitScanParam->status;
-    palFreeMemory( pMac->hHdd, (char *)body);
+    vos_mem_free(body);
 
     //Only abort scan if the we are scanning.
     if( pMac->lim.abortScan && 
        (eLIM_HAL_INIT_SCAN_WAIT_STATE == pMac->lim.gLimHalScanState) )
     {
-        limLog( pMac, LOGW, FL(" finish scan") );
+        limLog( pMac, LOGW, FL(" abort scan") );
         pMac->lim.abortScan = 0;
         limDeactivateAndChangeTimer(pMac, eLIM_MIN_CHANNEL_TIMER);
         limDeactivateAndChangeTimer(pMac, eLIM_MAX_CHANNEL_TIMER);
         //Set the resume channel to Any valid channel (invalid). 
         //This will instruct HAL to set it to any previous valid channel.
         peSetResumeChannel(pMac, 0, 0);
-        limSendHalFinishScanReq(pMac, eLIM_HAL_FINISH_SCAN_WAIT_STATE);
+        if (status != eHAL_STATUS_SUCCESS)
+        {
+           PELOGW(limLog(pMac, LOGW, FL("InitScnRsp failed status=%d"),status);)
+           pMac->lim.gLimHalScanState = eLIM_HAL_IDLE_SCAN_STATE;
+           pMac->lim.gLimNumOfConsecutiveBkgndScanFailure += 1;
+           limCompleteMlmScan(pMac, eSIR_SME_HAL_SCAN_INIT_FAILED);
+           return;
+        }
+        else
+        {
+           limSendHalFinishScanReq(pMac, eLIM_HAL_FINISH_SCAN_WAIT_STATE);
+        }
+
     }
     switch(pMac->lim.gLimHalScanState)
     {
@@ -3589,7 +3551,7 @@
     {
         /* Update PE session Id*/
         mlmReassocCnf.sessionId = pMlmReassocReq->sessionId;
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmReassocReq);
+        vos_mem_free(pMlmReassocReq);
     }
     else
     {
@@ -3656,9 +3618,9 @@
     // Apply previously set configuration at HW
     limApplyConfiguration(pMac, psessionEntry);
     /// Wait for Beacon to announce join success
-    palCopyMemory( pMac->hHdd, ssId.ssId,
-                          psessionEntry->ssId.ssId,
-                          psessionEntry->ssId.length);
+    vos_mem_copy(ssId.ssId,
+                 psessionEntry->ssId.ssId,
+                 psessionEntry->ssId.length);
     ssId.length = psessionEntry->ssId.length;
 
     limDeactivateAndChangeTimer(pMac, eLIM_PERIODIC_JOIN_PROBE_REQ_TIMER);
@@ -3697,7 +3659,7 @@
 error:  
     if(NULL != psessionEntry)
     {
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) (psessionEntry->pLimMlmJoinReq));
+        vos_mem_free(psessionEntry->pLimMlmJoinReq);
         psessionEntry->pLimMlmJoinReq = NULL;
         mlmJoinCnf.sessionId = psessionEntry->peSessionId;
     }
@@ -3745,7 +3707,7 @@
     peSessionId = pChnlParams->peSessionId;
     if((psessionEntry = peFindSessionBySessionId(pMac, peSessionId))== NULL)
     {
-        palFreeMemory( pMac->hHdd, (tANI_U8 *)body);
+        vos_mem_free(body);
         limLog(pMac, LOGP, FL("session does not exist for given sessionId"));
         return;
     }
@@ -3754,9 +3716,11 @@
     //Store this value to use in TPC report IE.
     rrmCacheMgmtTxPower( pMac, pChnlParams->txMgmtPower, psessionEntry );
 #endif
-    palFreeMemory( pMac->hHdd, (tANI_U8 *)body);
+    vos_mem_free(body);
     channelChangeReasonCode = psessionEntry->channelChangeReasonCode;
     // initialize it back to invalid id
+    psessionEntry->chainMask = pChnlParams->chainMask;
+    psessionEntry->smpsMode = pChnlParams->smpsMode;
     psessionEntry->channelChangeReasonCode = 0xBAD;
     switch(channelChangeReasonCode)
     {
@@ -3819,7 +3783,7 @@
     //Store start TSF of scan start. This will be stored in BSS params.
     rrmUpdateStartTSF( pMac, pStartScanParam->startTSF );
 #endif
-    palFreeMemory( pMac->hHdd, (tANI_U8 *)body);
+    vos_mem_free(body);
     if( pMac->lim.abortScan )
     {
         limLog( pMac, LOGW, FL(" finish scan") );
@@ -3868,7 +3832,7 @@
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
     pEndScanParam = (tpEndScanParams) body;
     status = pEndScanParam->status;
-    palFreeMemory( pMac->hHdd, (char *)body);
+    vos_mem_free(body);
     switch(pMac->lim.gLimHalScanState)
     {
         case eLIM_HAL_END_SCAN_WAIT_STATE:
@@ -3958,7 +3922,11 @@
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
     pFinishScanParam = (tpFinishScanParams) body;
     status = pFinishScanParam->status;
-    palFreeMemory( pMac->hHdd, (char *)body);
+    vos_mem_free(body);
+
+    limLog(pMac, LOGW, FL("Rcvd FinishScanRsp in state %d"),
+                        pMac->lim.gLimHalScanState);
+
     switch(pMac->lim.gLimHalScanState)
     {
         case eLIM_HAL_FINISH_SCAN_WAIT_STATE:
@@ -4004,7 +3972,7 @@
 //end WLAN_SUSPEND_LINK Related
 
         default:
-            limLog(pMac, LOGW, FL("Rcvd FinishScanRsp not in WAIT State, state %d"),
+            limLog(pMac, LOGE, FL("Rcvd FinishScanRsp not in WAIT State, state %d"),
                         pMac->lim.gLimHalScanState);
             break;
     }
@@ -4030,9 +3998,6 @@
     tpPESession     psessionEntry = NULL;
     tpAddBAParams pAddBAParams = (tpAddBAParams) limMsgQ->bodyptr;
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
-    limDiagEventReport(pMac, WLAN_PE_DIAG_HAL_ADDBA_RSP_EVENT, psessionEntry, 0, 0);
-#endif //FEATURE_WLAN_DIAG_SUPPORT
     //now LIM can process any defer message.
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
     if (pAddBAParams == NULL) {
@@ -4042,7 +4007,7 @@
     if((psessionEntry = peFindSessionBySessionId(pMac, pAddBAParams->sessionId))==NULL)
     {
         PELOGE(limLog(pMac, LOGE,FL("session does not exist for given sessionID: %d"),pAddBAParams->sessionId );)
-        palFreeMemory(pMac->hHdd, (void*)limMsgQ->bodyptr);
+        vos_mem_free(limMsgQ->bodyptr);
         return;
     }
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
@@ -4050,16 +4015,16 @@
 #endif //FEATURE_WLAN_DIAG_SUPPORT
 
     // Allocate for LIM_MLM_ADDBA_CNF
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pMlmAddBACnf, sizeof( tLimMlmAddBACnf ))) {
-        limLog( pMac, LOGP, FL(" palAllocateMemory failed with error code %d"));
-        palFreeMemory(pMac->hHdd, (void*)limMsgQ->bodyptr);
+    pMlmAddBACnf = vos_mem_malloc(sizeof(tLimMlmAddBACnf));
+    if ( NULL == pMlmAddBACnf ) {
+        limLog( pMac, LOGP, FL(" AllocateMemory failed for pMlmAddBACnf"));
+        vos_mem_free(limMsgQ->bodyptr);
         return;
     }
-    palZeroMemory( pMac->hHdd, (void *) pMlmAddBACnf, sizeof( tLimMlmAddBACnf ));
+     vos_mem_set((void *) pMlmAddBACnf, sizeof( tLimMlmAddBACnf ), 0);
      // Copy the peer MAC
-     palCopyMemory( pMac->hHdd, pMlmAddBACnf->peerMacAddr, pAddBAParams->peerMacAddr,
-                                                                                 sizeof( tSirMacAddr ));
+     vos_mem_copy(pMlmAddBACnf->peerMacAddr, pAddBAParams->peerMacAddr,
+                  sizeof( tSirMacAddr ));
      // Copy other ADDBA Rsp parameters
      pMlmAddBACnf->baDialogToken = pAddBAParams->baDialogToken;
      pMlmAddBACnf->baTID = pAddBAParams->baTID;
@@ -4072,7 +4037,7 @@
         pMlmAddBACnf->addBAResultCode = eSIR_MAC_SUCCESS_STATUS;
      else
         pMlmAddBACnf->addBAResultCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
-     palFreeMemory(pMac->hHdd, (void*)limMsgQ->bodyptr);
+     vos_mem_free(limMsgQ->bodyptr);
      // Send ADDBA CNF to LIM
      limPostSmeMessage( pMac, LIM_MLM_ADDBA_CNF, (tANI_U32 *) pMlmAddBACnf );
 }
@@ -4104,7 +4069,7 @@
   if((psessionEntry = peFindSessionBySessionId(pMac,pMlmAddBACnf->sessionId))== NULL)
   {
         PELOGE(limLog(pMac, LOGE,FL("session does not exist for given BSSId"));)
-        palFreeMemory( pMac->hHdd, (void *) pMsgBuf );
+        vos_mem_free(pMsgBuf);
         return;
   }
   // First, extract the DPH entry
@@ -4113,7 +4078,7 @@
   {
     PELOGE(limLog( pMac, LOGE,
         FL( "STA context not found - ignoring ADDBA CNF from HAL" ));)
-    palFreeMemory( pMac->hHdd, (void *) pMsgBuf );
+    vos_mem_free(pMsgBuf);
     return;
   }
   LIM_GET_STA_BA_STATE(pSta, pMlmAddBACnf->baTID, &curBaState);
@@ -4123,7 +4088,7 @@
     PELOGE(limLog( pMac, LOGE,
         FL( "Received unexpected ADDBA CNF when STA BA state is %d" ),
         curBaState );)
-      palFreeMemory( pMac->hHdd, (void *) pMsgBuf );
+      vos_mem_free(pMsgBuf);
     return;
   }
   // Restore STA BA state
@@ -4165,7 +4130,7 @@
     }
   }
   // Free the memory allocated for LIM_MLM_ADDBA_CNF
-  palFreeMemory( pMac->hHdd, (void *) pMsgBuf );
+  vos_mem_free(pMsgBuf);
 }
 /**
  * \brief Process LIM_MLM_DELBA_CNF
@@ -4197,7 +4162,7 @@
     if((psessionEntry = peFindSessionBySessionId(pMac, pMlmDelBACnf->sessionId))== NULL)
    {
         limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
-        palFreeMemory( pMac->hHdd, (void *) pMsgBuf );
+        vos_mem_free(pMsgBuf);
         return;
    }
     // First, extract the DPH entry
@@ -4206,7 +4171,7 @@
     {
         limLog( pMac, LOGE,
             FL( "STA context not found - ignoring DELBA CNF from HAL" ));
-        palFreeMemory( pMac->hHdd, (void *) pMsgBuf );
+        vos_mem_free(pMsgBuf);
         return;
     }
     if(NULL == pMlmDelBACnf)
@@ -4222,13 +4187,13 @@
         limLog( pMac, LOGE,
         FL( "Received unexpected DELBA CNF when STA BA state is %d" ),
         curBaState );
-        palFreeMemory( pMac->hHdd, (void *) pMsgBuf );
+        vos_mem_free(pMsgBuf);
         return;
     }
     // Restore STA BA state
     LIM_SET_STA_BA_STATE(pSta, pMlmDelBACnf->baTID, eLIM_BA_STATE_IDLE);
     // Free the memory allocated for LIM_MLM_DELBA_CNF
-    palFreeMemory( pMac->hHdd, (void *) pMsgBuf );
+    vos_mem_free(pMsgBuf);
 }
 /**
  * \brief Process SIR_LIM_DEL_BA_IND
@@ -4257,7 +4222,7 @@
     if((psessionEntry = peFindSessionByBssid(pMac,pBADeleteParams->bssId,&sessionId))== NULL)
     {
         PELOGE(limLog(pMac, LOGE,FL("session does not exist for given BSSId"));)
-        palFreeMemory( pMac->hHdd, (void *) limMsgQ->bodyptr );
+        vos_mem_free(limMsgQ->bodyptr);
         return;
     }
     // First, extract the DPH entry
@@ -4320,7 +4285,7 @@
   }
 returnAfterCleanup:
   // Free the memory allocated for SIR_LIM_DEL_BA_IND
-  palFreeMemory( pMac->hHdd, (void *) limMsgQ->bodyptr );
+  vos_mem_free(limMsgQ->bodyptr);
 }
 /**
  *  @function : limProcessSetMimoRsp()
@@ -4378,7 +4343,7 @@
             tSirMacAddr            macAddr;
 
             /** Obtain the AP's Mac Address */
-            palCopyMemory(pMac -> hHdd, (tANI_U8 *)macAddr, pMac->lim.gLimBssid, sizeof(tSirMacAddr));
+            vos_mem_copy((tANI_U8 *)macAddr, pMac->lim.gLimBssid, sizeof(tSirMacAddr));
 
             /** Send Action Frame with the corresponding mode */
             retStatus = limSendSMPowerStateFrame(pMac, macAddr, pMIMO_PSParams->htMIMOPSState);
@@ -4390,7 +4355,7 @@
         PELOG1(limLog(pMac, LOG1, FL("The Setting up of LimGlobals is successful for MIMOPS"));)
     }while(0);
 
-    palFreeMemory( pMac->hHdd, (void *) pMIMO_PSParams );
+    vos_mem_free((void *) pMIMO_PSParams);
 #endif
 }
 /**
@@ -4468,11 +4433,11 @@
             {
                 mlmReassocCnf.resultCode = eSIR_SME_RESOURCES_UNAVAILABLE;
                 mlmReassocCnf.protStatusCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
-                palFreeMemory(pMac->hHdd, assocRsp);
+                vos_mem_free(assocRsp);
                 pMac->lim.gLimAssocResponseData = NULL;
                 goto Error;
             }
-            palFreeMemory(pMac->hHdd, assocRsp);
+            vos_mem_free(assocRsp);
             psessionEntry->limAssocResponseData = NULL;
         }
         break;
@@ -4559,7 +4524,7 @@
     limPostSmeMessage( pMac, LIM_MLM_START_CNF, (tANI_U32 *) &mlmStartCnf );
     end:
     if( 0 != limMsgQ->bodyptr )
-        palFreeMemory( pMac->hHdd, (void *) pAddBssParams );
+        vos_mem_free(pAddBssParams);
 }
 
 /**
@@ -4592,10 +4557,10 @@
             tpDphHashNode   pStaDs;
             tSirRetStatus       retStatus = eSIR_SUCCESS;
             tSchBeaconStruct *pBeaconStruct;
-            if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                        (void **)&pBeaconStruct, sizeof(tSchBeaconStruct)))
+            pBeaconStruct = vos_mem_malloc(sizeof(tSchBeaconStruct));
+            if ( NULL == pBeaconStruct )
             {
-                limLog(pMac, LOGE, FL("Unable to PAL allocate memory in limHandleAddBssInReAssocContext") );
+                limLog(pMac, LOGE, FL("Unable to allocate memory in limHandleAddBssInReAssocContext") );
                 mlmReassocCnf.resultCode = eSIR_SME_RESOURCES_UNAVAILABLE;
                 mlmReassocCnf.protStatusCode = eSIR_SME_RESOURCES_UNAVAILABLE;
                 goto Error;
@@ -4608,7 +4573,7 @@
                 PELOGE(limLog(pMac, LOGE, FL("Fail to get STA PEER entry from hash"));)
                 mlmReassocCnf.resultCode = eSIR_SME_RESOURCES_UNAVAILABLE;
                 mlmReassocCnf.protStatusCode = eSIR_SME_SUCCESS;
-                palFreeMemory(pMac->hHdd, pBeaconStruct);
+                vos_mem_free(pBeaconStruct);
                 goto Error;
             }
             /** While Processing the ReAssoc Response Frame the ReAssocRsp Frame
@@ -4641,14 +4606,14 @@
             {
                 mlmReassocCnf.resultCode = eSIR_SME_RESOURCES_UNAVAILABLE;
                 mlmReassocCnf.protStatusCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
-                palFreeMemory(pMac->hHdd, assocRsp);
+                vos_mem_free(assocRsp);
                 pMac->lim.gLimAssocResponseData = NULL;
-                palFreeMemory(pMac->hHdd, pBeaconStruct);
+                vos_mem_free(pBeaconStruct);
                 goto Error;
             }
-            palFreeMemory(pMac->hHdd, assocRsp);
+            vos_mem_free(assocRsp);
             psessionEntry->limAssocResponseData = NULL;
-            palFreeMemory(pMac->hHdd, pBeaconStruct);
+            vos_mem_free(pBeaconStruct);
         }
         break;
         case eLIM_SME_WT_REASSOC_LINK_FAIL_STATE: {     /** Case wherein the DisAssoc / Deauth
@@ -4727,7 +4692,7 @@
        goto end;
     }
     if ((pStaDs &&
-         (( !palEqualMemory( pMac->hHdd,(tANI_U8 *) pStaDs->staAddr,
+         (( !vos_mem_compare((tANI_U8 *) pStaDs->staAddr,
                      (tANI_U8 *) assocCnf.peerMacAddr,
                      sizeof(tSirMacAddr)) ) ||
           (pStaDs->mlmStaContext.mlmState != eLIM_MLM_WT_ASSOC_CNF_STATE) ||
@@ -4775,11 +4740,11 @@
     {
         if ( ((tpSirAssocReq)(psessionEntry->parsedAssocReq[pStaDs->assocId]))->assocReqFrame) 
         {
-            palFreeMemory(pMac->hHdd,((tpSirAssocReq)(psessionEntry->parsedAssocReq[pStaDs->assocId]))->assocReqFrame);
+            vos_mem_free(((tpSirAssocReq)(psessionEntry->parsedAssocReq[pStaDs->assocId]))->assocReqFrame);
             ((tpSirAssocReq)(psessionEntry->parsedAssocReq[pStaDs->assocId]))->assocReqFrame = NULL;
         }        
 
-        palFreeMemory(pMac->hHdd, psessionEntry->parsedAssocReq[pStaDs->assocId]);
+        vos_mem_free(psessionEntry->parsedAssocReq[pStaDs->assocId]);
         psessionEntry->parsedAssocReq[pStaDs->assocId] = NULL;
     }
 } /*** end __limProcessSmeAssocCnfNew() ***/
@@ -4795,17 +4760,17 @@
                         FL( "Error:Unable to get the PESessionEntry" ));)
        return;
     }
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                                            (void **) &pBeaconGenParams, (sizeof(*pBeaconGenParams))))
+    pBeaconGenParams = vos_mem_malloc(sizeof(*pBeaconGenParams));
+    if ( NULL == pBeaconGenParams )
     {
         PELOGE( limLog( pMac, LOGP,
-                        FL( "Unable to PAL allocate memory during sending beaconPreMessage" ));)
+                        FL( "Unable to allocate memory during sending beaconPreMessage" ));)
         return;
     }
-    palZeroMemory( pMac->hHdd, pBeaconGenParams, sizeof(*pBeaconGenParams));
-    palCopyMemory( pMac->hHdd, (void *) pBeaconGenParams->bssId,
-                    (void *)psessionEntry->bssId,
-                    SIR_MAC_ADDR_LENGTH );
+    vos_mem_set(pBeaconGenParams, sizeof(*pBeaconGenParams), 0);
+    vos_mem_copy((void *) pBeaconGenParams->bssId,
+                 (void *)psessionEntry->bssId,
+                  SIR_MAC_ADDR_LENGTH );
     limMsg.bodyptr = pBeaconGenParams;
     schProcessPreBeaconInd(pMac, &limMsg);
     return;
@@ -4864,7 +4829,6 @@
     limSendSmeScanRsp(pMac, scanRspLen, pScanEvent->reasonCode,
             pScanEvent->sessionId,
             0);
-
 #ifdef FEATURE_WLAN_SCAN_PNO
     limSendSmeScanCacheUpdatedInd();
 #endif
@@ -4876,7 +4840,7 @@
     tSirScanOffloadEvent *pScanEvent = (tSirScanOffloadEvent *) buf;
 
     VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
-            "scan_id = %lu", pScanEvent->scanId);
+            "scan_id = %u", pScanEvent->scanId);
 
     switch (pScanEvent->event)
     {
@@ -4889,7 +4853,7 @@
                 limSendSmeRsp(pMac, eWNI_SME_REMAIN_ON_CHN_RSP,
                         eHAL_STATUS_SUCCESS,
                         pScanEvent->sessionId, 0);
-                palFreeMemory( pMac->hHdd, pMac->lim.gpLimRemainOnChanReq );
+                vos_mem_free(pMac->lim.gpLimRemainOnChanReq);
                 pMac->lim.gpLimRemainOnChanReq = NULL;
             }
             else
@@ -4923,7 +4887,7 @@
         case SCAN_EVENT_PREEMPTED:
         default:
             VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_DEBUG,
-                    "Received unhandled scan event %lu", pScanEvent->event);
+                    "Received unhandled scan event %u", pScanEvent->event);
     }
     vos_mem_free(buf);
 }
diff --git a/CORE/MAC/src/pe/lim/limProcessProbeReqFrame.c b/CORE/MAC/src/pe/lim/limProcessProbeReqFrame.c
index ba9a279..aef1e5a 100644
--- a/CORE/MAC/src/pe/lim/limProcessProbeReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessProbeReqFrame.c
@@ -93,8 +93,8 @@
 
     curTime = (tANI_TIMESTAMP)(palGetTickCount(pMac->hHdd) / PAL_TICKS_PER_SECOND);
 
-    palFillMemory( pMac->hHdd, (tANI_U8 *)addr, sizeof(tSirMacAddr), 0);
-    palFillMemory( pMac->hHdd, (tANI_U8 *)uuid_e, SIR_WPS_UUID_LEN, 0);
+    vos_mem_set((tANI_U8 *)addr, sizeof(tSirMacAddr), 0);
+    vos_mem_set((tANI_U8 *)uuid_e, SIR_WPS_UUID_LEN, 0);
 
     for (pbc = psessionEntry->pAPWPSPBCSession; pbc; pbc = pbc->next) {
 
@@ -105,8 +105,8 @@
         if(count > 1)
             break;
             
-        palCopyMemory(pMac->hHdd, (tANI_U8 *)addr, (tANI_U8 *)pbc->addr, sizeof(tSirMacAddr));
-        palCopyMemory(pMac->hHdd, (tANI_U8 *)uuid_e, (tANI_U8 *)pbc->uuid_e, SIR_WPS_UUID_LEN);                
+        vos_mem_copy((tANI_U8 *)addr, (tANI_U8 *)pbc->addr, sizeof(tSirMacAddr));
+        vos_mem_copy((tANI_U8 *)uuid_e, (tANI_U8 *)pbc->uuid_e, SIR_WPS_UUID_LEN);
         }
 
     if (count > 1)
@@ -159,7 +159,7 @@
         PELOG4(sirDumpBuf(pMac, SIR_LIM_MODULE_ID, LOG4, prev->addr, sizeof(tSirMacAddr));)
         PELOG4(sirDumpBuf(pMac, SIR_LIM_MODULE_ID, LOG4, prev->uuid_e, SIR_WPS_UUID_LEN);)
         
-        palFreeMemory(pMac->hHdd, prev);
+        vos_mem_free(prev);
        }
 }
 
@@ -169,12 +169,12 @@
     prev = pbc = psessionEntry->pAPWPSPBCSession;
 
     while (pbc) {
-        if (palEqualMemory(pMac->hHdd, (tANI_U8 *)pbc->addr, 
-              (tANI_U8 *)pRemoveMac, sizeof(tSirMacAddr))) {
+        if (vos_mem_compare((tANI_U8 *)pbc->addr,
+                            (tANI_U8 *)pRemoveMac, sizeof(tSirMacAddr))) {
           prev->next = pbc->next;
           if (pbc == psessionEntry->pAPWPSPBCSession)
             psessionEntry->pAPWPSPBCSession = pbc->next;
-            palFreeMemory(pMac->hHdd, pbc);
+            vos_mem_free(pbc);
             return;
         }
         prev = pbc;
@@ -224,8 +224,8 @@
     pbc = psessionEntry->pAPWPSPBCSession;
 
     while (pbc) {
-        if (palEqualMemory(pMac->hHdd, (tANI_U8 *)pbc->addr, (tANI_U8 *)addr, sizeof(tSirMacAddr)) &&
-            palEqualMemory(pMac->hHdd, (tANI_U8 *)pbc->uuid_e, (tANI_U8 *)uuid_e, SIR_WPS_UUID_LEN)) {
+        if (vos_mem_compare((tANI_U8 *)pbc->addr, (tANI_U8 *)addr, sizeof(tSirMacAddr)) &&
+            vos_mem_compare((tANI_U8 *)pbc->uuid_e, (tANI_U8 *)uuid_e, SIR_WPS_UUID_LEN)) {
             if (prev)
                 prev->next = pbc->next;
             else
@@ -237,16 +237,16 @@
     }
 
     if (!pbc) {
-        if (eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,
-            (void **) &pbc, sizeof(tSirWPSPBCSession)))
+        pbc = vos_mem_malloc(sizeof(tSirWPSPBCSession));
+        if ( NULL == pbc )
         {
             PELOGE(limLog(pMac, LOGE, FL("memory allocate failed!"));)
             return;
         }
-        palCopyMemory(pMac->hHdd, (tANI_U8 *)pbc->addr, (tANI_U8 *)addr, sizeof(tSirMacAddr));
+        vos_mem_copy((tANI_U8 *)pbc->addr, (tANI_U8 *)addr, sizeof(tSirMacAddr));
     
         if (uuid_e)
-            palCopyMemory(pMac->hHdd, (tANI_U8 *)pbc->uuid_e, (tANI_U8 *)uuid_e, SIR_WPS_UUID_LEN);
+            vos_mem_copy((tANI_U8 *)pbc->uuid_e, (tANI_U8 *)uuid_e, SIR_WPS_UUID_LEN);
     }
     
     pbc->next = psessionEntry->pAPWPSPBCSession;
@@ -532,12 +532,12 @@
                         (probeReq.probeReqWscIeInfo.DevicePasswordID.id == WSC_PASSWD_ID_PUSH_BUTTON))
                     {
                         // send the probe req to WSM when it is from a PBC station 
-                        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                               (void **)&pSirSmeProbeReq, sizeof(tSirSmeProbeReq)))
+                        pSirSmeProbeReq = vos_mem_malloc(sizeof(tSirSmeProbeReq));
+                        if ( NULL == pSirSmeProbeReq )
                         {
                             // Log error
                             limLog(pMac, LOGP,
-                               FL("call to palAllocateMemory failed for eWNI_SME_PROBE_REQ"));
+                               FL("call to AllocateMemory failed for eWNI_SME_PROBE_REQ"));
                             return;
                         }
                         msgQ.type = eWNI_SME_PROBE_REQ;
@@ -547,7 +547,7 @@
                         pSirSmeProbeReq->messageType = eWNI_SME_PROBE_REQ;
                         pSirSmeProbeReq->length = sizeof(tSirSmeProbeReq);
                         pSirSmeProbeReq->sessionId = psessionEntry->smeSessionId;
-                        palCopyMemory( pMac->hHdd, pSirSmeProbeReq->peerMacAddr, pHdr->sa, sizeof(tSirMacAddr));
+                        vos_mem_copy(pSirSmeProbeReq->peerMacAddr, pHdr->sa, sizeof(tSirMacAddr));
                         pSirSmeProbeReq->devicePasswdId = probeReq.probeReqWscIeInfo.DevicePasswordID.id;
                         MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, msgQ.type));
                        if (limSysProcessMmhMsgApi(pMac, &msgQ,  ePROT) != eSIR_SUCCESS){
@@ -559,9 +559,9 @@
 
             ssId.length = psessionEntry->ssId.length;
              /* Copy the SSID from sessio entry to local variable */
-            palCopyMemory( pMac->hHdd, ssId.ssId,
-                       psessionEntry->ssId.ssId,
-                       psessionEntry->ssId.length);
+            vos_mem_copy(ssId.ssId,
+                         psessionEntry->ssId.ssId,
+                         psessionEntry->ssId.length);
 
             // Compare received SSID with current SSID. If they
             // match, reply with Probe Response.
@@ -570,7 +570,7 @@
                 if (!ssId.length)
                     goto multipleSSIDcheck;
 
-                if (palEqualMemory( pMac->hHdd,(tANI_U8 *) &ssId,
+                if (vos_mem_compare((tANI_U8 *) &ssId,
                               (tANI_U8 *) &(probeReq.ssId), (tANI_U8) (ssId.length + 1)) )
                 {
                     limSendProbeRspMgmtFrame(pMac, pHdr->sa, &ssId, DPH_USE_MGMT_STAID,
@@ -582,7 +582,7 @@
                 {
                     tANI_U8   direct_ssid[7] = "DIRECT-";
                     tANI_U8   direct_ssid_len = 7;
-                    if (palEqualMemory( pMac->hHdd, (tANI_U8 *) &direct_ssid,
+                    if (vos_mem_compare((tANI_U8 *) &direct_ssid,
                               (tANI_U8 *) &(probeReq.ssId.ssId), (tANI_U8) (direct_ssid_len)) )
                     {
                         limSendProbeRspMgmtFrame(pMac, pHdr->sa, &ssId, DPH_USE_MGMT_STAID,
@@ -777,12 +777,13 @@
 {
     tSirSmeProbeReqInd     *pSirSmeProbeReqInd;
     tSirMsgQ                msgQ;   
-        
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeProbeReqInd, sizeof(tSirSmeProbeReqInd)))
+
+    pSirSmeProbeReqInd = vos_mem_malloc(sizeof(tSirSmeProbeReqInd));
+    if ( NULL == pSirSmeProbeReqInd )
     {
         // Log error
         limLog(pMac, LOGP,
-            FL("call to palAllocateMemory failed for eWNI_SME_PROBE_REQ"));
+            FL("call to AllocateMemory failed for eWNI_SME_PROBE_REQ"));
             return;
     }
     
@@ -794,12 +795,12 @@
     pSirSmeProbeReqInd->length = sizeof(tSirSmeProbeReq);
     pSirSmeProbeReqInd->sessionId = psessionEntry->smeSessionId;
 
-    palCopyMemory( pMac->hHdd, pSirSmeProbeReqInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
-    palCopyMemory( pMac->hHdd, pSirSmeProbeReqInd->WPSPBCProbeReq.peerMacAddr, peerMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy(pSirSmeProbeReqInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
+    vos_mem_copy(pSirSmeProbeReqInd->WPSPBCProbeReq.peerMacAddr, peerMacAddr, sizeof(tSirMacAddr));
 
     MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, msgQ.type));
     pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIELen = (tANI_U16)ProbeReqIELen;
-    palCopyMemory( pMac->hHdd, pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIE, pProbeReqIE, ProbeReqIELen);
+    vos_mem_copy(pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIE, pProbeReqIE, ProbeReqIELen);
     
     if (limSysProcessMmhMsgApi(pMac, &msgQ,  ePROT) != eSIR_SUCCESS){
                             PELOGE(limLog(pMac, LOGE, FL("couldnt send the probe req to hdd"));)
@@ -821,7 +822,7 @@
     pBody =  WDA_GET_RX_MPDU_DATA(pBd);   
 
     if( (pBody[0] == 0) && (pBody[1] == ssId.length) &&
-      (palEqualMemory( pMac->hHdd, ssId.ssId, pBody + 2, 
+      (vos_mem_compare(ssId.ssId, pBody + 2,
                        ssId.length)))
     {
         // Parse Probe Request frame
@@ -837,7 +838,7 @@
         if (psessionEntry->pePersona == VOS_P2P_GO_MODE) 
         {
             ssId.length = psessionEntry->ssId.length;
-            palCopyMemory(pMac->hHdd, ssId.ssId, psessionEntry->ssId.ssId,psessionEntry->ssId.length);
+            vos_mem_copy(ssId.ssId, psessionEntry->ssId.ssId,psessionEntry->ssId.length);
             limSendProbeRspMgmtFrame(pMac, pHdr->sa, &ssId, DPH_USE_MGMT_STAID, DPH_NON_KEEPALIVE_FRAME, 
                                      psessionEntry, probeReq.p2pIePresent );
         } 
diff --git a/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c b/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c
index a11f20a..61f631a 100644
--- a/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limProcessProbeRspFrame.cc contains the code
  * for processing Probe Response Frame.
@@ -101,10 +100,10 @@
     tANI_U8 qosEnabled =    false;
     tANI_U8 wmeEnabled =    false;
 
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                (void **)&pProbeRsp, sizeof(tSirProbeRespBeacon)))
+    pProbeRsp = vos_mem_malloc(sizeof(tSirProbeRespBeacon));
+    if ( NULL == pProbeRsp )
     {
-        limLog(pMac, LOGE, FL("Unable to PAL allocate memory in limProcessProbeRspFrame") );
+        limLog(pMac, LOGE, FL("Unable to allocate memory in limProcessProbeRspFrame") );
         return;
     }
 
@@ -125,7 +124,7 @@
    {
        if (limDeactivateMinChannelTimerDuringScan(pMac) != eSIR_SUCCESS)
        {
-           palFreeMemory(pMac->hHdd, pProbeRsp);
+           vos_mem_free(pProbeRsp);
            return;
        }
    }
@@ -135,7 +134,7 @@
    {
        PELOG1(limLog(pMac, LOG1,
                  FL("Parse error ProbeResponse, length=%d"), frameLen);)
-       palFreeMemory(pMac->hHdd, pProbeRsp);
+       vos_mem_free(pProbeRsp);
        return;
    }
 
@@ -155,7 +154,8 @@
      *
      * Ignore Probe Response frame in all other states
      */
-        // TO SUPPORT BT-AMP
+        /*  */
+   // TO SUPPORT BT-AMP
     if (((pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) ||   //mlm state check should be global - 18th oct
         (pMac->lim.gLimMlmState == eLIM_MLM_PASSIVE_SCAN_STATE) ||     //mlm state check should be global - 18th oct
         (pMac->lim.gLimMlmState == eLIM_MLM_LEARN_STATE) ||            //mlm state check should be global - 18th oct 
@@ -167,6 +167,14 @@
     {
         frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
 
+        if (pMac->lim.gLimBackgroundScanMode == eSIR_ROAMING_SCAN)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                      FL("Probe Resp Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"),
+                      MAC_ADDR_ARRAY(pHdr->bssId),
+                      (uint)abs((tANI_S8)WDA_GET_RX_RSSI_DB(pRxPacketInfo)));
+        }
+
         // Get pointer to Probe Response frame body
         pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
 
@@ -176,7 +184,7 @@
             PELOG1(limLog(pMac, LOG1,
                FL("Parse error ProbeResponse, length=%d"),
                frameLen);)
-            palFreeMemory(pMac->hHdd, pProbeRsp);
+            vos_mem_free(pProbeRsp);
             return;
         }
 
@@ -199,13 +207,13 @@
         {
             if( psessionEntry->beacon != NULL )//Either Beacon/probe response is required. Hence store it in same buffer.
             {
-                palFreeMemory(pMac->hHdd, psessionEntry->beacon);
+                vos_mem_free(psessionEntry->beacon);
                 psessionEntry->beacon = NULL;
             }
             psessionEntry->bcnLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
-            if ((palAllocateMemory(pMac->hHdd, (void**)&psessionEntry->beacon,
-                                   psessionEntry->bcnLen))
-                != eHAL_STATUS_SUCCESS)
+
+            psessionEntry->beacon = vos_mem_malloc(psessionEntry->bcnLen);
+            if ( NULL == psessionEntry->beacon )
             {
                 PELOGE(limLog(pMac, LOGE,
                               FL("Unable to allocate memory to store beacon"));)
@@ -213,9 +221,9 @@
             else
             {
                 //Store the Beacon/ProbeRsp. This is sent to csr/hdd in join cnf response. 
-                palCopyMemory(pMac->hHdd, psessionEntry->beacon,
-                              WDA_GET_RX_MPDU_DATA(pRxPacketInfo),
-                              psessionEntry->bcnLen);
+                vos_mem_copy(psessionEntry->beacon,
+                             WDA_GET_RX_MPDU_DATA(pRxPacketInfo),
+                             psessionEntry->bcnLen);
             }
 
             // STA in WT_JOIN_BEACON_STATE
@@ -241,9 +249,9 @@
             #endif //TO SUPPORT BT-AMP
             sirCopyMacAddr(currentBssId,psessionEntry->bssId);
 
-            if ( !palEqualMemory( pMac->hHdd,currentBssId, pHdr->bssId, sizeof(tSirMacAddr)) )
+            if ( !vos_mem_compare(currentBssId, pHdr->bssId, sizeof(tSirMacAddr)) )
             {
-                palFreeMemory(pMac->hHdd, pProbeRsp);    
+                vos_mem_free(pProbeRsp);
                 return;
             }
 
@@ -321,7 +329,7 @@
                 limHandleIBSScoalescing(pMac, pProbeRsp, pRxPacketInfo,psessionEntry);
     } // if ((pMac->lim.gLimMlmState == eLIM_MLM_WT_PROBE_RESP_STATE) || ...
 
-    palFreeMemory(pMac->hHdd, pProbeRsp);
+    vos_mem_free(pProbeRsp);
     // Ignore Probe Response frame in all other states
     return;
 } /*** end limProcessProbeRspFrame() ***/
@@ -335,10 +343,10 @@
     tpSirMacMgmtHdr         pHdr;
     tSirProbeRespBeacon    *pProbeRsp;
 
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                (void **)&pProbeRsp, sizeof(tSirProbeRespBeacon)))
+    pProbeRsp = vos_mem_malloc(sizeof(tSirProbeRespBeacon));
+    if ( NULL == pProbeRsp )
     {
-        limLog(pMac, LOGE, FL("Unable to PAL allocate memory in limProcessProbeRspFrameNoSession") );
+        limLog(pMac, LOGE, FL("Unable to allocate memory in limProcessProbeRspFrameNoSession") );
         return;
     }
 
@@ -364,7 +372,7 @@
         {
             if (limDeactivateMinChannelTimerDuringScan(pMac) != eSIR_SUCCESS)
             {
-                palFreeMemory(pMac->hHdd, pProbeRsp);
+                vos_mem_free(pProbeRsp);
                 return;
             }
         }
@@ -376,7 +384,7 @@
     {
        PELOG1(limLog(pMac, LOG1,FL("Parse error ProbeResponse, length=%d"),
               frameLen);)
-       palFreeMemory(pMac->hHdd, pProbeRsp);
+       vos_mem_free(pProbeRsp);
        return;
     }
     /*  Since there is no psessionEntry, PE cannot be in the following states:
@@ -394,13 +402,21 @@
     {
         frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
 
+        if (pMac->lim.gLimBackgroundScanMode == eSIR_ROAMING_SCAN)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                      FL("Probe Resp Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"),
+                      MAC_ADDR_ARRAY(pHdr->bssId),
+                      (uint)abs((tANI_S8)WDA_GET_RX_RSSI_DB(pRxPacketInfo)));
+        }
+
         // Get pointer to Probe Response frame body
         pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
 
         if (sirConvertProbeFrame2Struct(pMac, pBody, frameLen, pProbeRsp) == eSIR_FAILURE)
         {
             limLog(pMac, LOG1, FL("Parse error ProbeResponse, length=%d\n"), frameLen);
-            palFreeMemory(pMac->hHdd, pProbeRsp);
+            vos_mem_free(pProbeRsp);
             return;
         }
         limLog( pMac, LOG2, FL("Save this probe rsp in LFR cache"));
@@ -421,7 +437,7 @@
         {
             limLog(pMac, LOG1,
                     FL("Parse error ProbeResponse, length=%d\n"), frameLen);
-            palFreeMemory(pMac->hHdd, pProbeRsp);
+            vos_mem_free(pProbeRsp);
             return;
         }
         limCheckAndAddBssDescription(pMac, pProbeRsp, pRxPacketInfo,
@@ -433,13 +449,21 @@
     {
         frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
 
+        if (pMac->lim.gLimBackgroundScanMode == eSIR_ROAMING_SCAN)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                      FL("Probe Resp Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"),
+                      MAC_ADDR_ARRAY(pHdr->bssId),
+                      (uint)abs((tANI_S8)WDA_GET_RX_RSSI_DB(pRxPacketInfo)));
+        }
+
         // Get pointer to Probe Response frame body
         pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
 
         if (sirConvertProbeFrame2Struct(pMac, pBody, frameLen, pProbeRsp) == eSIR_FAILURE)
         {
             limLog(pMac, LOG1, FL("Parse error ProbeResponse, length=%d"), frameLen);
-            palFreeMemory(pMac->hHdd, pProbeRsp);
+            vos_mem_free(pProbeRsp);
             return;
         }
 
@@ -450,6 +474,6 @@
         {
         }
     } 
-    palFreeMemory(pMac->hHdd, pProbeRsp);
+    vos_mem_free(pProbeRsp);
     return;
 } /*** end limProcessProbeRspFrameNew() ***/
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index 8c01f38..68b7735 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -56,13 +56,14 @@
 #include "limSendMessages.h"
 #include "limApi.h"
 #include "wmmApsd.h"
+#include "limRMC.h"
 
 #include "sapApi.h"
 
 #if defined WLAN_FEATURE_VOWIFI
 #include "rrmApi.h"
 #endif
-#if defined FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include "ccxApi.h"
 #endif
 
@@ -107,7 +108,6 @@
 
 extern void peRegisterTLHandle(tpAniSirGlobal pMac);
 
-extern int limProcessRemainOnChnlReq(tpAniSirGlobal pMac, tANI_U32 *pMsg);
 
 #ifdef BACKGROUND_SCAN_ENABLED
 
@@ -533,22 +533,22 @@
     
     PELOG1(limLog(pMac, LOG1, FL("Received START_BSS_REQ"));)
 
-    /* Global Sme state and mlm states are not defined yet , for BT-AMP Suppoprt . TO BE DONE */
+    /* Global Sme state and mlm states are not defined yet, for BT-AMP Suppoprt . TO BE DONE */
     if ( (pMac->lim.gLimSmeState == eLIM_SME_OFFLINE_STATE) ||
          (pMac->lim.gLimSmeState == eLIM_SME_IDLE_STATE))
     {
         size = sizeof(tSirSmeStartBssReq) + SIR_MAC_MAX_IE_LENGTH;
 
-
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSmeStartBssReq, size))
+        pSmeStartBssReq = vos_mem_malloc(size);
+        if ( NULL == pSmeStartBssReq )
         {
-            PELOGE(limLog(pMac, LOGE, FL("palAllocateMemory failed for pMac->lim.gpLimStartBssReq"));)
+            PELOGE(limLog(pMac, LOGE, FL("AllocateMemory failed for pMac->lim.gpLimStartBssReq"));)
             /// Send failure response to host
             retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
             goto end;
         }
         
-        (void) palZeroMemory(pMac->hHdd, (void *)pSmeStartBssReq, size);
+        vos_mem_set((void *)pSmeStartBssReq, size, 0);
         
         if ((limStartBssReqSerDes(pMac, pSmeStartBssReq, (tANI_U8 *) pMsgBuf) == eSIR_FAILURE) ||
                 (!limIsSmeStartBssReqValid(pMac, pSmeStartBssReq)))
@@ -564,7 +564,7 @@
 #endif 
 
         /* This is the place where PE is going to create a session.
-         * If session is not existed , then create a new session */
+         * If session is not existed, then create a new session */
         if((psessionEntry = peFindSessionByBssid(pMac,pSmeStartBssReq->bssId,&sessionId)) != NULL)
         {
             limLog(pMac, LOGW, FL("Session Already exists for given BSSID"));
@@ -600,16 +600,14 @@
         sirCopyMacAddr(psessionEntry->selfMacAddr,pSmeStartBssReq->selfMacAddr);
         
         /* Copy SSID to session table */
-        palCopyMemory( pMac->hHdd, (tANI_U8 *)&psessionEntry->ssId,
+        vos_mem_copy( (tANI_U8 *)&psessionEntry->ssId,
                      (tANI_U8 *)&pSmeStartBssReq->ssId,
                       (pSmeStartBssReq->ssId.length + 1));
-        
-       
-        
+
         psessionEntry->bssType = pSmeStartBssReq->bssType;
-        
+
         psessionEntry->nwType = pSmeStartBssReq->nwType;
-        
+
         psessionEntry->beaconParams.beaconInterval = pSmeStartBssReq->beaconInterval;
 
         /* Store the channel number in session Table */
@@ -638,10 +636,10 @@
         psessionEntry->txLdpcIniFeatureEnabled = 
                                     pSmeStartBssReq->txLdpcIniFeatureEnabled;
 
-        palCopyMemory(pMac->hHdd, (void*)&psessionEntry->rateSet,
+        vos_mem_copy((void*)&psessionEntry->rateSet,
             (void*)&pSmeStartBssReq->operationalRateSet,
             sizeof(tSirMacRateSet));
-        palCopyMemory(pMac->hHdd, (void*)&psessionEntry->extRateSet,
+        vos_mem_copy((void*)&psessionEntry->extRateSet,
             (void*)&pSmeStartBssReq->extendedRateSet,
             sizeof(tSirMacRateSet));
 
@@ -677,11 +675,11 @@
                  psessionEntry->ssidHidden = pSmeStartBssReq->ssidHidden;
                  psessionEntry->wps_state = pSmeStartBssReq->wps_state;
                  psessionEntry->shortSlotTimeSupported = limGetShortSlotFromPhyMode(pMac, psessionEntry, psessionEntry->gLimPhyMode);
+                 psessionEntry->isCoalesingInIBSSAllowed =
+                                pSmeStartBssReq->isCoalesingInIBSSAllowed;
                  break;
             case eSIR_IBSS_MODE:
                  psessionEntry->limSystemRole = eLIM_STA_IN_IBSS_ROLE;
-                 psessionEntry->isCoalesingInIBSSAllowed =
-                                pSmeStartBssReq->isCoalesingInIBSSAllowed;
                  break;
 
             case eSIR_BTAMP_AP_MODE:
@@ -707,14 +705,17 @@
         || (pSmeStartBssReq->bssType == eSIR_INFRA_AP_MODE)
         )
         {
-            if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&psessionEntry->parsedAssocReq,
-                                                          (psessionEntry->dph.dphHashTable.size * sizeof(tpSirAssocReq)) ))
+            psessionEntry->parsedAssocReq = vos_mem_malloc(
+                     psessionEntry->dph.dphHashTable.size * sizeof(tpSirAssocReq));
+            if ( NULL == psessionEntry->parsedAssocReq )
             {
-                limLog(pMac, LOGW, FL("palAllocateMemory() failed"));
+                limLog(pMac, LOGW, FL("AllocateMemory() failed"));
                 retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
                 goto free;
             }
-            palZeroMemory(pMac->hHdd, psessionEntry->parsedAssocReq, (psessionEntry->dph.dphHashTable.size * sizeof(tpSirAssocReq)) );
+            vos_mem_set(psessionEntry->parsedAssocReq,
+                    (psessionEntry->dph.dphHashTable.size * sizeof(tpSirAssocReq)),
+                     0 );
         }
 
         /* Channel Bonding is not addressd yet for BT-AMP Support.. sunit will address channel bonding   */
@@ -762,7 +763,7 @@
                     centerChan = limGetCenterChannel(pMac,channelNumber,pSmeStartBssReq->cbMode,WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ);
                     if(centerChan != eSIR_CFG_INVALID_ID)
                     {
-                        limLog(pMac, LOGW, FL("***Center Channel for 80MHZ channel width = %ld"),centerChan);
+                        limLog(pMac, LOGW, FL("***Center Channel for 80MHZ channel width = %d"),centerChan);
                         psessionEntry->apCenterChan = centerChan;
                         if (cfgSetInt(pMac, WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1, centerChan)
                                                                      != eSIR_SUCCESS)
@@ -828,24 +829,25 @@
             /*each byte will have the following info
              *bit7       bit6    bit5   bit4 bit3   bit2  bit1 bit0
              *reserved reserved RIFS Lsig n-GF ht20 11g 11b*/
-            palCopyMemory( pMac->hHdd, (void *) &psessionEntry->cfgProtection,
+            vos_mem_copy( (void *) &psessionEntry->cfgProtection,
                           (void *) &pSmeStartBssReq->ht_capab,
                           sizeof( tANI_U16 ));
             psessionEntry->pAPWPSPBCSession = NULL; // Initialize WPS PBC session link list
         }
 
         // Prepare and Issue LIM_MLM_START_REQ to MLM
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmStartReq, sizeof(tLimMlmStartReq)))
+        pMlmStartReq = vos_mem_malloc(sizeof(tLimMlmStartReq));
+        if ( NULL == pMlmStartReq )
         {
-            limLog(pMac, LOGP, FL("call to palAllocateMemory failed for mlmStartReq"));
+            limLog(pMac, LOGP, FL("call to AllocateMemory failed for mlmStartReq"));
             retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
             goto free;
         }
 
-        (void)palZeroMemory(pMac->hHdd, (void *) pMlmStartReq, sizeof(tLimMlmStartReq));
+        vos_mem_set((void *) pMlmStartReq, sizeof(tLimMlmStartReq), 0);
 
         /* Copy SSID to the MLM start structure */
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMlmStartReq->ssId,
+        vos_mem_copy( (tANI_U8 *) &pMlmStartReq->ssId,
                           (tANI_U8 *) &pSmeStartBssReq->ssId,
                           pSmeStartBssReq->ssId.length + 1);
         pMlmStartReq->ssidHidden = pSmeStartBssReq->ssidHidden;
@@ -928,10 +930,9 @@
         pMlmStartReq->cfParamSet.cfpMaxDuration = (tANI_U16) val;
         
         //this may not be needed anymore now, as rateSet is now included in the session entry and MLM has session context.
-        palCopyMemory(pMac->hHdd, (void*)&pMlmStartReq->rateSet, (void*)&psessionEntry->rateSet,
+        vos_mem_copy((void*)&pMlmStartReq->rateSet, (void*)&psessionEntry->rateSet,
                        sizeof(tSirMacRateSet));
 
-                      
         // Now populate the 11n related parameters
         pMlmStartReq->nwType    = psessionEntry->nwType;
         pMlmStartReq->htCapable = psessionEntry->htCapability;
@@ -982,8 +983,8 @@
     {
         psessionEntry->pLimStartBssReq = NULL;
     }
-    palFreeMemory(pMac->hHdd, pSmeStartBssReq);
-    palFreeMemory(pMac->hHdd, pMlmStartReq);
+    vos_mem_free( pSmeStartBssReq);
+    vos_mem_free( pMlmStartReq);
 
 end:
 
@@ -1054,7 +1055,7 @@
      random[0] = tx_time_get();
      random[0] |= (random[0] << 15) ;
      random[1] = random[0] >> 1;
-     palCopyMemory(pMac->hHdd, data, (tANI_U8*)random, sizeof(tSirMacAddr));
+     vos_mem_copy( data, (tANI_U8*)random, sizeof(tSirMacAddr));
 }
 
 static eHalStatus limSendHalStartScanOffloadReq(tpAniSirGlobal pMac,
@@ -1063,7 +1064,6 @@
     tSirScanOffloadReq *pScanOffloadReq;
     tANI_U8 *p;
     tSirMsgQ msg;
-    eHalStatus status;
     tANI_U16 i, len;
     tSirRetStatus rc = eSIR_SUCCESS;
 
@@ -1072,21 +1072,21 @@
     len = sizeof(tSirScanOffloadReq) + (pScanReq->channelList.numChannels - 1) +
         pScanReq->uIEFieldLen;
 
-    status = palAllocateMemory(pMac->hHdd, (void **) &pScanOffloadReq, len);
-    if (status != eHAL_STATUS_SUCCESS)
+    pScanOffloadReq = vos_mem_malloc(len);
+    if ( NULL == pScanOffloadReq )
     {
         limLog(pMac, LOGE,
-                FL("palAllocateMemory failed for pScanOffloadReq"));
+                FL("AllocateMemory failed for pScanOffloadReq"));
         return eHAL_STATUS_FAILURE;
     }
 
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pScanOffloadReq, len);
+    vos_mem_set( (tANI_U8 *) pScanOffloadReq, len, 0);
 
     msg.type = WDA_START_SCAN_OFFLOAD_REQ;
     msg.bodyptr = pScanOffloadReq;
     msg.bodyval = 0;
 
-    palCopyMemory(pMac->hHdd, (tANI_U8 *) pScanOffloadReq->bssId,
+    vos_mem_copy((tANI_U8 *) pScanOffloadReq->bssId,
             (tANI_U8*) pScanReq->bssId,
             sizeof(tSirMacAddr));
 
@@ -1094,7 +1094,7 @@
     {
         limLog(pMac, LOGE,
                 FL("Invalid value (%d) for numSsid"), SIR_SCAN_MAX_NUM_SSID);
-        palFreeMemory(pMac->hHdd, (void *)pScanOffloadReq);
+        vos_mem_free (pScanOffloadReq);
         return eHAL_STATUS_FAILURE;
     }
 
@@ -1102,13 +1102,13 @@
     for (i = 0; i < pScanOffloadReq->numSsid; i++)
     {
         pScanOffloadReq->ssId[i].length = pScanReq->ssId[i].length;
-        palCopyMemory(pMac->hHdd, (tANI_U8 *) pScanOffloadReq->ssId[i].ssId,
+        vos_mem_copy((tANI_U8 *) pScanOffloadReq->ssId[i].ssId,
                 (tANI_U8 *) pScanReq->ssId[i].ssId,
                 pScanOffloadReq->ssId[i].length);
     }
 
     pScanOffloadReq->hiddenSsid = pScanReq->hiddenSsid;
-    palCopyMemory(pMac->hHdd, (tANI_U8 *) pScanOffloadReq->selfMacAddr,
+    vos_mem_copy((tANI_U8 *) pScanOffloadReq->selfMacAddr,
             (tANI_U8 *) pScanReq->selfMacAddr,
             sizeof(tSirMacAddr));
     pScanOffloadReq->bssType = pScanReq->bssType;
@@ -1131,7 +1131,7 @@
 
     pScanOffloadReq->uIEFieldLen = pScanReq->uIEFieldLen;
     pScanOffloadReq->uIEFieldOffset = len - pScanOffloadReq->uIEFieldLen;
-    palCopyMemory(pMac->hHdd,
+    vos_mem_copy(
             (tANI_U8 *) pScanOffloadReq + pScanOffloadReq->uIEFieldOffset,
             (tANI_U8 *) pScanReq + pScanReq->uIEFieldOffset,
             pScanReq->uIEFieldLen);
@@ -1139,9 +1139,8 @@
     rc = wdaPostCtrlMsg(pMac, &msg);
     if (rc != eSIR_SUCCESS)
     {
-        limLog(pMac, LOGE, FL("wdaPostCtrlMsg() return failure"),
-               pMac);
-        palFreeMemory(pMac->hHdd, (void *)pScanOffloadReq);
+        limLog(pMac, LOGE, FL("wdaPostCtrlMsg() return failure"));
+        vos_mem_free(pScanOffloadReq);
         return eHAL_STATUS_FAILURE;
     }
 
@@ -1205,7 +1204,7 @@
      */
      pMac->lim.gLimRspReqd = TRUE;
 
-    /*copy the Self MAC address from SmeReq to the globalplace , used for sending probe req.discussed on code review sep18*/
+    /*copy the Self MAC address from SmeReq to the globalplace, used for sending probe req*/
     sirCopyMacAddr(pMac->lim.gSelfMacAddr,  pScanReq->selfMacAddr);
 
    /* This routine should return the sme sessionId and SME transaction Id */
@@ -1250,10 +1249,6 @@
      */
   if (__limFreshScanReqd(pMac, pScanReq->returnFreshResults))
   {
-      /* Store the previous SME state */
-
-      MTRACE(macTrace(pMac, TRACE_CODE_SME_STATE, pScanReq->sessionId, pMac->lim.gLimSmeState));
-
       if (pScanReq->returnFreshResults & SIR_BG_SCAN_PURGE_RESUTLS)
       {
           // Discard previously cached scan results
@@ -1269,18 +1264,16 @@
 
       pMac->lim.gLimReturnUniqueResults   =
           ((pScanReq->returnUniqueResults) > 0 ? true : false);
-      /* De-activate Heartbeat timers for connected sessions while
-       * scan is in progress if the system is in Active mode *
-       * AND it is not a ROAMING ("background") scan */
-      if(pMac->psOffloadEnabled)
+
+      if (pMac->psOffloadEnabled)
       {
-         if((pMac->lim.gLimBackgroundScanMode != eSIR_ROAMING_SCAN) &&
+         if ((pMac->lim.gLimBackgroundScanMode != eSIR_ROAMING_SCAN) &&
             (!IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE))
          {
-            for(i=0;i<pMac->lim.maxBssId;i++)
+            for (i=0;i<pMac->lim.maxBssId;i++)
             {
                tpPESession psessionEntry = peFindSessionBySessionId(pMac,i);
-               if(psessionEntry && psessionEntry->valid &&
+               if (psessionEntry && psessionEntry->valid &&
                   (eLIM_MLM_LINK_ESTABLISHED_STATE ==
                           psessionEntry->limMlmState) &&
                   (psessionEntry->pmmOffloadInfo.psstate == PMM_FULL_POWER))
@@ -1290,24 +1283,25 @@
             }
          }
       }
-      else if(((ePMM_STATE_BMPS_WAKEUP == pMac->pmm.gPmmState) ||
+      /* De-activate Heartbeat timers for connected sessions while
+       * scan is in progress if the system is in Active mode *
+       * AND it is not a ROAMING ("background") scan */
+      else if (((ePMM_STATE_BMPS_WAKEUP == pMac->pmm.gPmmState) ||
                   (ePMM_STATE_READY == pMac->pmm.gPmmState)) &&
-                  (pScanReq->backgroundScanMode != eSIR_ROAMING_SCAN ) &&
-                  (!IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE))
-
+              (pScanReq->backgroundScanMode != eSIR_ROAMING_SCAN ) &&
+              (!IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE))
       {
-         for(i=0;i<pMac->lim.maxBssId;i++)
-         {
-             if((peFindSessionBySessionId(pMac,i) != NULL) &&
-                 (pMac->lim.gpSession[i].valid == TRUE) &&
-                 (eLIM_MLM_LINK_ESTABLISHED_STATE ==
-                           pMac->lim.gpSession[i].limMlmState))
-             {
-                  limHeartBeatDeactivateAndChangeTimer(pMac,
-                          peFindSessionBySessionId(pMac,i));
-             }
-         }
+          for(i=0;i<pMac->lim.maxBssId;i++)
+          {
+              if((peFindSessionBySessionId(pMac,i) != NULL) &&
+                      (pMac->lim.gpSession[i].valid == TRUE) &&
+                      (eLIM_MLM_LINK_ESTABLISHED_STATE == pMac->lim.gpSession[i].limMlmState))
+              {
+                  limHeartBeatDeactivateAndChangeTimer(pMac, peFindSessionBySessionId(pMac,i));
+              }
+          }
       }
+
       if (pMac->fScanOffload)
       {
           if (eHAL_STATUS_SUCCESS !=
@@ -1323,8 +1317,13 @@
       }
       else
       {
+
+          /*Change Global SME state  */
+          /* Store the previous SME state */
           pMac->lim.gLimPrevSmeState = pMac->lim.gLimSmeState;
           pMac->lim.gLimSmeState = eLIM_SME_WT_SCAN_STATE;
+          MTRACE(macTrace(pMac, TRACE_CODE_SME_STATE, pScanReq->sessionId, pMac->lim.gLimSmeState));
+
           if (pScanReq->channelList.numChannels == 0)
           {
               tANI_U32            cfg_len;
@@ -1332,17 +1331,18 @@
               len = sizeof(tLimMlmScanReq) +
                   (sizeof( pScanReq->channelList.channelNumber ) * (WNI_CFG_VALID_CHANNEL_LIST_LEN - 1)) +
                   pScanReq->uIEFieldLen;
-
-              if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmScanReq, len) )
+              pMlmScanReq = vos_mem_malloc(len);
+              if ( NULL == pMlmScanReq )
               {
-                  // Log error
-                  limLog(pMac, LOGP,
-                          FL("call to palAllocateMemory failed for mlmScanReq (%d)"), len);
+                // Log error
+                limLog(pMac, LOGP,
+                       FL("call to AllocateMemory failed for mlmScanReq (%d)"), len);
+
                   return;
-              }
+               }
 
               // Initialize this buffer
-              palZeroMemory( pMac->hHdd, (tANI_U8 *) pMlmScanReq, len );
+              vos_mem_set( (tANI_U8 *) pMlmScanReq, len, 0 );
 
               cfg_len = WNI_CFG_VALID_CHANNEL_LIST_LEN;
               if (wlan_cfgGetStr(pMac, WNI_CFG_VALID_CHANNEL_LIST,
@@ -1361,49 +1361,49 @@
           else
           {
               len = sizeof( tLimMlmScanReq ) - sizeof( pScanReq->channelList.channelNumber ) +
-                    (sizeof( pScanReq->channelList.channelNumber ) * pScanReq->channelList.numChannels ) +
-                    pScanReq->uIEFieldLen;
+                  (sizeof( pScanReq->channelList.channelNumber ) * pScanReq->channelList.numChannels ) +
+                  pScanReq->uIEFieldLen;
 
-              if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmScanReq, len) )
+              pMlmScanReq = vos_mem_malloc(len);
+              if ( NULL == pMlmScanReq )
               {
-                  // Log error
-                  limLog(pMac, LOGP,
-                          FL("call to palAllocateMemory failed for mlmScanReq(%d)"), len);
+                // Log error
+                limLog(pMac, LOGP,
+                    FL("call to AllocateMemory failed for mlmScanReq(%d)"), len);
 
                   return;
-              }
+               }
 
               // Initialize this buffer
-              palZeroMemory( pMac->hHdd, (tANI_U8 *) pMlmScanReq, len);
+              vos_mem_set( (tANI_U8 *) pMlmScanReq, len, 0);
               pMlmScanReq->channelList.numChannels =
-                  pScanReq->channelList.numChannels;
+                            pScanReq->channelList.numChannels;
 
-              palCopyMemory( pMac->hHdd, pMlmScanReq->channelList.channelNumber,
-                      pScanReq->channelList.channelNumber,
-                      pScanReq->channelList.numChannels);
-          }
+              vos_mem_copy( pMlmScanReq->channelList.channelNumber,
+                          pScanReq->channelList.channelNumber,
+                          pScanReq->channelList.numChannels);
+        }
 
-          pMlmScanReq->uIEFieldLen = pScanReq->uIEFieldLen;
-          pMlmScanReq->uIEFieldOffset = len - pScanReq->uIEFieldLen;
+         pMlmScanReq->uIEFieldLen = pScanReq->uIEFieldLen;
+         pMlmScanReq->uIEFieldOffset = len - pScanReq->uIEFieldLen;
+         if(pScanReq->uIEFieldLen)
+         {
+            vos_mem_copy( (tANI_U8 *)pMlmScanReq+ pMlmScanReq->uIEFieldOffset,
+                          (tANI_U8 *)pScanReq+(pScanReq->uIEFieldOffset),
+                          pScanReq->uIEFieldLen);
+         }
 
-          if(pScanReq->uIEFieldLen)
-          {
-              palCopyMemory( pMac->hHdd, (tANI_U8 *)pMlmScanReq+ pMlmScanReq->uIEFieldOffset,
-                      (tANI_U8 *)pScanReq+(pScanReq->uIEFieldOffset),
-                      pScanReq->uIEFieldLen);
-          }
+         pMlmScanReq->bssType = pScanReq->bssType;
+         vos_mem_copy( pMlmScanReq->bssId,
+                      pScanReq->bssId,
+                      sizeof(tSirMacAddr));
+         pMlmScanReq->numSsid = pScanReq->numSsid;
+         pMlmScanReq->sessionId = pScanReq->sessionId;
 
-          pMlmScanReq->bssType = pScanReq->bssType;
-          palCopyMemory( pMac->hHdd, pMlmScanReq->bssId,
-                  pScanReq->bssId,
-                  sizeof(tSirMacAddr));
-          pMlmScanReq->numSsid = pScanReq->numSsid;
-          pMlmScanReq->sessionId = pScanReq->sessionId;
-
-          i = 0;
-          while (i < pMlmScanReq->numSsid)
-          {
-              palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMlmScanReq->ssId[i],
+         i = 0;
+         while (i < pMlmScanReq->numSsid)
+         {
+            vos_mem_copy( (tANI_U8 *) &pMlmScanReq->ssId[i],
                       (tANI_U8 *) &pScanReq->ssId[i],
                       pScanReq->ssId[i].length + 1);
 
@@ -1427,8 +1427,7 @@
           // Issue LIM_MLM_SCAN_REQ to MLM
           limPostMlmMessage(pMac, LIM_MLM_SCAN_REQ, (tANI_U32 *) pMlmScanReq);
       }
-
-    } // if ((pMac->lim.gLimSmeState == eLIM_SME_IDLE_STATE) || ...
+  } // if ((pMac->lim.gLimSmeState == eLIM_SME_IDLE_STATE) || ...
     
     else
     {
@@ -1512,17 +1511,20 @@
     pOemDataReq = (tpSirOemDataReq) pMsgBuf; 
 
     //post the lim mlm message now
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, (void**)&pMlmOemDataReq, (sizeof(tLimMlmOemDataReq))))
+    pMlmOemDataReq = vos_mem_malloc(sizeof(tLimMlmOemDataReq));
+    if ( NULL == pMlmOemDataReq )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for mlmOemDataReq"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for mlmOemDataReq"));
         return;
     }
 
     //Initialize this buffer
-    palZeroMemory(pMac->hHdd, pMlmOemDataReq, (sizeof(tLimMlmOemDataReq)));
+    vos_mem_set( pMlmOemDataReq, (sizeof(tLimMlmOemDataReq)), 0);
 
-    palCopyMemory(pMac->hHdd, pMlmOemDataReq->selfMacAddr, pOemDataReq->selfMacAddr, sizeof(tSirMacAddr)); 
-    palCopyMemory(pMac->hHdd, pMlmOemDataReq->oemDataReq, pOemDataReq->oemDataReq, OEM_DATA_REQ_SIZE);
+    vos_mem_copy( pMlmOemDataReq->selfMacAddr, pOemDataReq->selfMacAddr,
+                  sizeof(tSirMacAddr));
+    vos_mem_copy( pMlmOemDataReq->oemDataReq, pOemDataReq->oemDataReq,
+                  OEM_DATA_REQ_SIZE);
 
     //Issue LIM_MLM_OEM_DATA_REQ to MLM
     limPostMlmMessage(pMac, LIM_MLM_OEM_DATA_REQ, (tANI_U32*)pMlmOemDataReq);
@@ -1533,6 +1535,29 @@
 
 #endif //FEATURE_OEM_DATA_SUPPORT
 
+/**
+ * __limProcessClearDfsChannelList()
+ *
+ *FUNCTION:
+ *Clear DFS channel list  when country is changed/aquired.
+.*This message is sent from SME.
+ *
+ *LOGIC:
+ *
+ *ASSUMPTIONS:
+ *
+ *NOTE:
+ *
+ * @param  pMac      Pointer to Global MAC structure
+ * @param  *pMsgBuf  A pointer to the SME message buffer
+ * @return None
+ */
+static void __limProcessClearDfsChannelList(tpAniSirGlobal pMac,
+                                                           tpSirMsgQ pMsg)
+{
+    vos_mem_set( &pMac->lim.dfschannelList,
+                  sizeof(tSirDFSChannelList), 0);
+}
 
 /**
  * __limProcessSmeJoinReq()
@@ -1595,13 +1620,15 @@
     if(pMac->lim.gLimSmeState == eLIM_SME_IDLE_STATE)
     {
         nSize = __limGetSmeJoinReqSizeForAlloc((tANI_U8*) pMsgBuf);
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSmeJoinReq, nSize))
+
+        pSmeJoinReq = vos_mem_malloc(nSize);
+        if ( NULL == pSmeJoinReq )
         {
-            limLog(pMac, LOGP, FL("call to palAllocateMemory failed for pSmeJoinReq"));
+            limLog(pMac, LOGP, FL("call to AllocateMemory failed for pSmeJoinReq"));
             retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
             goto end;
         }
-        (void) palZeroMemory(pMac->hHdd, (void *) pSmeJoinReq, nSize);
+        (void) vos_mem_set((void *) pSmeJoinReq, nSize, 0);
  
         if ((limJoinReqSerDes(pMac, pSmeJoinReq, (tANI_U8 *)pMsgBuf) == eSIR_FAILURE) ||
                 (!limIsSmeJoinReqValid(pMac, pSmeJoinReq)))
@@ -1613,7 +1640,7 @@
             goto end;
         }
 
-        //pMac->lim.gpLimJoinReq = pSmeJoinReq; TO SUPPORT BT-AMP ,review os sep 23
+        //pMac->lim.gpLimJoinReq = pSmeJoinReq; TO SUPPORT BT-AMP, review os sep 23
 
         /* check for the existence of start BSS session  */
 #ifdef FIXME_GEN6    
@@ -1663,6 +1690,7 @@
             }
         }   
         handleHTCapabilityandHTInfo(pMac, psessionEntry);
+        psessionEntry->isAmsduSupportInAMPDU = pSmeJoinReq->isAmsduSupportInAMPDU;
 
         /* Store Session related parameters */
         /* Store PE session Id in session Table */
@@ -1757,6 +1785,10 @@
         }
 #endif
 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM
+        psessionEntry->rssi =  pSmeJoinReq->bssDescription.rssi;
+#endif
+
         /*Store Persona */
         psessionEntry->pePersona = pSmeJoinReq->staPersona;
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
@@ -1764,65 +1796,63 @@
         
         /* Copy the SSID from smejoinreq to session entry  */  
         psessionEntry->ssId.length = pSmeJoinReq->ssId.length;
-        palCopyMemory( pMac->hHdd,psessionEntry->ssId.ssId,pSmeJoinReq->ssId.ssId,psessionEntry->ssId.length);
-            
-            /* Copy the SSID from smejoinreq to session entry  */  
-            psessionEntry->ssId.length = pSmeJoinReq->ssId.length;
-            palCopyMemory( pMac->hHdd,psessionEntry->ssId.ssId,pSmeJoinReq->ssId.ssId,psessionEntry->ssId.length);
-            
-            // Determin 11r or CCX connection based on input from SME
-            // which inturn is dependent on the profile the user wants to connect
-            // to, So input is coming from supplicant
+        vos_mem_copy( psessionEntry->ssId.ssId,
+                      pSmeJoinReq->ssId.ssId, psessionEntry->ssId.length);
+
+        // Determin 11r or CCX connection based on input from SME
+        // which inturn is dependent on the profile the user wants to connect
+        // to, So input is coming from supplicant
 #ifdef WLAN_FEATURE_VOWIFI_11R
-            psessionEntry->is11Rconnection = pSmeJoinReq->is11Rconnection;
+        psessionEntry->is11Rconnection = pSmeJoinReq->is11Rconnection;
 #endif
 #ifdef FEATURE_WLAN_CCX
-            psessionEntry->isCCXconnection = pSmeJoinReq->isCCXconnection;
+        psessionEntry->isCCXconnection = pSmeJoinReq->isCCXconnection;
 #endif
 #if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
-            psessionEntry->isFastTransitionEnabled = pSmeJoinReq->isFastTransitionEnabled;
+        psessionEntry->isFastTransitionEnabled = pSmeJoinReq->isFastTransitionEnabled;
 #endif
-            
+
 #ifdef FEATURE_WLAN_LFR
-            psessionEntry->isFastRoamIniFeatureEnabled = pSmeJoinReq->isFastRoamIniFeatureEnabled;
+        psessionEntry->isFastRoamIniFeatureEnabled = pSmeJoinReq->isFastRoamIniFeatureEnabled;
 #endif
-            psessionEntry->txLdpcIniFeatureEnabled = pSmeJoinReq->txLdpcIniFeatureEnabled;
+        psessionEntry->txLdpcIniFeatureEnabled = pSmeJoinReq->txLdpcIniFeatureEnabled;
 
-            if(psessionEntry->bssType == eSIR_INFRASTRUCTURE_MODE)
-            {
-                psessionEntry->limSystemRole = eLIM_STA_ROLE;
-            }
-            else if(psessionEntry->bssType == eSIR_BTAMP_AP_MODE)
-            {
-                psessionEntry->limSystemRole = eLIM_BT_AMP_STA_ROLE;
-            }
-            else
-            {   
-                /* Throw an error and return and make sure to delete the session.*/
-                limLog(pMac, LOGW, FL("received SME_JOIN_REQ with invalid bss type"));
-                retCode = eSIR_SME_INVALID_PARAMETERS;
-                goto end;
-            }    
-
-        if(pSmeJoinReq->addIEScan.length)
+        if (psessionEntry->bssType == eSIR_INFRASTRUCTURE_MODE)
         {
-            palCopyMemory(pMac->hHdd, &psessionEntry->pLimJoinReq->addIEScan,
+            psessionEntry->limSystemRole = eLIM_STA_ROLE;
+        }
+        else if (psessionEntry->bssType == eSIR_BTAMP_AP_MODE)
+        {
+            psessionEntry->limSystemRole = eLIM_BT_AMP_STA_ROLE;
+        }
+        else
+        {
+            /* Throw an error and return and make sure to delete the session.*/
+            limLog(pMac, LOGW, FL("received SME_JOIN_REQ with invalid bss type"));
+            retCode = eSIR_SME_INVALID_PARAMETERS;
+            goto end;
+        }
+
+        if (pSmeJoinReq->addIEScan.length)
+        {
+            vos_mem_copy( &psessionEntry->pLimJoinReq->addIEScan,
                           &pSmeJoinReq->addIEScan, sizeof(tSirAddie));
         }
 
-        if(pSmeJoinReq->addIEAssoc.length)
+        if (pSmeJoinReq->addIEAssoc.length)
         {
-            palCopyMemory(pMac->hHdd, &psessionEntry->pLimJoinReq->addIEAssoc,
+            vos_mem_copy( &psessionEntry->pLimJoinReq->addIEAssoc,
                           &pSmeJoinReq->addIEAssoc, sizeof(tSirAddie));
         }
                  
         val = sizeof(tLimMlmJoinReq) + psessionEntry->pLimJoinReq->bssDescription.length + 2;
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmJoinReq, val))
+        pMlmJoinReq = vos_mem_malloc(val);
+        if ( NULL == pMlmJoinReq )
         {
-            limLog(pMac, LOGP, FL("call to palAllocateMemory failed for mlmJoinReq"));
+            limLog(pMac, LOGP, FL("call to AllocateMemory failed for mlmJoinReq"));
             return;
         }
-        (void) palZeroMemory(pMac->hHdd, (void *) pMlmJoinReq, val);
+        (void) vos_mem_set((void *) pMlmJoinReq, val, 0);
 
         /* PE SessionId is stored as a part of JoinReq*/
         pMlmJoinReq->sessionId = psessionEntry->peSessionId;
@@ -1832,20 +1862,19 @@
             limLog(pMac, LOGP, FL("could not retrieve JoinFailureTimer value"));
 
         /* copy operational rate from psessionEntry*/
-        palCopyMemory(pMac->hHdd, (void*)&psessionEntry->rateSet, (void*)&pSmeJoinReq->operationalRateSet,
+        vos_mem_copy((void*)&psessionEntry->rateSet, (void*)&pSmeJoinReq->operationalRateSet,
                             sizeof(tSirMacRateSet));
-        palCopyMemory(pMac->hHdd, (void*)&psessionEntry->extRateSet, (void*)&pSmeJoinReq->extendedRateSet,
+        vos_mem_copy((void*)&psessionEntry->extRateSet, (void*)&pSmeJoinReq->extendedRateSet,
                             sizeof(tSirMacRateSet));
         //this may not be needed anymore now, as rateSet is now included in the session entry and MLM has session context.
-        palCopyMemory(pMac->hHdd, (void*)&pMlmJoinReq->operationalRateSet, (void*)&psessionEntry->rateSet,
+        vos_mem_copy((void*)&pMlmJoinReq->operationalRateSet, (void*)&psessionEntry->rateSet,
                            sizeof(tSirMacRateSet));
 
         psessionEntry->encryptType = pSmeJoinReq->UCEncryptionType;
 
         pMlmJoinReq->bssDescription.length = psessionEntry->pLimJoinReq->bssDescription.length;
 
-        palCopyMemory( pMac->hHdd,
-           (tANI_U8 *) &pMlmJoinReq->bssDescription.bssId,
+        vos_mem_copy((tANI_U8 *) &pMlmJoinReq->bssDescription.bssId,
            (tANI_U8 *) &psessionEntry->pLimJoinReq->bssDescription.bssId,
            psessionEntry->pLimJoinReq->bssDescription.length + 2);
 
@@ -1885,7 +1914,7 @@
 #ifdef FEATURE_WLAN_CCX
             psessionEntry->maxTxPower = limGetMaxTxPower(regMax, localPowerConstraint, pMac->roam.configParam.nTxPowerCap);
 #else
-            psessionEntry->maxTxPower = VOS_MIN( regMax , (localPowerConstraint) );
+            psessionEntry->maxTxPower = VOS_MIN( regMax, (localPowerConstraint) );
 #endif
 #if defined WLAN_VOWIFI_DEBUG
         limLog( pMac, LOGE, "Regulatory max = %d, local power constraint = %d, max tx = %d", regMax, localPowerConstraint, psessionEntry->maxTxPower );
@@ -1982,7 +2011,7 @@
     
     if(pSmeJoinReq)
     {
-        palFreeMemory( pMac->hHdd, pSmeJoinReq);
+        vos_mem_free(pSmeJoinReq);
         pSmeJoinReq = NULL;
         if (NULL != psessionEntry)
         {
@@ -2007,7 +2036,7 @@
 tANI_U8 limGetMaxTxPower(tPowerdBm regMax, tPowerdBm apTxPower, tANI_U8 iniTxPower)
 {
     tANI_U8 maxTxPower = 0;
-    tANI_U8 txPower = VOS_MIN( regMax , (apTxPower) );
+    tANI_U8 txPower = VOS_MIN( regMax, (apTxPower) );
     txPower = VOS_MIN(txPower, iniTxPower);
     if((txPower >= MIN_TX_PWR_CAP) && (txPower <= MAX_TX_PWR_CAP))
         maxTxPower =  txPower;
@@ -2058,16 +2087,17 @@
     PELOG3(limLog(pMac, LOG3, FL("Received REASSOC_REQ"));)
     
     nSize = __limGetSmeJoinReqSizeForAlloc((tANI_U8 *) pMsgBuf);
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pReassocReq, nSize ))
+    pReassocReq = vos_mem_malloc(nSize);
+    if ( NULL == pReassocReq )
     {
         // Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for pReassocReq"));
+               FL("call to AllocateMemory failed for pReassocReq"));
 
         retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
         goto end;
     }
-    (void) palZeroMemory(pMac->hHdd, (void *) pReassocReq, nSize);
+    (void) vos_mem_set((void *) pReassocReq, nSize, 0);
     if ((limJoinReqSerDes(pMac, (tpSirSmeJoinReq) pReassocReq,
                           (tANI_U8 *) pMsgBuf) == eSIR_FAILURE) ||
         (!limIsSmeJoinReqValid(pMac,
@@ -2113,7 +2143,7 @@
                 psessionEntry->peSessionId);
 
             // Make sure its our preauth bssid
-            if (!palEqualMemory( pMac->hHdd, pReassocReq->bssDescription.bssId, 
+            if (!vos_mem_compare( pReassocReq->bssDescription.bssId,
                 pMac->ft.ftPEContext.pFTPreAuthReq->preAuthbssId, 6))
             {
                 limPrintMacAddr(pMac, pReassocReq->bssDescription.bssId, LOGE);
@@ -2138,8 +2168,7 @@
         goto end;
     }
 
-    palCopyMemory( pMac->hHdd,
-             psessionEntry->limReAssocbssId,
+    vos_mem_copy( psessionEntry->limReAssocbssId,
              psessionEntry->pLimReAssocReq->bssDescription.bssId,
              sizeof(tSirMacAddr));
 
@@ -2184,7 +2213,7 @@
             psessionEntry);
     }
 
-    psessionEntry->maxTxPower = VOS_MIN( regMax , (localPowerConstraint) );
+    psessionEntry->maxTxPower = VOS_MIN( regMax, (localPowerConstraint) );
 #if defined WLAN_VOWIFI_DEBUG
             limLog( pMac, LOGE, "Regulatory max = %d, local power constraint = %d, max tx = %d", regMax, localPowerConstraint, psessionEntry->maxTxPower );
 #endif
@@ -2200,12 +2229,12 @@
     
     /* Copy the SSID from sessio entry to local variable */
     #if 0
-    palCopyMemory( pMac->hHdd, pMac->lim.gLimReassocSSID.ssId,
+    vos_mem_copy(  pMac->lim.gLimReassocSSID.ssId,
                    psessionEntry->ssId.ssId,
                    psessionEntry->ssId.length);
     #endif
     psessionEntry->limReassocSSID.length = pReassocReq->ssId.length;
-    palCopyMemory( pMac->hHdd, psessionEntry->limReassocSSID.ssId,
+    vos_mem_copy(   psessionEntry->limReassocSSID.ssId,
                     pReassocReq->ssId.ssId, psessionEntry->limReassocSSID.length);
 
     }
@@ -2233,17 +2262,18 @@
         }
     }
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmReassocReq, sizeof(tLimMlmReassocReq)))
+    pMlmReassocReq = vos_mem_malloc(sizeof(tLimMlmReassocReq));
+    if ( NULL == pMlmReassocReq )
     {
         // Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for mlmReassocReq"));
+               FL("call to AllocateMemory failed for mlmReassocReq"));
 
         retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
         goto end;
     }
 
-    palCopyMemory( pMac->hHdd, pMlmReassocReq->peerMacAddr,
+    vos_mem_copy( pMlmReassocReq->peerMacAddr,
                   psessionEntry->limReAssocbssId,
                   sizeof(tSirMacAddr));
 
@@ -2310,7 +2340,7 @@
      *  is lost upon disassociation and reassociation.
      */
 
-    limDelAllBASessions(pMac);
+    limDeleteBASessions(pMac, psessionEntry, BA_BOTH_DIRECTIONS);
 
     pMlmReassocReq->listenInterval = (tANI_U16) val;
 
@@ -2329,7 +2359,7 @@
 
 end:
     if (pReassocReq)
-        palFreeMemory( pMac->hHdd, pReassocReq);
+        vos_mem_free( pReassocReq);
 
     if (psessionEntry)
     {
@@ -2547,16 +2577,18 @@
         sendDisassocFrame = 0;     
     }
     // Trigger Disassociation frame to peer MAC entity
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmDisassocReq, sizeof(tLimMlmDisassocReq)))
+
+    pMlmDisassocReq = vos_mem_malloc(sizeof(tLimMlmDisassocReq));
+    if ( NULL == pMlmDisassocReq )
     {
         // Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for mlmDisassocReq"));
+               FL("call to AllocateMemory failed for mlmDisassocReq"));
 
         return;
     }
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMlmDisassocReq->peerMacAddr,
+    vos_mem_copy( (tANI_U8 *) &pMlmDisassocReq->peerMacAddr,
                   (tANI_U8 *) &smeDisassocReq.peerMacAddr,
                   sizeof(tSirMacAddr));
 
@@ -2835,16 +2867,17 @@
     }
 
     // Trigger Deauthentication frame to peer MAC entity
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmDeauthReq, sizeof(tLimMlmDeauthReq)))
+    pMlmDeauthReq = vos_mem_malloc(sizeof(tLimMlmDeauthReq));
+    if ( NULL == pMlmDeauthReq )
     {
         // Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for mlmDeauthReq"));
+               FL("call to AllocateMemory failed for mlmDeauthReq"));
 
         return;
     }
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMlmDeauthReq->peerMacAddr,
+    vos_mem_copy( (tANI_U8 *) &pMlmDeauthReq->peerMacAddr,
                   (tANI_U8 *) &smeDeauthReq.peerMacAddr,
                   sizeof(tSirMacAddr));
 
@@ -2909,11 +2942,11 @@
     }
 
     limGetSessionInfo(pMac,(tANI_U8 *)pMsgBuf,&smesessionId,&smetransactionId);
-    
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSetContextReq,
-                                                (sizeof(tSirKeys) * SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS)))
+
+    pSetContextReq = vos_mem_malloc(sizeof(tSirKeys) * SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS);
+    if ( NULL == pSetContextReq )
     {
-        limLog(pMac, LOGP, FL("call to palAllocateMemory failed for pSetContextReq"));
+        limLog(pMac, LOGP, FL("call to AllocateMemory failed for pSetContextReq"));
         return;
     }
 
@@ -2961,10 +2994,11 @@
          (psessionEntry->limSmeState == eLIM_SME_NORMAL_STATE)))
     {
         // Trigger MLM_SETKEYS_REQ
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmSetKeysReq, sizeof(tLimMlmSetKeysReq)))
+        pMlmSetKeysReq = vos_mem_malloc(sizeof(tLimMlmSetKeysReq));
+        if ( NULL == pMlmSetKeysReq )
         {
             // Log error
-            limLog(pMac, LOGP, FL("call to palAllocateMemory failed for mlmSetKeysReq"));
+            limLog(pMac, LOGP, FL("call to AllocateMemory failed for mlmSetKeysReq"));
             goto end;
         }
 
@@ -2975,12 +3009,12 @@
             limLog(pMac, LOGP, FL("Num of keys exceeded max num of default keys limit"));
             goto end;
         }
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMlmSetKeysReq->peerMacAddr,
+        vos_mem_copy( (tANI_U8 *) &pMlmSetKeysReq->peerMacAddr,
                       (tANI_U8 *) &pSetContextReq->peerMacAddr,
                       sizeof(tSirMacAddr));
 
 
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMlmSetKeysReq->key,
+        vos_mem_copy( (tANI_U8 *) &pMlmSetKeysReq->key,
                       (tANI_U8 *) &pSetContextReq->keyMaterial.key,
                       sizeof(tSirKeys) * (pMlmSetKeysReq->numKeys ? pMlmSetKeysReq->numKeys : 1));
 
@@ -2998,14 +3032,14 @@
             {
                 tANI_U8 keyId;
                 keyId = pSetContextReq->keyMaterial.key[0].keyId;
-                palCopyMemory(pMac, (tANI_U8 *)&psessionEntry->WEPKeyMaterial[keyId],
+                vos_mem_copy( (tANI_U8 *)&psessionEntry->WEPKeyMaterial[keyId],
                    (tANI_U8 *) &pSetContextReq->keyMaterial, sizeof(tSirKeyMaterial));
             }
             else {
                 tANI_U32 i;
                 for( i = 0; i < SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS; i++)
                 {
-                    palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMlmSetKeysReq->key[i],
+                    vos_mem_copy( (tANI_U8 *) &pMlmSetKeysReq->key[i],
                         (tANI_U8 *)psessionEntry->WEPKeyMaterial[i].key, sizeof(tSirKeys));
                 }
             }
@@ -3029,7 +3063,7 @@
     }
 
 end:
-    palFreeMemory( pMac->hHdd, pSetContextReq);
+    vos_mem_free( pSetContextReq);
     return;
 } /*** end __limProcessSmeSetContextReq() ***/
 
@@ -3073,12 +3107,12 @@
     
     limGetSessionInfo(pMac,(tANI_U8 *)pMsgBuf,&smesessionId,&smetransactionId);
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pRemoveKeyReq,
-                                                (sizeof(*pRemoveKeyReq))))
+    pRemoveKeyReq = vos_mem_malloc(sizeof(*pRemoveKeyReq));
+    if ( NULL == pRemoveKeyReq )
     {
         //Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for pRemoveKeyReq"));
+               FL("call to AllocateMemory failed for pRemoveKeyReq"));
 
         return;
      }
@@ -3125,11 +3159,12 @@
          (psessionEntry->limSmeState == eLIM_SME_NORMAL_STATE)))
     {
         // Trigger MLM_REMOVEKEYS_REQ
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMlmRemoveKeyReq, sizeof(tLimMlmRemoveKeyReq)))
+        pMlmRemoveKeyReq = vos_mem_malloc(sizeof(tLimMlmRemoveKeyReq));
+        if ( NULL == pMlmRemoveKeyReq )
         {
             // Log error
             limLog(pMac, LOGP,
-                   FL("call to palAllocateMemory failed for mlmRemoveKeysReq"));
+                   FL("call to AllocateMemory failed for mlmRemoveKeysReq"));
 
             goto end;
         }
@@ -3142,7 +3177,7 @@
         /* Update PE session Id */
         pMlmRemoveKeyReq->sessionId = sessionId;
 
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMlmRemoveKeyReq->peerMacAddr,
+        vos_mem_copy( (tANI_U8 *) &pMlmRemoveKeyReq->peerMacAddr,
                       (tANI_U8 *) &pRemoveKeyReq->peerMacAddr,
                       sizeof(tSirMacAddr));
 
@@ -3166,7 +3201,7 @@
     }
 
 end:
-    palFreeMemory( pMac->hHdd, pRemoveKeyReq);
+    vos_mem_free( pRemoveKeyReq);
 } /*** end __limProcessSmeRemoveKeyReq() ***/
 
 void limProcessSmeGetScanChannelInfo(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
@@ -3189,15 +3224,16 @@
            limMsgStr(eWNI_SME_GET_SCANNED_CHANNEL_RSP), pMac->lim.scanChnInfo.numChnInfo);)
 
     len = sizeof(tSmeGetScanChnRsp) + (pMac->lim.scanChnInfo.numChnInfo - 1) * sizeof(tLimScanChn);
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeRsp, len ))
+    pSirSmeRsp = vos_mem_malloc(len);
+    if ( NULL == pSirSmeRsp )
     {
         /// Buffer not available. Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for JOIN/REASSOC_RSP"));
+               FL("call to AllocateMemory failed for JOIN/REASSOC_RSP"));
 
         return;
     }
-    palZeroMemory(pMac->hHdd, pSirSmeRsp, len);
+    vos_mem_set(pSirSmeRsp, len, 0);
 
     pSirSmeRsp->mesgType = eWNI_SME_GET_SCANNED_CHANNEL_RSP;
     pSirSmeRsp->mesgLen = len;
@@ -3213,7 +3249,8 @@
     if(pMac->lim.scanChnInfo.numChnInfo)
     {
         pSirSmeRsp->numChn = pMac->lim.scanChnInfo.numChnInfo;
-        palCopyMemory(pMac->hHdd, pSirSmeRsp->scanChn, pMac->lim.scanChnInfo.scanChn, sizeof(tLimScanChn) * pSirSmeRsp->numChn);
+        vos_mem_copy( pSirSmeRsp->scanChn, pMac->lim.scanChnInfo.scanChn,
+                      sizeof(tLimScanChn) * pSirSmeRsp->numChn);
     }
     //Clear the list
     limRessetScanChannelInfo(pMac);
@@ -3276,7 +3313,7 @@
     {
         limLog(pMac, LOGE,
                         FL("Received unexpected message in state %X, in role %X"),
-                        psessionEntry->limSmeState , psessionEntry->limSystemRole);
+                        psessionEntry->limSmeState, psessionEntry->limSystemRole);
         goto limAssocStaEnd;
     }
 
@@ -3293,12 +3330,19 @@
 
         if (pStaDs->valid)
         {
-            palCopyMemory(pMac->hHdd, (tANI_U8 *)&pAssocStasTemp->staMac,
-                                        (tANI_U8 *)&pStaDs->staAddr,
-                                        sizeof(v_MACADDR_t));  // Mac address
+            vos_mem_copy((tANI_U8 *)&pAssocStasTemp->staMac,
+                         (tANI_U8 *)&pStaDs->staAddr,
+                         sizeof(v_MACADDR_t));  // Mac address
             pAssocStasTemp->assocId = (v_U8_t)pStaDs->assocId;         // Association Id
             pAssocStasTemp->staId   = (v_U8_t)pStaDs->staIndex;        // Station Id
 
+            vos_mem_copy((tANI_U8 *)&pAssocStasTemp->supportedRates,
+                                      (tANI_U8 *)&pStaDs->supportedRates,
+                                      sizeof(tSirSupportedRates));
+            pAssocStasTemp->ShortGI40Mhz = pStaDs->htShortGI40Mhz;
+            pAssocStasTemp->ShortGI20Mhz = pStaDs->htShortGI20Mhz;
+            pAssocStasTemp->Support40Mhz = pStaDs->htDsssCckRate40MHzSupport;
+
             limLog(pMac, LOG1, FL("dph Station Number = %d"), staCount+1);
             limLog(pMac, LOG1, FL("MAC = %02x:%02x:%02x:%02x:%02x:%02x"),
                                         pStaDs->staAddr[0],
@@ -3386,7 +3430,7 @@
     sapEvent.sapHddEventCode =  eSAP_GET_WPSPBC_SESSION_EVENT;
     sapEvent.sapevt.sapGetWPSPBCSessionEvent.module = VOS_MODULE_ID_PE;
 
-    if (palEqualMemory(pMac->hHdd, zeroMac, GetWPSPBCSessionsReq.pRemoveMac, sizeof(tSirMacAddr)))
+    if (vos_mem_compare( zeroMac, GetWPSPBCSessionsReq.pRemoveMac, sizeof(tSirMacAddr)))
     { //This is GetWpsSession call
 
       limGetWPSPBCSessions(pMac,
@@ -3607,9 +3651,9 @@
     (void) body;
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
     //TBD: get the sessionEntry
+    limIbssDelete(pMac,psessionEntry);
     dphHashTableClassInit(pMac, &psessionEntry->dph.dphHashTable);
     limDeletePreAuthList(pMac);
-    limIbssDelete(pMac,psessionEntry);
     limSendSmeRsp(pMac, eWNI_SME_STOP_BSS_RSP, eSIR_SME_SUCCESS,psessionEntry->smeSessionId,psessionEntry->transactionId);
     return;
 }
@@ -3658,7 +3702,7 @@
          ((psessionEntry->limSmeState != eLIM_SME_NORMAL_STATE) && (psessionEntry->limSmeState != eLIM_SME_NORMAL_CHANNEL_SCAN_STATE)))
     {
         limLog(pMac, LOGE, FL("Received unexpected message %X in state %X, in role %X"),
-               msgType, psessionEntry->limSmeState , psessionEntry->limSystemRole);
+               msgType, psessionEntry->limSmeState, psessionEntry->limSystemRole);
         goto end;
     }
 
@@ -3680,7 +3724,7 @@
        goto end;
     }
     if ((pStaDs &&
-         (( !palEqualMemory( pMac->hHdd,(tANI_U8 *) pStaDs->staAddr,
+         (( !vos_mem_compare( (tANI_U8 *) pStaDs->staAddr,
                      (tANI_U8 *) assocCnf.peerMacAddr,
                      sizeof(tSirMacAddr)) ) ||
           (pStaDs->mlmStaContext.mlmState != eLIM_MLM_WT_ASSOC_CNF_STATE) ||
@@ -3726,7 +3770,6 @@
                              true, pStaDs->mlmStaContext.authType,
                              pStaDs->assocId, true,
                              eSIR_MAC_UNSPEC_FAILURE_STATUS, psessionEntry);
-        return;
     }
 
 end:
@@ -3736,11 +3779,12 @@
         {
             if ( ((tpSirAssocReq)(psessionEntry->parsedAssocReq[pStaDs->assocId]))->assocReqFrame) 
             {
-                palFreeMemory(pMac->hHdd,((tpSirAssocReq)(psessionEntry->parsedAssocReq[pStaDs->assocId]))->assocReqFrame);
+                vos_mem_free(((tpSirAssocReq)
+                   (psessionEntry->parsedAssocReq[pStaDs->assocId]))->assocReqFrame);
                 ((tpSirAssocReq)(psessionEntry->parsedAssocReq[pStaDs->assocId]))->assocReqFrame = NULL;
             }
 
-            palFreeMemory(pMac->hHdd, psessionEntry->parsedAssocReq[pStaDs->assocId]);  
+            vos_mem_free(psessionEntry->parsedAssocReq[pStaDs->assocId]);
             psessionEntry->parsedAssocReq[pStaDs->assocId] = NULL;
         }
     }
@@ -3885,7 +3929,7 @@
 
     // save the addts request
     pMac->lim.gLimAddtsSent = true;
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMac->lim.gLimAddtsReq, (tANI_U8 *) pSirAddts, sizeof(tSirAddtsReq));
+    vos_mem_copy( (tANI_U8 *) &pMac->lim.gLimAddtsReq, (tANI_U8 *) pSirAddts, sizeof(tSirAddtsReq));
 
     // ship out the message now
     limSendAddtsReqActionFrame(pMac, peerMac, &pSirAddts->req,
@@ -4047,7 +4091,11 @@
      status = eSIR_FAILURE;
     }     
 #ifdef FEATURE_WLAN_CCX
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+    limSendSmeTsmIEInd(pMac, psessionEntry, 0, 0, 0);
+#else
     limDeactivateAndChangeTimer(pMac,eLIM_TSM_TIMER);
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
 #endif
 
     // send an sme response back
@@ -4128,7 +4176,7 @@
     if((psessionEntry = peFindSessionByBssid(pMac,pStatsReq->bssId,&sessionId))== NULL)
     {
         limLog(pMac, LOGE, FL("session does not exist for given bssId"));
-        palFreeMemory( pMac, pMsgBuf );
+        vos_mem_free( pMsgBuf );
         return;
     }
 
@@ -4153,7 +4201,7 @@
             break;   
         default: //Unknown request.
             PELOGE(limLog(pMac, LOGE, "Unknown Statistics request");)
-            palFreeMemory( pMac, pMsgBuf );
+            vos_mem_free( pMsgBuf );
             return;
     }
 
@@ -4170,7 +4218,7 @@
     }
     if( eSIR_SUCCESS != (wdaPostCtrlMsg( pMac, &msgQ ))){
         limLog(pMac, LOGP, "Unable to forward request");
-        palFreeMemory( pMac, pMsgBuf );
+        vos_mem_free( pMsgBuf );
         return;
     }
 
@@ -4208,7 +4256,7 @@
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, msgQ.type));
 
     if( eSIR_SUCCESS != (wdaPostCtrlMsg( pMac, &msgQ ))){
-        palFreeMemory( pMac, pMsgBuf );
+        vos_mem_free( pMsgBuf );
         limLog(pMac, LOGP, "Unable to forward request");
         return;
     }
@@ -4216,6 +4264,34 @@
     return;
 }
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+/**
+ *FUNCTION: __limProcessSmeGetTsmStatsRequest()
+ *
+ *NOTE:
+ *
+ * @param  pMac      Pointer to Global MAC structure
+ * @param  *pMsgBuf  A pointer to the SME message buffer
+ * @return None
+ */
+static void
+__limProcessSmeGetTsmStatsRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
+{
+    tSirMsgQ               msgQ;
+
+    msgQ.type = WDA_TSM_STATS_REQ;
+    msgQ.reserved = 0;
+    msgQ.bodyptr = pMsgBuf;
+    msgQ.bodyval = 0;
+    MTRACE(macTraceMsgTx(pMac, NO_SESSION, msgQ.type));
+
+    if( eSIR_SUCCESS != (wdaPostCtrlMsg( pMac, &msgQ ))){
+        vos_mem_free( pMsgBuf );
+        limLog(pMac, LOGP, "Unable to forward request");
+        return;
+    }
+}
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
 
 #if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
 /**
@@ -4245,7 +4321,7 @@
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, msgQ.type));
 
     if( eSIR_SUCCESS != (wdaPostCtrlMsg( pMac, &msgQ ))){
-        palFreeMemory( pMac, pMsgBuf );
+        vos_mem_free( pMsgBuf );
         limLog(pMac, LOGP, "Unable to forward request");
         return;
     }
@@ -4271,9 +4347,10 @@
         return;
     }
 
-    if( palAllocateMemory( pMac->hHdd, (void **)&pUpdateAPWPSIEsReq, sizeof(tSirUpdateAPWPSIEsReq)))
+    pUpdateAPWPSIEsReq = vos_mem_malloc(sizeof(tSirUpdateAPWPSIEsReq));
+    if ( NULL == pUpdateAPWPSIEsReq )
     {
-        limLog(pMac, LOGP, FL("call to palAllocateMemory failed for pUpdateAPWPSIEsReq"));
+        limLog(pMac, LOGP, FL("call to AllocateMemory failed for pUpdateAPWPSIEsReq"));
         return;
     }
 
@@ -4289,13 +4366,13 @@
         goto end;
     }
 
-    palCopyMemory(pMac->hHdd, &psessionEntry->APWPSIEs, &pUpdateAPWPSIEsReq->APWPSIEs, sizeof(tSirAPWPSIEs));
+    vos_mem_copy( &psessionEntry->APWPSIEs, &pUpdateAPWPSIEsReq->APWPSIEs, sizeof(tSirAPWPSIEs));
 
     schSetFixedBeaconFields(pMac, psessionEntry);
     limSendBeaconInd(pMac, psessionEntry);
 
 end:
-    palFreeMemory( pMac->hHdd, pUpdateAPWPSIEsReq);
+    vos_mem_free( pUpdateAPWPSIEsReq);
     return;
 } /*** end __limProcessSmeUpdateAPWPSIEs(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf) ***/
 
@@ -4345,10 +4422,11 @@
         limLog(pMac, LOGE,FL("Buffer is Pointing to NULL"));
         return;
     }
-    
-    if( palAllocateMemory( pMac->hHdd, (void **)&pUpdateAPWPARSNIEsReq, sizeof(tSirUpdateAPWPSIEsReq)))
+
+    pUpdateAPWPARSNIEsReq = vos_mem_malloc(sizeof(tSirUpdateAPWPSIEsReq));
+    if ( NULL == pUpdateAPWPARSNIEsReq )
     {
-        limLog(pMac, LOGP, FL("call to palAllocateMemory failed for pUpdateAPWPARSNIEsReq"));
+        limLog(pMac, LOGP, FL("call to AllocateMemory failed for pUpdateAPWPARSNIEsReq"));
         return;
     }
 
@@ -4364,7 +4442,8 @@
         goto end;
     }
 
-    palCopyMemory(pMac->hHdd, &psessionEntry->pLimStartBssReq->rsnIE, &pUpdateAPWPARSNIEsReq->APWPARSNIEs, sizeof(tSirRSNie));
+    vos_mem_copy(&psessionEntry->pLimStartBssReq->rsnIE,
+                 &pUpdateAPWPARSNIEsReq->APWPARSNIEs, sizeof(tSirRSNie));
     
     limSetRSNieWPAiefromSmeStartBSSReqMessage(pMac, &psessionEntry->pLimStartBssReq->rsnIE, psessionEntry);
     
@@ -4375,7 +4454,7 @@
     limSendBeaconInd(pMac, psessionEntry); 
 
 end:
-    palFreeMemory( pMac->hHdd, pUpdateAPWPARSNIEsReq);
+    vos_mem_free(pUpdateAPWPARSNIEsReq);
     return;
 } /*** end __limProcessSmeSetWPARSNIEs(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf) ***/
 
@@ -4426,6 +4505,7 @@
         /* Update beacon */
         schSetFixedBeaconFields(pMac, psessionEntry);
 
+        beaconParams.bssIdx = psessionEntry->bssIdx;
         //Set change in beacon Interval
         beaconParams.beaconInterval = pChangeBIParams->beaconInterval;
         beaconParams.paramChangeBitmap = PARAM_BCN_INTERVAL_CHANGED;
@@ -4506,7 +4586,7 @@
          break;
       case eWNI_SME_BEACON_REPORT_RESP_XMIT_IND:
         {
-#if defined FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
          tpSirBeaconReportXmitInd pBcnReport=NULL;
          tpPESession psessionEntry=NULL;
          tANI_U8 sessionId;
@@ -4562,8 +4642,9 @@
       PELOGE(limLog(pMac, LOGE, "%s:%d: Inavalid parameters", __func__, __LINE__ );)
       return eSIR_FAILURE;
    }
-   if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-            (void **) &pMaxTxParams, sizeof(tMaxTxPowerParams) ) ) 
+
+   pMaxTxParams = vos_mem_malloc(sizeof(tMaxTxPowerParams));
+   if ( NULL == pMaxTxParams )
    {
       limLog( pMac, LOGP, "%s:%d:Unable to allocate memory for pMaxTxParams ", __func__, __LINE__);
       return eSIR_MEM_ALLOC_FAILED;
@@ -4578,8 +4659,8 @@
       return eSIR_FAILURE;
    }
    pMaxTxParams->power = txPower;
-   palCopyMemory( pMac->hHdd, pMaxTxParams->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr) );
-   palCopyMemory( pMac->hHdd, pMaxTxParams->selfStaMacAddr, pSessionEntry->selfMacAddr, sizeof(tSirMacAddr) );
+   vos_mem_copy( pMaxTxParams->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr) );
+   vos_mem_copy( pMaxTxParams->selfStaMacAddr, pSessionEntry->selfMacAddr, sizeof(tSirMacAddr) );
 
    msgQ.type = WDA_SET_MAX_TX_POWER_REQ;
    msgQ.bodyptr = pMaxTxParams;
@@ -4590,7 +4671,7 @@
    if (eSIR_SUCCESS != retCode)
    {
       PELOGE(limLog(pMac, LOGE, FL("wdaPostCtrlMsg() failed"));)
-      palFreeMemory(pMac->hHdd, pMaxTxParams);
+      vos_mem_free(pMaxTxParams);
    }
    return retCode;
 }
@@ -4621,14 +4702,15 @@
    tpAddStaSelfParams pAddStaSelfParams;
    tpSirSmeAddStaSelfReq pSmeReq = (tpSirSmeAddStaSelfReq) pMsgBuf;
 
-   if ( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void**) &pAddStaSelfParams,
-            sizeof( tAddStaSelfParams) ) )
+   pAddStaSelfParams = vos_mem_malloc(sizeof(tAddStaSelfParams));
+   if ( NULL == pAddStaSelfParams )
    {
       limLog( pMac, LOGP, FL("Unable to allocate memory for tAddSelfStaParams") );
       return;
    }
 
-   palCopyMemory( pMac->hHdd, pAddStaSelfParams->selfMacAddr, pSmeReq->selfMacAddr, sizeof(tSirMacAddr) ); 
+   vos_mem_copy( pAddStaSelfParams->selfMacAddr, pSmeReq->selfMacAddr, sizeof(tSirMacAddr) );
+   pAddStaSelfParams->currDeviceMode = pSmeReq->currDeviceMode;
    pAddStaSelfParams->sessionId = pSmeReq->sessionId;
    pAddStaSelfParams->type = pSmeReq->type;
    pAddStaSelfParams->subType = pSmeReq->subType;
@@ -4674,14 +4756,14 @@
    tpDelStaSelfParams pDelStaSelfParams;
    tpSirSmeDelStaSelfReq pSmeReq = (tpSirSmeDelStaSelfReq) pMsgBuf;
 
-   if ( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void**) &pDelStaSelfParams,
-            sizeof( tDelStaSelfParams) ) )
+   pDelStaSelfParams = vos_mem_malloc(sizeof( tDelStaSelfParams));
+   if ( NULL == pDelStaSelfParams )
    {
       limLog( pMac, LOGP, FL("Unable to allocate memory for tDelStaSelfParams") );
       return;
    }
 
-   palCopyMemory( pMac->hHdd, pDelStaSelfParams->selfMacAddr, pSmeReq->selfMacAddr, sizeof(tSirMacAddr) ); 
+   vos_mem_copy( pDelStaSelfParams->selfMacAddr, pSmeReq->selfMacAddr, sizeof(tSirMacAddr) );
 
    pDelStaSelfParams->sessionId = pSmeReq->sessionId;
    msg.type = SIR_HAL_DEL_STA_SELF_REQ;
@@ -4741,7 +4823,7 @@
             {
                 if (pLimMgmtRegistration->matchLen == pSmeReq->matchLen)
                 {
-                    if (palEqualMemory(pMac, pLimMgmtRegistration->matchData, 
+                    if (vos_mem_compare( pLimMgmtRegistration->matchData,
                                 pSmeReq->matchData, pLimMgmtRegistration->matchLen))
                     {
                         /* found match! */
@@ -4771,24 +4853,23 @@
     {
         vos_list_remove_node(&pMac->lim.gLimMgmtFrameRegistratinQueue,
                 (vos_list_node_t*)pLimMgmtRegistration);
-        palFreeMemory(pMac,pLimMgmtRegistration);
+        vos_mem_free(pLimMgmtRegistration);
     }
 
     if(pSmeReq->registerFrame)
     {
-        palAllocateMemory(pMac, (void**)&pLimMgmtRegistration,
-                        sizeof(tLimMgmtFrameRegistration) + pSmeReq->matchLen);
-        if(pLimMgmtRegistration != NULL)
+        pLimMgmtRegistration = vos_mem_malloc(sizeof(tLimMgmtFrameRegistration) + pSmeReq->matchLen);
+        if ( pLimMgmtRegistration != NULL)
         {
-            palZeroMemory(pMac, (void*)pLimMgmtRegistration,
-              sizeof(tLimMgmtFrameRegistration) + pSmeReq->matchLen );
+            vos_mem_set((void*)pLimMgmtRegistration,
+                         sizeof(tLimMgmtFrameRegistration) + pSmeReq->matchLen, 0 );
             pLimMgmtRegistration->frameType = pSmeReq->frameType;
             pLimMgmtRegistration->matchLen  = pSmeReq->matchLen;
             pLimMgmtRegistration->sessionId = pSmeReq->sessionId;
             if(pSmeReq->matchLen)
             {
-                palCopyMemory(pMac,pLimMgmtRegistration->matchData,
-                              pSmeReq->matchData, pSmeReq->matchLen);
+                vos_mem_copy(pLimMgmtRegistration->matchData,
+                             pSmeReq->matchData, pSmeReq->matchLen);
             }
             vos_list_insert_front(&pMac->lim.gLimMgmtFrameRegistratinQueue,
                               &pLimMgmtRegistration->node);
@@ -4804,15 +4885,15 @@
     tpP2pPsParams pMsgNoA;
     tSirMsgQ msg;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory(
-                  pMac->hHdd, (void **) &pMsgNoA, sizeof( tP2pPsConfig )))
+    pMsgNoA = vos_mem_malloc(sizeof( tP2pPsConfig ));
+    if ( NULL == pMsgNoA )
     {
         limLog( pMac, LOGP,
                      FL( "Unable to allocate memory during NoA Update" ));
         goto error;
     }
 
-    palZeroMemory( pMac->hHdd, (tANI_U8 *)pMsgNoA, sizeof(tP2pPsConfig));
+    vos_mem_set((tANI_U8 *)pMsgNoA, sizeof(tP2pPsConfig), 0);
     /* Below params used for opp PS/periodic NOA and are don't care in this case - so initialized to 0 */
     pMsgNoA->opp_ps = 0;
     pMsgNoA->ctWindow = 0;
@@ -4838,7 +4919,7 @@
 
         // send the scan response back with status failure and do not even call insert NOA
         limSendSmeScanRsp(pMac, sizeof(tSirSmeScanRsp), eSIR_SME_SCAN_FAILED, pMac->lim.gSmeSessionId, pMac->lim.gTransactionId);
-        palFreeMemory( pMac->hHdd, pMsgNoA);
+        vos_mem_free(pMsgNoA);
         goto error;
     }
 
@@ -4883,7 +4964,7 @@
     if (pMac->lim.gpDefdSmeMsgForNOA != NULL)
     {
         /* __limProcessSmeScanReq consumed the buffer. We can free it. */
-        palFreeMemory( pMac->hHdd, (tANI_U32 *) pMac->lim.gpDefdSmeMsgForNOA);
+        vos_mem_free(pMac->lim.gpDefdSmeMsgForNOA);
         pMac->lim.gpDefdSmeMsgForNOA = NULL;
     }
 }
@@ -5060,8 +5141,8 @@
 #endif
 
      /* save dis request message for matching dialog token */
-     palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMac->lim.gLimTdlsDisReq, 
-                           (tANI_U8 *) disReq, sizeof(tSirTdlsDisReq));
+     vos_mem_copy((tANI_U8 *) &pMac->lim.gLimTdlsDisReq,
+                  (tANI_U8 *) disReq, sizeof(tSirTdlsDisReq));
 
      VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
                              "Transmit Discovery Request Frame") ;
@@ -5169,8 +5250,8 @@
     * memory after teardown, if the link is successfully setup or
     * free this memory if any timeout is happen in link setup procedure
     */
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                  (void **) &setupPeer, sizeof( tLimTdlsLinkSetupPeer )))
+    setupPeer = vos_mem_malloc(sizeof( tLimTdlsLinkSetupPeer ));
+    if ( NULL == setupPeer )
     {
      limLog( pMac, LOGP, 
                   FL( "Unable to allocate memory during ADD_STA" ));
@@ -5188,7 +5269,7 @@
     * we only populate peer MAC, so it can assit us to find the
     * TDLS peer after response/or after response timeout
     */
-    palCopyMemory(pMac->hHdd, setupPeer->peerMac, setupReq->peerMac,
+    vos_mem_copy(setupPeer->peerMac, setupReq->peerMac,
                                               sizeof(tSirMacAddr)) ;
     /* format TDLS discovery request frame and transmit it */
     limSendTdlsLinkSetupReqFrame(pMac, setupReq->peerMac, 
@@ -5354,12 +5435,13 @@
 {
     tANI_BOOLEAN bufConsumed = TRUE; //Set this flag to false within case block of any following message, that doesnt want pMsgBuf to be freed.
     tANI_U32 *pMsgBuf = pMsg->bodyptr;
-
+    tpSirSmeScanReq     pScanReq;
     PELOG1(limLog(pMac, LOG1, FL("LIM Received SME Message %s(%d) Global LimSmeState:%s(%d) Global LimMlmState: %s(%d)"),
          limMsgStr(pMsg->type), pMsg->type,
          limSmeStateStr(pMac->lim.gLimSmeState), pMac->lim.gLimSmeState,
          limMlmStateStr(pMac->lim.gLimMlmState), pMac->lim.gLimMlmState );)
 
+    pScanReq = (tpSirSmeScanReq) pMsgBuf;
     /* Special handling of some SME Req msgs where we have an existing GO session and
      * want to insert NOA before processing those msgs. These msgs will be processed later when
      * start event happens
@@ -5367,8 +5449,42 @@
     switch (pMsg->type)
     {
         case eWNI_SME_SCAN_REQ:
-        case eWNI_SME_OEM_DATA_REQ:
         case eWNI_SME_REMAIN_ON_CHANNEL_REQ:
+
+            /* If scan is disabled return from here
+             */
+            if (pMac->lim.fScanDisabled)
+            {
+                PELOGE(limLog(pMac, LOGE, FL("Error: Scan Disabled"));)
+                if (pMsg->type == eWNI_SME_SCAN_REQ)
+                {
+                   limSendSmeScanRsp(pMac,
+                                     offsetof(tSirSmeScanRsp,bssDescription[0]),
+                                     eSIR_SME_INVALID_PARAMETERS,
+                                     pScanReq->sessionId,
+                                     pScanReq->transactionId);
+
+                   bufConsumed = TRUE;
+                }
+                else if (pMsg->type == eWNI_SME_REMAIN_ON_CHANNEL_REQ)
+                {
+                    pMac->lim.gpDefdSmeMsgForNOA = NULL;
+                    pMac->lim.gpLimRemainOnChanReq = (tpSirRemainOnChnReq )pMsgBuf;
+                    limRemainOnChnRsp(pMac,eHAL_STATUS_FAILURE, NULL);
+
+                    /*
+                     * limRemainOnChnRsp will free the buffer this change is to
+                     * avoid "double free"
+                     */
+                    bufConsumed = FALSE;
+                }
+
+                return bufConsumed;
+            }
+            /*
+             * Do not add BREAK here
+             */
+        case eWNI_SME_OEM_DATA_REQ:
         case eWNI_SME_JOIN_REQ:
             /* If we have an existing P2P GO session we need to insert NOA before actually process this SME Req */
             if ((limIsNOAInsertReqd(pMac) == TRUE) && IS_FEATURE_SUPPORTED_BY_FW(P2P_GO_NOA_DECOUPLE_INIT_SCAN))
@@ -5412,6 +5528,9 @@
         case eWNI_SME_UPDATE_NOA:
             __limProcessSmeNoAUpdate(pMac, pMsgBuf);
             break;
+        case eWNI_SME_CLEAR_DFS_CHANNEL_LIST:
+            __limProcessClearDfsChannelList(pMac, pMsg);
+            break;
         case eWNI_SME_JOIN_REQ:
             __limProcessSmeJoinReq(pMac, pMsgBuf);
             break;
@@ -5507,6 +5626,12 @@
             bufConsumed = FALSE;
             break;
 #endif
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+        case eWNI_SME_GET_TSM_STATS_REQ:
+            __limProcessSmeGetTsmStatsRequest( pMac, pMsgBuf);
+            bufConsumed = FALSE;
+            break;
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
         case eWNI_SME_DEL_BA_PEER_IND:
             limProcessSmeDelBaPeerInd(pMac, pMsgBuf);
             break;
@@ -5559,7 +5684,7 @@
             break;
 #endif
 
-#if defined FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
        case eWNI_SME_CCX_ADJACENT_AP_REPORT:
             limProcessAdjacentAPRepMsg ( pMac, pMsgBuf );
             break;
@@ -5584,6 +5709,9 @@
         case eWNI_SME_TDLS_DEL_STA_REQ:
             limProcessSmeTdlsDelStaReq(pMac, pMsgBuf);
             break;
+        case eWNI_SME_TDLS_LINK_ESTABLISH_REQ:
+            limProcesSmeTdlsLinkEstablishReq(pMac, pMsgBuf);
+            break;
 #endif
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
         case eWNI_SME_TDLS_DISCOVERY_START_REQ:
@@ -5604,6 +5732,16 @@
             limSendSetTxPowerReq(pMac,  pMsgBuf);
             break ;
 
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+        case eWNI_SME_ENABLE_RMC_REQ:
+            limProcessRMCMessages(pMac, eLIM_RMC_ENABLE_REQ, pMsgBuf);
+            break ;
+
+        case eWNI_SME_DISABLE_RMC_REQ:
+            limProcessRMCMessages(pMac, eLIM_RMC_DISABLE_REQ, pMsgBuf);
+            break ;
+#endif /* defined WLAN_FEATURE_RELIABLE_MCAST */
+
         default:
             vos_mem_free((v_VOID_t*)pMsg->bodyptr);
             pMsg->bodyptr = NULL;
diff --git a/CORE/MAC/src/pe/lim/limProcessTdls.c b/CORE/MAC/src/pe/lim/limProcessTdls.c
index 6698c43..69c3f15 100644
--- a/CORE/MAC/src/pe/lim/limProcessTdls.c
+++ b/CORE/MAC/src/pe/lim/limProcessTdls.c
@@ -123,10 +123,10 @@
 #endif
 static tSirRetStatus limTdlsSetupAddSta(tpAniSirGlobal pMac,
                                         tSirTdlsAddStaReq *pAddStaReq,
-					tpPESession psessionEntry) ;
+                                        tpPESession psessionEntry) ;
 void PopulateDot11fLinkIden(tpAniSirGlobal pMac, tpPESession psessionEntry,
                           tDot11fIELinkIdentifier *linkIden, 
-                             tSirMacAddr peerMac , tANI_U8 reqType) ;
+                             tSirMacAddr peerMac, tANI_U8 reqType) ;
 void PopulateDot11fTdlsExtCapability(tpAniSirGlobal pMac, 
                                     tDot11fIEExtCap *extCapability) ;
 
@@ -273,10 +273,8 @@
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
     pMac->lim.gLimTdlsDisResultList = NULL ;
     pMac->lim.gLimTdlsDisStaCount = 0 ;
-    palZeroMemory(pMac->hHdd, &pMac->lim.gLimTdlsDisReq, 
-                                            sizeof(tSirTdlsDisReq));
-    palZeroMemory(pMac->hHdd, &pMac->lim.gLimTdlsLinkSetupInfo, 
-                                            sizeof(tLimTdlsLinkSetupInfo));
+    vos_mem_set(&pMac->lim.gLimTdlsDisReq, sizeof(tSirTdlsDisReq), 0);
+    vos_mem_set(&pMac->lim.gLimTdlsLinkSetupInfo, sizeof(tLimTdlsLinkSetupInfo), 0);
     pMac->lim.gAddStaDisRspWait = 0 ;
 
 #ifdef FEATURE_WLAN_TDLS_NEGATIVE
@@ -304,7 +302,7 @@
         else
             pMac->lim.gLimTdlsNegativeBehavior &= ~(1 << (value-1));
     }
-    LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,("%d %d -> gLimTdlsNegativeBehavior= 0x%lx"), \
+    LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,("%d %d -> gLimTdlsNegativeBehavior= 0x%lx"),
         value, on, pMac->lim.gLimTdlsNegativeBehavior));
 }
 #endif
@@ -343,19 +341,17 @@
     pMacHdr->fc.powerMgmt = 0 ;
 
      
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pMacHdr->da, peerMac,
-                                                    sizeof( tSirMacAddr ));
-    palCopyMemory( pMac->hHdd,
-                   (tANI_U8 *) pMacHdr->sa,
+    vos_mem_copy( (tANI_U8 *) pMacHdr->da, peerMac, sizeof( tSirMacAddr ));
+    vos_mem_copy( (tANI_U8 *) pMacHdr->sa,
                    staMac, sizeof( tSirMacAddr ));
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pMacHdr->bssId,
+    vos_mem_copy( (tANI_U8 *) pMacHdr->bssId,
                                 bssid, sizeof( tSirMacAddr ));
    
-   LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_WARN, ("Preparing TDLS action frame\n%02x:%02x:%02x:%02x:%02x:%02x/%02x:%02x:%02x:%02x:%02x:%02x/%02x:%02x:%02x:%02x:%02x:%02x"), \
-       pMacHdr->da[0], pMacHdr->da[1], pMacHdr->da[2], pMacHdr->da[3], pMacHdr->da[4], pMacHdr->da[5], \
-       pMacHdr->sa[0], pMacHdr->sa[1], pMacHdr->sa[2], pMacHdr->sa[3], pMacHdr->sa[4], pMacHdr->sa[5], \
-       pMacHdr->bssId[0], pMacHdr->bssId[1], pMacHdr->bssId[2], \
+   LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_WARN, ("Preparing TDLS action frame\n%02x:%02x:%02x:%02x:%02x:%02x/%02x:%02x:%02x:%02x:%02x:%02x/%02x:%02x:%02x:%02x:%02x:%02x"),
+       pMacHdr->da[0], pMacHdr->da[1], pMacHdr->da[2], pMacHdr->da[3], pMacHdr->da[4], pMacHdr->da[5],
+       pMacHdr->sa[0], pMacHdr->sa[1], pMacHdr->sa[2], pMacHdr->sa[3], pMacHdr->sa[4], pMacHdr->sa[5],
+       pMacHdr->bssId[0], pMacHdr->bssId[1], pMacHdr->bssId[2],
        pMacHdr->bssId[3], pMacHdr->bssId[4], pMacHdr->bssId[5]));
 
     return ; 
@@ -408,20 +404,21 @@
     pMacHdr->fc.wep = (psessionEntry->encryptType == eSIR_ED_NONE)? 0 : 1;
 
      
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pMacHdr->addr1, (tANI_U8 *)addr1,
-                                                    sizeof( tSirMacAddr ));
-    palCopyMemory( pMac->hHdd,
-                   (tANI_U8 *) pMacHdr->addr2,
-                   (tANI_U8 *) staMac,
-                   sizeof( tSirMacAddr ));
+    vos_mem_copy( (tANI_U8 *) pMacHdr->addr1,
+                  (tANI_U8 *)addr1,
+                  sizeof( tSirMacAddr ));
+    vos_mem_copy( (tANI_U8 *) pMacHdr->addr2,
+                  (tANI_U8 *) staMac,
+                  sizeof( tSirMacAddr ));
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pMacHdr->addr3,
-                                (tANI_U8 *) (addr3), sizeof( tSirMacAddr ));
+    vos_mem_copy( (tANI_U8 *) pMacHdr->addr3,
+                  (tANI_U8 *) (addr3),
+                  sizeof( tSirMacAddr ));
 
-    LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_WARN, ("Preparing TDLS frame header to %s\n%02x:%02x:%02x:%02x:%02x:%02x/%02x:%02x:%02x:%02x:%02x:%02x/%02x:%02x:%02x:%02x:%02x:%02x"), \
-       (tdlsLinkType == TDLS_LINK_AP) ? "AP" : "TD", \
-        pMacHdr->addr1[0], pMacHdr->addr1[1], pMacHdr->addr1[2], pMacHdr->addr1[3], pMacHdr->addr1[4], pMacHdr->addr1[5], \
-        pMacHdr->addr2[0], pMacHdr->addr2[1], pMacHdr->addr2[2], pMacHdr->addr2[3], pMacHdr->addr2[4], pMacHdr->addr2[5], \
+    LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_WARN, ("Preparing TDLS frame header to %s\n%02x:%02x:%02x:%02x:%02x:%02x/%02x:%02x:%02x:%02x:%02x:%02x/%02x:%02x:%02x:%02x:%02x:%02x"),
+       (tdlsLinkType == TDLS_LINK_AP) ? "AP" : "TD",
+        pMacHdr->addr1[0], pMacHdr->addr1[1], pMacHdr->addr1[2], pMacHdr->addr1[3], pMacHdr->addr1[4], pMacHdr->addr1[5],
+        pMacHdr->addr2[0], pMacHdr->addr2[1], pMacHdr->addr2[2], pMacHdr->addr2[3], pMacHdr->addr2[4], pMacHdr->addr2[5],
         pMacHdr->addr3[0], pMacHdr->addr3[1], pMacHdr->addr3[2], pMacHdr->addr3[3], pMacHdr->addr3[4], pMacHdr->addr3[5]));
 
     //printMacAddr(pMacHdr->bssId) ;
@@ -439,8 +436,8 @@
     /* 
      * Now form RFC1042 header
      */
-    palCopyMemory(pMac->hHdd, (tANI_U8 *)(pFrame + header_offset), 
-                       (tANI_U8 *)eth_890d_header , sizeof(eth_890d_header)) ;
+    vos_mem_copy((tANI_U8 *)(pFrame + header_offset),
+                 (tANI_U8 *)eth_890d_header, sizeof(eth_890d_header)) ;
 
     header_offset += sizeof(eth_890d_header) ; 
 
@@ -494,15 +491,15 @@
 #endif
     tANI_U8             smeSessionId = 0;
 
-    if(psessionEntry)
+    if (NULL != psessionEntry)
        smeSessionId = psessionEntry->smeSessionId;
     /* 
      * The scheme here is to fill out a 'tDot11fProbeRequest' structure
      * and then hand it off to 'dot11fPackProbeRequest' (for
      * serialization).  We start by zero-initializing the structure:
      */
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&tdlsDisReq, 
-                                      sizeof( tDot11fTDLSDisReq ) );
+    vos_mem_set( (tANI_U8*)&tdlsDisReq,
+                  sizeof( tDot11fTDLSDisReq ), 0 );
 
     /*
      * setup Fixed fields,
@@ -530,7 +527,7 @@
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a discovery Request ("
                                "0x%08x)."), status );
     }
@@ -577,7 +574,7 @@
     }
 
     /* zero out the memory */
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     /* 
      * IE formation, memory allocation is completed, Now form TDLS discovery
@@ -595,7 +592,7 @@
         tdlsDisReq.LinkIdentifier.bssid[4] = 0xde;
         tdlsDisReq.LinkIdentifier.bssid[5] = 0xad; 
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, 
-        ("TDLS negative running: wrong BSSID %02x:%02x:%02x:%02x:%02x:%02x in TDLS Discovery Req"), \
+        ("TDLS negative running: wrong BSSID %02x:%02x:%02x:%02x:%02x:%02x in TDLS Discovery Req"),
         tdlsDisReq.LinkIdentifier.bssid[0], 
         tdlsDisReq.LinkIdentifier.bssid[1], 
         tdlsDisReq.LinkIdentifier.bssid[2], 
@@ -609,16 +606,16 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req \
-                                               (0x%08x)."), status );
+        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req "
+                               "(0x%08x)."), status );
         palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, 
                                    ( void* ) pFrame, ( void* ) pPacket );
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while packing TDLS"
-                               "Discovery Request (0x%08x).") );
+        limLog( pMac, LOGW, FL("There were warnings while packing TDLS "
+                               "Discovery Request (0x%08x)."), status );
     }
 
 #ifndef NO_PAD_TDLS_MIN_8023_SIZE
@@ -638,7 +635,8 @@
 
         /* padding zero if more than 5 bytes are required */
         if (padLen > MIN_VENDOR_SPECIFIC_IE_SIZE)
-            palZeroMemory( pMac->hHdd, pFrame + header_offset + nPayload + MIN_VENDOR_SPECIFIC_IE_SIZE, padLen - MIN_VENDOR_SPECIFIC_IE_SIZE);
+            vos_mem_set( pFrame + header_offset + nPayload + MIN_VENDOR_SPECIFIC_IE_SIZE,
+                         padLen - MIN_VENDOR_SPECIFIC_IE_SIZE, 0);
     }
 #endif
 
@@ -834,14 +832,14 @@
         return eHAL_STATUS_FAILURE;
     }
 
-    VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO, 
+    VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
                   ("teardown peer Mac = %02x,%02x,%02x,%02x,%02x,%02x"),
-                             (peerInfo)->peerMac[0] ,             
-                             (peerInfo)->peerMac[1] ,             
-                             (peerInfo)->peerMac[2] ,             
-                             (peerInfo)->peerMac[3] ,             
-                             (peerInfo)->peerMac[4] ,             
-                             (peerInfo)->peerMac[5] ) ;           
+                             (peerInfo)->peerMac[0],
+                             (peerInfo)->peerMac[1],
+                             (peerInfo)->peerMac[2],
+                             (peerInfo)->peerMac[3],
+                             (peerInfo)->peerMac[4],
+                             (peerInfo)->peerMac[5]);
              
 
     //pMac->hal.pCBackFnTxComp = NULL ;
@@ -929,6 +927,61 @@
 #endif
 
 /*
+ * This static function is consistent with any kind of TDLS management
+ * frames we are sending. Currently it is being used by limSendTdlsDisRspFrame,
+ * limSendTdlsLinkSetupReqFrame and limSendTdlsSetupRspFrame
+ */
+static void PopulateDot11fTdlsHtVhtCap(tpAniSirGlobal pMac, uint32 selfDot11Mode,
+                                        tDot11fIEHTCaps *htCap, tDot11fIEVHTCaps *vhtCap,
+                                        tpPESession psessionEntry)
+{
+    if (IS_DOT11_MODE_HT(selfDot11Mode))
+    {
+        /* Include HT Capability IE */
+        PopulateDot11fHTCaps( pMac, NULL, htCap );
+        htCap->present = 1;
+        if (psessionEntry->currentOperChannel <= SIR_11B_CHANNEL_END)
+        {
+            /* hardcode NO channel bonding in 2.4Ghz */
+            htCap->supportedChannelWidthSet = 0;
+        }
+        else
+        {
+            //Placeholder to support different channel bonding mode of TDLS than AP.
+            //wlan_cfgGetInt(pMac,WNI_CFG_TDLS_CHANNEL_BONDING_MODE,&tdlsChannelBondingMode);
+            //htCap->supportedChannelWidthSet = tdlsChannelBondingMode ? 1 : 0;
+            htCap->supportedChannelWidthSet = 1; // hardcode it to max
+        }
+    }
+    else
+    {
+        htCap->present = 0;
+    }
+#ifdef WLAN_FEATURE_11AC
+    if (((psessionEntry->currentOperChannel <= SIR_11B_CHANNEL_END) &&
+          pMac->roam.configParam.enableVhtFor24GHz) ||
+         (psessionEntry->currentOperChannel >= SIR_11B_CHANNEL_END))
+    {
+        if (IS_DOT11_MODE_VHT(selfDot11Mode) &&
+            IS_FEATURE_SUPPORTED_BY_FW(DOT11AC))
+        {
+            /* Include VHT Capability IE */
+            PopulateDot11fVHTCaps( pMac, psessionEntry, vhtCap );
+        }
+        else
+        {
+            vhtCap->present = 0;
+        }
+    }
+    else
+    {
+        /* Vht Disable from ini in 2.4 GHz */
+        vhtCap->present = 0;
+    }
+#endif
+}
+
+/*
  * Send TDLS discovery response frame on direct link.
  */
 
@@ -951,7 +1004,7 @@
 //  uint32 tdlsChannelBondingMode;
     tANI_U8             smeSessionId = 0;
 
-    if(psessionEntry)
+    if (NULL != psessionEntry)
        smeSessionId = psessionEntry->smeSessionId;
 
     /* 
@@ -959,8 +1012,8 @@
      * and then hand it off to 'dot11fPackProbeRequest' (for
      * serialization).  We start by zero-initializing the structure:
      */
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&tdlsDisRsp, 
-                                      sizeof( tDot11fTDLSDisRsp ) );
+    vos_mem_set( ( tANI_U8* )&tdlsDisRsp,
+                                      sizeof( tDot11fTDLSDisRsp ), 0 );
 
     /*
      * setup Fixed fields,
@@ -996,54 +1049,9 @@
 
     wlan_cfgGetInt(pMac,WNI_CFG_DOT11_MODE,&selfDot11Mode);
 
-    if (psessionEntry->currentOperChannel <= SIR_11B_CHANNEL_END)
-    {
-        if (IS_DOT11_MODE_HT(selfDot11Mode))
-        {
-            /* Include HT Capability IE */
-            PopulateDot11fHTCaps( pMac, psessionEntry, &tdlsDisRsp.HTCaps );
-            tdlsDisRsp.HTCaps.present = 1;
-            /* hardcode NO channel bonding in 2.4Ghz */
-            tdlsDisRsp.HTCaps.supportedChannelWidthSet = 0;
-        }
-        else
-        {
-            tdlsDisRsp.HTCaps.present = 0;
-        }
-#ifdef WLAN_FEATURE_11AC
-        /* in 2.4Ghz, hardcode NO 11ac */
-        tdlsDisRsp.VHTCaps.present = 0;
-#endif
-    }
-    else
-    {
-        if (IS_DOT11_MODE_HT(selfDot11Mode))
-        {
-            /* Include HT Capability IE */
-            PopulateDot11fHTCaps( pMac, psessionEntry, &tdlsDisRsp.HTCaps );
-
-            tdlsDisRsp.HTCaps.present = 1;
-            //Placeholder to support different channel bonding mode of TDLS than AP.
-            //wlan_cfgGetInt(pMac,WNI_CFG_TDLS_CHANNEL_BONDING_MODE,&tdlsChannelBondingMode);
-            //tdlsDisRsp.HTCaps.supportedChannelWidthSet = tdlsChannelBondingMode ? 1 : 0;
-            tdlsDisRsp.HTCaps.supportedChannelWidthSet = 1; // hardcode it to max
-        }
-        else
-        {
-            tdlsDisRsp.HTCaps.present = 0;
-        }
-#ifdef WLAN_FEATURE_11AC
-        if (IS_DOT11_MODE_VHT(selfDot11Mode))
-        {
-            /* Include VHT Capability IE */
-            PopulateDot11fVHTCaps( pMac, psessionEntry, &tdlsDisRsp.VHTCaps );
-        }
-        else
-        {
-            tdlsDisRsp.VHTCaps.present = 0;
-        }
-#endif
-    }
+    /* Populate HT/VHT Capabilities */
+    PopulateDot11fTdlsHtVhtCap( pMac, selfDot11Mode, &tdlsDisRsp.HTCaps,
+                               &tdlsDisRsp.VHTCaps, psessionEntry );
 
     /* 
      * now we pack it.  First, how much space are we going to need?
@@ -1058,7 +1066,7 @@
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a discovery Request ("
                                "0x%08x)."), status );
     }
@@ -1085,7 +1093,7 @@
     }
 
     /* zero out the memory */
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     /* 
      * IE formation, memory allocation is completed, Now form TDLS discovery
@@ -1116,7 +1124,7 @@
         tdlsDisRsp.LinkIdentifier.bssid[4] = 0xde;
         tdlsDisRsp.LinkIdentifier.bssid[5] = 0xad; 
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, 
-        ("TDLS negative running: wrong BSSID %02x:%02x:%02x:%02x:%02x:%02x in TDLS Discovery Rsp"), \
+        ("TDLS negative running: wrong BSSID %02x:%02x:%02x:%02x:%02x:%02x in TDLS Discovery Rsp"),
         tdlsDisRsp.LinkIdentifier.bssid[0], 
         tdlsDisRsp.LinkIdentifier.bssid[1], 
         tdlsDisRsp.LinkIdentifier.bssid[2], 
@@ -1131,16 +1139,16 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req \
-                                               (0x%08x)."), status );
+        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req "
+                               "(0x%08x)."), status );
         palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, 
                                    ( void* ) pFrame, ( void* ) pPacket );
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while packing TDLS"
-                               "Discovery Request (0x%08x).") );
+        limLog( pMac, LOGW, FL("There were warnings while packing TDLS "
+                               "Discovery Request (0x%08x)."), status );
     }
 
 #if 0
@@ -1187,15 +1195,55 @@
 }
 
 /*
+ * This static function is currently used by limSendTdlsLinkSetupReqFrame and
+ * limSendTdlsSetupRspFrame to populate the AID if device is 11ac capable.
+ */
+static void PopulateDotfTdlsVhtAID(tpAniSirGlobal pMac, uint32 selfDot11Mode,
+                                   tSirMacAddr peerMac, tDot11fIEAID *Aid,
+                                   tpPESession psessionEntry)
+{
+    if (((psessionEntry->currentOperChannel <= SIR_11B_CHANNEL_END) &&
+          pMac->roam.configParam.enableVhtFor24GHz) ||
+         (psessionEntry->currentOperChannel >= SIR_11B_CHANNEL_END))
+    {
+        if (IS_DOT11_MODE_VHT(selfDot11Mode) &&
+            IS_FEATURE_SUPPORTED_BY_FW(DOT11AC))
+        {
+
+            tANI_U16 aid;
+            tpDphHashNode       pStaDs;
+
+            pStaDs = dphLookupHashEntry(pMac, peerMac, &aid, &psessionEntry->dph.dphHashTable);
+            if (NULL != pStaDs)
+            {
+                 Aid->present = 1;
+                 Aid->assocId = aid | LIM_AID_MASK; // set bit 14 and 15 1's
+            }
+            else
+            {
+                Aid->present = 0;
+                limLog( pMac, LOGE, FL("pStaDs is NULL for " MAC_ADDRESS_STR ),
+                        MAC_ADDR_ARRAY(peerMac));
+            }
+        }
+    }
+    else
+    {
+        Aid->present = 0;
+        limLog( pMac, LOGW, FL("Vht not enable from ini for 2.4GHz."));
+    }
+}
+
+/*
  * TDLS setup Request frame on AP link
  */
 
 tSirRetStatus limSendTdlsLinkSetupReqFrame(tpAniSirGlobal pMac,
             tSirMacAddr peerMac, tANI_U8 dialog, tpPESession psessionEntry,
-            tANI_U8 *addIe, tANI_U16 addIeLen) 
+            tANI_U8 *addIe, tANI_U16 addIeLen)
 {
     tDot11fTDLSSetupReq    tdlsSetupReq ;
-    tANI_U16            caps = 0 ;            
+    tANI_U16            caps = 0 ;
     tANI_U32            status = 0 ;
     tANI_U32            nPayload = 0 ;
     tANI_U32            nBytes = 0 ;
@@ -1204,23 +1252,21 @@
     void               *pPacket;
     eHalStatus          halstatus;
     uint32              selfDot11Mode;
+    tANI_U8             smeSessionId = 0;
 //  Placeholder to support different channel bonding mode of TDLS than AP.
 //  Today, WNI_CFG_CHANNEL_BONDING_MODE will be overwritten when connecting to AP
 //  To support this feature, we need to introduce WNI_CFG_TDLS_CHANNEL_BONDING_MODE
 //  As of now, we hardcoded to max channel bonding of dot11Mode (i.e HT80 for 11ac/HT40 for 11n)
 //  uint32 tdlsChannelBondingMode;
-    tANI_U8             smeSessionId = 0;
 
-    if(psessionEntry)
-       smeSessionId = psessionEntry->smeSessionId;
-
-    /* 
+    /*
      * The scheme here is to fill out a 'tDot11fProbeRequest' structure
      * and then hand it off to 'dot11fPackProbeRequest' (for
      * serialization).  We start by zero-initializing the structure:
      */
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&tdlsSetupReq, 
-                                      sizeof( tDot11fTDLSSetupReq ) );
+    smeSessionId = psessionEntry->smeSessionId;
+
+    vos_mem_set(( tANI_U8* )&tdlsSetupReq, sizeof( tDot11fTDLSSetupReq ), 0);
     tdlsSetupReq.Category.category = SIR_MAC_ACTION_TDLS ;
     tdlsSetupReq.Action.action     = SIR_MAC_TDLS_SETUP_REQ ;
     tdlsSetupReq.DialogToken.token = dialog ;
@@ -1241,9 +1287,9 @@
     swapBitField16(caps, ( tANI_U16* )&tdlsSetupReq.Capabilities );
 
     /* populate supported rate IE */
-    PopulateDot11fSuppRates( pMac, POPULATE_DOT11F_RATES_OPERATIONAL, 
+    PopulateDot11fSuppRates( pMac, POPULATE_DOT11F_RATES_OPERATIONAL,
                               &tdlsSetupReq.SuppRates, psessionEntry );
-   
+
     /* Populate extended supported rates */
     PopulateDot11fExtSuppRates( pMac, POPULATE_DOT11F_RATES_OPERATIONAL,
                                 &tdlsSetupReq.ExtSuppRates, psessionEntry );
@@ -1251,10 +1297,10 @@
     /* Populate extended supported rates */
     PopulateDot11fTdlsExtCapability( pMac, &tdlsSetupReq.ExtCap );
 
-   /* 
+   /*
      * TODO: we need to see if we have to support conditions where we have
      * EDCA parameter info element is needed a) if we need different QOS
-     * parameters for off channel operations or QOS is not supported on 
+     * parameters for off channel operations or QOS is not supported on
      * AP link and we wanted to QOS on direct link.
      */
     /* Populate QOS info, needed for Peer U-APSD session */
@@ -1263,11 +1309,11 @@
     tdlsSetupReq.QOSCapsStation.present = 1;
     tdlsSetupReq.QOSCapsStation.max_sp_length = 0;
     tdlsSetupReq.QOSCapsStation.qack = 0;
-    tdlsSetupReq.QOSCapsStation.acbe_uapsd = 0;
-    tdlsSetupReq.QOSCapsStation.acbk_uapsd = 0;
-    tdlsSetupReq.QOSCapsStation.acvi_uapsd = 0;
-    tdlsSetupReq.QOSCapsStation.acvo_uapsd = 0;
-    
+    tdlsSetupReq.QOSCapsStation.acbe_uapsd = ((pMac->lim.gLimTDLSUapsdMask & 0x08) >> 3) ;
+    tdlsSetupReq.QOSCapsStation.acbk_uapsd = ((pMac->lim.gLimTDLSUapsdMask & 0x04)>> 2);
+    tdlsSetupReq.QOSCapsStation.acvi_uapsd = ((pMac->lim.gLimTDLSUapsdMask & 0x02)>> 1);
+    tdlsSetupReq.QOSCapsStation.acvo_uapsd = (pMac->lim.gLimTDLSUapsdMask & 0x01);
+
 
     /*
      * we will always try to init TDLS link with 11n capabilities
@@ -1277,68 +1323,18 @@
 
     wlan_cfgGetInt(pMac,WNI_CFG_DOT11_MODE,&selfDot11Mode);
 
-    if (psessionEntry->currentOperChannel <= SIR_11B_CHANNEL_END)
-    {
-        if (IS_DOT11_MODE_HT(selfDot11Mode))
-        {
-            /* Include HT Capability IE */
-            PopulateDot11fHTCaps( pMac, psessionEntry, &tdlsSetupReq.HTCaps );
+    /* Populate HT/VHT Capabilities */
+    PopulateDot11fTdlsHtVhtCap( pMac, selfDot11Mode, &tdlsSetupReq.HTCaps,
+                               &tdlsSetupReq.VHTCaps, psessionEntry );
 
-            tdlsSetupReq.HTCaps.present = 1;
-            /* hardcode NO channel bonding in 2.4Ghz */
-            tdlsSetupReq.HTCaps.supportedChannelWidthSet = 0;
-        }
-        else
-        {
-            tdlsSetupReq.HTCaps.present = 0;
-        }
-#ifdef WLAN_FEATURE_11AC
-        /* in 2.4Ghz, hardcode NO 11ac */
-        tdlsSetupReq.VHTCaps.present = 0;
-#endif
-    }
-    else
-    {
-        if (IS_DOT11_MODE_HT(selfDot11Mode))
-        {
-            /* Include HT Capability IE */
-            PopulateDot11fHTCaps( pMac, psessionEntry, &tdlsSetupReq.HTCaps );
+    /* Populate AID */
+    PopulateDotfTdlsVhtAID( pMac, selfDot11Mode, peerMac,
+                            &tdlsSetupReq.AID, psessionEntry );
 
-            tdlsSetupReq.HTCaps.present = 1;
-            //Placeholder to support different channel bonding mode of TDLS than AP.
-            //wlan_cfgGetInt(pMac,WNI_CFG_TDLS_CHANNEL_BONDING_MODE,&tdlsChannelBondingMode);
-            //tdlsSetupReq.HTCaps.supportedChannelWidthSet = tdlsChannelBondingMode ? 1 : 0;
-            tdlsSetupReq.HTCaps.supportedChannelWidthSet = 1; // hardcode it to max
-        }
-        else
-        {
-            tdlsSetupReq.HTCaps.present = 0;
-        }
-#ifdef WLAN_FEATURE_11AC
-        /* Include VHT Capability IE */
-        PopulateDot11fVHTCaps( pMac, psessionEntry, &tdlsSetupReq.VHTCaps );
-        if (IS_DOT11_MODE_VHT(selfDot11Mode))
-        {
-            tANI_U16 aid;
-            tpDphHashNode       pStaDs;
-
-            pStaDs = dphLookupHashEntry(pMac, peerMac, &aid , &psessionEntry->dph.dphHashTable);
-            if (NULL != pStaDs)
-            {
-                tdlsSetupReq.AID.present = 1;
-                tdlsSetupReq.AID.assocId = aid | LIM_AID_MASK; // set bit 14 and 15 1's
-            }
-        }
-        else
-        {
-            tdlsSetupReq.VHTCaps.present = 0;
-        }
-#endif
-    }
-    /* 
+    /*
      * now we pack it.  First, how much space are we going to need?
      */
-    status = dot11fGetPackedTDLSSetupReqSize( pMac, &tdlsSetupReq, 
+    status = dot11fGetPackedTDLSSetupReqSize( pMac, &tdlsSetupReq,
                                                               &nPayload);
     if ( DOT11F_FAILED( status ) )
     {
@@ -1349,7 +1345,7 @@
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a discovery Request ("
                                "0x%08x)."), status );
     }
@@ -1359,7 +1355,7 @@
      * This frame is going out from PE as data frames with special ethertype
      * 89-0d.
      * 8 bytes of RFC 1042 header
-     */ 
+     */
 
 
     nBytes = nPayload + ((IS_QOS_ENABLED(psessionEntry))
@@ -1371,7 +1367,7 @@
     /* Ok-- try to allocate memory from MGMT PKT pool */
 
     halstatus = palPktAlloc( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
-                             ( tANI_U16 )nBytes , ( void** ) &pFrame,
+                             ( tANI_U16 )nBytes, ( void** ) &pFrame,
                              ( void** ) &pPacket );
     if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
     {
@@ -1381,30 +1377,30 @@
     }
 
     /* zero out the memory */
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0);
 
-    /* 
+    /*
      * IE formation, memory allocation is completed, Now form TDLS discovery
      * request frame
      */
 
     /* fill out the buffer descriptor */
 
-    header_offset = limPrepareTdlsFrameHeader(pMac, pFrame, 
+    header_offset = limPrepareTdlsFrameHeader(pMac, pFrame,
                      LINK_IDEN_ADDR_OFFSET(tdlsSetupReq), TDLS_LINK_AP, TDLS_INITIATOR, TID_AC_BK, psessionEntry) ;
 
 #ifdef FEATURE_WLAN_TDLS_NEGATIVE
     if(pMac->lim.gLimTdlsNegativeBehavior & LIM_TDLS_NEGATIVE_WRONG_BSSID_IN_SETUP_REQ)
     {
         tdlsSetupReq.LinkIdentifier.bssid[4] = 0xde;
-        tdlsSetupReq.LinkIdentifier.bssid[5] = 0xad; 
-        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, 
-        ("TDLS negative running: wrong BSSID %02x:%02x:%02x:%02x:%02x:%02x in TDLS Setup Req"), \
-        tdlsSetupReq.LinkIdentifier.bssid[0], 
-        tdlsSetupReq.LinkIdentifier.bssid[1], 
-        tdlsSetupReq.LinkIdentifier.bssid[2], 
-        tdlsSetupReq.LinkIdentifier.bssid[3], 
-        tdlsSetupReq.LinkIdentifier.bssid[4], 
+        tdlsSetupReq.LinkIdentifier.bssid[5] = 0xad;
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+        ("TDLS negative running: wrong BSSID %02x:%02x:%02x:%02x:%02x:%02x in TDLS Setup Req"),
+        tdlsSetupReq.LinkIdentifier.bssid[0],
+        tdlsSetupReq.LinkIdentifier.bssid[1],
+        tdlsSetupReq.LinkIdentifier.bssid[2],
+        tdlsSetupReq.LinkIdentifier.bssid[3],
+        tdlsSetupReq.LinkIdentifier.bssid[4],
         tdlsSetupReq.LinkIdentifier.bssid[5]);
     }
 #endif
@@ -1412,24 +1408,24 @@
             __func__, tdlsSetupReq.VHTCaps.supportedChannelWidthSet, tdlsSetupReq.VHTCaps.rxMCSMap,
             tdlsSetupReq.VHTCaps.txMCSMap, tdlsSetupReq.VHTCaps.txSupDataRate );
 
-    status = dot11fPackTDLSSetupReq( pMac, &tdlsSetupReq, pFrame 
+    status = dot11fPackTDLSSetupReq( pMac, &tdlsSetupReq, pFrame
                                + header_offset, nPayload, &nPayload );
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req \
-                                               (0x%08x)."), status );
+        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req "
+                               "(0x%08x)."), status );
         palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, 
                                    ( void* ) pFrame, ( void* ) pPacket );
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while packing TDLS"
-                               "Discovery Request (0x%08x).") );
+        limLog( pMac, LOGW, FL("There were warnings while packing TDLS "
+                               "Discovery Request (0x%08x)."), status );
     }
 
-    //Copy the additional IE. 
+    //Copy the additional IE.
     //TODO : addIe is added at the end of the frame. This means it doesnt
     //follow the order. This should be ok, but we should consider changing this
     //if there is any IOT issue.
@@ -1437,7 +1433,7 @@
     {
     LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, ("Copy Additional Ie Len = %d"),
             addIeLen ));
-       palCopyMemory( pMac->hHdd, pFrame + header_offset + nPayload, addIe, addIeLen ); 
+       vos_mem_copy( pFrame + header_offset + nPayload, addIe, addIeLen );
     }
 
     LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, TDLS_DEBUG_LOG_LEVEL, ("[TDLS] action %d (%s) -AP-> OTA"),
@@ -1469,7 +1465,7 @@
 
 tSirRetStatus limSendTdlsTeardownFrame(tpAniSirGlobal pMac,
             tSirMacAddr peerMac, tANI_U16 reason, tANI_U8 responder, tpPESession psessionEntry,
-            tANI_U8 *addIe, tANI_U16 addIeLen) 
+            tANI_U8 *addIe, tANI_U16 addIeLen)
 {
     tDot11fTDLSTeardown teardown ;
     tANI_U32            status = 0 ;
@@ -1484,24 +1480,23 @@
 #endif
     tANI_U8             smeSessionId = 0;
 
-    if(psessionEntry)
+    if (NULL != psessionEntry)
        smeSessionId = psessionEntry->smeSessionId;
-    /* 
+    /*
      * The scheme here is to fill out a 'tDot11fProbeRequest' structure
      * and then hand it off to 'dot11fPackProbeRequest' (for
      * serialization).  We start by zero-initializing the structure:
      */
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&teardown, 
-                                      sizeof( tDot11fTDLSTeardown ) );
+    vos_mem_set( ( tANI_U8* )&teardown, sizeof( tDot11fTDLSTeardown ), 0 );
     teardown.Category.category = SIR_MAC_ACTION_TDLS ;
     teardown.Action.action     = SIR_MAC_TDLS_TEARDOWN ;
     teardown.Reason.code       = reason ;
 
-    PopulateDot11fLinkIden( pMac, psessionEntry, &teardown.LinkIdentifier, 
+    PopulateDot11fLinkIden( pMac, psessionEntry, &teardown.LinkIdentifier,
                                                 peerMac, (responder == TRUE) ? TDLS_RESPONDER : TDLS_INITIATOR) ;
 
 
-    /* 
+    /*
      * now we pack it.  First, how much space are we going to need?
      */
     status = dot11fGetPackedTDLSTeardownSize( pMac, &teardown, &nPayload);
@@ -1514,7 +1509,7 @@
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a discovery Request ("
                                "0x%08x)."), status );
     }
@@ -1524,7 +1519,7 @@
      * This frame is going out from PE as data frames with special ethertype
      * 89-0d.
      * 8 bytes of RFC 1042 header
-     */ 
+     */
 
 
     nBytes = nPayload + ((IS_QOS_ENABLED(psessionEntry))
@@ -1563,43 +1558,43 @@
     }
 
     /* zero out the memory */
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
-    /* 
+    /*
      * IE formation, memory allocation is completed, Now form TDLS discovery
      * request frame
      */
 
     /* fill out the buffer descriptor */
 
-    header_offset = limPrepareTdlsFrameHeader(pMac, pFrame, 
-                     LINK_IDEN_ADDR_OFFSET(teardown), 
-                          (reason == eSIR_MAC_TDLS_TEARDOWN_PEER_UNREACHABLE) 
+    header_offset = limPrepareTdlsFrameHeader(pMac, pFrame,
+                     LINK_IDEN_ADDR_OFFSET(teardown),
+                          (reason == eSIR_MAC_TDLS_TEARDOWN_PEER_UNREACHABLE)
                               ? TDLS_LINK_AP : TDLS_LINK_DIRECT,
                               (responder == TRUE) ? TDLS_RESPONDER : TDLS_INITIATOR,
                               TID_AC_VI, psessionEntry) ;
 
-    status = dot11fPackTDLSTeardown( pMac, &teardown, pFrame 
+    status = dot11fPackTDLSTeardown( pMac, &teardown, pFrame
                                + header_offset, nPayload, &nPayload );
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog( pMac, LOGE, FL("Failed to pack a TDLS Teardown req \
-                                               (0x%08x)."), status );
-        palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, 
+        limLog( pMac, LOGE, FL("Failed to pack a TDLS Teardown req (0x%08x)."),
+                status );
+        palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
                                    ( void* ) pFrame, ( void* ) pPacket );
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while packing TDLS"
-                               "Teardown Request (0x%08x).") );
+        limLog( pMac, LOGW, FL("There were warnings while packing TDLS "
+                               "Teardown Request (0x%08x)."), status );
     }
 #if 0
-    if(pMac->hal.pCBackFnTxComp == NULL) 
+    if(pMac->hal.pCBackFnTxComp == NULL)
     {
         pMac->hal.pCBackFnTxComp = (tpCBackFnTxComp)limTdlsTeardownTxComplete;
-        if(TX_SUCCESS != tx_timer_activate(&pMac->hal.txCompTimer)) 
+        if(TX_SUCCESS != tx_timer_activate(&pMac->hal.txCompTimer))
         {
             status = eHAL_STATUS_FAILURE;
             return status;
@@ -1612,12 +1607,12 @@
         return status ;
     }
 #endif
- 
+
     if( addIeLen != 0 )
     {
     LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, ("Copy Additional Ie Len = %d"),
             addIeLen ));
-       palCopyMemory( pMac->hHdd, pFrame + header_offset + nPayload, addIe, addIeLen ); 
+       vos_mem_copy( pFrame + header_offset + nPayload, addIe, addIeLen );
     }
 
 #ifndef NO_PAD_TDLS_MIN_8023_SIZE
@@ -1637,7 +1632,8 @@
 
         /* padding zero if more than 5 bytes are required */
         if (padLen > MIN_VENDOR_SPECIFIC_IE_SIZE)
-            palZeroMemory( pMac->hHdd, pFrame + header_offset + nPayload + addIeLen + MIN_VENDOR_SPECIFIC_IE_SIZE, padLen - MIN_VENDOR_SPECIFIC_IE_SIZE);
+            vos_mem_set( pFrame + header_offset + nPayload + addIeLen + MIN_VENDOR_SPECIFIC_IE_SIZE,
+                         padLen - MIN_VENDOR_SPECIFIC_IE_SIZE, 0);
     }
 #endif
     LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, TDLS_DEBUG_LOG_LEVEL, ("[TDLS] action %d (%s) -%s-> OTA"),
@@ -1648,7 +1644,7 @@
                             HAL_TXRX_FRM_802_11_DATA,
                             ANI_TXDIR_TODS,
                             TID_AC_VI,
-                            limTxComplete, pFrame, 
+                            limTxComplete, pFrame,
                             limMgmtTXComplete,
                             HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
                             smeSessionId );
@@ -1688,15 +1684,15 @@
 //  uint32 tdlsChannelBondingMode;
     tANI_U8             smeSessionId = 0;
 
-    if(psessionEntry)
-        smeSessionId = psessionEntry->smeSessionId;
+    if (NULL != psessionEntry)
+       smeSessionId = psessionEntry->smeSessionId;
+
     /* 
      * The scheme here is to fill out a 'tDot11fProbeRequest' structure
      * and then hand it off to 'dot11fPackProbeRequest' (for
      * serialization).  We start by zero-initializing the structure:
      */
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&tdlsSetupRsp, 
-                                      sizeof( tDot11fTDLSSetupRsp ) );
+    vos_mem_set( ( tANI_U8* )&tdlsSetupRsp, sizeof( tDot11fTDLSSetupRsp ),0 );
 
     /*
      * setup Fixed fields,
@@ -1742,71 +1738,20 @@
     tdlsSetupRsp.QOSCapsStation.present = 1;
     tdlsSetupRsp.QOSCapsStation.max_sp_length = 0;
     tdlsSetupRsp.QOSCapsStation.qack = 0;
-    tdlsSetupRsp.QOSCapsStation.acbe_uapsd = 1;
-    tdlsSetupRsp.QOSCapsStation.acbk_uapsd = 1;
-    tdlsSetupRsp.QOSCapsStation.acvi_uapsd = 1;
-    tdlsSetupRsp.QOSCapsStation.acvo_uapsd = 1;
+    tdlsSetupRsp.QOSCapsStation.acbe_uapsd = ((pMac->lim.gLimTDLSUapsdMask & 0x08) >> 3);
+    tdlsSetupRsp.QOSCapsStation.acbk_uapsd = ((pMac->lim.gLimTDLSUapsdMask & 0x04) >> 2);
+    tdlsSetupRsp.QOSCapsStation.acvi_uapsd = ((pMac->lim.gLimTDLSUapsdMask & 0x02) >> 1);
+    tdlsSetupRsp.QOSCapsStation.acvo_uapsd = (pMac->lim.gLimTDLSUapsdMask & 0x01);
 
     wlan_cfgGetInt(pMac,WNI_CFG_DOT11_MODE,&selfDot11Mode);
 
-    if (psessionEntry->currentOperChannel <= SIR_11B_CHANNEL_END)
-    {
-        if (IS_DOT11_MODE_HT(selfDot11Mode))
-        {
-            /* Include HT Capability IE */
-            PopulateDot11fHTCaps( pMac, psessionEntry, &tdlsSetupRsp.HTCaps );
+    /* Populate HT/VHT Capabilities */
+    PopulateDot11fTdlsHtVhtCap( pMac, selfDot11Mode, &tdlsSetupRsp.HTCaps,
+                                &tdlsSetupRsp.VHTCaps, psessionEntry );
 
-            tdlsSetupRsp.HTCaps.present = 1;
-            /* hardcode NO channel bonding in 2.4Ghz */
-            tdlsSetupRsp.HTCaps.supportedChannelWidthSet = 0;
-        }
-        else
-        {
-            tdlsSetupRsp.HTCaps.present = 0;
-        }
-#ifdef WLAN_FEATURE_11AC
-        /* in 2.4Ghz, hardcode NO 11ac */
-        tdlsSetupRsp.VHTCaps.present = 0;
-#endif
-    }
-    else
-    {
-        if (IS_DOT11_MODE_HT(selfDot11Mode))
-        {
-            /* Include HT Capability IE */
-            PopulateDot11fHTCaps( pMac, psessionEntry, &tdlsSetupRsp.HTCaps );
-
-            tdlsSetupRsp.HTCaps.present = 1;
-            //Placeholder to support different channel bonding mode of TDLS than AP.
-            //wlan_cfgGetInt(pMac,WNI_CFG_TDLS_CHANNEL_BONDING_MODE,&tdlsChannelBondingMode);
-            //tdlsSetupRsp.HTCaps.supportedChannelWidthSet = tdlsChannelBondingMode ? 1 : 0;
-            tdlsSetupRsp.HTCaps.supportedChannelWidthSet = 1; // hardcode it to max
-        }
-        else
-        {
-            tdlsSetupRsp.HTCaps.present = 0;
-        }
-#ifdef WLAN_FEATURE_11AC
-        /* Include VHT Capability IE */
-        PopulateDot11fVHTCaps( pMac, psessionEntry, &tdlsSetupRsp.VHTCaps );
-        if (IS_DOT11_MODE_VHT(selfDot11Mode))
-        {
-            tANI_U16 aid;
-            tpDphHashNode       pStaDs;
-
-            pStaDs = dphLookupHashEntry(pMac, peerMac, &aid , &psessionEntry->dph.dphHashTable);
-            if (NULL != pStaDs)
-            {
-                tdlsSetupRsp.AID.present = 1;
-                tdlsSetupRsp.AID.assocId = aid | LIM_AID_MASK; // set bit 14 and 15 1's
-            }
-        }
-        else
-        {
-            tdlsSetupRsp.VHTCaps.present = 0;
-        }
-#endif
-    }
+    /* Populate AID */
+    PopulateDotfTdlsVhtAID( pMac, selfDot11Mode, peerMac,
+                            &tdlsSetupRsp.AID, psessionEntry );
 
     tdlsSetupRsp.Status.status = setupStatus ;
 
@@ -1824,7 +1769,7 @@
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a discovery Request ("
                                "0x%08x)."), status );
     }
@@ -1855,7 +1800,7 @@
     }
 
     /* zero out the memory */
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set(  pFrame, nBytes, 0 );
 
     /* 
      * IE formation, memory allocation is completed, Now form TDLS discovery
@@ -1875,7 +1820,7 @@
         tdlsSetupRsp.LinkIdentifier.bssid[4] = 0xde;
         tdlsSetupRsp.LinkIdentifier.bssid[5] = 0xad; 
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, 
-        ("TDLS negative running: wrong BSSID %02x:%02x:%02x:%02x:%02x:%02x in TDLS Setup Rsp"), \
+        ("TDLS negative running: wrong BSSID %02x:%02x:%02x:%02x:%02x:%02x in TDLS Setup Rsp"),
         tdlsSetupRsp.LinkIdentifier.bssid[0], 
         tdlsSetupRsp.LinkIdentifier.bssid[1], 
         tdlsSetupRsp.LinkIdentifier.bssid[2], 
@@ -1892,16 +1837,16 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req \
-                                               (0x%08x)."), status );
+        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req "
+                               "(0x%08x)."), status );
         palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, 
                                    ( void* ) pFrame, ( void* ) pPacket );
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while packing TDLS"
-                               "Discovery Request (0x%08x).") );
+        limLog( pMac, LOGW, FL("There were warnings while packing TDLS "
+                               "Discovery Request (0x%08x)."), status );
     }
 
     //Copy the additional IE. 
@@ -1910,7 +1855,7 @@
     //if there is any IOT issue.
     if( addIeLen != 0 )
     {
-       palCopyMemory( pMac->hHdd, pFrame + header_offset + nPayload, addIe, addIeLen ); 
+       vos_mem_copy( pFrame + header_offset + nPayload, addIe, addIeLen );
     }
 
     LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, TDLS_DEBUG_LOG_LEVEL, ("[TDLS] action %d (%s) -AP-> OTA"),
@@ -1955,17 +1900,16 @@
 #ifndef NO_PAD_TDLS_MIN_8023_SIZE
     tANI_U32            padLen = 0;
 #endif
-    tANI_U8             smeSessionId = 0;
+    tANI_U8              smeSessionId = 0;
 
-    if(psessionEntry)
-       smeSessionId = psessionEntry->smeSessionId;
     /* 
      * The scheme here is to fill out a 'tDot11fProbeRequest' structure
      * and then hand it off to 'dot11fPackProbeRequest' (for
      * serialization).  We start by zero-initializing the structure:
      */
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&tdlsSetupCnf, 
-                                      sizeof( tDot11fTDLSSetupCnf ) );
+    smeSessionId = psessionEntry->smeSessionId;
+
+    vos_mem_set( ( tANI_U8* )&tdlsSetupCnf, sizeof( tDot11fTDLSSetupCnf ), 0 );
 
     /*
      * setup Fixed fields,
@@ -1978,8 +1922,8 @@
     PopulateDot11fLinkIden( pMac, psessionEntry, &tdlsSetupCnf.LinkIdentifier,
                       peerMac, TDLS_INITIATOR) ;
 #else
-    palCopyMemory( pMac->hHdd, (tANI_U8 *)&tdlsSetupCnf.LinkIdentifier, 
-                     (tANI_U8 *)&setupRsp->LinkIdentifier, sizeof(tDot11fIELinkIdentifier)) ; 
+    vos_mem_copy( (tANI_U8 *)&tdlsSetupCnf.LinkIdentifier,
+                  (tANI_U8 *)&setupRsp->LinkIdentifier, sizeof(tDot11fIELinkIdentifier)) ;
 #endif
 
     /* 
@@ -2014,7 +1958,7 @@
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a discovery Request ("
                                "0x%08x)."), status );
     }
@@ -2063,7 +2007,7 @@
     }
 
     /* zero out the memory */
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     /* 
      * IE formation, memory allocation is completed, Now form TDLS discovery
@@ -2088,16 +2032,16 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req \
-                                               (0x%08x)."), status );
+        limLog( pMac, LOGE, FL("Failed to pack a TDLS discovery req "
+                               "(0x%08x)."), status );
         palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, 
                                    ( void* ) pFrame, ( void* ) pPacket );
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while packing TDLS"
-                               "Discovery Request (0x%08x).") );
+        limLog( pMac, LOGW, FL("There were warnings while packing TDLS "
+                               "Discovery Request (0x%08x)."), status );
     }
 #if 0
     if(pMac->hal.pCBackFnTxComp == NULL) 
@@ -2122,7 +2066,7 @@
     //if there is any IOT issue.
     if( addIeLen != 0 )
     {
-       palCopyMemory( pMac->hHdd, pFrame + header_offset + nPayload, addIe, addIeLen ); 
+       vos_mem_copy( pFrame + header_offset + nPayload, addIe, addIeLen );
     }
 
 #ifndef NO_PAD_TDLS_MIN_8023_SIZE
@@ -2142,7 +2086,8 @@
 
         /* padding zero if more than 5 bytes are required */
         if (padLen > MIN_VENDOR_SPECIFIC_IE_SIZE)
-            palZeroMemory( pMac->hHdd, pFrame + header_offset + nPayload + addIeLen + MIN_VENDOR_SPECIFIC_IE_SIZE, padLen - MIN_VENDOR_SPECIFIC_IE_SIZE);
+            vos_mem_set( pFrame + header_offset + nPayload + addIeLen + MIN_VENDOR_SPECIFIC_IE_SIZE,
+                         padLen - MIN_VENDOR_SPECIFIC_IE_SIZE, 0);
     }
 #endif
 
@@ -2176,7 +2121,7 @@
 /*
  * Convert HT caps to lim based HT caps 
  */
-static void limTdlsCovertHTCaps(tpAniSirGlobal pMac ,
+static void limTdlsCovertHTCaps(tpAniSirGlobal pMac,
                          tSirTdlsPeerInfo *peerInfo, tDot11fIEHTCaps *HTCaps)
 {
 
@@ -2207,7 +2152,7 @@
     peerInfo->tdlsPeerHtExtCaps.pco = HTCaps->pco ;
     peerInfo->tdlsPeerHtExtCaps.transitionTime = HTCaps->transitionTime ;
     peerInfo->tdlsPeerHtExtCaps.mcsFeedback = HTCaps->mcsFeedback ;
-    palCopyMemory(pMac->hHdd, peerInfo->supportedMCSSet, 
+    vos_mem_copy( peerInfo->supportedMCSSet,
                       HTCaps->supportedMCSSet, SIZE_OF_SUPPORTED_MCS_SET) ;
 
     return ;
@@ -2250,7 +2195,7 @@
 
     /* Populate peer info of tdls discovery result */
 
-    tdlsUpdateCapInfo(&setupPeer->capabilityInfo , &setupReq->Capabilities) ;
+    tdlsUpdateCapInfo(&setupPeer->capabilityInfo, &setupReq->Capabilities) ;
 
     if(setupReq->SuppRates.present)
     {
@@ -2263,29 +2208,29 @@
     {
        ConvertQOSCapsStation(pMac->hHdd, &setupPeer->qosCaps, 
                    &setupReq->QOSCapsStation) ;
-       LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,("setupReq->SPLen=%d (be %d %d %d %d vo) more %d qack %d."), \
-         setupReq->QOSCapsStation.max_sp_length, setupReq->QOSCapsStation.acbe_uapsd, \
-         setupReq->QOSCapsStation.acbk_uapsd, setupReq->QOSCapsStation.acvi_uapsd, \
-         setupReq->QOSCapsStation.acvo_uapsd, setupReq->QOSCapsStation.more_data_ack, \
+       LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,("setupReq->SPLen=%d (be %d %d %d %d vo) more %d qack %d."),
+         setupReq->QOSCapsStation.max_sp_length, setupReq->QOSCapsStation.acbe_uapsd,
+         setupReq->QOSCapsStation.acbk_uapsd, setupReq->QOSCapsStation.acvi_uapsd,
+         setupReq->QOSCapsStation.acvo_uapsd, setupReq->QOSCapsStation.more_data_ack,
          setupReq->QOSCapsStation.qack));
     }
     
-    if(setupReq->ExtSuppRates.present)
+    if (setupReq->ExtSuppRates.present)
     {
         setupPeer->ExtRatesPresent = 1;
         ConvertExtSuppRates( pMac, &setupPeer->extendedRates,
                                                 &setupReq->ExtSuppRates );
     }
     /* update HT caps */
-    if(setupReq->HTCaps.present)
+    if (setupReq->HTCaps.present)
     {
-        palCopyMemory(pMac->hHdd, &setupPeer->tdlsPeerHTCaps, 
+        vos_mem_copy( &setupPeer->tdlsPeerHTCaps,
                     &setupReq->HTCaps, sizeof(tDot11fIEHTCaps)) ;
     }
     /* Update EXT caps */
-    if(setupReq->ExtCap.present)
+    if (setupReq->ExtCap.present)
     {
-        palCopyMemory(pMac->hHdd, &setupPeer->tdlsPeerExtCaps, 
+        vos_mem_copy( &setupPeer->tdlsPeerExtCaps,
                     &setupReq->ExtCap, sizeof(tDot11fIEExtCap)) ;
     }    
 
@@ -2301,7 +2246,7 @@
 {
 
     /* Populate peer info of tdls discovery result */
-    tdlsUpdateCapInfo(&setupPeer->capabilityInfo , &setupRsp->Capabilities) ;
+    tdlsUpdateCapInfo(&setupPeer->capabilityInfo, &setupRsp->Capabilities) ;
 
     if(setupRsp->SuppRates.present)
     {
@@ -2314,10 +2259,10 @@
     {
        ConvertQOSCapsStation(pMac->hHdd, &setupPeer->qosCaps, 
                    &setupRsp->QOSCapsStation) ;
-       LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, ("setupRsp->SPLen=%d (be %d %d %d %d vo) more %d qack %d."), \
-         setupRsp->QOSCapsStation.max_sp_length, setupRsp->QOSCapsStation.acbe_uapsd, \
-         setupRsp->QOSCapsStation.acbk_uapsd, setupRsp->QOSCapsStation.acvi_uapsd, \
-         setupRsp->QOSCapsStation.acvo_uapsd, setupRsp->QOSCapsStation.more_data_ack, \
+       LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, ("setupRsp->SPLen=%d (be %d %d %d %d vo) more %d qack %d."),
+         setupRsp->QOSCapsStation.max_sp_length, setupRsp->QOSCapsStation.acbe_uapsd,
+         setupRsp->QOSCapsStation.acbk_uapsd, setupRsp->QOSCapsStation.acvi_uapsd,
+         setupRsp->QOSCapsStation.acvo_uapsd, setupRsp->QOSCapsStation.more_data_ack,
          setupRsp->QOSCapsStation.qack));
     }
     
@@ -2328,16 +2273,16 @@
                                                 &setupRsp->ExtSuppRates );
     }
     /* update HT caps */
-    if(setupRsp->HTCaps.present)
+    if (setupRsp->HTCaps.present)
     {
-        palCopyMemory(pMac->hHdd, &setupPeer->tdlsPeerHTCaps, 
+        vos_mem_copy(&setupPeer->tdlsPeerHTCaps,
                     &setupRsp->HTCaps, sizeof(tDot11fIEHTCaps)) ;
     }
 
     /* update EXT caps */
-    if(setupRsp->ExtCap.present)
+    if (setupRsp->ExtCap.present)
     {
-        palCopyMemory(pMac->hHdd, &setupPeer->tdlsPeerExtCaps, 
+        vos_mem_copy( &setupPeer->tdlsPeerExtCaps,
                     &setupRsp->ExtCap, sizeof(tDot11fIEExtCap)) ;
     }
 
@@ -2345,7 +2290,7 @@
 }
 #endif
 
-/* This Function is similar to PopulateDot11fHTCaps , except that the HT Capabilities
+/* This Function is similar to PopulateDot11fHTCaps, except that the HT Capabilities
  * are considered from the AddStaReq rather from the cfg.dat as in PopulateDot11fHTCaps
  */
 static tSirRetStatus limTdlsPopulateDot11fHTCaps(tpAniSirGlobal pMac, tpPESession psessionEntry,
@@ -2413,7 +2358,8 @@
 
     dot11fLog( pMac, LOG2, FL( "AMPDU Param: %x" ), nCfgValue);
 
-    palCopyMemory(pMac->hHdd, pDot11f->supportedMCSSet,  pTdlsAddStaReq->htCap.suppMcsSet, SIZE_OF_SUPPORTED_MCS_SET);
+    vos_mem_copy( pDot11f->supportedMCSSet, pTdlsAddStaReq->htCap.suppMcsSet,
+                  SIZE_OF_SUPPORTED_MCS_SET);
 
     nCfgValue = pTdlsAddStaReq->htCap.extendedHtCapInfo;
 
@@ -2547,11 +2493,12 @@
     // get own rate set
     val = WNI_CFG_OPERATIONAL_RATE_SET_LEN;
     if (wlan_cfgGetStr(pMac, WNI_CFG_OPERATIONAL_RATE_SET,
-					  (tANI_U8 *) &tempRateSet.rate,
-					  &val) != eSIR_SUCCESS)
+                                          (tANI_U8 *) &tempRateSet.rate,
+                                          &val) != eSIR_SUCCESS)
     {
         /// Could not get rateset from CFG. Log error.
         limLog(pMac, LOGP, FL("could not retrieve rateset"));
+        val = 0;
     }
     tempRateSet.numRates = val;
 
@@ -2561,8 +2508,8 @@
         // get own extended rate set
         val = WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET_LEN;
         if (wlan_cfgGetStr(pMac, WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET,
-						  (tANI_U8 *) &tempRateSet2.rate,
-						  &val) != eSIR_SUCCESS)
+                                                  (tANI_U8 *) &tempRateSet2.rate,
+                                                  &val) != eSIR_SUCCESS)
         tempRateSet2.numRates = val;
     }
     else
@@ -2624,7 +2571,7 @@
         tpSirSupportedRates  rates = &pStaDs->supportedRates;
         tANI_U8 aRateIndex = 0;
         tANI_U8 bRateIndex = 0;
-        palZeroMemory( pMac->hHdd, (tANI_U8 *) rates, sizeof(tSirSupportedRates));
+        vos_mem_set( (tANI_U8 *) rates, sizeof(tSirSupportedRates), 0);
 
         for (i = 0;i < tempRateSet2.numRates; i++)
         {
@@ -2765,8 +2712,9 @@
 {
     //tDot11fIEHTCaps *htCaps = &setupPeerInfo->tdlsPeerHTCaps ;
     tDot11fIEHTCaps htCap, *htCaps;
+    tDot11fIEVHTCaps *pVhtCaps = NULL;
 #ifdef WLAN_FEATURE_11AC
-    tDot11fIEVHTCaps vhtCap, *pVhtCaps;
+    tDot11fIEVHTCaps vhtCap;
     tANI_U8 cbMode;
 #endif
     tpDphHashNode pSessStaDs = NULL;
@@ -2809,9 +2757,20 @@
     pVhtCaps = &vhtCap;
     if (pVhtCaps->present)
     {
-        pStaDs->mlmStaContext.vhtCapability = 1 ;
-        pStaDs->vhtSupportedChannelWidthSet =  WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ;
-        pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_40MHZ ;
+       pStaDs->mlmStaContext.vhtCapability = 1 ;
+
+       if ((psessionEntry->currentOperChannel <= SIR_11B_CHANNEL_END) &&
+            pMac->roam.configParam.enableVhtFor24GHz)
+        {
+            pStaDs->vhtSupportedChannelWidthSet = WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
+            pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_20MHZ;
+        }
+        else
+        {
+            pStaDs->vhtSupportedChannelWidthSet =  WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ;
+            pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_40MHZ ;
+        }
+
         pStaDs->vhtLdpcCapable = pVhtCaps->ldpcCodingCap;
         pStaDs->vhtBeamFormerCapable= pVhtCaps->suBeamFormerCap;
         // TODO , is it necessary , Sunil???
@@ -2854,7 +2813,7 @@
                                    pTdlsAddStaReq->supported_rates_length,
                                    (tANI_U8 *)pTdlsAddStaReq->htCap.suppMcsSet,
                                    &pStaDs->mlmStaContext.propRateSet,
-                                   psessionEntry, (tDot11fIEVHTCaps *)&pTdlsAddStaReq->vhtCap);
+                                   psessionEntry, pVhtCaps);
 
     /*  TDLS Dummy AddSTA does not have right capability , is it OK ??
      */
@@ -2877,9 +2836,9 @@
 
     while (linkSetupList != NULL)
     {
-        if (palEqualMemory( pMac->hHdd,(tANI_U8 *) peerMac, 
-                        (tANI_U8 *) linkSetupList->peerMac, 
-                                                 sizeof(tSirMacAddr)) )
+        if (vos_mem_compare((tANI_U8 *) peerMac,
+                            (tANI_U8 *) linkSetupList->peerMac,
+                            sizeof(tSirMacAddr)) )
         {
             checkNode = TDLS_NODE_FOUND ;
             *setupPeer = linkSetupList ;
@@ -2913,7 +2872,7 @@
                  peerInfo->peerMac[4], 
                  peerInfo->peerMac[5]) ;
 
-        if (palEqualMemory( pMac->hHdd,(tANI_U8 *) peerMac,
+        if (vos_mem_compare((tANI_U8 *) peerMac,
                        (tANI_U8 *) &peerInfo->peerMac, sizeof(tSirMacAddr)) )
         {
             break ;
@@ -3000,7 +2959,7 @@
     for(currentNode = *linkSetupList ; currentNode != NULL ;
                     prevNode = currentNode, currentNode = currentNode->next)
     {
-        if (palEqualMemory( pMac->hHdd,(tANI_U8 *) peerMac, 
+        if (vos_mem_compare( (tANI_U8 *) peerMac,
                         (tANI_U8 *) currentNode->peerMac, 
                                                  sizeof(tSirMacAddr)) )
         {
@@ -3021,7 +2980,7 @@
             {
                 prevNode->next = currentNode->next ;
             }
-            palFreeMemory(pMac, currentNode) ;
+            vos_mem_free(currentNode) ;
             return ;
         }
     }
@@ -3054,15 +3013,15 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog(pMac, LOGE, FL("Failed to parse TDLS discovery Request \
-                              frame (0x%08x, %d bytes):"),status, frmLen);
+        limLog(pMac, LOGE, FL("Failed to parse TDLS discovery Request "
+                              "frame (0x%08x, %d bytes):"),status, frmLen);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while unpacking an\
-                      TDLS discovery Request frame (0x%08x," "%d bytes):"),
+        limLog( pMac, LOGW, FL("There were warnings while unpacking a TDLS "
+                               "discovery Request frame (0x%08x, %d bytes):"),
                    status, frmLen );
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
     }
@@ -3076,8 +3035,8 @@
                          &tdlsDisReq.LinkIdentifier.bssid[0], &sessionId) ;
     if(NULL == psessionEntry)
     {
-        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, \
-        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"), \
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"),
         tdlsDisReq.LinkIdentifier.bssid[0],    
         tdlsDisReq.LinkIdentifier.bssid[1],    
         tdlsDisReq.LinkIdentifier.bssid[2],    
@@ -3090,7 +3049,7 @@
     }
  
     /* varify BSSID */
-    status = palEqualMemory(pMac->hHdd, &psessionEntry->bssId[0],
+    status = vos_mem_compare( &psessionEntry->bssId[0],
                     &tdlsDisReq.LinkIdentifier.bssid[0], sizeof(tSirMacAddr)) ;
     VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO, 
             ("lim BSSID %02x, %02x, %02x, %02x, %02x, %02x"),
@@ -3121,7 +3080,7 @@
      * check if this is echo of our transmitted discovery request
      * drop it here, TODO: better to drop this in TL.
      */    
-    status = palEqualMemory(pMac->hHdd, psessionEntry->selfMacAddr, 
+    status = vos_mem_compare( psessionEntry->selfMacAddr,
                     &tdlsDisReq.LinkIdentifier.InitStaAddr[0],
                                                      sizeof(tSirMacAddr)) ;
     if(status)
@@ -3135,7 +3094,7 @@
      * STA_MAC--> MAC of TDLS discovery initiator
      * STA_PEER_MAC--> MAC of TDLS discovery responder.
      */
-    palCopyMemory(pMac->hHdd, peerMac,  
+    vos_mem_copy( peerMac,
                         &tdlsDisReq.LinkIdentifier.InitStaAddr[0], 
                                                      sizeof(tSirMacAddr)) ;
     /* TODO, do more validation */
@@ -3151,13 +3110,11 @@
          * out. We are freeing this memory at the time we are sending this
          * collected peer info to SME.
          */
-        status = palAllocateMemory(pMac->hHdd, (void **)&tdlsDisResult, 
-                                           sizeof(tLimDisResultList)) ; 
-    
-        if(status != eHAL_STATUS_SUCCESS)
+        tdlsDisResult = vos_mem_malloc(sizeof(tLimDisResultList));
+        if ( NULL == tdlsDisResult )
         {
-            limLog(pMac, LOGP, FL("alloc fail for TDLS discovery \
-                                                    reponse info")) ;
+            limLog(pMac, LOGP, FL("alloc fail for TDLS discovery "
+                                  "reponse info")) ;
             return eSIR_FAILURE ;
         }
 
@@ -3169,8 +3126,7 @@
         peerInfo->sessionId = psessionEntry->peSessionId;
         
         /* Populate peer info of tdls discovery result */
-        status = palCopyMemory(pMac->hHdd, peerInfo->peerMac, peerMac, 
-                                                 sizeof(tSirMacAddr)) ;
+        vos_mem_copy( peerInfo->peerMac, peerMac, sizeof(tSirMacAddr)) ;
 
          /*
          * Now, as per D13, there will not be any Supp rates, ext Supp rates
@@ -3208,7 +3164,7 @@
             }
             swapBitField16(caps, ( tANI_U16* )&capsInfo );
             /* update Caps Info */
-            tdlsUpdateCapInfo(&peerInfo->capabilityInfo , &capsInfo) ;
+            tdlsUpdateCapInfo(&peerInfo->capabilityInfo, &capsInfo) ;
 
             PopulateDot11fHTCaps( pMac, psessionEntry, &HTCaps );
             limTdlsCovertHTCaps(pMac, peerInfo, &HTCaps) ;
@@ -3279,16 +3235,16 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog(pMac, LOGE, FL("Failed to parse TDLS discovery Request \
-                              frame (0x%08x, %d bytes):"),status, frmLen);
+        limLog(pMac, LOGE, FL("Failed to parse TDLS discovery Request "
+                              "frame (0x%08x, %d bytes):"),status, frmLen);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while unpacking an\
-                      TDLS setup Request frame (0x%08x," "%d bytes):"),
-                   status, pBody );
+        limLog( pMac, LOGW, FL("There were warnings while unpacking a TDLS "
+                      "setup Request frame (0x%08x, %d bytes):"),
+                   status, frmLen );
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
     }
     /*
@@ -3300,8 +3256,8 @@
                          &tdlsSetupReq.LinkIdentifier.bssid[0], &sessionId) ;
     if(NULL == psessionEntry)
     {
-        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, \
-        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"), \
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"),
         tdlsSetupReq.LinkIdentifier.bssid[0],    
         tdlsSetupReq.LinkIdentifier.bssid[1],    
         tdlsSetupReq.LinkIdentifier.bssid[2],    
@@ -3313,7 +3269,7 @@
         return eSIR_FAILURE ;
     }
     /* TODO: we don;t need this check now, varify BSSID */
-    status = palEqualMemory(pMac->hHdd, psessionEntry->bssId, 
+    status = vos_mem_compare( psessionEntry->bssId,
                     &tdlsSetupReq.LinkIdentifier.bssid[0], 
                                                      sizeof(tSirMacAddr)) ;
      
@@ -3321,8 +3277,9 @@
     {
         limLog( pMac, LOGE, FL("TDLS setup request frame from other BSS -> something wrong. Check RXP filter")) ;
 
-        limSendTdlsSetupRspFrame(pMac, tdlsSetupReq.LinkIdentifier.InitStaAddr, tdlsSetupReq.DialogToken.token , psessionEntry,
-                                            TDLS_SETUP_STATUS_FAILURE, NULL, 0 ) ;
+        limSendTdlsSetupRspFrame(pMac, tdlsSetupReq.LinkIdentifier.InitStaAddr,
+                                 tdlsSetupReq.DialogToken.token, psessionEntry,
+                                 TDLS_SETUP_STATUS_FAILURE, NULL, 0 ) ;
         return eSIR_FAILURE ; 
     }
 
@@ -3471,8 +3428,8 @@
          * initiator, we don't care, if this request is unicast ro broadcast,
          * we simply, send discovery response frame on direct link.
          */
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                      (void **) &setupPeer, sizeof( tLimTdlsLinkSetupPeer )))
+        setupPeer = vos_mem_malloc(sizeof( tLimTdlsLinkSetupPeer ));
+        if ( NULL == setupPeer )
         {
             VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, 
                                  ( "Unable to allocate memory during ADD_STA" ));
@@ -3488,7 +3445,7 @@
         setupPeer->tdls_sessionId = psessionEntry->peSessionId;
         setupPeer->tdls_bIsResponder = 0;
 
-        palCopyMemory(pMac->hHdd, setupPeer->peerMac,  
+        vos_mem_copy(setupPeer->peerMac,
                      &tdlsSetupReq.LinkIdentifier.InitStaAddr[0], 
                                                      sizeof(tSirMacAddr)) ;
 
@@ -3509,12 +3466,12 @@
                                                   setupPeer, psessionEntry))
         {
             VOS_ASSERT(0) ;
-            palFreeMemory(pMac->hHdd, (void **) &setupPeer) ;
+            vos_mem_free((void **) &setupPeer) ;
             return eSIR_FAILURE ;
         }
 
         limSendTdlsSetupRspFrame(pMac, tdlsSetupReq.LinkIdentifier.InitStaAddr,
-                                  tdlsSetupReq.DialogToken.token , psessionEntry, 
+                                  tdlsSetupReq.DialogToken.token, psessionEntry,
                                   TDLS_SETUP_STATUS_SUCCESS, NULL, 0) ;
 
         limStartTdlsTimer(pMac, psessionEntry->peSessionId, 
@@ -3538,7 +3495,7 @@
         setupPeer->tdls_sessionId = psessionEntry->peSessionId;
         setupPeer->tdls_bIsResponder = 0;
 
-        palCopyMemory(pMac->hHdd, setupPeer->peerMac,  
+        vos_mem_copy( setupPeer->peerMac,
                      &tdlsSetupReq.LinkIdentifier.InitStaAddr[0], 
                                                      sizeof(tSirMacAddr)) ;
 
@@ -3553,7 +3510,7 @@
  
         limTdlsUpdateLinkReqPeerInfo(pMac, setupPeer, &tdlsSetupReq) ;
         limSendTdlsSetupRspFrame(pMac, tdlsSetupReq.LinkIdentifier.InitStaAddr, 
-                                 tdlsSetupReq.DialogToken.token , psessionEntry, 
+                                 tdlsSetupReq.DialogToken.token, psessionEntry,
                                  TDLS_SETUP_STATUS_SUCCESS, NULL, 0) ;
 
         limStartTdlsTimer(pMac, psessionEntry->peSessionId, 
@@ -3585,15 +3542,15 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog(pMac, LOGE, FL("Failed to parse TDLS discovery Request \
-                              frame (0x%08x, %d bytes):"),status, frmLen);
+        limLog(pMac, LOGE, FL("Failed to parse TDLS discovery Request "
+                              "frame (0x%08x, %d bytes):"),status, frmLen);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while unpacking an\
-                      TDLS discovery Request frame (0x%08x," "%d bytes):"),
+        limLog( pMac, LOGW, FL("There were warnings while unpacking a TDLS "
+                               "discovery Request frame (0x%08x, %d bytes):"),
                    status, frmLen );
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
     }
@@ -3607,8 +3564,8 @@
                          &tdlsSetupRsp.LinkIdentifier.bssid[0], &sessionId) ;
     if(NULL == psessionEntry)
     {
-        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, \
-        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"), \
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"),
         tdlsSetupRsp.LinkIdentifier.bssid[0],    
         tdlsSetupRsp.LinkIdentifier.bssid[1],    
         tdlsSetupRsp.LinkIdentifier.bssid[2],    
@@ -3621,7 +3578,7 @@
     }
   
     /* varify BSSID */
-    status = palEqualMemory(pMac->hHdd, psessionEntry->bssId, 
+    status = vos_mem_compare( psessionEntry->bssId,
                     &tdlsSetupRsp.LinkIdentifier.bssid[0], 
                                                   sizeof(tSirMacAddr)) ;
      
@@ -3632,7 +3589,7 @@
         VOS_ASSERT(0) ;
         return eSIR_FAILURE ; 
     }
-    palCopyMemory(pMac->hHdd, peerMac,  
+    vos_mem_copy( peerMac,
                       &tdlsSetupRsp.LinkIdentifier.RespStaAddr[0], 
                                                      sizeof(tSirMacAddr)) ;
 
@@ -3648,8 +3605,7 @@
 
     if(NULL == setupPeer)
     {
-        limLog( pMac, LOGE, FL(" unknown setup Response frame \
-                                                        other BSS")) ;
+        limLog( pMac, LOGE, FL("unknown setup Response frame other BSS")) ;
         return eSIR_FAILURE ;
     }
                                                 
@@ -3724,15 +3680,15 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog(pMac, LOGE, FL("Failed to parse an TDLS discovery Response \
-                              frame (0x%08x, %d bytes):"),status, frmLen);
+        limLog(pMac, LOGE, FL("Failed to parse an TDLS discovery Response "
+                              "frame (0x%08x, %d bytes):"),status, frmLen);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while unpacking an\
-                      TDLS discovery Response frame (0x%08x," "%d bytes):"),
+        limLog( pMac, LOGW, FL("There were warnings while unpacking a TDLS "
+                               "discovery Response frame (0x%08x, %d bytes):"),
                    status, frmLen );
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
     }
@@ -3745,8 +3701,8 @@
                          &tdlsSetupCnf.LinkIdentifier.bssid[0], &sessionId) ;
     if(NULL == psessionEntry)
     {
-        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, \
-        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"), \
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"),
         tdlsSetupCnf.LinkIdentifier.bssid[0],    
         tdlsSetupCnf.LinkIdentifier.bssid[1],    
         tdlsSetupCnf.LinkIdentifier.bssid[2],    
@@ -3759,7 +3715,7 @@
     }
  
     /* varify BSSID */
-    status = palEqualMemory(pMac->hHdd, psessionEntry->bssId, 
+    status = vos_mem_compare( psessionEntry->bssId,
                     &tdlsSetupCnf.LinkIdentifier.bssid[0], 
                                                      sizeof(tSirMacAddr)) ;
 
@@ -3847,22 +3803,22 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog(pMac, LOGE, FL("Failed to parse an TDLS discovery Response \
-                              frame (0x%08x, %d bytes):"),status, frmLen);
+        limLog(pMac, LOGE, FL("Failed to parse an TDLS discovery Response "
+                              "frame (0x%08x, %d bytes):"),status, frmLen);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while unpacking an\
-                      TDLS discovery Response frame (0x%08x," "%d bytes):"),
+        limLog( pMac, LOGW, FL("There were warnings while unpacking a TDLS "
+                               "discovery Response frame (0x%08x, %d bytes):"),
                    status, frmLen );
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pFrame, nFrame);)
     }
     /*TODO:  match dialog token, before proceeding further */
 
     /* varify BSSID */
-    status = palEqualMemory(pMac->hHdd, psessionEntry->bssId, 
+    status = vos_mem_compare( psessionEntry->bssId,
                     &tdlsDisRsp.LinkIdentifier.bssid[0], 
                                                      sizeof(tSirMacAddr)) ;
 
@@ -3887,10 +3843,8 @@
      * out. We are freeing this memory at the time we are sending this
      * collected peer info to SME.
      */
-    status = palAllocateMemory(pMac->hHdd, (void **)&tdlsDisResult, 
-                                               sizeof(tLimDisResultList)) ; 
-    
-    if(status != eHAL_STATUS_SUCCESS)
+    tdlsDisResult = vos_mem_malloc(sizeof(tLimDisResultList));
+    if ( NULL == tdlsDisResult )
     {
         limLog(pMac, LOGP, FL("alloc fail for TDLS discovery reponse info")) ;
         return eSIR_FAILURE ;
@@ -3903,11 +3857,11 @@
         /* Populate peer info of tdls discovery result */
         peerInfo->sessionId = psessionEntry->peSessionId;
         /*
-         * When we receive DIS RSP from peer MAC, 
+         * When we receive DIS RSP from peer MAC,
          * STA_MAC_OFFSET will carry peer MAC address and PEER MAC OFFSET
          * will carry our MAC.
          */
-        status = palCopyMemory(pMac->hHdd, peerInfo->peerMac, 
+        vos_mem_copy( peerInfo->peerMac,
                     &tdlsDisRsp.LinkIdentifier.RespStaAddr[0], 
                                                      sizeof(tSirMacAddr)) ;
 
@@ -3915,7 +3869,7 @@
         peerInfo->tdlsPeerRssi = rssi ;
 
         /* update Caps Info */
-        tdlsUpdateCapInfo(&peerInfo->capabilityInfo , 
+        tdlsUpdateCapInfo(&peerInfo->capabilityInfo,
                                           &tdlsDisRsp.Capabilities) ;
 
         /* update Supp rates */
@@ -3935,16 +3889,9 @@
         /* update HT caps */
         if (tdlsDisRsp.HTCaps.present)
         {
-            palCopyMemory( pMac, &peerInfo->tdlsPeerHtCaps, &tdlsDisRsp.HTCaps, 
+            vos_mem_copy( &peerInfo->tdlsPeerHtCaps, &tdlsDisRsp.HTCaps,
                                                sizeof( tDot11fIEHTCaps ) );
         }
-        /* update EXT caps */
-        if (tdlsDisRsp.ExtCap.present)
-        {
-            //palCopyMemory( pMac, &peerInfo->tdlsPeerExtenCaps, 
-             //                &tdlsDisRsp.ExtCap, 
-              //                          sizeof( tDot11fIEExtCap ) );
-        }
     } while(0) ;
 
     /* now add this new found discovery node into tdls discovery list */
@@ -3970,15 +3917,15 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog(pMac, LOGE, FL("Failed to parse an TDLS discovery Response \
-                              frame (0x%08x, %d bytes):"),status, frmLen);
+        limLog(pMac, LOGE, FL("Failed to parse an TDLS discovery Response "
+                              "frame (0x%08x, %d bytes):"),status, frmLen);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while unpacking an\
-                      TDLS discovery Response frame (0x%08x," "%d bytes):"),
+        limLog( pMac, LOGW, FL("There were warnings while unpacking a TDLS "
+                               "discovery Response frame (0x%08x, %d bytes):"),
                    status, frmLen );
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frmLen);)
     }
@@ -3992,8 +3939,8 @@
                          &tdlsTeardown.LinkIdentifier.bssid[0], &sessionId) ;
     if(NULL == psessionEntry)
     {
-        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, \
-        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"), \
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+        ("no Seesion entry for TDLS session (bssid %02x:%02x:%02x:%02x:%02x:%02x)"),
         tdlsTeardown.LinkIdentifier.bssid[0],    
         tdlsTeardown.LinkIdentifier.bssid[1],    
         tdlsTeardown.LinkIdentifier.bssid[2],    
@@ -4006,7 +3953,7 @@
     }
  
     /* varify BSSID */
-    status = palEqualMemory(pMac->hHdd, psessionEntry->bssId, 
+    status = vos_mem_compare( psessionEntry->bssId,
                                   &tdlsTeardown.LinkIdentifier.bssid[0], 
                                                      sizeof(tSirMacAddr)) ;
 
@@ -4116,7 +4063,7 @@
     }
 
     frameLen -= (pOffset + PAYLOAD_TYPE_TDLS_SIZE) ;
-    LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, ("Received TDLS action %d (%s)"), \
+    LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, ("Received TDLS action %d (%s)"),
         action, limTraceTdlsActionString(action) ));
 
     switch(action)
@@ -4266,8 +4213,7 @@
 
 
         pStaDs->mlmStaContext.capabilityInfo = peerInfo->capabilityInfo;
-        palCopyMemory(pMac->hHdd, pStaDs->staAddr, peerMac, 
-                                                   sizeof(tSirMacAddr)) ; 
+        vos_mem_copy( pStaDs->staAddr, peerMac, sizeof(tSirMacAddr)) ;
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
                 ("Add STA for Peer: %02x, %02x, %02x, %02x, %02x, %02x"),
                              pStaDs->staAddr[0],
@@ -4426,8 +4372,8 @@
     limTdlsFindLinkPeer(pMac, peerMac, &setupPeer) ;
     if(NULL == setupPeer) {
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, 
-            ("limTdlsLinkEstablish: cannot find peer mac in tdls linksetup list: %02X %02X %02X %02X %02X %02X"), \
-        peerMac[0], peerMac[1], peerMac[2], \
+            ("limTdlsLinkEstablish: cannot find peer mac in tdls linksetup list: %02X %02X %02X %02X %02X %02X"),
+        peerMac[0], peerMac[1], peerMac[2],
         peerMac[3], peerMac[4], peerMac[5]);
         return eSIR_FAILURE;
     }
@@ -4443,17 +4389,18 @@
         return eHAL_STATUS_FAILURE;
     }
 
+    /* */
     pStaDs = dphLookupHashEntry(pMac, peerMac, &aid, &psessionEntry->dph.dphHashTable) ;
     if(pStaDs == NULL) {
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, 
-            ("limTdlsLinkEstablish: cannot find peer mac in hash table: %02X %02X %02X %02X %02X %02X"), \
-            peerMac[0], peerMac[1], peerMac[2], \
+            ("limTdlsLinkEstablish: cannot find peer mac in hash table: %02X %02X %02X %02X %02X %02X"),
+            peerMac[0], peerMac[1], peerMac[2],
             peerMac[3], peerMac[4], peerMac[5]);
         return eSIR_FAILURE;
     }
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&tdlsPtiTemplate, 
-               sizeof( tDot11fTDLSPeerTrafficInd ) );
+    vos_mem_set( ( tANI_U8* )&tdlsPtiTemplate,
+               sizeof( tDot11fTDLSPeerTrafficInd ), 0 );
 
     /*
     * setup Fixed fields,
@@ -4507,7 +4454,7 @@
         nBytes = 64;
     }
     /* zero out the memory */
-    palZeroMemory( pMac->hHdd, pFrame, sizeof(pFrame) );
+    vos_mem_set( pFrame, sizeof(pFrame), 0 );
 
     /* fill out the buffer descriptor */
 
@@ -4519,17 +4466,17 @@
 
     if ( DOT11F_FAILED( status ) )
     {
-        limLog( pMac, LOGE, FL("Failed to pack a PTI template \
-                            (0x%08x)."), status );
+        limLog( pMac, LOGE, FL("Failed to pack a PTI template (0x%08x)."),
+                status );
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while packing TDLS"
-            "Peer Traffic Indication (0x%08x).") );
+        limLog( pMac, LOGW, FL("There were warnings while packing TDLS "
+                               "Peer Traffic Indication (0x%08x)."), status );
     }
 
-    LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, ("bIsResponder=%d, header_offset=%ld, linkIdenOffset=%d, ptiBufStatusOffset=%d "), \
+    LIM_LOG_TDLS(VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, ("bIsResponder=%d, header_offset=%ld, linkIdenOffset=%d, ptiBufStatusOffset=%d "),
         setupPeer->tdls_bIsResponder, header_offset, PTI_LINK_IDEN_OFFSET, PTI_BUF_STATUS_OFFSET));
 
     limSendTdlsLinkEstablish(pMac, setupPeer->tdls_bIsResponder, 
@@ -4554,8 +4501,8 @@
     limTdlsFindLinkPeer(pMac, peerMac, &setupPeer) ;
     if(NULL == setupPeer) {
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, 
-            ("limTdlsLinkTeardown: cannot find peer mac in tdls linksetup list: %02X %02X %02X %02X %02X %02X"), \
-        peerMac[0], peerMac[1], peerMac[2], \
+            ("limTdlsLinkTeardown: cannot find peer mac in tdls linksetup list: %02X %02X %02X %02X %02X %02X"),
+        peerMac[0], peerMac[1], peerMac[2],
         peerMac[3], peerMac[4], peerMac[5]);
         return eSIR_FAILURE;
     }
@@ -4577,8 +4524,8 @@
 
     if(pStaDs == NULL) {
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR, 
-            ("limTdlsLinkTeardown: cannot find peer mac in hash table: %02X %02X %02X %02X %02X %02X"), \
-            peerMac[0], peerMac[1], peerMac[2], \
+            ("limTdlsLinkTeardown: cannot find peer mac in hash table: %02X %02X %02X %02X %02X %02X"),
+            peerMac[0], peerMac[1], peerMac[2],
             peerMac[3], peerMac[4], peerMac[5]);
         return eSIR_FAILURE;
     }
@@ -4607,11 +4554,11 @@
     disMsgRspSize += (disStaCount * sizeof(tSirTdlsPeerInfo));
         
     /* now allocate memory */
-    status = palAllocateMemory( pMac->hHdd, (void **)&disRsp, disMsgRspSize ) ;
- 
-    if(eHAL_STATUS_FAILURE == status)
+
+    disRsp = vos_mem_malloc(disMsgRspSize);
+    if ( NULL == disRsp )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for DIS RSP"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for DIS RSP"));
         return NULL ;
     }
         
@@ -4624,29 +4571,29 @@
         while(tdlsDisRspList != NULL)
         {
 
-            palCopyMemory( pMac->hHdd, (tANI_U8 *)peerInfo, 
+            vos_mem_copy( (tANI_U8 *)peerInfo,
                           (tANI_U8 *) &tdlsDisRspList->tdlsDisPeerInfo, 
                                                  sizeof(tSirTdlsPeerInfo));
         
             VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO, 
             ("Msg Sent to PE, peer MAC: %02x, %02x, %02x, %02x, %02x, %02x"),
-                                  peerInfo->peerMac[0] ,
-                                  peerInfo->peerMac[1] ,
-                                  peerInfo->peerMac[2] ,
-                                  peerInfo->peerMac[3] ,
-                                  peerInfo->peerMac[4] ,
-                                  peerInfo->peerMac[5]) ;
+                                  peerInfo->peerMac[0],
+                                  peerInfo->peerMac[1],
+                                  peerInfo->peerMac[2],
+                                  peerInfo->peerMac[3],
+                                  peerInfo->peerMac[4],
+                                  peerInfo->peerMac[5]);
             disStaCount-- ;
             peerInfo++ ;
             currentNode = tdlsDisRspList ;
             tdlsDisRspList = tdlsDisRspList->next ;
-            palFreeMemory(pMac->hHdd, currentNode) ;
+            vos_mem_free(currentNode) ;
             /* boundary condition check, may be fatal */
             if(((!disStaCount) && (tdlsDisRspList)) 
                             || ((!tdlsDisRspList) && disStaCount))
             {
-                limLog(pMac, LOG1, FL("mismatch in dis sta count and\
-                                        and number of nodes in list")) ;
+                limLog(pMac, LOG1, FL("mismatch in dis sta count and "
+                                      "number of nodes in list")) ;
                 VOS_ASSERT(0) ;
                 return NULL ;
             } 
@@ -4671,14 +4618,12 @@
     
     mmhMsg.type = msgType ;
 
-    status = palAllocateMemory( pMac->hHdd, (void **)&teardownRspMsg, 
-                                        sizeof(tSirTdlsTeardownRsp)) ;
-
-    if(eHAL_STATUS_SUCCESS != status)
+    teardownRspMsg = vos_mem_malloc(sizeof(tSirTdlsTeardownRsp));
+    if ( NULL == teardownRspMsg )
     {
         VOS_ASSERT(0) ;
     } 
-    palCopyMemory( pMac->hHdd, teardownRspMsg->peerMac, (tANI_U8 *)peerMac, 
+    vos_mem_copy( teardownRspMsg->peerMac, (tANI_U8 *)peerMac,
                                                    sizeof(tSirMacAddr)) ;
     teardownRspMsg->statusCode =  statusCode ;
     mmhMsg.bodyptr = teardownRspMsg ;
@@ -4703,15 +4648,13 @@
 
     mmhMsg.type = msgType ;
 
-    status = palAllocateMemory( pMac->hHdd, (void **)&setupRspMsg, 
-                                        sizeof(tSirTdlsLinksetupRsp)) ;
-
-    if(eHAL_STATUS_SUCCESS != status)
+    setupRspMsg = vos_mem_malloc(sizeof(tSirTdlsLinksetupRsp));
+    if ( NULL == setupRspMsg )
     {
         VOS_ASSERT(0) ;
     } 
 
-    palCopyMemory( pMac->hHdd, setupRspMsg->peerMac, (tANI_U8 *)peerMac, 
+    vos_mem_copy( setupRspMsg->peerMac, (tANI_U8 *)peerMac,
                                                    sizeof(tSirMacAddr)) ;
     setupRspMsg->statusCode =  statusCode ;
     mmhMsg.bodyptr = setupRspMsg ;
@@ -4775,14 +4718,15 @@
     tSirMsgQ  mmhMsg = {0} ;
     tSirTdlsPeerInd *peerInd = NULL ;
     mmhMsg.type = eWNI_SME_ADD_TDLS_PEER_IND ;
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,(void * *) &peerInd,
-                                                (sizeof(tSirTdlsPeerInd))))
+
+    peerInd = vos_mem_malloc(sizeof(tSirTdlsPeerInd));
+    if ( NULL == peerInd )
     {
         PELOGE(limLog(pMac, LOGE, FL("Failed to allocate memory"));)
         return eSIR_FAILURE;
     }
 
-    palCopyMemory( pMac->hHdd, peerInd->peerMac, 
+    vos_mem_copy( peerInd->peerMac,
                            (tANI_U8 *) pStaDs->staAddr, sizeof(tSirMacAddr));
     peerInd->sessionId = sessionId;
     peerInd->staId = pStaDs->staIndex ;
@@ -4807,14 +4751,15 @@
     tSirMsgQ  mmhMsg = {0} ;
     tSirTdlsPeerInd *peerInd = NULL ;
     mmhMsg.type = eWNI_SME_DELETE_TDLS_PEER_IND ;
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,(void * *) &peerInd,
-                                                (sizeof(tSirTdlsPeerInd))))
+
+    peerInd = vos_mem_malloc(sizeof(tSirTdlsPeerInd));
+    if ( NULL == peerInd )
     {
         PELOGE(limLog(pMac, LOGE, FL("Failed to allocate memory"));)
         return eSIR_FAILURE;
     }
 
-    palCopyMemory( pMac->hHdd, peerInd->peerMac, 
+    vos_mem_copy( peerInd->peerMac,
                            (tANI_U8 *) pStaDs->staAddr, sizeof(tSirMacAddr));
     peerInd->sessionId = sessionId;
     peerInd->staId = pStaDs->staIndex ;
@@ -4842,14 +4787,14 @@
     tSirTdlsLinkSetupInd *setupInd = NULL ;
 
     mmhMsg.type = eWNI_SME_TDLS_LINK_START_IND ;
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,(void * *) &setupInd,
-                                            (sizeof(tSirTdlsLinkSetupInd))))
+    setupInd = vos_mem_malloc(sizeof(tSirTdlsLinkSetupInd));
+    if ( NULL == setupInd )
     {
         PELOGE(limLog(pMac, LOGE, FL("Failed to allocate memory"));)
         return eSIR_FAILURE;
     }
 
-    palCopyMemory( pMac->hHdd, setupInd->peerMac, 
+    vos_mem_copy( setupInd->peerMac,
                            (tANI_U8 *) peerMac, sizeof(tSirMacAddr));
     setupInd->length = sizeof(tSirTdlsLinkSetupInd);
     setupInd->statusCode = status ;
@@ -4961,8 +4906,9 @@
     tSirMsgQ  mmhMsg = {0} ;
     tSirTdlsAddStaRsp *addStaRsp = NULL ;
     mmhMsg.type = eWNI_SME_TDLS_ADD_STA_RSP ;
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,(void * *) &addStaRsp,
-                                                (sizeof(tSirTdlsAddStaRsp))))
+
+    addStaRsp = vos_mem_malloc(sizeof(tSirTdlsAddStaRsp));
+    if ( NULL == addStaRsp )
     {
         PELOGE(limLog(pMac, LOGE, FL("Failed to allocate memory"));)
         return eSIR_FAILURE;
@@ -4978,7 +4924,7 @@
     }
     if( peerMac )
     {
-        palCopyMemory( pMac->hHdd, addStaRsp->peerMac, 
+        vos_mem_copy( addStaRsp->peerMac,
                 (tANI_U8 *) peerMac, sizeof(tSirMacAddr));
     }
     if (updateSta)
@@ -5009,7 +4955,7 @@
 
     SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
     VOS_TRACE(VOS_MODULE_ID_PE, TDLS_DEBUG_LOG_LEVEL,
-            ("limTdlsAddStaRsp: staIdx=%d, staMac=%02x:%02x:%02x:%02x:%02x:%02x"), pAddStaParams->staIdx, \
+            ("limTdlsAddStaRsp: staIdx=%d, staMac=%02x:%02x:%02x:%02x:%02x:%02x"), pAddStaParams->staIdx,
                             pAddStaParams->staMac[0], 
                             pAddStaParams->staMac[1], 
                             pAddStaParams->staMac[2], 
@@ -5049,7 +4995,7 @@
     {
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
                                          ("Peer IND msg to SME failed")) ;
-        palFreeMemory( pMac->hHdd, (void *) pAddStaParams );
+        vos_mem_free( pAddStaParams );
         return eSIR_FAILURE ;
     }
 
@@ -5080,7 +5026,7 @@
 add_sta_error:
     status = limSendSmeTdlsAddStaRsp(pMac, psessionEntry->smeSessionId, 
                                         pAddStaParams->staMac, pAddStaParams->updateSta, pStaDs, status) ;
-    palFreeMemory( pMac->hHdd, (void *) pAddStaParams );
+    vos_mem_free( pAddStaParams );
     return status ;
 }
 
@@ -5102,13 +5048,13 @@
                                    (respStaAddr = linkIden->RespStaAddr))
                                 : ((respStaAddr = linkIden->InitStaAddr ),
                                    (initStaAddr = linkIden->RespStaAddr)) ;
-    palCopyMemory( pMac->hHdd, (tANI_U8 *)linkIden->bssid, 
+    vos_mem_copy( (tANI_U8 *)linkIden->bssid,
                      (tANI_U8 *) psessionEntry->bssId, sizeof(tSirMacAddr)) ; 
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *)initStaAddr,
+    vos_mem_copy( (tANI_U8 *)initStaAddr,
                           psessionEntry->selfMacAddr, sizeof(tSirMacAddr)) ;
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *)respStaAddr, (tANI_U8 *) peerMac, 
+    vos_mem_copy( (tANI_U8 *)respStaAddr, (tANI_U8 *) peerMac,
                                                        sizeof( tSirMacAddr ));
 
     linkIden->present = 1 ;
@@ -5120,7 +5066,7 @@
                                         tDot11fIEExtCap *extCapability)
 {
     extCapability->TDLSPeerPSMSupp = PEER_PSM_SUPPORT ;
-    extCapability->TDLSPeerUAPSDBufferSTA = PEER_BUFFER_STA_SUPPORT ;
+    extCapability->TDLSPeerUAPSDBufferSTA = pMac->lim.gLimTDLSBufStaEnabled;
     extCapability->TDLSChannelSwitching = CH_SWITCH_SUPPORT ;
     extCapability->TDLSSupport = TDLS_SUPPORT ;
     extCapability->TDLSProhibited = TDLS_PROHIBITED ;
@@ -5159,8 +5105,9 @@
     * memory after teardown, if the link is successfully setup or
     * free this memory if any timeout is happen in link setup procedure
     */
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                  (void **) &setupPeer, sizeof( tLimTdlsLinkSetupPeer )))
+
+    setupPeer = vos_mem_malloc(sizeof( tLimTdlsLinkSetupPeer ));
+    if ( NULL == setupPeer )
     {
         limLog( pMac, LOGP, 
                   FL( "Unable to allocate memory during ADD_STA" ));
@@ -5179,7 +5126,7 @@
     * we only populate peer MAC, so it can assit us to find the
     * TDLS peer after response/or after response timeout
     */
-    palCopyMemory(pMac->hHdd, setupPeer->peerMac, peerMac,
+    vos_mem_copy(setupPeer->peerMac, peerMac,
                                               sizeof(tSirMacAddr)) ;
     /* format TDLS discovery request frame and transmit it */
     limSendTdlsLinkSetupReqFrame(pMac, peerMac, dialog, psessionEntry, NULL, 0) ;
@@ -5242,8 +5189,8 @@
             (psessionEntry->limSmeState != eLIM_SME_LINK_EST_STATE))
     {
 
-        limLog(pMac, LOGE, "send mgmt received in invalid LIMsme \
-                state (%d)", psessionEntry->limSmeState);
+        limLog(pMac, LOGE, "send mgmt received in invalid LIMsme "
+                "state (%d)", psessionEntry->limSmeState);
         goto lim_tdls_send_mgmt_error;
     }
 
@@ -5325,6 +5272,38 @@
 }
 
 /*
+ * Send Response to Link Establish Request to SME
+ */
+void limSendSmeTdlsLinkEstablishReqRsp(tpAniSirGlobal pMac,
+                    tANI_U8 sessionId, tSirMacAddr peerMac, tDphHashNode   *pStaDs,
+                    tANI_U8 status)
+{
+    tSirMsgQ  mmhMsg = {0} ;
+
+    tSirTdlsLinkEstablishReqRsp *pTdlsLinkEstablishReqRsp = NULL ;
+
+    pTdlsLinkEstablishReqRsp = vos_mem_malloc(sizeof(tSirTdlsLinkEstablishReqRsp));
+    if ( NULL == pTdlsLinkEstablishReqRsp )
+    {
+        PELOGE(limLog(pMac, LOGE, FL("Failed to allocate memory"));)
+        return ;
+    }
+    pTdlsLinkEstablishReqRsp->statusCode = status ;
+    if ( peerMac )
+    {
+        vos_mem_copy(pTdlsLinkEstablishReqRsp->peerMac, peerMac, sizeof(tSirMacAddr));
+    }
+    pTdlsLinkEstablishReqRsp->sessionId = sessionId;
+    mmhMsg.type = eWNI_SME_TDLS_LINK_ESTABLISH_RSP ;
+    mmhMsg.bodyptr = pTdlsLinkEstablishReqRsp;
+    mmhMsg.bodyval = 0;
+    limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
+    return ;
+
+
+}
+
+/*
  * Once link is teardown, send Del Peer Ind to SME
  */
 static eHalStatus limSendSmeTdlsDelStaRsp(tpAniSirGlobal pMac, 
@@ -5334,8 +5313,9 @@
     tSirMsgQ  mmhMsg = {0} ;
     tSirTdlsDelStaRsp *pDelSta = NULL ;
     mmhMsg.type = eWNI_SME_TDLS_DEL_STA_RSP ;
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,(void * *) &pDelSta,
-                (sizeof(tSirTdlsDelStaRsp))))
+
+    pDelSta = vos_mem_malloc(sizeof(tSirTdlsDelStaRsp));
+    if ( NULL == pDelSta )
     {
         PELOGE(limLog(pMac, LOGE, FL("Failed to allocate memory"));)
             return eSIR_FAILURE;
@@ -5352,7 +5332,7 @@
 
     if( peerMac )
     {
-        palCopyMemory(pMac->hHdd, pDelSta->peerMac, peerMac, sizeof(tSirMacAddr));
+        vos_mem_copy(pDelSta->peerMac, peerMac, sizeof(tSirMacAddr));
     }
 
     pDelSta->length = sizeof(tSirTdlsDelStaRsp) ;
@@ -5406,8 +5386,8 @@
                 (psessionEntry->limSmeState != eLIM_SME_LINK_EST_STATE))
      {
      
-         limLog(pMac, LOGE, "send mgmt received in invalid LIMsme \
-                               state (%d)", psessionEntry->limSmeState);
+         limLog(pMac, LOGE, "send mgmt received in invalid LIMsme "
+                "state (%d)", psessionEntry->limSmeState);
          goto lim_tdls_add_sta_error;
      }
 
@@ -5470,8 +5450,8 @@
             (psessionEntry->limSmeState != eLIM_SME_LINK_EST_STATE))
     {
 
-        limLog(pMac, LOGE, "Del Sta received in invalid LIMsme \
-                state (%d)", psessionEntry->limSmeState);
+        limLog(pMac, LOGE, "Del Sta received in invalid LIMsme state (%d)",
+               psessionEntry->limSmeState);
         goto lim_tdls_del_sta_error;
     }
 
@@ -5500,6 +5480,99 @@
     return eSIR_SUCCESS;
 }
 
+
+/*
+ * Process Link Establishment Request from SME .
+ */
+tSirRetStatus limProcesSmeTdlsLinkEstablishReq(tpAniSirGlobal pMac,
+                                                           tANI_U32 *pMsgBuf)
+{
+    /* get all discovery request parameters */
+    tSirTdlsLinkEstablishReq *pTdlsLinkEstablishReq = (tSirTdlsLinkEstablishReq*) pMsgBuf ;
+    tpPESession psessionEntry;
+    tANI_U8      sessionId;
+    tpTdlsLinkEstablishParams pMsgTdlsLinkEstablishReq;
+    tSirMsgQ msg;
+    tANI_U16 peerIdx = 0 ;
+    tpDphHashNode pStaDs = NULL ;
+
+    VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+            ("Send Mgmt Recieved")) ;
+
+    if((psessionEntry = peFindSessionByBssid(pMac, pTdlsLinkEstablishReq->bssid, &sessionId))
+            == NULL)
+    {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+                "PE Session does not exist for given sme sessionId %d",
+                pTdlsLinkEstablishReq->sessionId);
+        limSendSmeTdlsLinkEstablishReqRsp(pMac, pTdlsLinkEstablishReq->sessionId, pTdlsLinkEstablishReq->peerMac,
+             NULL, eSIR_FAILURE) ;
+        return eSIR_FAILURE;
+    }
+
+    /* check if we are in proper state to work as TDLS client */
+    if (psessionEntry->limSystemRole != eLIM_STA_ROLE)
+    {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+                "TDLS Link Establish Request received in wrong system Role %d",
+                psessionEntry->limSystemRole);
+        goto lim_tdls_link_establish_error;
+    }
+
+    /*
+     * if we are still good, go ahead and check if we are in proper state to
+     * do TDLS discovery req/rsp/....frames.
+     */
+    if ((psessionEntry->limSmeState != eLIM_SME_ASSOCIATED_STATE) &&
+            (psessionEntry->limSmeState != eLIM_SME_LINK_EST_STATE))
+    {
+
+        limLog(pMac, LOGE, "TDLS Link Establish Request received in "
+               "invalid LIMsme state (%d)", psessionEntry->limSmeState);
+        goto lim_tdls_link_establish_error;
+    }
+    /*TODO Sunil , TDLSPeer Entry has the STA ID , Use it */
+    pStaDs = dphLookupHashEntry(pMac, pTdlsLinkEstablishReq->peerMac, &peerIdx,
+                                &psessionEntry->dph.dphHashTable) ;
+    if ( NULL == pStaDs )
+    {
+        limLog( pMac, LOGE, FL( "pStaDs is NULL" ));
+        goto lim_tdls_link_establish_error;
+
+    }
+    pMsgTdlsLinkEstablishReq = vos_mem_malloc(sizeof( tTdlsLinkEstablishParams ));
+    if ( NULL == pMsgTdlsLinkEstablishReq )
+    {
+        limLog( pMac, LOGE,
+                     FL( "Unable to allocate memory TDLS Link Establish Request" ));
+        return eSIR_MEM_ALLOC_FAILED;
+    }
+
+    vos_mem_set( (tANI_U8 *)pMsgTdlsLinkEstablishReq, sizeof(tpTdlsLinkEstablishParams), 0);
+
+    pMsgTdlsLinkEstablishReq->staIdx = pStaDs->staIndex;
+    pMsgTdlsLinkEstablishReq->isResponder = pTdlsLinkEstablishReq->isResponder;
+    pMsgTdlsLinkEstablishReq->uapsdQueues = pTdlsLinkEstablishReq->uapsdQueues;
+    pMsgTdlsLinkEstablishReq->maxSp = pTdlsLinkEstablishReq->maxSp;
+    pMsgTdlsLinkEstablishReq->isBufsta = pTdlsLinkEstablishReq->isBufSta;
+    msg.type = WDA_SET_TDLS_LINK_ESTABLISH_REQ;
+    msg.reserved = 0;
+    msg.bodyptr = pMsgTdlsLinkEstablishReq;
+    msg.bodyval = 0;
+    if(eSIR_SUCCESS != wdaPostCtrlMsg(pMac, &msg))
+    {
+        limLog(pMac, LOGE, FL("halPostMsgApi failed"));
+        goto lim_tdls_link_establish_error;
+    }
+    return eSIR_SUCCESS;
+lim_tdls_link_establish_error:
+     limSendSmeTdlsLinkEstablishReqRsp(pMac, psessionEntry->smeSessionId, pTdlsLinkEstablishReq->peerMac,
+                                       NULL, eSIR_FAILURE) ;
+
+    return eSIR_SUCCESS;
+}
+
+
 /* Delete all the TDLS peer connected before leaving the BSS */
 tSirRetStatus limDeleteTDLSPeers(tpAniSirGlobal pMac, tpPESession psessionEntry)
 {
diff --git a/CORE/MAC/src/pe/lim/limPropExtsUtils.c b/CORE/MAC/src/pe/lim/limPropExtsUtils.c
index 7a7f079..a66364b 100644
--- a/CORE/MAC/src/pe/lim/limPropExtsUtils.c
+++ b/CORE/MAC/src/pe/lim/limPropExtsUtils.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limPropExtsUtils.cc contains the utility functions
  * to populate, parse proprietary extensions required to
@@ -85,14 +84,15 @@
 #if !defined WLAN_FEATURE_VOWIFI
     tANI_U32            localPowerConstraints = 0;
 #endif
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                (void **)&pBeaconStruct, sizeof(tSirProbeRespBeacon)))
+
+    pBeaconStruct = vos_mem_malloc(sizeof(tSirProbeRespBeacon));
+    if ( NULL == pBeaconStruct )
     {
-        limLog(pMac, LOGE, FL("Unable to PAL allocate memory in limExtractApCapability") );
+        limLog(pMac, LOGE, FL("Unable to allocate memory in limExtractApCapability") );
         return;
     }
 
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pBeaconStruct, sizeof(tSirProbeRespBeacon));
+    vos_mem_set( (tANI_U8 *) pBeaconStruct, sizeof(tSirProbeRespBeacon), 0);
     *qosCap = 0;
     *propCap = 0;
     *uapsd = 0;
@@ -166,7 +166,7 @@
         }
 #endif
     }
-    palFreeMemory(pMac->hHdd, pBeaconStruct);
+    vos_mem_free(pBeaconStruct);
     return;
 } /****** end limExtractApCapability() ******/
 
diff --git a/CORE/MAC/src/pe/lim/limRoamingAlgo.c b/CORE/MAC/src/pe/lim/limRoamingAlgo.c
index f91abf3..d41b529 100644
--- a/CORE/MAC/src/pe/lim/limRoamingAlgo.c
+++ b/CORE/MAC/src/pe/lim/limRoamingAlgo.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limRoamingAlgo.cc contains the code for LIM
  * algorithms.
@@ -47,15 +46,15 @@
 
 
 /** ----------------------------------------------------------------------
-\fn      limSelectsBackgroundScanMode()
-\brief   This function is called by limIsBackgroundScanAllowed().
-\        Here LIM decides whether we shall enforce this background
-\        scan or let HAL decide whether to proceed with the background
+\fn      limSelectsBackgroundScanMode() 
+\brief   This function is called by limIsBackgroundScanAllowed(). 
+\        Here LIM decides whether we shall enforce this background 
+\        scan or let HAL decide whether to proceed with the background 
 \        scan as HAL sees fits.  LIM shall enforce background scan if:
 \        1) station is not in link established state
 \        2) station is in link established state, but there has been
 \           max number of consecutive background scan failure.
-\
+\ 
 \param   tpAniSirGlobal  pMac
 \return  none
 \ ------------------------------------------------------------------------- */
@@ -68,7 +67,7 @@
         limLog(pMac, LOGP, FL("Fail to get WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE value"));
         return eSIR_NORMAL_BACKGROUND_SCAN;
     }
-
+  
     if (cfgVal == 0)
         return eSIR_NORMAL_BACKGROUND_SCAN;
 
@@ -92,7 +91,7 @@
 /** -----------------------------------------------------------
 \fn      limIsBackgroundScanAllowed
 \brief   This function determines if background scan should be
-\        allowed. It is called by limTriggerBackgroundScan().
+\        allowed. It is called by limTriggerBackgroundScan(). 
 \param   tpAniSirGlobal  pMac
 \return  none
 \ ------------------------------------------------------------- */
@@ -135,10 +134,10 @@
 \        when there is an exisiting link with an AP.
 \        SME_SCAN_REQ is issued to SME state machine with Active
 \        scanning is performed on one channel at a time.
-\
+\ 
 \        Assumptions:
-\        Valid channel list at CFG is either populated by Roaming
-\        algorithm upon determining/selecting a regulatory domain
+\        Valid channel list at CFG is either populated by Roaming 
+\        algorithm upon determining/selecting a regulatory domain 
 \        or by default has all 36 possible channels.
 \
 \param   tpAniSirGlobal  pMac
@@ -181,9 +180,9 @@
     smeScanReq.messageType = eWNI_SME_SCAN_REQ;
     smeScanReq.length      = sizeof(tSirSmeScanReq);
     smeScanReq.bssType     = eSIR_INFRASTRUCTURE_MODE;
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) smeScanReq.bssId,
+    vos_mem_copy( (tANI_U8 *) smeScanReq.bssId,
                   (tANI_U8 *) &bcAddr, sizeof(tSirMacAddr));
-
+ 
     if (wlan_cfgGetStr(pMac, WNI_CFG_SSID,
                     (tANI_U8 *) (smeScanReq.ssId[0].ssId),
                     (tANI_U32 *) &ssidLen) != eSIR_SUCCESS)
@@ -218,7 +217,7 @@
     smeScanReq.returnAfterFirstMatch = 0;
     smeScanReq.returnUniqueResults   = 1;
 
-    //At the first channel scan, clear the cached results
+    //At the first channel scan, clear the cached results 
     if(pMac->lim.gLimBackgroundScanChannelId == 0)
     {
         /*
@@ -231,7 +230,7 @@
     {
         smeScanReq.returnFreshResults    = SIR_BG_SCAN_RETURN_FRESH_RESULTS;
     }
-
+   
 
     smeScanReq.channelList.numChannels = 1;
     if (pMac->lim.gLimBackgroundScanChannelId >= len)
@@ -241,7 +240,7 @@
         PELOGE(limLog(pMac, LOGE, FL("Skipping Background Scan since the channel list is exhausted."));)
         PELOGE(limLog(pMac, LOGE, FL("SME should send WNI_CFG_BACKGROUND_SCAN_PERIOD indication to start the background scan again."));)
 
-        /* Stop the BG scan timer here. SME should send WNI_CFG_BACKGROUND_SCAN_PERIOD
+        /* Stop the BG scan timer here. SME should send WNI_CFG_BACKGROUND_SCAN_PERIOD 
          * indication to start the background scan again.
          */
         if (TX_TIMER_VALID(pMac->lim.limTimers.gLimBackgroundScanTimer))
@@ -267,17 +266,17 @@
 
     smeScanReq.uIEFieldLen = 0;
     smeScanReq.uIEFieldOffset = sizeof(tSirSmeScanReq);
-
+    
     backgroundScan = limSelectsBackgroundScanMode(pMac);
     PELOG1(limLog(pMac, LOG1, FL("Performing (mode %d) Background Scan "), backgroundScan);)
     smeScanReq.backgroundScanMode = backgroundScan;
-
+    
     //determine whether to send the results or not, If so, notify the BG scan results to SME
     if (pMac->lim.gLimBackgroundScanChannelId >= len)
     {
         pMac->lim.gLimReportBackgroundScanResults = TRUE;
     }
-
+    
     limPostSmeMessage(pMac,
                       eWNI_SME_SCAN_REQ,
                       (tANI_U32 *) &smeScanReq);
@@ -286,8 +285,8 @@
 
 /** ----------------------------------------------------------------------
 \fn      limAbortBackgroundScan
-\brief   This function aborts background scan and send scan
-\        response to SME.
+\brief   This function aborts background scan and send scan 
+\        response to SME. 
 \param   tpAniSirGlobal  pMac
 \return  none
 \ ------------------------------------------------------------------------- */
@@ -295,12 +294,12 @@
 {
     tANI_U16  scanRspLen = 8;
 
-    if(pMac->lim.gLimBackgroundScanTerminate == FALSE)
+    if(pMac->lim.gLimBackgroundScanTerminate == FALSE) 
     {
         limLog(pMac, LOGE, FL("Abort Background Scan "));
         if (TX_TIMER_VALID(pMac->lim.limTimers.gLimBackgroundScanTimer))
         {
-            limDeactivateAndChangeTimer(pMac, eLIM_BACKGROUND_SCAN_TIMER);
+            limDeactivateAndChangeTimer(pMac, eLIM_BACKGROUND_SCAN_TIMER); 
         }
 
         pMac->lim.gLimBackgroundScanTerminate = TRUE;
@@ -314,11 +313,11 @@
                          pMac->lim.gLimSmeScanResultLength -
                          sizeof(tSirBssDescription);
             limSendSmeScanRsp(pMac, scanRspLen, eSIR_SME_SUCCESS, 0, 0);
-        }
+        }       
     }
 
     // reset background scan variables
-    pMac->lim.gLimBackgroundScanChannelId = 0;
+    pMac->lim.gLimBackgroundScanChannelId = 0;   
     return;
 }
 
diff --git a/CORE/MAC/src/pe/lim/limScanResultUtils.c b/CORE/MAC/src/pe/lim/limScanResultUtils.c
index 1e3a706..747a3bd 100644
--- a/CORE/MAC/src/pe/lim/limScanResultUtils.c
+++ b/CORE/MAC/src/pe/lim/limScanResultUtils.c
@@ -125,14 +125,14 @@
  * @return None
  */
 #if defined WLAN_FEATURE_VOWIFI
-void
+eHalStatus
 limCollectBssDescription(tpAniSirGlobal pMac,
                          tSirBssDescription *pBssDescr,
                          tpSirProbeRespBeacon pBPR,
                          tANI_U8  *pRxPacketInfo,
                          tANI_U8  fScanning)
 #else
-void
+eHalStatus
 limCollectBssDescription(tpAniSirGlobal pMac,
                          tSirBssDescription *pBssDescr,
                          tpSirProbeRespBeacon pBPR,
@@ -144,13 +144,26 @@
     tpSirMacMgmtHdr     pHdr;
     tANI_U8             channelNum;
     tANI_U8             rxChannel;
+    tANI_U8             rfBand = 0;
 
     pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo);
     VOS_ASSERT(WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo) >= SIR_MAC_B_PR_SSID_OFFSET);
     ieLen    = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo) - SIR_MAC_B_PR_SSID_OFFSET;
     rxChannel = WDA_GET_RX_CH(pRxPacketInfo);
     pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
+    rfBand = WDA_GET_RX_RFBAND(pRxPacketInfo);
 
+    /**
+     * Drop all the beacons and probe response without P2P IE during P2P search
+     */
+    if (NULL != pMac->lim.gpLimMlmScanReq && pMac->lim.gpLimMlmScanReq->p2pSearch)
+    {
+        if (NULL == limGetP2pIEPtr(pMac, (pBody + SIR_MAC_B_PR_SSID_OFFSET), ieLen))
+        {
+            limLog( pMac, LOG3, MAC_ADDRESS_STR, MAC_ADDR_ARRAY(pHdr->bssId));
+            return eHAL_STATUS_FAILURE;
+        }
+    }
 
     /**
      * Length of BSS desription is without length of
@@ -162,8 +175,8 @@
                     sizeof(tANI_U32) + ieLen);
 
     // Copy BSS Id
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &pBssDescr->bssId,
-                  (tANI_U8 *) pHdr->bssId,
+    vos_mem_copy((tANI_U8 *) &pBssDescr->bssId,
+                 (tANI_U8 *) pHdr->bssId,
                   sizeof(tSirMacAddr));
 
     // Copy Timestamp, Beacon Interval and Capability Info
@@ -191,18 +204,22 @@
     pBssDescr->channelId = limGetChannelFromBeacon(pMac, pBPR);
 
     if (pBssDescr->channelId == 0)
-   {
-      /* If the channel Id is not retrieved from Beacon, extract the channel from BD */
-      /* Unmapped the channel.This We have to do since we have done mapping in the hal to
+    {
+       /* If the channel Id is not retrieved from Beacon, extract the channel from BD */
+       /* Unmapped the channel.This We have to do since we have done mapping in the hal to
          overcome  the limitation of RXBD of not able to accomodate the bigger channel number.*/
-      if (!( rxChannel = limUnmapChannel(rxChannel)))
-      {
-         rxChannel = pMac->lim.gLimCurrentScanChannelId;
-      }
-      pBssDescr->channelId = rxChannel;
-   }
+       if ((!rfBand) || IS_5G_BAND(rfBand))
+       {
+          rxChannel = limUnmapChannel(rxChannel);
+       }
+       if (!rxChannel)
+       {
+          rxChannel = pMac->lim.gLimCurrentScanChannelId;
+       }
+       pBssDescr->channelId = rxChannel;
+    }
 
-    pBssDescr->channelIdSelf = rxChannel;
+    pBssDescr->channelIdSelf = pBssDescr->channelId;
     //set the network type in bss description
     channelNum = pBssDescr->channelId;
     pBssDescr->nwType = limGetNwType(pMac, channelNum, SIR_MAC_MGMT_FRAME, pBPR);
@@ -257,7 +274,7 @@
     }
 #endif
     // Copy IE fields
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &pBssDescr->ieFields,
+    vos_mem_copy((tANI_U8 *) &pBssDescr->ieFields,
                   pBody + SIR_MAC_B_PR_SSID_OFFSET,
                   ieLen);
 
@@ -269,7 +286,7 @@
         pBssDescr->aniIndicator,
         ieLen );
 
-    return;
+    return eHAL_STATUS_SUCCESS;
 } /*** end limCollectBssDescription() ***/
 
 /**
@@ -302,7 +319,7 @@
 
     for (i = 0; i < pMac->lim.gpLimMlmScanReq->numSsid; i++)
     {
-        if ( eANI_BOOLEAN_TRUE == palEqualMemory( pMac->hHdd,(tANI_U8 *) ssId,
+        if ( eANI_BOOLEAN_TRUE == vos_mem_compare((tANI_U8 *) ssId,
                    (tANI_U8 *) &pMac->lim.gpLimMlmScanReq->ssId[i],
                    (tANI_U8) (pMac->lim.gpLimMlmScanReq->ssId[i].length + 1)))
         {
@@ -349,6 +366,8 @@
     tANI_U8               rxChannelInBeacon = 0;
     eHalStatus            status;
     tANI_U8               dontUpdateAll = 0;
+    tANI_U8               rfBand = 0;
+    tANI_U8               rxChannelInBD = 0;
 
     tSirMacAddr bssid = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
     tANI_BOOLEAN fFound = FALSE;
@@ -359,11 +378,11 @@
     //Checking if scanning for a particular BSSID
     if ((fScanning) && (pMac->lim.gpLimMlmScanReq)) 
     {
-        fFound = palEqualMemory(pMac->hHdd, pHdr->addr3, &pMac->lim.gpLimMlmScanReq->bssId, 6);
+        fFound = vos_mem_compare(pHdr->addr3, &pMac->lim.gpLimMlmScanReq->bssId, 6);
         if (!fFound)
         {
             if ((pMac->lim.gpLimMlmScanReq->p2pSearch) &&
-               (palEqualMemory(pMac->hHdd, pBPR->P2PProbeRes.P2PDeviceInfo.P2PDeviceAddress, 
+               (vos_mem_compare(pBPR->P2PProbeRes.P2PDeviceInfo.P2PDeviceAddress,
                &pMac->lim.gpLimMlmScanReq->bssId, 6)))
             {
                 fFound = eANI_BOOLEAN_TRUE;
@@ -393,7 +412,7 @@
            !limIsScanRequestedSSID(pMac, &pBPR->ssId)) ||
           (!fFound && (pMac->lim.gpLimMlmScanReq &&
                        pMac->lim.gpLimMlmScanReq->bssId) &&
-           !palEqualMemory(pMac->hHdd, bssid,
+           !vos_mem_compare(bssid,
                            &pMac->lim.gpLimMlmScanReq->bssId, 6))))
     {
         /**
@@ -423,35 +442,39 @@
      * from another channel heard as noise on the current scanning channel
      */
 
-    if (pBPR->dsParamsPresent)
+    if ((pBPR->dsParamsPresent) || (pBPR->HTInfo.present))
     {
        /* This means that we are in 2.4GHz mode or 5GHz 11n mode */
        rxChannelInBeacon = limGetChannelFromBeacon(pMac, pBPR);
-       if (rxChannelInBeacon < 15)
+       rfBand = WDA_GET_RX_RFBAND(pRxPacketInfo);
+       rxChannelInBD = WDA_GET_RX_CH(pRxPacketInfo);
+
+       if ((!rfBand) || IS_5G_BAND(rfBand))
        {
-          /* This means that we are in 2.4GHz mode */
-          if(WDA_GET_RX_CH(pRxPacketInfo) != rxChannelInBeacon)
-          {
-             /* BCAST Frame, if CH do not match, Drop */
-             if(WDA_IS_RX_BCAST(pRxPacketInfo))
-             {
+          rxChannelInBD = limUnmapChannel(rxChannelInBD);
+       }
+
+       if(rxChannelInBD != rxChannelInBeacon)
+       {
+          /* BCAST Frame, if CH do not match, Drop */
+           if(WDA_IS_RX_BCAST(pRxPacketInfo))
+           {
                 limLog(pMac, LOG3, FL("Beacon/Probe Rsp dropped. Channel in BD %d. "
                                       "Channel in beacon" " %d"),
                        WDA_GET_RX_CH(pRxPacketInfo),limGetChannelFromBeacon(pMac, pBPR));
                 return;
-             }
-             /* Unit cast frame, Probe RSP, do not drop */
-             else
-             {
-                dontUpdateAll = 1;
-                limLog(pMac, LOG3, FL("SSID %s, CH in ProbeRsp %d, CH in BD %d, miss-match, Do Not Drop"),
-                                       pBPR->ssId.ssId,
-                                       rxChannelInBeacon,
-                                       WDA_GET_RX_CH(pRxPacketInfo));
-                WDA_GET_RX_CH(pRxPacketInfo) = rxChannelInBeacon;
-             }
-          }
-       }
+           }
+           /* Unit cast frame, Probe RSP, do not drop */
+           else
+           {
+              dontUpdateAll = 1;
+              limLog(pMac, LOG3, FL("SSID %s, CH in ProbeRsp %d, CH in BD %d, miss-match, Do Not Drop"),
+                                     pBPR->ssId.ssId,
+                                     rxChannelInBeacon,
+                                     WDA_GET_RX_CH(pRxPacketInfo));
+              WDA_GET_RX_CH(pRxPacketInfo) = rxChannelInBeacon;
+           }
+        }
     }
 
     /**
@@ -472,24 +495,32 @@
 
     frameLen = sizeof(tLimScanResultNode) + ieLen - sizeof(tANI_U32); //Sizeof(tANI_U32) is for ieFields[1]
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pBssDescr, frameLen))
+    pBssDescr = vos_mem_malloc(frameLen);
+    if ( NULL == pBssDescr )
     {
         // Log error
         limLog(pMac, LOGP,
-           FL("call for palAllocateMemory failed for storing BSS description"));
+           FL("call for AllocateMemory failed for storing BSS description"));
 
         return;
     }
 
     // In scan state, store scan result.
 #if defined WLAN_FEATURE_VOWIFI
-    limCollectBssDescription(pMac, &pBssDescr->bssDescription,
+    status = limCollectBssDescription(pMac, &pBssDescr->bssDescription,
                              pBPR, pRxPacketInfo, fScanning);
+    if (eHAL_STATUS_SUCCESS != status)
+    {
+        goto last;
+    }
 #else
-    limCollectBssDescription(pMac, &pBssDescr->bssDescription,
+    status = limCollectBssDescription(pMac, &pBssDescr->bssDescription,
                              pBPR, pRxPacketInfo);
+    if (eHAL_STATUS_SUCCESS != status)
+    {
+        goto last;
+    }
 #endif
-
     pBssDescr->bssDescription.fProbeRsp = fProbeRsp;
 
     pBssDescr->next = NULL;
@@ -578,10 +609,12 @@
         }
     }//(eANI_BOOLEAN_TRUE == fScanning)
 
+last:
     if( eHAL_STATUS_SUCCESS != status )
     {
-        palFreeMemory( pMac->hHdd, pBssDescr );
+        vos_mem_free( pBssDescr );
     }
+    return;
 } /****** end limCheckAndAddBssDescription() ******/
 
 
@@ -698,13 +731,13 @@
     {
         //For infrastructure, check BSSID and SSID. For IBSS, check more
         pSirCapTemp = (tSirMacCapabilityInfo *)&ptemp->bssDescription.capabilityInfo;
-        if((pSirCapTemp->ess == pSirCap->ess) && //matching ESS type first
-            (palEqualMemory( pMac->hHdd,(tANI_U8 *) pBssDescr->bssDescription.bssId,
+        if ((pSirCapTemp->ess == pSirCap->ess) && //matching ESS type first
+            (vos_mem_compare( (tANI_U8 *) pBssDescr->bssDescription.bssId,
                       (tANI_U8 *) ptemp->bssDescription.bssId,
                       sizeof(tSirMacAddr))) &&   //matching BSSID
             (pBssDescr->bssDescription.channelId ==
                                       ptemp->bssDescription.channelId) &&
-            palEqualMemory( pMac->hHdd,((tANI_U8 *) &pBssDescr->bssDescription.ieFields + 1),
+            vos_mem_compare( ((tANI_U8 *) &pBssDescr->bssDescription.ieFields + 1),
                            ((tANI_U8 *) &ptemp->bssDescription.ieFields + 1),
                            (tANI_U8) (ssidLen + 1)) &&
             ((pSirCapTemp->ess) || //we are done for infrastructure
@@ -740,7 +773,7 @@
                             //Found it
                             if((DOT11F_IE_WSCPROBERES_MAX_LEN - 2) >= pbIe[1])
                             {
-                                palCopyMemory(pMac->hHdd, pBssDescr->bssDescription.WscIeProbeRsp,
+                                vos_mem_copy(pBssDescr->bssDescription.WscIeProbeRsp,
                                    pbIe, pbIe[1] + 2);
                                 pBssDescr->bssDescription.WscIeLen = pbIe[1] + 2;
                             }
@@ -769,7 +802,7 @@
                 pMac->lim.gLimMlmScanResultLength -=
                     ptemp->bssDescription.length + sizeof(tANI_U16);
 
-                palFreeMemory( pMac->hHdd, (tANI_U8 *) ptemp);
+                vos_mem_free(ptemp);
             }
             found = true;
             break;
@@ -920,13 +953,13 @@
     {
         //For infrastructure, check BSSID and SSID. For IBSS, check more
         pSirCapTemp = (tSirMacCapabilityInfo *)&ptemp->bssDescription.capabilityInfo;
-        if((pSirCapTemp->ess == pSirCap->ess) && //matching ESS type first
-            (palEqualMemory( pMac->hHdd,(tANI_U8 *) pBssDescr->bssDescription.bssId,
+        if ((pSirCapTemp->ess == pSirCap->ess) && //matching ESS type first
+            (vos_mem_compare( (tANI_U8 *) pBssDescr->bssDescription.bssId,
                       (tANI_U8 *) ptemp->bssDescription.bssId,
                       sizeof(tSirMacAddr))) &&   //matching BSSID
             (pBssDescr->bssDescription.channelId ==
                                       ptemp->bssDescription.channelId) &&
-            palEqualMemory( pMac->hHdd,((tANI_U8 *) &pBssDescr->bssDescription.ieFields + 1),
+            vos_mem_compare( ((tANI_U8 *) &pBssDescr->bssDescription.ieFields + 1),
                            ((tANI_U8 *) &ptemp->bssDescription.ieFields + 1),
                            (tANI_U8) (ssidLen + 1)) &&
             ((pSirCapTemp->ess) || //we are done for infrastructure
@@ -963,7 +996,7 @@
                             //Found it
                             if((DOT11F_IE_WSCPROBERES_MAX_LEN - 2) >= pbIe[1])
                             {
-                                palCopyMemory(pMac->hHdd, pBssDescr->bssDescription.WscIeProbeRsp,
+                                vos_mem_copy( pBssDescr->bssDescription.WscIeProbeRsp,
                                    pbIe, pbIe[1] + 2);
                                 pBssDescr->bssDescription.WscIeLen = pbIe[1] + 2;
                             }
@@ -992,7 +1025,7 @@
                 pMac->lim.gLimMlmLfrScanResultLength -=
                     ptemp->bssDescription.length + sizeof(tANI_U16);
 
-                palFreeMemory( pMac->hHdd, (tANI_U8 *) ptemp);
+                vos_mem_free(ptemp);
             }
             break;
         }
@@ -1094,7 +1127,7 @@
             while(ptemp)
             {
                 /// Copy entire BSS description including length
-                palCopyMemory( pMac->hHdd, pDest,
+                vos_mem_copy( pDest,
                               (tANI_U8 *) &ptemp->bssDescription,
                               ptemp->bssDescription.length + 2);
                 pDest += ptemp->bssDescription.length + 2;
@@ -1141,7 +1174,7 @@
                 pNextNode = pNode->next;
 
                 // Delete the current node
-                palFreeMemory( pMac->hHdd, (tANI_U8 *) pNode);
+                vos_mem_free(pNode);
 
                 pNode = pNextNode;
             }
@@ -1219,7 +1252,7 @@
                 pNextNode = pNode->next;
 
                 // Delete the current node
-                palFreeMemory( pMac->hHdd, (tANI_U8 *) pNode);
+                vos_mem_free(pNode);
 
                 pNode = pNextNode;
             }
diff --git a/CORE/MAC/src/pe/lim/limScanResultUtils.h b/CORE/MAC/src/pe/lim/limScanResultUtils.h
index a5bd034..8e43996 100644
--- a/CORE/MAC/src/pe/lim/limScanResultUtils.h
+++ b/CORE/MAC/src/pe/lim/limScanResultUtils.h
@@ -62,13 +62,13 @@
 tANI_U32 limDeactivateMinChannelTimerDuringScan(tpAniSirGlobal);
 void    limCheckAndAddBssDescription(tpAniSirGlobal, tpSirProbeRespBeacon, tANI_U8 *, tANI_BOOLEAN, tANI_U8);
 #if defined WLAN_FEATURE_VOWIFI
-void    limCollectBssDescription(tpAniSirGlobal,
+eHalStatus    limCollectBssDescription(tpAniSirGlobal,
                                  tSirBssDescription *,
                                  tpSirProbeRespBeacon,
                                  tANI_U8 *,
                                  tANI_U8);
 #else
-void    limCollectBssDescription(tpAniSirGlobal,
+eHalStatus    limCollectBssDescription(tpAniSirGlobal,
                                  tSirBssDescription *,
                                  tpSirProbeRespBeacon,
                                  tANI_U8 *);
diff --git a/CORE/MAC/src/pe/lim/limSecurityUtils.c b/CORE/MAC/src/pe/lim/limSecurityUtils.c
index 7951047..c0e572a 100644
--- a/CORE/MAC/src/pe/lim/limSecurityUtils.c
+++ b/CORE/MAC/src/pe/lim/limSecurityUtils.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limUtils.cc contains the utility functions
  * LIM uses.
@@ -251,9 +250,9 @@
 
     while (pTempNode != NULL)
     {
-        if (palEqualMemory( pMac->hHdd,(tANI_U8 *) macAddr,
-                      (tANI_U8 *) &pTempNode->peerMacAddr,
-                      sizeof(tSirMacAddr)) )
+        if (vos_mem_compare( (tANI_U8 *) macAddr,
+                             (tANI_U8 *) &pTempNode->peerMacAddr,
+                              sizeof(tSirMacAddr)) )
             break;
 
         pTempNode = pTempNode->next;
@@ -358,9 +357,9 @@
     if (pTempNode == NULL)
         return;
 
-    if (palEqualMemory( pMac->hHdd,(tANI_U8 *) macAddr,
-                  (tANI_U8 *) &pTempNode->peerMacAddr,
-                  sizeof(tSirMacAddr)) )
+    if (vos_mem_compare( (tANI_U8 *) macAddr,
+                         (tANI_U8 *) &pTempNode->peerMacAddr,
+                         sizeof(tSirMacAddr)) )
     {
         // First node to be deleted
 
@@ -380,8 +379,8 @@
 
     while (pTempNode != NULL)
     {
-        if (palEqualMemory( pMac->hHdd,(tANI_U8 *) macAddr,
-                      (tANI_U8 *) &pTempNode->peerMacAddr,
+        if (vos_mem_compare( (tANI_U8 *) macAddr,
+                             (tANI_U8 *) &pTempNode->peerMacAddr,
                       sizeof(tSirMacAddr)) )
         {
             // Found node to be deleted
@@ -441,7 +440,7 @@
     tSirMacAddr     currentBssId;
     tLimMlmAuthCnf  mlmAuthCnf;
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmAuthCnf.peerMacAddr,
+    vos_mem_copy( (tANI_U8 *) &mlmAuthCnf.peerMacAddr,
                   (tANI_U8 *) &pMac->lim.gpLimMlmAuthReq->peerMacAddr,
                   sizeof(tSirMacAddr));
     mlmAuthCnf.authType   = pMac->lim.gpLimMlmAuthReq->authType;
@@ -453,7 +452,7 @@
 
     /// Free up buffer allocated
     /// for pMac->lim.gLimMlmAuthReq
-    palFreeMemory( pMac->hHdd, pMac->lim.gpLimMlmAuthReq);
+    vos_mem_free(pMac->lim.gpLimMlmAuthReq);
     pMac->lim.gpLimMlmAuthReq = NULL;
 
     sessionEntry->limMlmState = sessionEntry->limPrevMlmState;
@@ -552,12 +551,12 @@
     halGetTxTSFtimer(pMac, (tSirMacTimeStamp *) &seed);
 
     // Bytes 3-7 of seed is key
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &seed[3], pKey, keyLength - 3);
+    vos_mem_copy((tANI_U8 *) &seed[3], pKey, keyLength - 3);
 
     // Compute CRC-32 and place them in last 4 bytes of plain text
     limComputeCrc32(icv, pPlainText, sizeof(tSirMacAuthFrameBody));
 
-    palCopyMemory( pMac->hHdd, pPlainText + sizeof(tSirMacAuthFrameBody),
+    vos_mem_copy( pPlainText + sizeof(tSirMacAuthFrameBody),
                   icv, SIR_MAC_WEP_ICV_LENGTH);
 
     // Run RC4 on plain text with the seed
@@ -747,10 +746,10 @@
 
 
     // Bytes 0-2 of seed is received IV
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) seed, pEncrBody, SIR_MAC_WEP_IV_LENGTH - 1);
+    vos_mem_copy((tANI_U8 *) seed, pEncrBody, SIR_MAC_WEP_IV_LENGTH - 1);
 
     // Bytes 3-7 of seed is key
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &seed[3], pKey, keyLength - 3);
+    vos_mem_copy((tANI_U8 *) &seed[3], pKey, keyLength - 3);
 
     // Run RC4 on encrypted text with the seed
     limRC4(pPlainBody,
@@ -789,17 +788,17 @@
     tLimMlmSetKeysCnf *mlmSetKeysCnf)
 {
   // Prepare and Send LIM_MLM_SETKEYS_CNF
-  palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmSetKeysCnf->peerMacAddr,
+  vos_mem_copy( (tANI_U8 *) &mlmSetKeysCnf->peerMacAddr,
                 (tANI_U8 *) pMlmSetKeysReq->peerMacAddr,
                 sizeof(tSirMacAddr));
 
-  palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmSetKeysCnf->peerMacAddr,
+  vos_mem_copy( (tANI_U8 *) &mlmSetKeysCnf->peerMacAddr,
                 (tANI_U8 *) pMlmSetKeysReq->peerMacAddr,
                 sizeof(tSirMacAddr));
 
 
   /// Free up buffer allocated for mlmSetKeysReq
-  palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmSetKeysReq );
+  vos_mem_free( pMlmSetKeysReq );
   pMac->lim.gpLimMlmSetKeysReq = NULL;
 
   limPostSmeMessage( pMac,
@@ -818,12 +817,12 @@
     tLimMlmRemoveKeyCnf *mlmRemoveKeyCnf)
 {
   // Prepare and Send LIM_MLM_REMOVEKEYS_CNF
-  palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmRemoveKeyCnf->peerMacAddr,
+  vos_mem_copy( (tANI_U8 *) &mlmRemoveKeyCnf->peerMacAddr,
                 (tANI_U8 *) pMlmRemoveKeyReq->peerMacAddr,
                 sizeof(tSirMacAddr));
 
   /// Free up buffer allocated for mlmRemoveKeysReq
-  palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmRemoveKeyReq );
+  vos_mem_free( pMlmRemoveKeyReq );
   pMac->lim.gpLimMlmRemoveKeyReq = NULL;
 
   psessionEntry->limMlmState = psessionEntry->limPrevMlmState; //Restore the state.
@@ -876,21 +875,19 @@
 
   // Package WDA_SET_BSSKEY_REQ message parameters
 
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pSetBssKeyParams,
-         sizeof( tSetBssKeyParams )))     
+  pSetBssKeyParams = vos_mem_malloc(sizeof( tSetBssKeyParams ));
+  if ( NULL == pSetBssKeyParams )
   {
     limLog( pMac, LOGE,
-        FL( "Unable to PAL allocate memory during SET_BSSKEY" ));
+        FL( "Unable to allocate memory during SET_BSSKEY" ));
 
     // Respond to SME with error code
     mlmSetKeysCnf.resultCode = eSIR_SME_RESOURCES_UNAVAILABLE;
     goto end;
   }
   else
-    palZeroMemory( pMac->hHdd,
-        (void *) pSetBssKeyParams,
-         sizeof( tSetBssKeyParams ));     
+    vos_mem_set( (void *) pSetBssKeyParams,
+         sizeof( tSetBssKeyParams ), 0);
 
   // Update the WDA_SET_BSSKEY_REQ parameters
   pSetBssKeyParams->bssIdx = psessionEntry->bssIdx;
@@ -917,18 +914,16 @@
     /* IF the key id is non-zero and encryption type is WEP, Send all the 4 
      * keys to HAL with filling the key at right index in pSetBssKeyParams->key. */
     pSetBssKeyParams->numKeys = SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS;
-    palCopyMemory( pMac->hHdd,
-      (tANI_U8 *) &pSetBssKeyParams->key[pMlmSetKeysReq->key[0].keyId],
-      (tANI_U8 *) &pMlmSetKeysReq->key[0], sizeof(pMlmSetKeysReq->key[0]));
+    vos_mem_copy( (tANI_U8 *) &pSetBssKeyParams->key[pMlmSetKeysReq->key[0].keyId],
+                  (tANI_U8 *) &pMlmSetKeysReq->key[0], sizeof(pMlmSetKeysReq->key[0]));
 
   }
   else
   {
     pSetBssKeyParams->numKeys = pMlmSetKeysReq->numKeys;
-    palCopyMemory( pMac->hHdd,
-      (tANI_U8 *) &pSetBssKeyParams->key,
-      (tANI_U8 *) &pMlmSetKeysReq->key,
-      sizeof( tSirKeys ) * pMlmSetKeysReq->numKeys );
+    vos_mem_copy( (tANI_U8 *) &pSetBssKeyParams->key,
+                  (tANI_U8 *) &pMlmSetKeysReq->key,
+                  sizeof( tSirKeys ) * pMlmSetKeysReq->numKeys );
   }
 
   SET_LIM_PROCESS_DEFD_MESGS(pMac, false);
@@ -998,12 +993,14 @@
 tANI_U32 val = 0;
 
   // Package WDA_SET_STAKEY_REQ message parameters
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **) &pSetStaKeyParams,
-                                                                                                 sizeof( tSetStaKeyParams ))) {
-        limLog( pMac, LOGP, FL( "Unable to PAL allocate memory during SET_BSSKEY" ));
-        return;
-    }else
-        palZeroMemory( pMac->hHdd, (void *) pSetStaKeyParams, sizeof( tSetStaKeyParams ));
+  pSetStaKeyParams = vos_mem_malloc(sizeof( tSetStaKeyParams ));
+  if ( NULL == pSetStaKeyParams )
+  {
+      limLog( pMac, LOGP, FL( "Unable to allocate memory during SET_BSSKEY" ));
+      return;
+  }
+  else
+      vos_mem_set( (void *) pSetStaKeyParams, sizeof( tSetStaKeyParams ), 0);
 
   // Update the WDA_SET_STAKEY_REQ parameters
   pSetStaKeyParams->staIdx = staIdx;
@@ -1031,8 +1028,8 @@
   pSetStaKeyParams->defWEPIdx = defWEPIdx;
     
   pSetStaKeyParams->smesessionId = pMlmSetKeysReq->smesessionId;
-  palCopyMemory(pMac->hHdd, pSetStaKeyParams->peerMacAddr,
-                pMlmSetKeysReq->peerMacAddr, sizeof(tSirMacAddr));
+  vos_mem_copy(pSetStaKeyParams->peerMacAddr,
+               pMlmSetKeysReq->peerMacAddr, sizeof(tSirMacAddr));
 
   /** Store the Previous MlmState*/
   sessionEntry->limPrevMlmState = sessionEntry->limMlmState;
@@ -1061,9 +1058,8 @@
 
           for(i=0; i < SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS ;i++)
           { 
-              palCopyMemory( pMac->hHdd,
-                             (tANI_U8 *) &pSetStaKeyParams->key[i],
-                             (tANI_U8 *) &pMlmSetKeysReq->key[i], sizeof( tSirKeys ));
+              vos_mem_copy( (tANI_U8 *) &pSetStaKeyParams->key[i],
+                            (tANI_U8 *) &pMlmSetKeysReq->key[i], sizeof( tSirKeys ));
           }
           pSetStaKeyParams->wepType = eSIR_WEP_STATIC;
           sessionEntry->limMlmState = eLIM_MLM_WT_SET_STA_KEY_STATE;
@@ -1071,8 +1067,7 @@
       }else {
           /*This case the keys are coming from upper layer so need to fill the 
           * key at the default wep key index and send to the HAL */
-          palCopyMemory( pMac->hHdd,
-                             (tANI_U8 *) &pSetStaKeyParams->key[defWEPIdx],
+          vos_mem_copy((tANI_U8 *) &pSetStaKeyParams->key[defWEPIdx],
                              (tANI_U8 *) &pMlmSetKeysReq->key[0], sizeof( pMlmSetKeysReq->key[0] ));
           pMlmSetKeysReq->numKeys = SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS;
       }
@@ -1083,8 +1078,8 @@
   case eSIR_ED_WPI: 
 #endif
       {
-          palCopyMemory( pMac->hHdd, (tANI_U8 *) &pSetStaKeyParams->key,
-                         (tANI_U8 *) &pMlmSetKeysReq->key[0], sizeof( tSirKeys ));
+          vos_mem_copy( (tANI_U8 *) &pSetStaKeyParams->key,
+                        (tANI_U8 *) &pMlmSetKeysReq->key[0], sizeof( tSirKeys ));
       }
       break;
   default:
@@ -1143,22 +1138,19 @@
 tSirRetStatus      retCode;
 
   // Package WDA_REMOVE_BSSKEY_REQ message parameters
-
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pRemoveBssKeyParams,
-         sizeof( tRemoveBssKeyParams )))     
+  pRemoveBssKeyParams = vos_mem_malloc(sizeof( tRemoveBssKeyParams ));
+  if ( NULL == pRemoveBssKeyParams )
   {
     limLog( pMac, LOGE,
-        FL( "Unable to PAL allocate memory during REMOVE_BSSKEY" ));
+        FL( "Unable to allocate memory during REMOVE_BSSKEY" ));
 
     // Respond to SME with error code
     mlmRemoveKeysCnf.resultCode = eSIR_SME_RESOURCES_UNAVAILABLE;
     goto end;
   }
   else
-    palZeroMemory( pMac->hHdd,
-        (void *) pRemoveBssKeyParams,
-         sizeof( tRemoveBssKeyParams ));     
+    vos_mem_set( (void *) pRemoveBssKeyParams,
+                  sizeof( tRemoveBssKeyParams ), 0);
 
   // Update the WDA_REMOVE_BSSKEY_REQ parameters
   pRemoveBssKeyParams->bssIdx = psessionEntry->bssIdx;
@@ -1227,7 +1219,7 @@
  */
 void limSendRemoveStaKeyReq( tpAniSirGlobal pMac,
     tLimMlmRemoveKeyReq *pMlmRemoveKeyReq,
-    tANI_U16 staIdx ,
+    tANI_U16 staIdx,
     tpPESession psessionEntry)
 {
 tSirMsgQ           msgQ;
@@ -1235,23 +1227,19 @@
 tLimMlmRemoveKeyCnf  mlmRemoveKeyCnf;
 tSirRetStatus      retCode;
 
-
-
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pRemoveStaKeyParams,
-          sizeof( tRemoveStaKeyParams )))
+  pRemoveStaKeyParams = vos_mem_malloc(sizeof( tRemoveStaKeyParams ));
+  if ( NULL == pRemoveStaKeyParams )
   {
     limLog( pMac, LOGE,
-        FL( "Unable to PAL allocate memory during REMOVE_STAKEY" ));
+        FL( "Unable to allocate memory during REMOVE_STAKEY" ));
 
     // Respond to SME with error code
     mlmRemoveKeyCnf.resultCode = eSIR_SME_RESOURCES_UNAVAILABLE;
     goto end;
   }
   else
-    palZeroMemory( pMac->hHdd,
-        (void *) pRemoveStaKeyParams,
-        sizeof( tRemoveStaKeyParams ));
+    vos_mem_set( (void *) pRemoveStaKeyParams,
+                  sizeof( tRemoveStaKeyParams ), 0);
 
   if( (pMlmRemoveKeyReq->edType == eSIR_ED_WEP104 || pMlmRemoveKeyReq->edType == eSIR_ED_WEP40) &&
         pMlmRemoveKeyReq->wepType == eSIR_WEP_STATIC )
@@ -1291,7 +1279,8 @@
     limLog( pMac, LOGE,
         FL("Posting REMOVE_STAKEY to HAL failed, reason=%X"),
         retCode );
-    palFreeMemory(pMac->hHdd, pRemoveStaKeyParams);
+    vos_mem_free(pRemoveStaKeyParams);
+    pRemoveStaKeyParams = NULL;
 
     // Respond to SME with LIM_MLM_REMOVEKEY_CNF
     mlmRemoveKeyCnf.resultCode = eSIR_SME_HAL_SEND_MESSAGE_FAIL;
@@ -1300,6 +1289,10 @@
     return;
 
 end:
+  if (pRemoveStaKeyParams)
+  {
+    vos_mem_free(pRemoveStaKeyParams);
+  }
   limPostSmeRemoveKeyCnf( pMac,
       psessionEntry,
       pMlmRemoveKeyReq,
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index 398f833..f764e32 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -54,9 +54,6 @@
 #include "rrmApi.h"
 #endif
 
-#ifdef FEATURE_WLAN_CCX
-#include <limCcxparserApi.h>
-#endif
 #include "wlan_qct_wda.h"
 #ifdef WLAN_FEATURE_11W
 #include "dot11fdefs.h"
@@ -95,7 +92,7 @@
                              tANI_U8* pBD,
                              tANI_U8 type,
                              tANI_U8 subType,
-                             tSirMacAddr peerAddr ,tSirMacAddr selfMacAddr)
+                             tSirMacAddr peerAddr, tSirMacAddr selfMacAddr)
 {
     tSirRetStatus   statusCode = eSIR_SUCCESS;
     tpSirMacMgmtHdr pMacHdr;
@@ -109,8 +106,7 @@
     pMacHdr->fc.subType = subType;
 
     // Prepare Address 1
-    palCopyMemory( pMac->hHdd,
-                   (tANI_U8 *) pMacHdr->da,
+    vos_mem_copy(  (tANI_U8 *) pMacHdr->da,
                    (tANI_U8 *) peerAddr,
                    sizeof( tSirMacAddr ));
 
@@ -118,13 +114,54 @@
     sirCopyMacAddr(pMacHdr->sa,selfMacAddr);
 
     // Prepare Address 3
-    palCopyMemory( pMac->hHdd,
-                   (tANI_U8 *) pMacHdr->bssId,
+    vos_mem_copy(  (tANI_U8 *) pMacHdr->bssId,
                    (tANI_U8 *) peerAddr,
                    sizeof( tSirMacAddr ));
     return statusCode;
 } /*** end limPopulateMacHeader() ***/
 
+#ifdef WLAN_FEATURE_11W
+/**
+ *
+ * \brief This function is called by various LIM modules to correctly set
+ * the Protected bit in the Frame Control Field of the 802.11 frame MAC header
+ *
+ *
+ * \param  pMac Pointer to Global MAC structure
+ *
+ * \param psessionEntry Pointer to session corresponding to the connection
+ *
+ * \param peer Peer address of the STA to which the frame is to be sent
+ *
+ * \param pMacHdr Pointer to the frame MAC header
+ *
+ * \return nothing
+ *
+ *
+ */
+void
+limSetProtectedBit(tpAniSirGlobal  pMac,
+                   tpPESession     psessionEntry,
+                   tSirMacAddr     peer,
+                   tpSirMacMgmtHdr pMacHdr)
+{
+    tANI_U16 aid;
+    tpDphHashNode pStaDs;
+
+    if( (psessionEntry->limSystemRole == eLIM_AP_ROLE) ||
+         (psessionEntry->limSystemRole == eLIM_BT_AMP_AP_ROLE) )
+    {
+
+        pStaDs = dphLookupHashEntry( pMac, peer, &aid, &psessionEntry->dph.dphHashTable );
+        if( pStaDs != NULL )
+            if( pStaDs->rmfEnabled )
+                pMacHdr->fc.wep = 1;
+    }
+    else if ( psessionEntry->limRmfEnabled )
+        pMacHdr->fc.wep = 1;
+} /*** end limSetProtectedBit() ***/
+#endif
+
 /**
  * \brief limSendProbeReqMgmtFrame
  *
@@ -198,13 +235,13 @@
     */
     psessionEntry = peFindSessionByBssid(pMac,bssid,&sessionId);
 
-    if(psessionEntry)
+    if (psessionEntry != NULL )
         smeSessionId = psessionEntry->smeSessionId;
 
     // The scheme here is to fill out a 'tDot11fProbeRequest' structure
     // and then hand it off to 'dot11fPackProbeRequest' (for
     // serialization).  We start by zero-initializing the structure:
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&pr, sizeof( pr ) );
+    vos_mem_set(( tANI_U8* )&pr, sizeof( pr ), 0);
 
     // & delegating to assorted helpers:
     PopulateDot11fSSID( pMac, pSsid, &pr.SSID );
@@ -321,11 +358,11 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
-                                SIR_MAC_MGMT_PROBE_REQ, bssid ,SelfMacAddr);
+                                SIR_MAC_MGMT_PROBE_REQ, bssid, SelfMacAddr);
     if ( eSIR_SUCCESS != nSirStatus )
     {
         limLog( pMac, LOGE, FL("Failed to populate the buffer descrip"
@@ -350,13 +387,13 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a P"
-                               "robe Request (0x%08x).") );
+                               "robe Request (0x%08x)."), nStatus );
     }
 
     // Append any AddIE if present.
     if( nAdditionalIELen )
     {
-        palCopyMemory( pMac->hHdd, pFrame+sizeof(tSirMacMgmtHdr)+nPayload, 
+        vos_mem_copy( pFrame+sizeof(tSirMacMgmtHdr)+nPayload,
                                                     pAdditionalIE, nAdditionalIELen );
         nPayload += nAdditionalIELen;
     }
@@ -414,8 +451,8 @@
             return eSIR_FAILURE;
         }
 
-        if( (palAllocateMemory(pMac->hHdd, (void**)&tempbuf,
-             left)) != eHAL_STATUS_SUCCESS)
+        tempbuf = vos_mem_malloc(left);
+        if ( NULL == tempbuf )
         {
             PELOGE(limLog(pMac, LOGE,
                  FL("Unable to allocate memory to store addn IE"));)
@@ -432,21 +469,21 @@
                 limLog( pMac, LOGE,
                    FL("****Invalid IEs eid = %d elem_len=%d left=%d*****"),
                                                    elem_id,elem_len,left);
-                palFreeMemory(pMac->hHdd, tempbuf);
+                vos_mem_free(tempbuf);
                 return eSIR_FAILURE;
             }
             if ( !( (SIR_MAC_EID_VENDOR == elem_id) &&
                    (memcmp(&ptr[2], SIR_MAC_P2P_OUI, SIR_MAC_P2P_OUI_SIZE)==0) ) )
             {
-                palCopyMemory ( pMac->hHdd, tempbuf + tempLen, &ptr[0], elem_len + 2);
+                vos_mem_copy (tempbuf + tempLen, &ptr[0], elem_len + 2);
                 tempLen += (elem_len + 2);
             }
             left -= elem_len;
             ptr += (elem_len + 2);
        }
-       palCopyMemory ( pMac->hHdd, addIE, tempbuf, tempLen);
+       vos_mem_copy (addIE, tempbuf, tempLen);
        *addnIELen = tempLen;
-       palFreeMemory(pMac->hHdd, tempbuf);
+       vos_mem_free(tempbuf);
     }
     return eSIR_SUCCESS;
 }
@@ -494,17 +531,16 @@
     }
 
     smeSessionId = psessionEntry->smeSessionId;
-
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                (void **)&pFrm, sizeof(tDot11fProbeResponse)))
+    pFrm = vos_mem_malloc(sizeof(tDot11fProbeResponse));
+    if ( NULL == pFrm )
     {
-        limLog(pMac, LOGE, FL("Unable to PAL allocate memory in limSendProbeRspMgmtFrame") );
+        limLog(pMac, LOGE, FL("Unable to allocate memory in limSendProbeRspMgmtFrame") );
         return;
     }
 
     // Fill out 'frm', after which we'll just hand the struct off to
     // 'dot11fPackProbeResponse'.
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pFrm, sizeof( tDot11fProbeResponse ) );
+    vos_mem_set(( tANI_U8* )pFrm, sizeof( tDot11fProbeResponse ), 0);
 
     // Timestamp to be updated by TFP, below.
 
@@ -520,7 +556,7 @@
         {
             limLog( pMac, LOGP, FL("Failed to retrieve WNI_CFG_BEACON_INTERVAL from CFG (%d)."),
                     nSirStatus );
-            palFreeMemory(pMac->hHdd, pFrm);
+            vos_mem_free(pFrm);
             return;
         }
         pFrm->BeaconInterval.interval = ( tANI_U16 ) cfg;
@@ -602,8 +638,8 @@
     {
       PopulateDot11fWPA( pMac, &( psessionEntry->pLimStartBssReq->rsnIE ),
           &pFrm->WPA );
-      PopulateDot11fRSN( pMac, &( psessionEntry->pLimStartBssReq->rsnIE ),
-          &pFrm->RSN );
+      PopulateDot11fRSNOpaque( pMac, &( psessionEntry->pLimStartBssReq->rsnIE ),
+          &pFrm->RSNOpaque );
     }
 
     PopulateDot11fWMM( pMac, &pFrm->WMMInfoAp, &pFrm->WMMParams, &pFrm->WMMCaps, psessionEntry );
@@ -651,19 +687,20 @@
                            &addnIEPresent) != eSIR_SUCCESS)
         {
             limLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_FLAG"));
-            palFreeMemory(pMac->hHdd, pFrm);
+            vos_mem_free(pFrm);
             return;
         }
     }
 
     if (addnIEPresent)
     {
-        if( (palAllocateMemory(pMac->hHdd, (void**)&addIE, 
-             WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN*3 )) != eHAL_STATUS_SUCCESS)
+
+        addIE = vos_mem_malloc(WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN*3);
+        if ( NULL == addIE )
         {
             PELOGE(limLog(pMac, LOGE,
                  FL("Unable to allocate memory to store addn IE"));)
-            palFreeMemory(pMac->hHdd, pFrm);
+            vos_mem_free(pFrm);
             return;
         }
         
@@ -672,8 +709,8 @@
                                   WNI_CFG_PROBE_RSP_ADDNIE_DATA1, &addnIE1Len) )
         {
             limLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 length"));
-            palFreeMemory(pMac->hHdd, addIE);
-            palFreeMemory(pMac->hHdd, pFrm);
+            vos_mem_free(addIE);
+            vos_mem_free(pFrm);
             return;
         }
         if (addnIE1Len <= WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN && addnIE1Len &&
@@ -685,8 +722,8 @@
             {
                 limLog(pMac, LOGP,
                      FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 String"));
-                palFreeMemory(pMac->hHdd, addIE);
-                palFreeMemory(pMac->hHdd, pFrm);
+                vos_mem_free(addIE);
+                vos_mem_free(pFrm);
                 return;
             }
         }
@@ -696,8 +733,8 @@
                                   WNI_CFG_PROBE_RSP_ADDNIE_DATA2, &addnIE2Len) )
         {
             limLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA2 length"));
-            palFreeMemory(pMac->hHdd, addIE);
-            palFreeMemory(pMac->hHdd, pFrm);
+            vos_mem_free(addIE);
+            vos_mem_free(pFrm);
             return;
         }
         if (addnIE2Len <= WNI_CFG_PROBE_RSP_ADDNIE_DATA2_LEN && addnIE2Len &&
@@ -709,8 +746,8 @@
             {
                 limLog(pMac, LOGP,
                      FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA2 String"));
-                palFreeMemory(pMac->hHdd, addIE);
-                palFreeMemory(pMac->hHdd, pFrm);
+                vos_mem_free(addIE);
+                vos_mem_free(pFrm);
                 return;
             }
         }
@@ -720,8 +757,8 @@
                                   WNI_CFG_PROBE_RSP_ADDNIE_DATA3, &addnIE3Len) )
         {
             limLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA3 length"));
-            palFreeMemory(pMac->hHdd, addIE);
-            palFreeMemory(pMac->hHdd, pFrm);
+            vos_mem_free(addIE);
+            vos_mem_free(pFrm);
             return;
         }
         if (addnIE3Len <= WNI_CFG_PROBE_RSP_ADDNIE_DATA3_LEN && addnIE3Len &&
@@ -734,8 +771,8 @@
             {
                 limLog(pMac, LOGP,
                      FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA3 String"));
-                palFreeMemory(pMac->hHdd, addIE);
-                palFreeMemory(pMac->hHdd, pFrm);
+                vos_mem_free(addIE);
+                vos_mem_free(pFrm);
                 return;
             }
         }
@@ -745,8 +782,8 @@
         {
             limLog(pMac, LOGP,
                  FL("Unable to get final Additional IE for Probe Req"));
-            palFreeMemory(pMac->hHdd, addIE);
-                palFreeMemory(pMac->hHdd, pFrm);
+            vos_mem_free(addIE);
+            vos_mem_free(pFrm);
             return;
         }
         nBytes = nBytes + totalAddnIeLen;
@@ -777,14 +814,14 @@
                                "be Response."), nBytes );
         if ( addIE != NULL )
         {
-            palFreeMemory(pMac->hHdd, addIE);
+            vos_mem_free(addIE);
         }
-        palFreeMemory(pMac->hHdd, pFrm);
+        vos_mem_free(pFrm);
         return;
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -798,9 +835,9 @@
                     ( void* ) pFrame, ( void* ) pPacket );
         if ( addIE != NULL )
         {
-            palFreeMemory(pMac->hHdd, addIE);
+            vos_mem_free(addIE);
         }
-        palFreeMemory(pMac->hHdd, pFrm);
+        vos_mem_free(pFrm);
         return;
     }
 
@@ -818,15 +855,15 @@
         palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, ( void* ) pFrame, ( void* ) pPacket );
         if ( addIE != NULL )
         {
-            palFreeMemory(pMac->hHdd, addIE);
+            vos_mem_free(addIE);
         }
-        palFreeMemory(pMac->hHdd, pFrm);
+        vos_mem_free(pFrm);
         return;                 // allocated!
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a P"
-                               "robe Response (0x%08x).") );
+                               "robe Response (0x%08x)."), nStatus );
     }
 
     PELOG3(limLog( pMac, LOG3, FL("Sending Probe Response frame to ") );
@@ -836,33 +873,30 @@
 
     if( pMac->lim.gpLimRemainOnChanReq )
     {
-        palCopyMemory ( pMac->hHdd, pFrame+sizeof(tSirMacMgmtHdr)+nPayload,
+        vos_mem_copy ( pFrame+sizeof(tSirMacMgmtHdr)+nPayload,
           pMac->lim.gpLimRemainOnChanReq->probeRspIe, (pMac->lim.gpLimRemainOnChanReq->length - sizeof( tSirRemainOnChnReq )) );
     }
 
     if ( addnIEPresent )
     {
-        if (palCopyMemory ( pMac->hHdd, pFrame+sizeof(tSirMacMgmtHdr)+nPayload,
-             &addIE[0], totalAddnIeLen) != eHAL_STATUS_SUCCESS)
-        {
-            limLog(pMac, LOGP, FL("Additional Probe Rp IE request failed while Appending: %x"),halstatus);
-            palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
-                            ( void* ) pFrame, ( void* ) pPacket );
-            if ( addIE != NULL )
-            {
-                palFreeMemory(pMac->hHdd, addIE);
-            }
-            palFreeMemory(pMac->hHdd, pFrm);
-            return;
-        }
+        vos_mem_copy(pFrame+sizeof(tSirMacMgmtHdr)+nPayload, &addIE[0], totalAddnIeLen);
     }
     if (noaLen != 0)
     {
-        if (palCopyMemory ( pMac->hHdd, &pFrame[nBytes - (total_noaLen)],
-                            &noaIe[0], total_noaLen) != eHAL_STATUS_SUCCESS)
+        if (total_noaLen > (SIR_MAX_NOA_ATTR_LEN + SIR_P2P_IE_HEADER_LEN))
         {
             limLog(pMac, LOGE,
                   FL("Not able to insert NoA because of length constraint"));
+            vos_mem_free(addIE);
+            vos_mem_free(pFrm);
+            palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
+                       ( void* ) pFrame, ( void* ) pPacket );
+            return;
+        }
+        else
+        {
+            vos_mem_copy( &pFrame[nBytes - (total_noaLen)],
+                            &noaIe[0], total_noaLen);
         }
     }
 
@@ -889,10 +923,10 @@
 
     if ( addIE != NULL )
     {
-        palFreeMemory(pMac->hHdd, addIE);
+        vos_mem_free(addIE);
     }
 
-    palFreeMemory(pMac->hHdd, pFrm);
+    vos_mem_free(pFrm);
     return;
 
 
@@ -928,7 +962,7 @@
 
     if ( ! pAddTS->wmeTspecPresent )
     {
-        palZeroMemory( pMac->hHdd, ( tANI_U8* )&AddTSReq, sizeof( AddTSReq ) );
+        vos_mem_set(( tANI_U8* )&AddTSReq, sizeof( AddTSReq ), 0);
 
         AddTSReq.Action.action     = SIR_MAC_QOS_ADD_TS_REQ;
         AddTSReq.DialogToken.token = pAddTS->dialogToken;
@@ -996,7 +1030,7 @@
     }
     else
     {
-        palZeroMemory( pMac->hHdd, ( tANI_U8* )&WMMAddTSReq, sizeof( WMMAddTSReq ) );
+        vos_mem_set(( tANI_U8* )&WMMAddTSReq, sizeof( WMMAddTSReq ), 0);
 
         WMMAddTSReq.Action.action     = SIR_MAC_QOS_ADD_TS_REQ;
         WMMAddTSReq.DialogToken.token = pAddTS->dialogToken;
@@ -1051,7 +1085,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -1084,10 +1118,7 @@
     sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
 
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, peerMacAddr, pMacHdr);
 #endif
 
     // That done, pack the struct:
@@ -1106,8 +1137,8 @@
         }
         else if ( DOT11F_WARNED( nStatus ) )
         {
-            limLog( pMac, LOGW, FL("There were warnings while packing"
-                                   "an Add TS Request (0x%08x).") );
+            limLog( pMac, LOGW, FL("There were warnings while packing "
+                                   "an Add TS Request (0x%08x)."), nStatus );
         }
     }
     else
@@ -1125,8 +1156,8 @@
         }
         else if ( DOT11F_WARNED( nStatus ) )
         {
-            limLog( pMac, LOGW, FL("There were warnings while packing"
-                                   "a WMM Add TS Request (0x%08x).") );
+            limLog( pMac, LOGW, FL("There were warnings while packing "
+                                   "a WMM Add TS Request (0x%08x)."), nStatus );
         }
     }
 
@@ -1190,7 +1221,7 @@
 
     smeSessionId = psessionEntry->smeSessionId;
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
     limGetQosMode(psessionEntry, &qosMode);
     limGetWmeMode(psessionEntry, &wmeMode);
@@ -1296,7 +1327,7 @@
     } // End if on non-NULL 'pSta'.
 
 
-   palZeroMemory( pMac->hHdd, ( tANI_U8* )&beaconParams, sizeof( tUpdateBeaconParams) );
+   vos_mem_set(( tANI_U8* )&beaconParams, sizeof( tUpdateBeaconParams), 0);
 
     if( psessionEntry->limSystemRole == eLIM_AP_ROLE ){
         if(psessionEntry->gLimProtectionControl != WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
@@ -1306,8 +1337,8 @@
     limUpdateShortPreamble(pMac, peerMacAddr, &beaconParams, psessionEntry);
     limUpdateShortSlotTime(pMac, peerMacAddr, &beaconParams, psessionEntry);
 
-    /* Populate Do11capabilities after updating session with Assos req details
-     */
+   /* Populate Do11capabilities after updating session with Assos req details
+    */
     PopulateDot11fCapabilities( pMac, &frm.Capabilities, psessionEntry );
 
     beaconParams.bssIdx = psessionEntry->bssIdx;
@@ -1330,7 +1361,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for an Association Re"
                                "sponse (0x%08x)."), nStatus );
     }
@@ -1378,7 +1409,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac,
@@ -1416,7 +1447,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing an "
-                               "Association Response (0x%08x).") );
+                               "Association Response (0x%08x)."), nStatus );
     }
 
     macAddr = pMacHdr->da;
@@ -1436,14 +1467,7 @@
 
     if ( addnIEPresent )
     {
-        if (palCopyMemory ( pMac->hHdd, pFrame+sizeof(tSirMacMgmtHdr)+nPayload,
-                           &addIE[0], addnIELen ) != eHAL_STATUS_SUCCESS)
-        {
-            limLog(pMac, LOGP, FL("Additional Assoc IEs request failed while Appending: %x"),halstatus);
-            palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
-                       ( void* ) pFrame, ( void* ) pPacket );
-            return;
-        }
+        vos_mem_copy (  pFrame+sizeof(tSirMacMgmtHdr)+nPayload, &addIE[0], addnIELen ) ;
     }
 
     if( ( SIR_BAND_5_GHZ == limGetRFBand(psessionEntry->currentOperChannel))
@@ -1506,7 +1530,7 @@
 
     if ( ! pAddTS->wmeTspecPresent )
     {
-        palZeroMemory( pMac->hHdd, ( tANI_U8* )&AddTSRsp, sizeof( AddTSRsp ) );
+        vos_mem_set( ( tANI_U8* )&AddTSRsp, sizeof( AddTSRsp ), 0 );
 
         AddTSRsp.Category.category = SIR_MAC_ACTION_QOS_MGMT;
         AddTSRsp.Action.action     = SIR_MAC_QOS_ADD_TS_RSP;
@@ -1607,13 +1631,13 @@
         else if ( DOT11F_WARNED( nStatus ) )
         {
             limLog( pMac, LOGW, FL("There were warnings while calcula"
-                                   "tingthe packed size for an Add TS"
+                                   "ting the packed size for an Add TS"
                                    " Response (0x%08x)."), nStatus );
         }
     }
     else
     {
-        palZeroMemory( pMac->hHdd, ( tANI_U8* )&WMMAddTSRsp, sizeof( WMMAddTSRsp ) );
+        vos_mem_set( ( tANI_U8* )&WMMAddTSRsp, sizeof( WMMAddTSRsp ), 0 );
 
         WMMAddTSRsp.Category.category = SIR_MAC_ACTION_WME;
         WMMAddTSRsp.Action.action     = SIR_MAC_QOS_ADD_TS_RSP;
@@ -1634,7 +1658,7 @@
         else if ( DOT11F_WARNED( nStatus ) )
         {
             limLog( pMac, LOGW, FL("There were warnings while calcula"
-                                   "tingthe packed size for a WMM Add"
+                                   "ting the packed size for a WMM Add"
                                    "TS Response (0x%08x)."), nStatus );
         }
     }
@@ -1650,7 +1674,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set(  pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -1680,10 +1704,7 @@
     sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
 
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
     // That done, pack the struct:
@@ -1702,8 +1723,8 @@
         }
         else if ( DOT11F_WARNED( nStatus ) )
         {
-            limLog( pMac, LOGW, FL("There were warnings while packing"
-                                   "an Add TS Response (0x%08x).") );
+            limLog( pMac, LOGW, FL("There were warnings while packing "
+                                   "an Add TS Response (0x%08x)."), nStatus );
         }
     }
     else
@@ -1721,8 +1742,8 @@
         }
         else if ( DOT11F_WARNED( nStatus ) )
         {
-            limLog( pMac, LOGW, FL("There were warnings while packing"
-                                   "a WMM Add TS Response (0x%08x).") );
+            limLog( pMac, LOGW, FL("There were warnings while packing "
+                                   "a WMM Add TS Response (0x%08x)."), nStatus );
         }
     }
 
@@ -1781,7 +1802,7 @@
 
     if ( ! wmmTspecPresent )
     {
-        palZeroMemory( pMac->hHdd, ( tANI_U8* )&DelTS, sizeof( DelTS ) );
+        vos_mem_set( ( tANI_U8* )&DelTS, sizeof( DelTS ), 0 );
 
         DelTS.Category.category = SIR_MAC_ACTION_QOS_MGMT;
         DelTS.Action.action     = SIR_MAC_QOS_DEL_TS_REQ;
@@ -1805,7 +1826,7 @@
     }
     else
     {
-        palZeroMemory( pMac->hHdd, ( tANI_U8* )&WMMDelTS, sizeof( WMMDelTS ) );
+        vos_mem_set( ( tANI_U8* )&WMMDelTS, sizeof( WMMDelTS ), 0 );
 
         WMMDelTS.Category.category = SIR_MAC_ACTION_WME;
         WMMDelTS.Action.action     = SIR_MAC_QOS_DEL_TS_REQ;
@@ -1840,7 +1861,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -1872,10 +1893,7 @@
     sirCopyMacAddr(pMacHdr->bssId, psessionEntry->bssId);
     
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
     // That done, pack the struct:
@@ -1893,8 +1911,8 @@
         }
         else if ( DOT11F_WARNED( nStatus ) )
         {
-            limLog( pMac, LOGW, FL("There were warnings while packing"
-                                   "a Del TS frame (0x%08x).") );
+            limLog( pMac, LOGW, FL("There were warnings while packing "
+                                   "a Del TS frame (0x%08x)."), nStatus );
         }
     }
     else
@@ -1911,8 +1929,8 @@
         }
         else if ( DOT11F_WARNED( nStatus ) )
         {
-            limLog( pMac, LOGW, FL("There were warnings while packing"
-                                   "a WMM Del TS frame (0x%08x).") );
+            limLog( pMac, LOGW, FL("There were warnings while packing "
+                                   "a WMM Del TS frame (0x%08x)."), nStatus );
         }
     }
 
@@ -1984,15 +2002,15 @@
     nAddIELen = psessionEntry->pLimJoinReq->addIEAssoc.length; 
     pAddIE = psessionEntry->pLimJoinReq->addIEAssoc.addIEdata;
 
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                (void **)&pFrm, sizeof(tDot11fAssocRequest)))
+    pFrm = vos_mem_malloc(sizeof(tDot11fAssocRequest));
+    if ( NULL == pFrm )
     {
-        limLog(pMac, LOGE, FL("Unable to PAL allocate memory in limSendAssocReqMgmtFrame") );
+        limLog(pMac, LOGE, FL("Unable to allocate memory in limSendAssocReqMgmtFrame") );
         return;
     }
 
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pFrm, sizeof( tDot11fAssocRequest ) );
+    vos_mem_set( ( tANI_U8* )pFrm, sizeof( tDot11fAssocRequest ), 0 );
 
     caps = pMlmAssocReq->capabilityInfo;
     if ( PROP_CAPABILITY_GET( 11EQOS, psessionEntry->limCurrentBssPropCap ) )
@@ -2162,23 +2180,30 @@
                 (unsigned int)psessionEntry->pLimJoinReq->bssDescription.mdie[1],
                 (unsigned int)psessionEntry->pLimJoinReq->bssDescription.mdie[2]);
 #endif
-        PopulateMDIE( pMac, &pFrm->MobilityDomain, psessionEntry->pLimJoinReq->bssDescription.mdie); 
+        PopulateMDIE( pMac, &pFrm->MobilityDomain,
+                                 psessionEntry->pLimJoinReq->bssDescription.mdie);
     }
-    else 
+    else
     {
         // No 11r IEs dont send any MDIE
-        limLog( pMac, LOG1, FL("mdie not present"));
+        limLog( pMac, LOG1, FL("MDIE not present"));
     }
 #endif
 
 #ifdef FEATURE_WLAN_CCX
-    // For CCX Associations fill the CCX IEs
-    if (psessionEntry->isCCXconnection)
+    /* CCX Version IE will be included in association request
+       when CCX is enabled on DUT through ini */
+    if (psessionEntry->pLimJoinReq->isCCXFeatureIniEnabled)
+    {
+        PopulateDot11fCCXVersion(&pFrm->CCXVersion);
+    }
+    /* For CCX Associations fill the CCX IEs */
+    if (psessionEntry->isCCXconnection &&
+        psessionEntry->pLimJoinReq->isCCXFeatureIniEnabled)
     {
 #ifndef FEATURE_DISABLE_RM
         PopulateDot11fCCXRadMgmtCap(&pFrm->CCXRadMgmtCap);
 #endif
-        PopulateDot11fCCXVersion(&pFrm->CCXVersion);
     }
 #endif
 
@@ -2193,7 +2218,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                     "the packed size for an Association Re "
                     "quest(0x%08x)."), nStatus );
     }
@@ -2223,12 +2248,12 @@
         limPostSmeMessage( pMac, LIM_MLM_ASSOC_CNF,
                 ( tANI_U32* ) &mlmAssocCnf);
 
-        palFreeMemory(pMac->hHdd, pFrm);
+        vos_mem_free(pFrm);
         return;
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -2239,7 +2264,7 @@
                     "tor for an Association Request (%d)."),
                 nSirStatus );
         palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, ( void* ) pFrame, ( void* ) pPacket );
-        palFreeMemory(pMac->hHdd, pFrm);
+        vos_mem_free(pFrm);
         return;
     }
 
@@ -2255,13 +2280,13 @@
                 nStatus );
         palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
                 ( void* ) pFrame, ( void* ) pPacket );
-        palFreeMemory(pMac->hHdd, pFrm);
+        vos_mem_free(pFrm);
         return;
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a P"
-                    "robe Response (0x%08x).") );
+                               "robe Response (0x%08x)."), nStatus );
     }
 
     PELOG1(limLog( pMac, LOG1, FL("*** Sending Association Request length %d"
@@ -2271,27 +2296,27 @@
 
         if( psessionEntry->assocReq != NULL )
         {
-            palFreeMemory(pMac->hHdd, psessionEntry->assocReq);
+            vos_mem_free(psessionEntry->assocReq);
             psessionEntry->assocReq = NULL;
         }
 
     if( nAddIELen )
     {
-        palCopyMemory( pMac->hHdd, pFrame + sizeof(tSirMacMgmtHdr) + nPayload, 
-                pAddIE, 
-                nAddIELen );
+        vos_mem_copy( pFrame + sizeof(tSirMacMgmtHdr) + nPayload,
+                      pAddIE,
+                      nAddIELen );
         nPayload += nAddIELen;
     }
 
-    if( (palAllocateMemory(pMac->hHdd, (void**)&psessionEntry->assocReq,
-                           nPayload)) != eHAL_STATUS_SUCCESS)
+    psessionEntry->assocReq = vos_mem_malloc(nPayload);
+    if ( NULL == psessionEntry->assocReq )
     {
         PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc request"));)
     }
     else
     {
         //Store the Assoc request. This is sent to csr/hdd in join cnf response. 
-        palCopyMemory(pMac->hHdd, psessionEntry->assocReq, pFrame + sizeof(tSirMacMgmtHdr), nPayload);
+        vos_mem_copy( psessionEntry->assocReq, pFrame + sizeof(tSirMacMgmtHdr), nPayload);
         psessionEntry->assocReqLen = nPayload;
     }
 
@@ -2318,13 +2343,13 @@
         limLog( pMac, LOGE, FL("Failed to send Association Request (%X)!"),
                 halstatus );
         //Pkt will be freed up by the callback
-        palFreeMemory(pMac->hHdd, pFrm);
+        vos_mem_free(pFrm);
         return;
     }
 
     // Free up buffer allocated for mlmAssocReq
-    palFreeMemory( pMac->hHdd, ( tANI_U8* ) pMlmAssocReq );
-    palFreeMemory(pMac->hHdd, pFrm);
+    vos_mem_free(pMlmAssocReq);
+    vos_mem_free(pFrm);
     return;
 } // End limSendAssocReqMgmtFrame
 
@@ -2378,7 +2403,7 @@
     limLog( pMac, LOG1, FL("limSendReassocReqWithFTIEsMgmtFrame received in "
                            "state (%d)."), psessionEntry->limMlmState);
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
     caps = pMlmReassocReq->capabilityInfo;
     if (PROP_CAPABILITY_GET(11EQOS, psessionEntry->limReassocBssPropCap))
@@ -2398,7 +2423,7 @@
     frm.ListenInterval.interval = pMlmReassocReq->listenInterval;
 
     // Get the old bssid of the older AP.
-    palCopyMemory( pMac->hHdd, ( tANI_U8* )frm.CurrentAPAddress.mac,
+    vos_mem_copy( ( tANI_U8* )frm.CurrentAPAddress.mac,
             pMac->ft.ftPEContext.pFTPreAuthReq->currbssId, 6); 
 
     PopulateDot11fSSID2( pMac, &frm.SSID );
@@ -2496,7 +2521,7 @@
         }
 
 #ifdef FEATURE_WLAN_CCX
-        if(psessionEntry->pLimReAssocReq->cckmIE.length)
+        if (psessionEntry->pLimReAssocReq->cckmIE.length)
         {
             PopulateDot11fCCXCckmOpaque( pMac, &( psessionEntry->pLimReAssocReq->cckmIE ),
                     &frm.CCXCckmOpaque );
@@ -2505,15 +2530,21 @@
     }
 
 #ifdef FEATURE_WLAN_CCX
+    /* CCX Version IE will be included in reassociation request
+       when CCX is enabled on DUT through ini */
+    if (psessionEntry->pLimReAssocReq->isCCXFeatureIniEnabled)
+    {
+        PopulateDot11fCCXVersion(&frm.CCXVersion);
+    }
     // For CCX Associations fill the CCX IEs
-    if (psessionEntry->isCCXconnection)
+    if (psessionEntry->isCCXconnection &&
+        psessionEntry->pLimReAssocReq->isCCXFeatureIniEnabled)
     {
 #ifndef FEATURE_DISABLE_RM
         PopulateDot11fCCXRadMgmtCap(&frm.CCXRadMgmtCap);
 #endif
-        PopulateDot11fCCXVersion(&frm.CCXVersion);
     }
-#endif //FEATURE_WLAN_CCX 
+#endif //FEATURE_WLAN_CCX
 #endif //FEATURE_WLAN_CCX || FEATURE_WLAN_LFR
 
     // include WME EDCA IE as well
@@ -2550,14 +2581,14 @@
                 {
                     tsrsIE.rates[0] = TSRS_11AG_RATE_6MBPS;
                 }
-                else 
+                else
                 {
                     tsrsIE.rates[0] = TSRS_11B_RATE_5_5MBPS;
                 }
                 PopulateDot11TSRSIE(pMac,&tsrsIE, &frm.CCXTrafStrmRateSet, sizeof(tANI_U8));
             }
         }
-#endif    
+#endif
     }
 
     if ( psessionEntry->htCapability &&
@@ -2588,7 +2619,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                     "the packed size for a Re-Association Re "
                     "quest(0x%08x)."), nStatus );
     }
@@ -2620,7 +2651,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes + ft_ies_length);
+    vos_mem_set( pFrame, nBytes + ft_ies_length, 0);
 
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
     limPrintMacAddr(pMac, psessionEntry->limReAssocbssId, LOG1);
@@ -2654,7 +2685,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a R"
-                    "e-Association Request (0x%08x).") );
+                               "e-Association Request (0x%08x)."), nStatus );
     }
 
     PELOG3(limLog( pMac, LOG3, 
@@ -2662,27 +2693,27 @@
             nBytes, nPayload );)
     if( psessionEntry->assocReq != NULL )
     {
-        palFreeMemory(pMac->hHdd, psessionEntry->assocReq);
+        vos_mem_free(psessionEntry->assocReq);
         psessionEntry->assocReq = NULL;
     }
 
     if( nAddIELen )
     {
-        palCopyMemory( pMac->hHdd, pFrame + sizeof(tSirMacMgmtHdr) + nPayload, 
-                       pAddIE, 
-                       nAddIELen );
+        vos_mem_copy( pFrame + sizeof(tSirMacMgmtHdr) + nPayload,
+                      pAddIE,
+                      nAddIELen );
         nPayload += nAddIELen;
     }
 
-    if( (palAllocateMemory(pMac->hHdd, (void**)&psessionEntry->assocReq,
-                           nPayload)) != eHAL_STATUS_SUCCESS)
+    psessionEntry->assocReq = vos_mem_malloc(nPayload);
+    if ( NULL == psessionEntry->assocReq )
     {
         PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc request"));)
     }
     else
     {
         //Store the Assoc request. This is sent to csr/hdd in join cnf response. 
-        palCopyMemory(pMac->hHdd, psessionEntry->assocReq, pFrame + sizeof(tSirMacMgmtHdr), nPayload);
+        vos_mem_copy( psessionEntry->assocReq, pFrame + sizeof(tSirMacMgmtHdr), nPayload);
         psessionEntry->assocReqLen = nPayload;
     }
 
@@ -2718,12 +2749,12 @@
  
     if( NULL != psessionEntry->assocReq )
     {
-        palFreeMemory(pMac->hHdd, psessionEntry->assocReq);
+        vos_mem_free(psessionEntry->assocReq);
         psessionEntry->assocReq = NULL;
     }
 
-    if( (palAllocateMemory(pMac->hHdd, (void**)&psessionEntry->assocReq, 
-                           (ft_ies_length))) != eHAL_STATUS_SUCCESS )
+    psessionEntry->assocReq = vos_mem_malloc(ft_ies_length);
+    if ( NULL == psessionEntry->assocReq )
     {
         PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc request"));)
         psessionEntry->assocReqLen = 0;
@@ -2731,8 +2762,8 @@
     else
     {
        //Store the Assoc request. This is sent to csr/hdd in join cnf response. 
-       palCopyMemory(pMac->hHdd, psessionEntry->assocReq, pMac->ft.ftSmeContext.reassoc_ft_ies, 
-                     (ft_ies_length));
+       vos_mem_copy( psessionEntry->assocReq, pMac->ft.ftSmeContext.reassoc_ft_ies,
+                    (ft_ies_length));
        psessionEntry->assocReqLen = (ft_ies_length);
     }
 
@@ -2753,7 +2784,7 @@
 
 end:
     // Free up buffer allocated for mlmAssocReq
-    palFreeMemory( pMac->hHdd, ( tANI_U8* ) pMlmReassocReq );
+    vos_mem_free( pMlmReassocReq );
     psessionEntry->pLimMlmReassocReq = NULL;
 
 }
@@ -2766,9 +2797,10 @@
     tLimMlmReassocReq       *pTmpMlmReassocReq = NULL;
     if(NULL == pTmpMlmReassocReq)
     {
-        if ( !HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pTmpMlmReassocReq, sizeof(tLimMlmReassocReq))) ) goto end;
-        palZeroMemory(pMac->hHdd, pTmpMlmReassocReq, sizeof(tLimMlmReassocReq));
-        palCopyMemory( pMac->hHdd, pTmpMlmReassocReq, pMlmReassocReq, sizeof(tLimMlmReassocReq));
+        pTmpMlmReassocReq = vos_mem_malloc(sizeof(tLimMlmReassocReq));
+        if ( NULL == pTmpMlmReassocReq ) goto end;
+        vos_mem_set( pTmpMlmReassocReq, sizeof(tLimMlmReassocReq), 0);
+        vos_mem_copy( pTmpMlmReassocReq, pMlmReassocReq, sizeof(tLimMlmReassocReq));
     }
 
     // Prepare and send Reassociation request frame
@@ -2797,12 +2829,12 @@
     // Free up buffer allocated for reassocReq
     if (pMlmReassocReq != NULL)
     {
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmReassocReq);
+        vos_mem_free(pMlmReassocReq);
         pMlmReassocReq = NULL;
     }
     if (pTmpMlmReassocReq != NULL)
     {
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pTmpMlmReassocReq);
+        vos_mem_free(pTmpMlmReassocReq);
         pTmpMlmReassocReq = NULL;
     }
     mlmReassocCnf.resultCode = eSIR_SME_FT_REASSOC_FAILURE;
@@ -2852,7 +2884,7 @@
     nAddIELen = psessionEntry->pLimReAssocReq->addIEAssoc.length; 
     pAddIE = psessionEntry->pLimReAssocReq->addIEAssoc.addIEdata;
     
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
     caps = pMlmReassocReq->capabilityInfo;
     if (PROP_CAPABILITY_GET(11EQOS, psessionEntry->limReassocBssPropCap))
@@ -2871,8 +2903,8 @@
 
     frm.ListenInterval.interval = pMlmReassocReq->listenInterval;
 
-    palCopyMemory( pMac->hHdd, ( tANI_U8* )frm.CurrentAPAddress.mac,
-                   ( tANI_U8* )psessionEntry->bssId, 6 );
+    vos_mem_copy(( tANI_U8* )frm.CurrentAPAddress.mac,
+                 ( tANI_U8* )psessionEntry->bssId, 6 );
 
     PopulateDot11fSSID2( pMac, &frm.SSID );
     PopulateDot11fSuppRates( pMac, POPULATE_DOT11F_RATES_OPERATIONAL,
@@ -3007,7 +3039,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a Re-Association Re "
                                "quest(0x%08x)."), nStatus );
     }
@@ -3027,7 +3059,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -3058,7 +3090,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a R"
-                               "e-Association Request (0x%08x).") );
+                               "e-Association Request (0x%08x)."), nStatus );
     }
 
     PELOG1(limLog( pMac, LOG1, FL("*** Sending Re-Association Request length %d"
@@ -3067,27 +3099,27 @@
 
     if( psessionEntry->assocReq != NULL )
     {
-        palFreeMemory(pMac->hHdd, psessionEntry->assocReq);
+        vos_mem_free(psessionEntry->assocReq);
         psessionEntry->assocReq = NULL;
     }
 
     if( nAddIELen )
     {
-        palCopyMemory( pMac->hHdd, pFrame + sizeof(tSirMacMgmtHdr) + nPayload, 
-                       pAddIE, 
-                       nAddIELen );
+        vos_mem_copy( pFrame + sizeof(tSirMacMgmtHdr) + nPayload,
+                      pAddIE,
+                      nAddIELen );
         nPayload += nAddIELen;
     }
 
-    if( (palAllocateMemory(pMac->hHdd, (void**)&psessionEntry->assocReq,
-                           nPayload)) != eHAL_STATUS_SUCCESS)
+    psessionEntry->assocReq = vos_mem_malloc(nPayload);
+    if ( NULL == psessionEntry->assocReq )
     {
         PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc request"));)
     }
     else
     {
         //Store the Assoc request. This is sent to csr/hdd in join cnf response. 
-        palCopyMemory(pMac->hHdd, psessionEntry->assocReq, pFrame + sizeof(tSirMacMgmtHdr), nPayload);
+        vos_mem_copy(psessionEntry->assocReq, pFrame + sizeof(tSirMacMgmtHdr), nPayload);
         psessionEntry->assocReqLen = nPayload;
     }
 
@@ -3120,7 +3152,7 @@
 
 end:
     // Free up buffer allocated for mlmAssocReq
-    palFreeMemory( pMac->hHdd, ( tANI_U8* ) pMlmReassocReq );
+    vos_mem_free( pMlmReassocReq );
     psessionEntry->pLimMlmReassocReq = NULL;
 
 } // limSendReassocReqMgmtFrame
@@ -3314,9 +3346,9 @@
     // Prepare BSSId
     if(  (psessionEntry->limSystemRole == eLIM_AP_ROLE)|| (psessionEntry->limSystemRole == eLIM_BT_AMP_AP_ROLE) )
     {
-        palCopyMemory( pMac->hHdd,(tANI_U8 *) pMacHdr->bssId,
-                       (tANI_U8 *) psessionEntry->bssId,
-                       sizeof( tSirMacAddr ));
+        vos_mem_copy( (tANI_U8 *) pMacHdr->bssId,
+                      (tANI_U8 *) psessionEntry->bssId,
+                      sizeof( tSirMacAddr ));
     }
 
     /// Prepare Authentication frame body
@@ -3324,7 +3356,7 @@
 
     if (wepBit == LIM_WEP_IN_FC)
     {
-        palCopyMemory( pMac->hHdd, pBody, (tANI_U8 *) pAuthFrameBody, bodyLen);
+        vos_mem_copy(pBody, (tANI_U8 *) pAuthFrameBody, bodyLen);
 
         PELOG1(limLog(pMac, LOG1,
            FL("*** Sending Auth seq# 3 status %d (%d) to"),
@@ -3346,8 +3378,10 @@
         *((tANI_U16 *)(pBody)) = sirSwapU16ifNeeded(pAuthFrameBody->authStatusCode);
         pBody   += sizeof(tANI_U16);
         bodyLen -= sizeof(tANI_U16);
-        if ( bodyLen < sizeof (pAuthFrameBody->type) + sizeof (pAuthFrameBody->length) + sizeof (pAuthFrameBody->challengeText))
-            palCopyMemory( pMac->hHdd, pBody, (tANI_U8 *) &pAuthFrameBody->type, bodyLen);
+        if ( bodyLen <= (sizeof (pAuthFrameBody->type) +
+                         sizeof (pAuthFrameBody->length) +
+                         sizeof (pAuthFrameBody->challengeText)))
+            vos_mem_copy(pBody, (tANI_U8 *) &pAuthFrameBody->type, bodyLen);
 
 #if defined WLAN_FEATURE_VOWIFI_11R
         if ((pAuthFrameBody->authAlgoNumber == eSIR_FT_AUTH) && 
@@ -3401,7 +3435,7 @@
        || ( psessionEntry->pePersona == VOS_P2P_CLIENT_MODE ) ||
          ( psessionEntry->pePersona == VOS_P2P_GO_MODE)
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
-       || ((NULL != pMac->ft.ftPEContext.pFTPreAuthReq) 
+       || ((NULL != pMac->ft.ftPEContext.pFTPreAuthReq)
            && ( SIR_BAND_5_GHZ == limGetRFBand(pMac->ft.ftPEContext.pFTPreAuthReq->preAuthchannelNum)))
 #endif
          )
@@ -3468,12 +3502,12 @@
         /// Receive path cleanup with dummy packet
         limCleanupRxPath(pMac, pStaDs,psessionEntry);
         /// Free up buffer allocated for mlmDeauthReq
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDeauthReq);
+        vos_mem_free(pMlmDeauthReq);
         pMac->lim.limDisassocDeauthCnfReq.pMlmDeauthReq = NULL;
     }
     return eHAL_STATUS_SUCCESS;
 end:
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmDeauthCnf.peerMacAddr,
+    vos_mem_copy( (tANI_U8 *) &mlmDeauthCnf.peerMacAddr,
             (tANI_U8 *) pMlmDeauthReq->peerMacAddr,
             sizeof(tSirMacAddr));
     mlmDeauthCnf.deauthTrigger = pMlmDeauthReq->deauthTrigger;
@@ -3482,7 +3516,7 @@
 
     // Free up buffer allocated
     // for mlmDeauthReq
-    palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDeauthReq);
+    vos_mem_free(pMlmDeauthReq);
 
     limPostSmeMessage(pMac,
             LIM_MLM_DEAUTH_CNF,
@@ -3531,18 +3565,18 @@
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
         if  ( (psessionEntry->limSystemRole == eLIM_STA_ROLE ) && 
-                ( 
+                (
 #ifdef FEATURE_WLAN_CCX
-                 (psessionEntry->isCCXconnection ) || 
+                 (psessionEntry->isCCXconnection ) ||
 #endif
 #ifdef FEATURE_WLAN_LFR
                  (psessionEntry->isFastRoamIniFeatureEnabled ) ||
 #endif
                  (psessionEntry->is11Rconnection )) &&
-                (pMlmDisassocReq->reasonCode != 
+                (pMlmDisassocReq->reasonCode !=
                  eSIR_MAC_DISASSOC_DUE_TO_FTHANDOFF_REASON))
         {
-            PELOGE(limLog(pMac, LOGE, 
+            PELOGE(limLog(pMac, LOGE,
                    FL("FT Preauth Session (%p,%d) Cleanup"),
                    psessionEntry, psessionEntry->peSessionId););
             limFTCleanup(pMac);
@@ -3571,7 +3605,7 @@
 #endif
 
         /// Free up buffer allocated for mlmDisassocReq
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDisassocReq);
+        vos_mem_free(pMlmDisassocReq);
         pMac->lim.limDisassocDeauthCnfReq.pMlmDisassocReq = NULL;
         return eHAL_STATUS_SUCCESS;
     }
@@ -3580,7 +3614,7 @@
         return eHAL_STATUS_SUCCESS;
     }
 end:
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &mlmDisassocCnf.peerMacAddr,
+    vos_mem_copy( (tANI_U8 *) &mlmDisassocCnf.peerMacAddr,
             (tANI_U8 *) pMlmDisassocReq->peerMacAddr,
             sizeof(tSirMacAddr));
     mlmDisassocCnf.aid = pMlmDisassocReq->aid;
@@ -3592,7 +3626,7 @@
     if(pMlmDisassocReq != NULL)
     {
         /// Free up buffer allocated for mlmDisassocReq
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pMlmDisassocReq);
+        vos_mem_free(pMlmDisassocReq);
         pMac->lim.limDisassocDeauthCnfReq.pMlmDisassocReq = NULL;
     }
 
@@ -3650,7 +3684,8 @@
     }
 
     smeSessionId = psessionEntry->smeSessionId;
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0);
 
     frm.Reason.code = nReason;
 
@@ -3665,7 +3700,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a Disassociation "
                                "(0x%08x)."), nStatus );
     }
@@ -3683,7 +3718,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -3704,10 +3739,7 @@
     sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
     
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
     nStatus = dot11fPackDisassociation( pMac, &frm, pFrame +
@@ -3724,7 +3756,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a D"
-                               "isassociation (0x%08x).") );
+                               "isassociation (0x%08x)."), nStatus );
     }
 
     PELOG1(limLog( pMac, LOG1, FL("*** Sending Disassociation frame with rea"
@@ -3835,7 +3867,8 @@
     }
 
     smeSessionId = psessionEntry->smeSessionId;
-    palZeroMemory( pMac->hHdd, ( tANI_U8* ) &frm, sizeof( frm ) );
+    
+    vos_mem_set( ( tANI_U8* ) &frm, sizeof( frm ), 0 );
 
     frm.Reason.code = nReason;
 
@@ -3850,7 +3883,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a De-Authentication "
                                "(0x%08x)."), nStatus );
     }
@@ -3868,7 +3901,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set(  pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -3889,10 +3922,7 @@
     sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
 
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
     nStatus = dot11fPackDeAuth( pMac, &frm, pFrame +
@@ -3909,7 +3939,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a D"
-                               "e-Authentication (0x%08x).") );
+                               "e-Authentication (0x%08x)."), nStatus );
     }
 
     PELOG1(limLog( pMac, LOG1, FL("*** Sending De-Authentication frame with rea"
@@ -4040,7 +4070,7 @@
     void               *pPacket;
     eHalStatus          halstatus;
    
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
     frm.Category.category = SIR_MAC_ACTION_SPECTRUM_MGMT;
     frm.Action.action     = SIR_MAC_ACTION_MEASURE_REPORT_ID;
@@ -4083,7 +4113,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a Measurement Rep"
                                "ort (0x%08x)."), nStatus );
     }
@@ -4099,7 +4129,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -4127,10 +4157,7 @@
     }
 
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
     nStatus = dot11fPackMeasurementReport( pMac, &frm, pFrame +
@@ -4146,7 +4173,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a M"
-                               "easurement Report (0x%08x).") );
+                               "easurement Report (0x%08x)."), nStatus );
     }
 
     halstatus = halTxFrame( pMac, pPacket, ( tANI_U16 ) nBytes,
@@ -4191,7 +4218,7 @@
     void               *pPacket;
     eHalStatus          halstatus;
    
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
     frm.Category.category  = SIR_MAC_ACTION_SPECTRUM_MGMT;
     frm.Action.action      = SIR_MAC_ACTION_TPC_REQUEST_ID;
@@ -4209,7 +4236,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a TPC Request (0x"
                                "%08x)."), nStatus );
     }
@@ -4225,7 +4252,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set(pFrame, nBytes,0);
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -4253,10 +4280,7 @@
     }
 
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
     nStatus = dot11fPackTPCRequest( pMac, &frm, pFrame +
@@ -4272,7 +4296,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a T"
-                               "PC Request (0x%08x).") );
+                               "PC Request (0x%08x)."), nStatus );
     }
 
     halstatus = halTxFrame( pMac, pPacket, ( tANI_U16 ) nBytes,
@@ -4318,7 +4342,7 @@
     void               *pPacket;
     eHalStatus          halstatus;
    
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
     frm.Category.category  = SIR_MAC_ACTION_SPECTRUM_MGMT;
     frm.Action.action      = SIR_MAC_ACTION_TPC_REPORT_ID;
@@ -4343,7 +4367,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a TPC Report (0x"
                                "%08x)."), nStatus );
     }
@@ -4359,7 +4383,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
@@ -4387,10 +4411,7 @@
     }
 
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
     nStatus = dot11fPackTPCReport( pMac, &frm, pFrame +
@@ -4406,7 +4427,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a T"
-                               "PC Report (0x%08x).") );
+                               "PC Report (0x%08x)."), nStatus );
     }
 
 
@@ -4465,12 +4486,13 @@
     void               *pPacket;
     eHalStatus          halstatus;
     tANI_U8 txFlag = 0;
+    
     tANI_U8 smeSessionId = 0;
 
-    if(psessionEntry)
+    if (psessionEntry != NULL )
         smeSessionId = psessionEntry->smeSessionId;
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
     frm.Category.category     = SIR_MAC_ACTION_SPECTRUM_MGMT;
     frm.Action.action         = SIR_MAC_ACTION_CHANNEL_SWITCH_ID;
@@ -4490,7 +4512,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a Channel Switch (0x"
                                "%08x)."), nStatus );
     }
@@ -4506,16 +4528,15 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
                                 SIR_MAC_MGMT_ACTION, peer, psessionEntry->selfMacAddr);
     pMacHdr = ( tpSirMacMgmtHdr ) pFrame;
-    palCopyMemory( pMac->hHdd,
-                   (tANI_U8 *) pMacHdr->bssId,
-                   (tANI_U8 *) psessionEntry->bssId,
-                   sizeof( tSirMacAddr ));
+    vos_mem_copy( (tANI_U8 *) pMacHdr->bssId,
+                  (tANI_U8 *) psessionEntry->bssId,
+                  sizeof( tSirMacAddr ));
     if ( eSIR_SUCCESS != nSirStatus )
     {
         limLog( pMac, LOGE, FL("Failed to populate the buffer descrip"
@@ -4541,10 +4562,7 @@
 #endif
 
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
     nStatus = dot11fPackChannelSwitch( pMac, &frm, pFrame +
@@ -4560,7 +4578,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a C"
-                               "hannel Switch (0x%08x).") );
+                               "hannel Switch (0x%08x)."), nStatus );
     }
 
     if( ( SIR_BAND_5_GHZ == limGetRFBand(psessionEntry->currentOperChannel))
@@ -4605,12 +4623,13 @@
     void               *pPacket;
     eHalStatus          halstatus;
     tANI_U8 txFlag = 0;
+    
     tANI_U8 smeSessionId = 0;
 
-    if(psessionEntry)
+    if (psessionEntry != NULL )
         smeSessionId = psessionEntry->smeSessionId;
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
     frm.Category.category     = SIR_MAC_ACTION_VHT;
     frm.Action.action         = SIR_MAC_VHT_OPMODE_NOTIFICATION;
@@ -4629,7 +4648,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a Operating Mode (0x"
                                "%08x)."), nStatus );
     }
@@ -4645,7 +4664,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
 
     // Next, we fill out the buffer descriptor:
@@ -4656,10 +4675,9 @@
         nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
                                            SIR_MAC_MGMT_ACTION, psessionEntry->bssId, psessionEntry->selfMacAddr);
     pMacHdr = ( tpSirMacMgmtHdr ) pFrame;
-    palCopyMemory( pMac->hHdd,
-                   (tANI_U8 *) pMacHdr->bssId,
-                   (tANI_U8 *) psessionEntry->bssId,
-                   sizeof( tSirMacAddr ));
+    vos_mem_copy( (tANI_U8 *) pMacHdr->bssId,
+                  (tANI_U8 *) psessionEntry->bssId,
+                  sizeof( tSirMacAddr ));
     if ( eSIR_SUCCESS != nSirStatus )
     {
         limLog( pMac, LOGE, FL("Failed to populate the buffer descrip"
@@ -4681,7 +4699,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a Operating Mode"
-                               " (0x%08x).") );
+                               " (0x%08x)."), nStatus );
     }
     if( ( SIR_BAND_5_GHZ == limGetRFBand(psessionEntry->currentOperChannel))
        || ( psessionEntry->pePersona == VOS_P2P_CLIENT_MODE ) ||
@@ -4741,12 +4759,13 @@
     void               *pPacket;
     eHalStatus          halstatus;
     tANI_U8 txFlag = 0;
-    tANI_U8 smeSessionId = 0;
+    
+   tANI_U8            smeSessionId = 0;
 
-    if(psessionEntry)
-        smeSessionId = psessionEntry->smeSessionId;
+    if (psessionEntry != NULL )
+      smeSessionId = psessionEntry->smeSessionId;
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+    vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
                 
 
     frm.Category.category     = SIR_MAC_ACTION_SPECTRUM_MGMT;
@@ -4773,7 +4792,7 @@
     }
     else if ( DOT11F_WARNED( nStatus ) )
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
                                "the packed size for a Channel Switch (0x"
                                "%08x)."), nStatus );
     }
@@ -4788,16 +4807,15 @@
         return eSIR_FAILURE;
     }
    // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set( pFrame, nBytes, 0 );
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
                                 SIR_MAC_MGMT_ACTION, peer, psessionEntry->selfMacAddr);
     pMacHdr = ( tpSirMacMgmtHdr ) pFrame;
-    palCopyMemory( pMac->hHdd,
-                   (tANI_U8 *) pMacHdr->bssId,
-                   (tANI_U8 *) psessionEntry->bssId,
-                   sizeof( tSirMacAddr ));
+    vos_mem_copy( (tANI_U8 *) pMacHdr->bssId,
+                  (tANI_U8 *) psessionEntry->bssId,
+                  sizeof( tSirMacAddr ));
     if ( eSIR_SUCCESS != nSirStatus )
     {
         limLog( pMac, LOGE, FL("Failed to populate the buffer descrip"
@@ -4819,7 +4837,7 @@
     else if ( DOT11F_WARNED( nStatus ) )
     {
         limLog( pMac, LOGW, FL("There were warnings while packing a C"
-                               "hannel Switch (0x%08x).") );
+                               "hannel Switch (0x%08x)."), nStatus );
     }
 
     if( ( SIR_BAND_5_GHZ == limGetRFBand(psessionEntry->currentOperChannel))
@@ -4866,7 +4884,7 @@
  *         eSIR_FAILURE is some problem is encountered
  */
 tSirRetStatus limSendAddBAReq( tpAniSirGlobal pMac,
-    tpLimMlmAddBAReq pMlmAddBAReq ,tpPESession psessionEntry)
+    tpLimMlmAddBAReq pMlmAddBAReq, tpPESession psessionEntry)
 {
     tDot11fAddBAReq frmAddBAReq;
     tANI_U8 *pAddBAReqBuffer = NULL;
@@ -4885,7 +4903,7 @@
 
     smeSessionId = psessionEntry->smeSessionId;
 
-    palZeroMemory( pMac->hHdd, (void *) &frmAddBAReq, sizeof( frmAddBAReq ));
+    vos_mem_set( (void *) &frmAddBAReq, sizeof( frmAddBAReq ), 0);
 
     // Category - 3 (BA)
     frmAddBAReq.Category.category = SIR_MAC_ACTION_BLKACK;
@@ -4929,7 +4947,7 @@
     else if( DOT11F_WARNED( nStatus ))
     {
         limLog( pMac, LOGW,
-        FL( "There were warnings while calculating"
+        FL( "There were warnings while calculating "
           "the packed size for an ADDBA Req (0x%08x)."),
         nStatus );
     }
@@ -4955,7 +4973,7 @@
         goto returnAfterError;
     }
 
-    palZeroMemory( pMac->hHdd, (void *) pAddBAReqBuffer, frameLen );
+    vos_mem_set( (void *) pAddBAReqBuffer, frameLen, 0 );
 
     // Copy necessary info to BD
     if( eSIR_SUCCESS !=
@@ -4988,10 +5006,7 @@
     sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
 
 #ifdef WLAN_FEATURE_11W
-    if ( psessionEntry->limRmfEnabled )
-    {
-        pMacHdr->fc.wep = 1;
-    }
+    limSetProtectedBit(pMac, psessionEntry, pMlmAddBAReq->peerMacAddr, pMacHdr);
 #endif
 
     // Now, we're ready to "pack" the frames
@@ -5014,7 +5029,8 @@
     else if( DOT11F_WARNED( nStatus ))
     {
         limLog( pMac, LOGW,
-        FL( "There were warnings while packing an ADDBA Req (0x%08x)." ));
+                FL( "There were warnings while packing an ADDBA Req (0x%08x)."),
+                nStatus );
     }
 
     limLog( pMac, LOGW,
@@ -5097,9 +5113,7 @@
         return eSIR_FAILURE;
     }
 
-      smeSessionId = psessionEntry->smeSessionId;
-
-      palZeroMemory( pMac->hHdd, (void *) &frmAddBARsp, sizeof( frmAddBARsp ));
+      vos_mem_set( (void *) &frmAddBARsp, sizeof( frmAddBARsp ), 0);
 
       // Category - 3 (BA)
       frmAddBARsp.Category.category = SIR_MAC_ACTION_BLKACK;
@@ -5116,7 +5130,16 @@
       frmAddBARsp.AddBAParameterSet.tid = pMlmAddBARsp->baTID;
       frmAddBARsp.AddBAParameterSet.policy = pMlmAddBARsp->baPolicy;
       frmAddBARsp.AddBAParameterSet.bufferSize = pMlmAddBARsp->baBufferSize;
-      frmAddBARsp.AddBAParameterSet.amsduSupported = psessionEntry->amsduSupportedInBA;
+
+      if(psessionEntry->isAmsduSupportInAMPDU)
+      {
+         frmAddBARsp.AddBAParameterSet.amsduSupported =
+                                          psessionEntry->amsduSupportedInBA;
+      }
+      else
+      {
+         frmAddBARsp.AddBAParameterSet.amsduSupported = 0;
+      }
 
       // BA timeout
       // 0 - indicates no BA timeout
@@ -5137,7 +5160,7 @@
       else if( DOT11F_WARNED( nStatus ))
       {
         limLog( pMac, LOGW,
-            FL( "There were warnings while calculating"
+            FL( "There were warnings while calculating "
               "the packed size for an ADDBA Rsp (0x%08x)."),
             nStatus );
       }
@@ -5163,7 +5186,7 @@
         goto returnAfterError;
       }
 
-      palZeroMemory( pMac->hHdd, (void *) pAddBARspBuffer, frameLen );
+      vos_mem_set( (void *) pAddBARspBuffer, frameLen, 0 );
 
       // Copy necessary info to BD
       if( eSIR_SUCCESS !=
@@ -5197,10 +5220,7 @@
       sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
 
 #ifdef WLAN_FEATURE_11W
-      if ( psessionEntry->limRmfEnabled )
-      {
-        pMacHdr->fc.wep = 1;
-      }
+      limSetProtectedBit(pMac, psessionEntry, pMlmAddBARsp->peerMacAddr, pMacHdr);
 #endif
 
       // Now, we're ready to "pack" the frames
@@ -5223,7 +5243,8 @@
       else if( DOT11F_WARNED( nStatus ))
       {
         limLog( pMac, LOGW,
-            FL( "There were warnings while packing an ADDBA Rsp (0x%08x)." ));
+                FL( "There were warnings while packing an ADDBA Rsp (0x%08x)." ),
+                nStatus);
       }
 
       limLog( pMac, LOGW,
@@ -5303,7 +5324,7 @@
     eHalStatus halStatus;
     void *pPacket;
     tANI_U8 txFlag = 0;
-    tANI_U8 smeSessionId = 0;
+   tANI_U8             smeSessionId = 0;
 
      if(NULL == psessionEntry)
     {
@@ -5311,8 +5332,7 @@
     }
 
     smeSessionId = psessionEntry->smeSessionId;
-
-    palZeroMemory( pMac->hHdd, (void *) &frmDelBAInd, sizeof( frmDelBAInd ));
+    vos_mem_set( (void *) &frmDelBAInd, sizeof( frmDelBAInd ), 0);
 
       // Category - 3 (BA)
       frmDelBAInd.Category.category = SIR_MAC_ACTION_BLKACK;
@@ -5342,7 +5362,7 @@
       else if( DOT11F_WARNED( nStatus ))
       {
         limLog( pMac, LOGW,
-            FL( "There were warnings while calculating"
+            FL( "There were warnings while calculating "
               "the packed size for an DELBA Ind (0x%08x)."),
             nStatus );
       }
@@ -5368,7 +5388,7 @@
         goto returnAfterError;
       }
 
-      palZeroMemory( pMac->hHdd, (void *) pDelBAIndBuffer, frameLen );
+      vos_mem_set( (void *) pDelBAIndBuffer, frameLen, 0 );
 
       // Copy necessary info to BD
       if( eSIR_SUCCESS !=
@@ -5401,10 +5421,7 @@
       sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
 
 #ifdef WLAN_FEATURE_11W
-      if ( psessionEntry->limRmfEnabled )
-      {
-        pMacHdr->fc.wep = 1;
-      }
+      limSetProtectedBit(pMac, psessionEntry, pMlmDelBAReq->peerMacAddr, pMacHdr);
 #endif
 
       // Now, we're ready to "pack" the frames
@@ -5427,7 +5444,8 @@
       else if( DOT11F_WARNED( nStatus ))
       {
         limLog( pMac, LOGW,
-            FL( "There were warnings while packing an DELBA Ind (0x%08x)." ));
+                FL( "There were warnings while packing an DELBA Ind (0x%08x)." ),
+                nStatus);
       }
 
       limLog( pMac, LOGW,
@@ -5514,7 +5532,7 @@
       return eSIR_FAILURE;
    }
    smeSessionId = psessionEntry->smeSessionId;
-   palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+   vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
    frm.Category.category = SIR_MAC_ACTION_RRM;
    frm.Action.action     = SIR_MAC_RRM_NEIGHBOR_REQ;
@@ -5537,7 +5555,7 @@
    }
    else if ( DOT11F_WARNED( nStatus ) )
    {
-      limLog( pMac, LOGW, FL("There were warnings while calculating"
+      limLog( pMac, LOGW, FL("There were warnings while calculating "
                "the packed size for a Neighbor Rep"
                "ort Request(0x%08x)."), nStatus );
    }
@@ -5553,7 +5571,7 @@
    }
 
    // Paranoia:
-   palZeroMemory( pMac->hHdd, pFrame, nBytes );
+   vos_mem_set( pFrame, nBytes, 0 );
 
    // Copy necessary info to BD
    if( eSIR_SUCCESS !=
@@ -5570,10 +5588,7 @@
    sirCopyMacAddr( pMacHdr->bssId, psessionEntry->bssId );
 
 #ifdef WLAN_FEATURE_11W
-   if ( psessionEntry->limRmfEnabled )
-   {
-       pMacHdr->fc.wep = 1;
-   }
+   limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
    // Now, we're ready to "pack" the frames
@@ -5596,7 +5611,8 @@
    else if( DOT11F_WARNED( nStatus ))
    {
       limLog( pMac, LOGW,
-            FL( "There were warnings while packing Neighbor Report Request (0x%08x)." ));
+              FL( "There were warnings while packing Neighbor Report "
+                  "Request (0x%08x)." ), nStatus);
    }
 
    limLog( pMac, LOGW,
@@ -5676,9 +5692,7 @@
       return eSIR_FAILURE;
    }
 
-   smeSessionId = psessionEntry->smeSessionId;
-
-   palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+   vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
 
    frm.Category.category = SIR_MAC_ACTION_RRM;
    frm.Action.action     = SIR_MAC_RRM_LINK_MEASUREMENT_RPT;
@@ -5711,7 +5725,7 @@
    }
    else if ( DOT11F_WARNED( nStatus ) )
    {
-      limLog( pMac, LOGW, FL("There were warnings while calculating"
+      limLog( pMac, LOGW, FL("There were warnings while calculating "
                "the packed size for a Link Rep"
                "ort (0x%08x)."), nStatus );
    }
@@ -5727,7 +5741,7 @@
    }
 
    // Paranoia:
-   palZeroMemory( pMac->hHdd, pFrame, nBytes );
+   vos_mem_set( pFrame, nBytes, 0 );
 
    // Copy necessary info to BD
    if( eSIR_SUCCESS !=
@@ -5744,10 +5758,7 @@
    sirCopyMacAddr( pMacHdr->bssId, psessionEntry->bssId );
 
 #ifdef WLAN_FEATURE_11W
-   if ( psessionEntry->limRmfEnabled )
-   {
-       pMacHdr->fc.wep = 1;
-   }
+   limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
    // Now, we're ready to "pack" the frames
@@ -5770,7 +5781,8 @@
    else if( DOT11F_WARNED( nStatus ))
    {
       limLog( pMac, LOGW,
-            FL( "There were warnings while packing Link Report (0x%08x)." ));
+              FL( "There were warnings while packing Link Report (0x%08x)." ),
+              nStatus );
    }
 
    limLog( pMac, LOGW,
@@ -5862,8 +5874,7 @@
       vos_mem_free(frm);
       return eSIR_FAILURE;
    }
-   smeSessionId = psessionEntry->smeSessionId;
-   palZeroMemory( pMac->hHdd, ( tANI_U8* )frm, sizeof( *frm ) );
+   vos_mem_set( ( tANI_U8* )frm, sizeof( *frm ), 0 );
 
    frm->Category.category = SIR_MAC_ACTION_RRM;
    frm->Action.action     = SIR_MAC_RRM_RADIO_MEASURE_RPT;
@@ -5905,7 +5916,7 @@
    }
    else if ( DOT11F_WARNED( nStatus ) )
    {
-      limLog( pMac, LOGW, FL("There were warnings while calculating"
+      limLog( pMac, LOGW, FL("There were warnings while calculating "
                "the packed size for a Radio Measure Rep"
                "ort (0x%08x)."), nStatus );
    }
@@ -5922,7 +5933,7 @@
    }
 
    // Paranoia:
-   palZeroMemory( pMac->hHdd, pFrame, nBytes );
+   vos_mem_set( pFrame, nBytes, 0 );
 
    // Copy necessary info to BD
    if( eSIR_SUCCESS !=
@@ -5939,10 +5950,7 @@
    sirCopyMacAddr( pMacHdr->bssId, psessionEntry->bssId );
 
 #ifdef WLAN_FEATURE_11W
-   if ( psessionEntry->limRmfEnabled )
-   {
-       pMacHdr->fc.wep = 1;
-   }
+   limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 #endif
 
    // Now, we're ready to "pack" the frames
@@ -5965,7 +5973,8 @@
    else if( DOT11F_WARNED( nStatus ))
    {
       limLog( pMac, LOGW,
-            FL( "There were warnings while packing Radio Measure Report (0x%08x)." ));
+              FL( "There were warnings while packing Radio "
+                  "Measure Report (0x%08x)." ), nStatus);
    }
 
    limLog( pMac, LOGW,
@@ -6040,12 +6049,11 @@
    void               *pPacket;
    eHalStatus         halstatus;
    tANI_U8            txFlag = 0;
-   tANI_U8            smeSessionId = 0;
+   tANI_U8             smeSessionId = 0;
 
-   if(psessionEntry)
-      smeSessionId = psessionEntry->smeSessionId;
+   smeSessionId = psessionEntry->smeSessionId;
 
-   palZeroMemory( pMac->hHdd, ( tANI_U8* )&frm, sizeof( frm ) );
+   vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
    frm.Category.category  = SIR_MAC_ACTION_SA_QUERY;
    /*11w action  field is :
     action: 0 --> SA query request action frame
@@ -6066,7 +6074,7 @@
    }
    else if ( DOT11F_WARNED( nStatus ) )
    {
-      limLog( pMac, LOGW, FL("There were warnings while calculating"
+      limLog( pMac, LOGW, FL("There were warnings while calculating "
                "the packed size for an SA Query Response"
                " (0x%08x)."), nStatus );
    }
@@ -6081,7 +6089,7 @@
    }
 
    // Paranoia:
-   palZeroMemory( pMac->hHdd, pFrame, nBytes );
+   vos_mem_set( pFrame, nBytes, 0 );
 
    // Copy necessary info to BD
    nSirStatus = limPopulateMacHeader( pMac,
@@ -6165,3 +6173,139 @@
    return nSirStatus;
 } // End limSendSaQueryResponseFrame
 #endif
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+tSirRetStatus
+limSendRMCActionFrame(tpAniSirGlobal  pMac,
+                        tSirMacAddr   peerMacAddr,
+                        tSirRMCInfo  *pRMC,
+                        tpPESession   psessionEntry)
+{
+    tSirRetStatus    nSirStatus;
+    tANI_U8         *pFrame;
+    tDot11fRMC       RMC;
+    tANI_U32         nPayload, nBytes, nStatus;
+    tpSirMacMgmtHdr  pMacHdr;
+    void            *pPacket;
+    eHalStatus       halstatus;
+    tANI_U8          txFlag = 0;
+    tANI_U8          smeSessionId = 0;
+
+
+    if (NULL == psessionEntry)
+    {
+       return eSIR_FAILURE;
+    }
+
+    smeSessionId = psessionEntry->smeSessionId;
+
+    vos_mem_set(( tANI_U8* )&RMC, sizeof( RMC ), 0);
+
+    RMC.Action.action     = pRMC->action;
+    RMC.RMCDialogToken.token = pRMC->dialogToken;
+    RMC.Category.category = SIR_MAC_ACTION_VENDOR_SPECIFIC_CATEGORY;
+    RMC.RMCVersion.version = SIR_MAC_RMC_VER;
+
+    vos_mem_copy(&RMC.RMCOUI.oui, SIR_MAC_RMC_OUI, SIR_MAC_RMC_OUI_SIZE);
+
+    vos_mem_copy(&RMC.MagicCode.magic, SIR_MAC_OXYGEN_MAGIC_CODE,
+                     SIR_MAC_OXYGEN_MAGIC_CODE_SIZE);
+
+    vos_mem_copy(&RMC.Leader.mac, pRMC->mcastLeader, sizeof(tSirMacAddr));
+
+    nStatus = dot11fGetPackedRMCSize( pMac, &RMC, &nPayload );
+    if ( DOT11F_FAILED( nStatus ) )
+    {
+        limLog( pMac, LOGE, FL("Failed to calculate the packed size for "
+                               "an RMC (0x%08x)."),
+                nStatus );
+        // We'll fall back on the worst case scenario:
+        nPayload = sizeof( tDot11fRMC );
+    }
+    else if ( DOT11F_WARNED( nStatus ) )
+    {
+        limLog( pMac, LOGW, FL("There were warnings while calculating "
+                               "the packed size for an RMC Action Frame"
+                               " (0x%08x)."), nStatus );
+    }
+
+    nBytes = nPayload + sizeof( tSirMacMgmtHdr );
+
+    halstatus = palPktAlloc( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
+                             ( tANI_U16 )nBytes, ( void** ) &pFrame,
+                             ( void** ) &pPacket );
+    if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
+    {
+        limLog( pMac, LOGP, FL("Failed to allocate %d bytes for an RMC "
+                               "Action Frame."), nBytes );
+        return eSIR_FAILURE;
+    }
+
+    // Paranoia:
+    vos_mem_set( pFrame, nBytes, 0 );
+
+    // Next, we fill out the buffer descriptor:
+    nSirStatus = limPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
+                    SIR_MAC_MGMT_ACTION, peerMacAddr,
+                    psessionEntry->selfMacAddr);
+    if ( eSIR_SUCCESS != nSirStatus )
+    {
+        limLog( pMac, LOGE, FL("Failed to populate the buffer descriptor "
+                               "for an RMC Action Frame (%d)."),
+                nSirStatus );
+        palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
+                    ( void* ) pFrame, ( void* ) pPacket );
+        return nSirStatus;
+    }
+
+    // Update A3 with the BSSID
+    pMacHdr = ( tpSirMacMgmtHdr ) pFrame;
+    sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
+
+    // That done, pack the struct:
+    nStatus = dot11fPackRMC( pMac, &RMC,
+                                      pFrame + sizeof(tSirMacMgmtHdr),
+                                      nPayload, &nPayload );
+    if ( DOT11F_FAILED( nStatus ) )
+    {
+        limLog( pMac, LOGE, FL("Failed to pack an RMC "
+                               "(0x%08x)."),
+                nStatus );
+        palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, ( void* ) pFrame,
+                     ( void* ) pPacket );
+        return eSIR_FAILURE;
+    }
+    else if ( DOT11F_WARNED( nStatus ) )
+    {
+        limLog( pMac, LOGW, FL("There were warnings while packing "
+                               "an RMC (0x%08x)."), nStatus );
+    }
+
+    PELOG3(limLog( pMac, LOG3, FL("Sending an RMC Action frame to "
+             MAC_ADDRESS_STR), MAC_ADDR_ARRAY(peerMacAddr) );)
+
+    /*
+     * With this masking, RMC action frames will be sent
+     * at self-sta rates for both 2G and 5G bands.
+     */
+    txFlag |= HAL_USE_SELF_STA_REQUESTED_MASK;
+
+    // Queue RMC Action frame in high priority WQ
+    halstatus = halTxFrame( pMac, pPacket, ( tANI_U16 ) nBytes,
+                            HAL_TXRX_FRM_802_11_MGMT,
+                            ANI_TXDIR_TODS,
+                            7,//SMAC_SWBD_TX_TID_MGMT_HIGH,
+                            limTxComplete, pFrame, txFlag, smeSessionId );
+    if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
+    {
+        limLog( pMac, LOGE, FL( "*** Could not send an RMC Action frame"
+                                " (%X) ***" ), halstatus );
+        //Pkt will be freed up by the callback
+        return eSIR_FAILURE;
+    }
+
+    return eSIR_SUCCESS;
+
+} // End limSendRMCActionFrame.
+
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
diff --git a/CORE/MAC/src/pe/lim/limSendMessages.c b/CORE/MAC/src/pe/lim/limSendMessages.c
index 8aeeba9..e22905b 100644
--- a/CORE/MAC/src/pe/lim/limSendMessages.c
+++ b/CORE/MAC/src/pe/lim/limSendMessages.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * limSendMessages.c: Provides functions to send messages or Indications to HAL.
  * Author:    Sunit Bhatia
@@ -68,6 +67,7 @@
 #endif
 #ifdef WLAN_FEATURE_11AC
    ,{SIR_MAC_VHT_OPMODE_EID,     0,  {0, 0, 0, 0}}
+   ,{SIR_MAC_VHT_OPERATION_EID,  0,  {0, 0, VHTOP_CHWIDTH_MASK, 0}}
 #endif
 };
 
@@ -98,16 +98,15 @@
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pCFParams,
-          sizeof( tUpdateCFParams )))
+    pCFParams = vos_mem_malloc(sizeof( tUpdateCFParams ));
+    if ( NULL == pCFParams )
       {
         limLog( pMac, LOGP,
-            FL( "Unable to PAL allocate memory during Update CF Params" ));
+            FL( "Unable to allocate memory during Update CF Params" ));
         retCode = eSIR_MEM_ALLOC_FAILED;
         goto returnFailure;
       }
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pCFParams, sizeof(tUpdateCFParams));
+    vos_mem_set( (tANI_U8 *) pCFParams, sizeof(tUpdateCFParams), 0);
     pCFParams->cfpCount = cfpCount;
     pCFParams->cfpPeriod = cfpPeriod;
     pCFParams->bssIdx     = bssIdx;
@@ -121,7 +120,7 @@
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, msgQ.type));
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
-        palFreeMemory(pMac->hHdd, pCFParams);
+        vos_mem_free(pCFParams);
         limLog( pMac, LOGP,
                     FL("Posting  WDA_UPDATE_CF_IND to WDA failed, reason=%X"),
                     retCode );
@@ -159,14 +158,14 @@
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pBcnParams, sizeof(*pBcnParams)))
+    pBcnParams = vos_mem_malloc(sizeof(*pBcnParams));
+    if ( NULL == pBcnParams )
     {
         limLog( pMac, LOGP,
-            FL( "Unable to PAL allocate memory during Update Beacon Params" ));
+            FL( "Unable to allocate memory during Update Beacon Params" ));
         return eSIR_MEM_ALLOC_FAILED;
     }
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pBcnParams,  pUpdatedBcnParams, sizeof(*pBcnParams));
+    vos_mem_copy((tANI_U8 *) pBcnParams,  pUpdatedBcnParams, sizeof(*pBcnParams));
     msgQ.type = WDA_UPDATE_BEACON_IND;
     msgQ.reserved = 0;
     msgQ.bodyptr = pBcnParams;
@@ -186,7 +185,7 @@
     pBcnParams->smeSessionId = psessionEntry->smeSessionId;
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
-        palFreeMemory(pMac->hHdd, pBcnParams);
+        vos_mem_free(pBcnParams);
         limLog( pMac, LOGP,
                     FL("Posting  WDA_UPDATE_BEACON_IND to WDA failed, reason=%X"),
                     retCode );
@@ -232,31 +231,30 @@
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
     tpPESession pSessionEntry;
-    if((pSessionEntry = peFindSessionBySessionId(pMac , peSessionId)) == NULL)
+    if((pSessionEntry = peFindSessionBySessionId(pMac, peSessionId)) == NULL)
     {
        limLog( pMac, LOGP,
              FL( "Unable to get Session for session Id %d" ), peSessionId);
        return eSIR_FAILURE;
     }
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pChnlParams,
-          sizeof( tSwitchChannelParams )))
-      {
-          limLog( pMac, LOGP,
-            FL( "Unable to PAL allocate memory during Switch Channel Params" ));
+    pChnlParams = vos_mem_malloc(sizeof( tSwitchChannelParams ));
+    if ( NULL == pChnlParams )
+    {
+        limLog( pMac, LOGP,
+            FL( "Unable to allocate memory during Switch Channel Params" ));
         retCode = eSIR_MEM_ALLOC_FAILED;
         goto returnFailure;
-      }
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pChnlParams, sizeof(tSwitchChannelParams));
+    }
+    vos_mem_set((tANI_U8 *) pChnlParams, sizeof(tSwitchChannelParams), 0);
     pChnlParams->secondaryChannelOffset = secondaryChnlOffset;
     pChnlParams->channelNumber= chnlNumber;
-    palCopyMemory( pMac->hHdd, pChnlParams->selfStaMacAddr, pSessionEntry->selfMacAddr, sizeof(tSirMacAddr) );
+    vos_mem_copy( pChnlParams->selfStaMacAddr, pSessionEntry->selfMacAddr, sizeof(tSirMacAddr) );
 #if defined WLAN_FEATURE_VOWIFI  
     pChnlParams->maxTxPower = maxTxPower;
 #else
     pChnlParams->localPowerConstraint = localPwrConstraint;
 #endif
-    palCopyMemory( pMac->hHdd, pChnlParams->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr) );
+    vos_mem_copy(  pChnlParams->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr) );
     pChnlParams->peSessionId = peSessionId;
     
     //we need to defer the message until we get the response back from WDA.
@@ -277,7 +275,7 @@
     MTRACE(macTraceMsgTx(pMac, peSessionId, msgQ.type));
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
-        palFreeMemory(pMac->hHdd, pChnlParams);
+        vos_mem_free(pChnlParams);
         limLog( pMac, LOGP,
                     FL("Posting  WDA_CHNL_SWITCH_REQ to WDA failed, reason=%X"),
                     retCode );
@@ -312,12 +310,12 @@
     tEdcaParams *pEdcaParams = NULL;
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pEdcaParams,
-          sizeof(tEdcaParams)))
+
+    pEdcaParams = vos_mem_malloc(sizeof(tEdcaParams));
+    if ( NULL == pEdcaParams )
     {
         limLog( pMac, LOGP,
-            FL( "Unable to PAL allocate memory during Update EDCA Params" ));
+            FL( "Unable to allocate memory during Update EDCA Params" ));
         retCode = eSIR_MEM_ALLOC_FAILED;
         return retCode;
     }
@@ -344,7 +342,7 @@
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, msgQ.type));
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
-        palFreeMemory(pMac->hHdd, pEdcaParams);
+        vos_mem_free(pEdcaParams);
         limLog( pMac, LOGP,
                     FL("Posting  WDA_UPDATE_EDCA_PROFILE_IND to WDA failed, reason=%X"),
                     retCode );
@@ -498,16 +496,15 @@
     tSirRetStatus retCode;
     tpLinkStateParams pLinkStateParams = NULL;
     // Allocate memory.
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pLinkStateParams,
-          sizeof(tLinkStateParams)))
+    pLinkStateParams = vos_mem_malloc(sizeof(tLinkStateParams));
+    if ( NULL == pLinkStateParams )
     {
         limLog( pMac, LOGP,
-        FL( "Unable to PAL allocate memory while sending Set Link State" ));
+        FL( "Unable to allocate memory while sending Set Link State" ));
         retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
         return retCode;
     }
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pLinkStateParams, sizeof(tLinkStateParams));
+    vos_mem_set((tANI_U8 *) pLinkStateParams, sizeof(tLinkStateParams), 0);
     pLinkStateParams->state        = state;
     pLinkStateParams->callback     = callback;
     pLinkStateParams->callbackArg  = callbackArg;
@@ -526,8 +523,9 @@
     retCode = (tANI_U32)wdaPostCtrlMsg(pMac, &msgQ);
     if (retCode != eSIR_SUCCESS)
     {
-        palFreeMemory(pMac, (void*)pLinkStateParams);
-        limLog(pMac, LOGP, FL("Posting link state %d failed, reason = %x "), retCode);
+        vos_mem_free(pLinkStateParams);
+        limLog(pMac, LOGP, FL("Posting link state %d failed, reason = %x "),
+               state, retCode);
     }
     return retCode;
 }
@@ -539,16 +537,15 @@
     tSirRetStatus retCode;
     tpLinkStateParams pLinkStateParams = NULL;
     // Allocate memory.
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pLinkStateParams,
-          sizeof(tLinkStateParams)))
+    pLinkStateParams = vos_mem_malloc(sizeof(tLinkStateParams));
+    if ( NULL == pLinkStateParams )
     {
         limLog( pMac, LOGP,
-        FL( "Unable to PAL allocate memory while sending Set Link State" ));
+        FL( "Unable to allocate memory while sending Set Link State" ));
         retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
         return retCode;
     }
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pLinkStateParams, sizeof(tLinkStateParams));
+    vos_mem_set((tANI_U8 *) pLinkStateParams, sizeof(tLinkStateParams), 0);
     pLinkStateParams->state = state;
     /* Copy Mac address */
     sirCopyMacAddr(pLinkStateParams->bssid,bssId);
@@ -572,8 +569,9 @@
     retCode = (tANI_U32)wdaPostCtrlMsg(pMac, &msgQ);
     if (retCode != eSIR_SUCCESS)
     {
-        palFreeMemory(pMac, (void*)pLinkStateParams);
-        limLog(pMac, LOGP, FL("Posting link state %d failed, reason = %x "), retCode);
+        vos_mem_free(pLinkStateParams);
+        limLog(pMac, LOGP, FL("Posting link state %d failed, reason = %x "),
+               state, retCode);
     }
     return retCode;
 }
@@ -597,18 +595,18 @@
     if (NULL == pMsgBuf)
         return eSIR_FAILURE;
 
-    palAllocateMemory(pMac->hHdd, (void **)&txPowerReq, sizeof(tSirSetTxPowerReq));
-    if (NULL == txPowerReq)
+    txPowerReq = vos_mem_malloc(sizeof(tSirSetTxPowerReq));
+    if ( NULL == txPowerReq )
     {
         return eSIR_FAILURE;
     }
-    palCopyMemory(pMac->hHdd, txPowerReq, (tSirSetTxPowerReq *)pMsgBuf, sizeof(tSirSetTxPowerReq));
+    vos_mem_copy(txPowerReq, (tSirSetTxPowerReq *)pMsgBuf, sizeof(tSirSetTxPowerReq));
 
     /* Found corresponding seesion to find BSS IDX */
     psessionEntry = peFindSessionByBssid(pMac, txPowerReq->bssId, &sessionId);
     if (NULL == psessionEntry)
     {
-        palFreeMemory(pMac->hHdd, (tANI_U8 *) txPowerReq);
+        vos_mem_free(txPowerReq);
         limLog(pMac, LOGE, FL("Session does not exist for given BSSID"));
         return eSIR_FAILURE;
     }
@@ -626,7 +624,7 @@
     if (eSIR_SUCCESS != retCode)
     {
         limLog(pMac, LOGP, FL("Posting WDA_SET_TX_POWER_REQ to WDA failed, reason=%X"), retCode);
-        palFreeMemory(pMac->hHdd, (tANI_U8 *) txPowerReq);
+        vos_mem_free(txPowerReq);
         return retCode;
     }
 
@@ -656,7 +654,7 @@
         limLog( pMac, LOGP, FL("Posting WDA_GET_TX_POWER_REQ to WDA failed, reason=%X"), retCode );
         if (NULL != pTxPowerReq)
         {
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pTxPowerReq);
+            vos_mem_free(pTxPowerReq);
         }
         return retCode;
     }
@@ -685,14 +683,14 @@
         return retCode;
     }
     msgSize = sizeof(tBeaconFilterMsg) + sizeof(beaconFilterTable);
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pBeaconFilterMsg, msgSize) )
+    pBeaconFilterMsg = vos_mem_malloc(msgSize);
+    if ( NULL == pBeaconFilterMsg )
     {
         limLog( pMac, LOGP, FL("Fail to allocate memory for beaconFiilterMsg "));
         retCode = eSIR_MEM_ALLOC_FAILED;
         return retCode;
     }
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pBeaconFilterMsg, msgSize);
+    vos_mem_set((tANI_U8 *) pBeaconFilterMsg, msgSize, 0);
     // Fill in capability Info and mask
     //TBD-RAJESH get the BSS capability from session.
     //Don't send this message if no active Infra session is found.
@@ -725,7 +723,7 @@
     MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, msgQ.type));
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
-        palFreeMemory(pMac->hHdd, pBeaconFilterMsg);
+        vos_mem_free(pBeaconFilterMsg);
         limLog( pMac, LOGP,
             FL("Posting  WDA_BEACON_FILTER_IND to WDA failed, reason=%X"),
             retCode );
@@ -743,14 +741,14 @@
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pVhtOpMode, sizeof(tUpdateVHTOpMode)))
+    pVhtOpMode = vos_mem_malloc(sizeof(tUpdateVHTOpMode));
+    if ( NULL == pVhtOpMode )
     {
         limLog( pMac, LOGP,
-            FL( "Unable to PAL allocate memory during Update Op Mode" ));
+            FL( "Unable to allocate memory during Update Op Mode" ));
         return eSIR_MEM_ALLOC_FAILED;
     }
-    palCopyMemory( pMac->hHdd, (tANI_U8 *)pVhtOpMode, pTempParam, sizeof(tUpdateVHTOpMode));
+    vos_mem_copy((tANI_U8 *)pVhtOpMode, pTempParam, sizeof(tUpdateVHTOpMode));
     msgQ.type =  WDA_UPDATE_OP_MODE;
     msgQ.reserved = 0;
     msgQ.bodyptr = pVhtOpMode;
@@ -767,7 +765,7 @@
     }
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
-        palFreeMemory(pMac->hHdd, pVhtOpMode);
+        vos_mem_free(pVhtOpMode);
         limLog( pMac, LOGP,
                     FL("Posting  WDA_UPDATE_OP_MODE to WDA failed, reason=%X"),
                     retCode );
@@ -784,14 +782,15 @@
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pMembership, sizeof(tUpdateMembership)))
+    pMembership = vos_mem_malloc(sizeof(tUpdateMembership));
+    if ( NULL == pMembership )
     {
         limLog( pMac, LOGP,
-            FL( "Unable to PAL allocate memory during Update Membership Mode" ));
+            FL( "Unable to allocate memory during Update Membership Mode" ));
         return eSIR_MEM_ALLOC_FAILED;
     }
-    palCopyMemory( pMac->hHdd, (tANI_U8 *)pMembership, pTempParam, sizeof(tUpdateMembership));
+    vos_mem_copy((tANI_U8 *)pMembership, pTempParam, sizeof(tUpdateMembership));
+
     msgQ.type =  WDA_UPDATE_MEMBERSHIP;
     msgQ.reserved = 0;
     msgQ.bodyptr = pMembership;
@@ -808,7 +807,7 @@
     }
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
-        palFreeMemory(pMac->hHdd, pMembership);
+        vos_mem_free(pMembership);
         limLog( pMac, LOGP,
                     FL("Posting  WDA_UPDATE_MEMBERSHIP to WDA failed, reason=%X"),
                     retCode );
@@ -825,14 +824,15 @@
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pUserPos, sizeof(tUpdateUserPos)))
+    pUserPos = vos_mem_malloc(sizeof(tUpdateUserPos));
+    if ( NULL == pUserPos )
     {
         limLog( pMac, LOGP,
-            FL( "Unable to PAL allocate memory during Update User Position" ));
+            FL( "Unable to allocate memory during Update User Position" ));
         return eSIR_MEM_ALLOC_FAILED;
     }
-    palCopyMemory( pMac->hHdd, (tANI_U8 *)pUserPos, pTempParam, sizeof(tUpdateUserPos));
+    vos_mem_copy((tANI_U8 *)pUserPos, pTempParam, sizeof(tUpdateUserPos));
+
     msgQ.type =  WDA_UPDATE_USERPOS;
     msgQ.reserved = 0;
     msgQ.bodyptr = pUserPos;
@@ -849,7 +849,7 @@
     }
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
-        palFreeMemory(pMac->hHdd, pUserPos);
+        vos_mem_free(pUserPos);
         limLog( pMac, LOGP,
                     FL("Posting  WDA_UPDATE_USERPOS to WDA failed, reason=%X"),
                     retCode );
@@ -876,27 +876,26 @@
     tpSirTdlsLinkEstablishInd pTdlsLinkEstablish = NULL;
 
     // Allocate memory.
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pTdlsLinkEstablish,
-          sizeof(tSirTdlsLinkEstablishInd)))
+    pTdlsLinkEstablish = vos_mem_malloc(sizeof(tSirTdlsLinkEstablishInd));
+    if ( NULL == pTdlsLinkEstablish )
     {
         limLog( pMac, LOGP,
-        FL( "Unable to PAL allocate memory while sending Tdls Link Establish " ));
+        FL( "Unable to allocate memory while sending Tdls Link Establish " ));
 
         retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
         return retCode;
     }
 
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pTdlsLinkEstablish, sizeof(tSirTdlsLinkEstablishInd));
+    vos_mem_set((tANI_U8 *) pTdlsLinkEstablish, sizeof(tSirTdlsLinkEstablishInd), 0);
 
     pTdlsLinkEstablish->bIsResponder = !!bIsPeerResponder; 
     pTdlsLinkEstablish->linkIdenOffset = linkIdenOffset;
     pTdlsLinkEstablish->ptiBufStatusOffset = ptiBufStatusOffset;
     pTdlsLinkEstablish->ptiTemplateLen = ptiFrameLen;
     /* Copy ptiFrame template */
-    palCopyMemory( pMac->hHdd, pTdlsLinkEstablish->ptiTemplateBuf, ptiFrame, ptiFrameLen);
+    vos_mem_copy(pTdlsLinkEstablish->ptiTemplateBuf, ptiFrame, ptiFrameLen);
     /* Copy extended capabilities */
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pTdlsLinkEstablish->extCapability,  extCapability, sizeof(pTdlsLinkEstablish->extCapability));
+    vos_mem_copy((tANI_U8 *) pTdlsLinkEstablish->extCapability,  extCapability, sizeof(pTdlsLinkEstablish->extCapability));
 
     msgQ.type = SIR_HAL_TDLS_LINK_ESTABLISH;
     msgQ.reserved = 0;
@@ -908,7 +907,7 @@
     retCode = (tANI_U32)wdaPostCtrlMsg(pMac, &msgQ);
     if (retCode != eSIR_SUCCESS)
     {
-        palFreeMemory(pMac, (void*)pTdlsLinkEstablish);
+        vos_mem_free(pTdlsLinkEstablish);
         limLog(pMac, LOGP, FL("Posting tdls link establish %d failed, reason = %x "), retCode);
     }
 
@@ -929,18 +928,17 @@
     tpSirTdlsLinkTeardownInd pTdlsLinkTeardown = NULL;
 
     // Allocate memory.
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &pTdlsLinkTeardown,
-          sizeof(tSirTdlsLinkTeardownInd)))
+    pTdlsLinkTeardown = vos_mem_malloc(sizeof(tSirTdlsLinkTeardownInd));
+    if ( NULL == pTdlsLinkTeardown )
     {
         limLog( pMac, LOGP,
-        FL( "Unable to PAL allocate memory while sending Tdls Link Teardown " ));
+        FL( "Unable to allocate memory while sending Tdls Link Teardown " ));
 
         retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
         return retCode;
     }
 
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) pTdlsLinkTeardown, sizeof(tSirTdlsLinkTeardownInd));
+    vos_mem_set((tANI_U8 *) pTdlsLinkTeardown, sizeof(tSirTdlsLinkTeardownInd), 0);
 
     pTdlsLinkTeardown->staId = staId;
 
@@ -954,7 +952,7 @@
     retCode = (tANI_U32)wdaPostCtrlMsg(pMac, &msgQ);
     if (retCode != eSIR_SUCCESS)
     {
-        palFreeMemory(pMac, (void*)pTdlsLinkTeardown);
+        vos_mem_free(pTdlsLinkTeardown);
         limLog(pMac, LOGP, FL("Posting tdls link teardown %d failed, reason = %x "), retCode);
     }
 
@@ -982,12 +980,11 @@
     tSirMsgQ msgQ;
     tSirWlanExcludeUnencryptParam * pExcludeUnencryptParam;
 
-    if (eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,
-                                                  (void **) &pExcludeUnencryptParam,
-                                                  sizeof(tSirWlanExcludeUnencryptParam)))
+    pExcludeUnencryptParam = vos_mem_malloc(sizeof(tSirWlanExcludeUnencryptParam));
+    if ( NULL == pExcludeUnencryptParam )
     {
         limLog(pMac, LOGP,
-            FL( "Unable to PAL allocate memory during limSendExcludeUnencryptInd"));
+            FL( "Unable to allocate memory during limSendExcludeUnencryptInd"));
         return eSIR_MEM_ALLOC_FAILED;
     }
 
@@ -1004,7 +1001,7 @@
     retCode = wdaPostCtrlMsg(pMac, &msgQ);
     if (eSIR_SUCCESS != retCode)
     {
-        palFreeMemory(pMac->hHdd, pExcludeUnencryptParam);
+        vos_mem_free(pExcludeUnencryptParam);
         limLog(pMac, LOGP,
                FL("Posting  WDA_EXCLUDE_UNENCRYPTED_IND to WDA failed, reason=%X"),
                retCode);
diff --git a/CORE/MAC/src/pe/lim/limSendMessages.h b/CORE/MAC/src/pe/lim/limSendMessages.h
index 6cc0db5..1fcc961 100644
--- a/CORE/MAC/src/pe/lim/limSendMessages.h
+++ b/CORE/MAC/src/pe/lim/limSendMessages.h
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * limSendMessages.h: Provides functions to send messages or Indications to HAL.
  * Author:    Sunit Bhatia
@@ -95,6 +94,7 @@
 #define HT_BYTE2_FILTER_MASK    0xEB
 #define HT_BYTE5_FILTER_MASK    0xFD
 #define DS_PARAM_CHANNEL_MASK   0x0
+#define VHTOP_CHWIDTH_MASK      0xFC
 
 tSirRetStatus limSendBeaconFilterInfo(tpAniSirGlobal pMac, tpPESession psessionEntry);
 
diff --git a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
index d4f795e..f5b6667 100644
--- a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
@@ -96,15 +96,16 @@
            FL("Sending message %s with reasonCode %s"),
            limMsgStr(msgType), limResultCodeStr(resultCode));)
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeRsp, sizeof(tSirSmeRsp)))
+    pSirSmeRsp = vos_mem_malloc(sizeof(tSirSmeRsp));
+    if ( NULL == pSirSmeRsp )
     {
         /// Buffer not available. Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for eWNI_SME_*_RSP"));
+               FL("call to AllocateMemory failed for eWNI_SME_*_RSP"));
 
         return;
     }
-
+  
     pSirSmeRsp->messageType = msgType;
     pSirSmeRsp->length      = sizeof(tSirSmeRsp);
     pSirSmeRsp->statusCode  = resultCode;
@@ -117,9 +118,9 @@
     mmhMsg.type = msgType;
     mmhMsg.bodyptr = pSirSmeRsp;
     mmhMsg.bodyval = 0;
-    MTRACE(macTraceMsgTx(pMac, smesessionId , mmhMsg.type));
+    MTRACE(macTraceMsgTx(pMac, smesessionId, mmhMsg.type));
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
    {
     tpPESession psessionEntry = peGetValidPowerSaveSession(pMac);
     switch(msgType)
@@ -132,7 +133,7 @@
             break;
         case eWNI_PMC_ENTER_IMPS_RSP:
             limDiagEventReport(pMac, WLAN_PE_DIAG_ENTER_IMPS_RSP_EVENT, psessionEntry, (tANI_U16)resultCode, 0);
-            break;
+            break;        
         case eWNI_PMC_EXIT_IMPS_RSP:
             limDiagEventReport(pMac, WLAN_PE_DIAG_EXIT_IMPS_RSP_EVENT, psessionEntry, (tANI_U16)resultCode, 0);
             break;
@@ -147,17 +148,17 @@
             break;
         case eWNI_SME_STOP_BSS_RSP:
             limDiagEventReport(pMac, WLAN_PE_DIAG_STOP_BSS_RSP_EVENT, NULL, (tANI_U16)resultCode, 0);
-            break;
+            break;      
         case eWNI_PMC_ENTER_WOWL_RSP:
             limDiagEventReport(pMac, WLAN_PE_DIAG_ENTER_WOWL_RSP_EVENT, psessionEntry, (tANI_U16)resultCode, 0);
             break;
         case eWNI_PMC_EXIT_WOWL_RSP:
             limDiagEventReport(pMac, WLAN_PE_DIAG_EXIT_WOWL_RSP_EVENT, psessionEntry, (tANI_U16)resultCode, 0);
-            break;
-    }
-   }
+            break;          
+    } 
+   }  
 #endif //FEATURE_WLAN_DIAG_SUPPORT
-
+    
     limSysProcessMmhMsgApi(pMac, &mmhMsg,  ePROT);
 } /*** end limSendSmeRsp() ***/
 
@@ -180,13 +181,13 @@
  * NA
  *
  * @param pMac         Pointer to Global MAC structure
- * @param status       Resume link status
+ * @param status       Resume link status 
  * @param ctx          context passed while calling resmune link.
  *                     (join response to be sent)
  *
  * @return None
  */
-static void limSendSmeJoinReassocRspAfterResume( tpAniSirGlobal pMac,
+static void limSendSmeJoinReassocRspAfterResume( tpAniSirGlobal pMac, 
                                        eHalStatus status, tANI_U32 *ctx)
 {
     tSirMsgQ         mmhMsg;
@@ -235,7 +236,7 @@
     tANI_U32 rspLen;
     tpDphHashNode pStaDs    = NULL;
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
     if (msgType == eWNI_SME_REASSOC_RSP)
         limDiagEventReport(pMac, WLAN_PE_DIAG_REASSOC_RSP_EVENT, psessionEntry, (tANI_U16)resultCode, 0);
     else
@@ -249,18 +250,19 @@
     if(psessionEntry == NULL)
     {
 
-        rspLen = sizeof(tSirSmeJoinRsp);
+        rspLen = sizeof(tSirSmeJoinRsp);   
 
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeJoinRsp, rspLen))
+        pSirSmeJoinRsp = vos_mem_malloc(rspLen);
+        if ( NULL == pSirSmeJoinRsp )
         {
             /// Buffer not available. Log error
-            limLog(pMac, LOGP, FL("call to palAllocateMemory failed for JOIN/REASSOC_RSP"));
+            limLog(pMac, LOGP, FL("call to AllocateMemory failed for JOIN/REASSOC_RSP"));
             return;
         }
-
-        palZeroMemory(pMac, (tANI_U8*)pSirSmeJoinRsp, rspLen);
-
-
+         
+        vos_mem_set((tANI_U8*)pSirSmeJoinRsp, rspLen, 0);
+         
+         
         pSirSmeJoinRsp->beaconLength = 0;
         pSirSmeJoinRsp->assocReqLength = 0;
         pSirSmeJoinRsp->assocRspLength = 0;
@@ -268,26 +270,27 @@
 
     else
     {
-        rspLen = psessionEntry->assocReqLen + psessionEntry->assocRspLen +
-            psessionEntry->bcnLen +
+        rspLen = psessionEntry->assocReqLen + psessionEntry->assocRspLen + 
+            psessionEntry->bcnLen + 
 #ifdef WLAN_FEATURE_VOWIFI_11R
             psessionEntry->RICDataLen +
 #endif
-#ifdef FEATURE_WLAN_CCX
-            psessionEntry->tspecLen +
-#endif
+#ifdef FEATURE_WLAN_CCX            
+            psessionEntry->tspecLen + 
+#endif            
             sizeof(tSirSmeJoinRsp) - sizeof(tANI_U8) ;
 
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeJoinRsp, rspLen))
+        pSirSmeJoinRsp = vos_mem_malloc(rspLen);
+        if ( NULL == pSirSmeJoinRsp )
         {
             /// Buffer not available. Log error
             limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for JOIN/REASSOC_RSP"));
+               FL("call to AllocateMemory failed for JOIN/REASSOC_RSP"));
 
             return;
         }
 
-        palZeroMemory(pMac, (tANI_U8*)pSirSmeJoinRsp, rspLen);
+        vos_mem_set((tANI_U8*)pSirSmeJoinRsp, rspLen, 0);
 
         if (resultCode == eSIR_SME_SUCCESS)
         {
@@ -311,29 +314,31 @@
 #ifdef WLAN_FEATURE_VOWIFI_11R
         pSirSmeJoinRsp->parsedRicRspLen = 0;
 #endif
-#ifdef FEATURE_WLAN_CCX
+#ifdef FEATURE_WLAN_CCX            
         pSirSmeJoinRsp->tspecIeLen = 0;
 #endif
-
+        
         if(resultCode == eSIR_SME_SUCCESS)
         {
 
             if(psessionEntry->beacon != NULL)
             {
                 pSirSmeJoinRsp->beaconLength = psessionEntry->bcnLen;
-                palCopyMemory(pMac->hHdd, pSirSmeJoinRsp->frames, psessionEntry->beacon, pSirSmeJoinRsp->beaconLength);
-                palFreeMemory(pMac->hHdd, psessionEntry->beacon);
+                vos_mem_copy( pSirSmeJoinRsp->frames, psessionEntry->beacon,
+                              pSirSmeJoinRsp->beaconLength);
+                vos_mem_free( psessionEntry->beacon);
                 psessionEntry->beacon = NULL;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
                 PELOG1(limLog(pMac, LOG1, FL("Beacon=%d"), psessionEntry->bcnLen);)
 #endif
             }
-
+        
             if(psessionEntry->assocReq != NULL)
             {
                 pSirSmeJoinRsp->assocReqLength = psessionEntry->assocReqLen;
-                palCopyMemory(pMac->hHdd, pSirSmeJoinRsp->frames + psessionEntry->bcnLen, psessionEntry->assocReq, pSirSmeJoinRsp->assocReqLength);
-                palFreeMemory(pMac->hHdd, psessionEntry->assocReq);
+                vos_mem_copy( pSirSmeJoinRsp->frames + psessionEntry->bcnLen,
+                              psessionEntry->assocReq, pSirSmeJoinRsp->assocReqLength);
+                vos_mem_free( psessionEntry->assocReq);
                 psessionEntry->assocReq = NULL;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
                 PELOG1(limLog(pMac, LOG1, FL("AssocReq=%d"), psessionEntry->assocReqLen);)
@@ -342,30 +347,38 @@
             if(psessionEntry->assocRsp != NULL)
             {
                 pSirSmeJoinRsp->assocRspLength = psessionEntry->assocRspLen;
-                palCopyMemory(pMac->hHdd, pSirSmeJoinRsp->frames + psessionEntry->bcnLen + psessionEntry->assocReqLen, psessionEntry->assocRsp, pSirSmeJoinRsp->assocRspLength);
-                palFreeMemory(pMac->hHdd, psessionEntry->assocRsp);
+                vos_mem_copy( pSirSmeJoinRsp->frames + psessionEntry->bcnLen +
+                                               psessionEntry->assocReqLen,
+                              psessionEntry->assocRsp,
+                              pSirSmeJoinRsp->assocRspLength);
+                vos_mem_free( psessionEntry->assocRsp);
                 psessionEntry->assocRsp = NULL;
-            }
+            }           
 #ifdef WLAN_FEATURE_VOWIFI_11R
             if(psessionEntry->ricData != NULL)
             {
                 pSirSmeJoinRsp->parsedRicRspLen = psessionEntry->RICDataLen;
-                palCopyMemory(pMac->hHdd, pSirSmeJoinRsp->frames + psessionEntry->bcnLen + psessionEntry->assocReqLen + psessionEntry->assocRspLen, psessionEntry->ricData, pSirSmeJoinRsp->parsedRicRspLen);
-                palFreeMemory(pMac->hHdd, psessionEntry->ricData);
+                vos_mem_copy( pSirSmeJoinRsp->frames + psessionEntry->bcnLen +
+                                 psessionEntry->assocReqLen + psessionEntry->assocRspLen,
+                              psessionEntry->ricData, pSirSmeJoinRsp->parsedRicRspLen);
+                vos_mem_free(psessionEntry->ricData);
                 psessionEntry->ricData = NULL;
                 PELOG1(limLog(pMac, LOG1, FL("RicLength=%d"), pSirSmeJoinRsp->parsedRicRspLen);)
             }
 #endif
-#ifdef FEATURE_WLAN_CCX
+#ifdef FEATURE_WLAN_CCX            
             if(psessionEntry->tspecIes != NULL)
             {
                 pSirSmeJoinRsp->tspecIeLen = psessionEntry->tspecLen;
-                palCopyMemory(pMac->hHdd, pSirSmeJoinRsp->frames + psessionEntry->bcnLen + psessionEntry->assocReqLen + psessionEntry->assocRspLen + psessionEntry->RICDataLen, psessionEntry->tspecIes, pSirSmeJoinRsp->tspecIeLen);
-                palFreeMemory(pMac->hHdd, psessionEntry->tspecIes);
+                vos_mem_copy( pSirSmeJoinRsp->frames + psessionEntry->bcnLen +
+                                psessionEntry->assocReqLen + psessionEntry->assocRspLen +
+                                  psessionEntry->RICDataLen,
+                              psessionEntry->tspecIes, pSirSmeJoinRsp->tspecIeLen);
+                vos_mem_free(psessionEntry->tspecIes);
                 psessionEntry->tspecIes = NULL;
                 PELOG1(limLog(pMac, LOG1, FL("CCX-TspecLen=%d"), psessionEntry->tspecLen);)
             }
-#endif
+#endif            
             pSirSmeJoinRsp->aid = psessionEntry->limAID;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
             PELOG1(limLog(pMac, LOG1, FL("AssocRsp=%d"), psessionEntry->assocRspLen);)
@@ -376,19 +389,19 @@
 
             if(psessionEntry->beacon != NULL)
             {
-                palFreeMemory(pMac->hHdd, psessionEntry->beacon);
+                vos_mem_free(psessionEntry->beacon);
                 psessionEntry->beacon = NULL;
             }
 
             if(psessionEntry->assocReq != NULL)
             {
-                palFreeMemory(pMac->hHdd, psessionEntry->assocReq);
+                vos_mem_free( psessionEntry->assocReq);
                 psessionEntry->assocReq = NULL;
             }
 
             if(psessionEntry->assocRsp != NULL)
             {
-                palFreeMemory(pMac->hHdd, psessionEntry->assocRsp);
+                vos_mem_free( psessionEntry->assocRsp);
                 psessionEntry->assocRsp = NULL;
             }
 
@@ -400,29 +413,29 @@
     pSirSmeJoinRsp->length = (tANI_U16) rspLen;
     pSirSmeJoinRsp->statusCode = resultCode;
     pSirSmeJoinRsp->protStatusCode = protStatusCode;
-
+    
     /* Update SME session ID and transaction Id */
     pSirSmeJoinRsp->sessionId = smesessionId;
     pSirSmeJoinRsp->transactionId = smetransactionId;
-
+    
     if(IS_MCC_SUPPORTED && limIsLinkSuspended( pMac ) )
     {
         if( psessionEntry && psessionEntry->limSmeState == eLIM_SME_LINK_EST_STATE )
         {
-
+            
 #ifdef WLAN_FEATURE_11AC
             if (psessionEntry->vhtCapability)
             {
                 ePhyChanBondState htSecondaryChannelOffset;
                /*Get 11ac cbState from 11n cbState*/
-                 htSecondaryChannelOffset = limGet11ACPhyCBState(pMac,
+                 htSecondaryChannelOffset = limGet11ACPhyCBState(pMac, 
                                     psessionEntry->currentOperChannel,
                                     psessionEntry->htSecondaryChannelOffset,
                                     psessionEntry->apCenterChan,
                                     psessionEntry);
                 peSetResumeChannel( pMac, psessionEntry->currentOperChannel, htSecondaryChannelOffset);
             }
-            else
+            else 
 #endif
                peSetResumeChannel( pMac, psessionEntry->currentOperChannel, psessionEntry->htSecondaryChannelOffset);
         }
@@ -430,7 +443,7 @@
         {
             peSetResumeChannel( pMac, 0, 0);
         }
-        limResumeLink( pMac, limSendSmeJoinReassocRspAfterResume,
+        limResumeLink( pMac, limSendSmeJoinReassocRspAfterResume, 
                                               (tANI_U32*) pSirSmeJoinRsp );
     }
     else
@@ -487,15 +500,15 @@
 
     if(psessionEntry == NULL)
     {
-
-         if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeRsp, size))
+         pSirSmeRsp = vos_mem_malloc(size);
+         if ( NULL == pSirSmeRsp )
          {
             /// Buffer not available. Log error
-            limLog(pMac, LOGP,FL("call to palAllocateMemory failed for eWNI_SME_START_BSS_RSP"));
+            limLog(pMac, LOGP,FL("call to AllocateMemory failed for eWNI_SME_START_BSS_RSP"));
             return;
          }
-         palZeroMemory(pMac, (tANI_U8*)pSirSmeRsp, size);
-
+         vos_mem_set((tANI_U8*)pSirSmeRsp, size, 0);
+                      
     }
     else
     {
@@ -505,21 +518,22 @@
         //calculate the memory size to allocate
         size += ieLen;
 
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeRsp, size))
+        pSirSmeRsp = vos_mem_malloc(size);
+        if ( NULL == pSirSmeRsp )
         {
             /// Buffer not available. Log error
             limLog(pMac, LOGP,
-            FL("call to palAllocateMemory failed for eWNI_SME_START_BSS_RSP"));
+            FL("call to AllocateMemory failed for eWNI_SME_START_BSS_RSP"));
 
             return;
         }
-        palZeroMemory(pMac, (tANI_U8*)pSirSmeRsp, size);
+        vos_mem_set((tANI_U8*)pSirSmeRsp, size, 0);
         size = sizeof(tSirSmeStartBssRsp);
         if (resultCode == eSIR_SME_SUCCESS)
         {
 
                 sirCopyMacAddr(pSirSmeRsp->bssDescription.bssId, psessionEntry->bssId);
-
+        
                 /* Read beacon interval from session */
                 pSirSmeRsp->bssDescription.beaconInterval = (tANI_U16) psessionEntry->beaconParams.beaconInterval;
                 pSirSmeRsp->bssType         = psessionEntry->bssType;
@@ -533,19 +547,19 @@
 #if 0
             if (wlan_cfgGetInt(pMac, WNI_CFG_CURRENT_CHANNEL, &len) != eSIR_SUCCESS)
                 limLog(pMac, LOGP, FL("could not retrieve CURRENT_CHANNEL from CFG"));
-
-#endif// TO SUPPORT BT-AMP
-
+           
+#endif// TO SUPPORT BT-AMP 
+            
                 pSirSmeRsp->bssDescription.channelId = psessionEntry->currentOperChannel;
 
                 pSirSmeRsp->bssDescription.aniIndicator = 1;
 
                 curLen = pMac->sch.schObject.gSchBeaconOffsetBegin - ieOffset;
-                palCopyMemory( pMac->hHdd, (tANI_U8 *) &pSirSmeRsp->bssDescription.ieFields,
+                vos_mem_copy( (tANI_U8 *) &pSirSmeRsp->bssDescription.ieFields,
                            pMac->sch.schObject.gSchBeaconFrameBegin + ieOffset,
                           (tANI_U32)curLen);
 
-                palCopyMemory( pMac->hHdd, ((tANI_U8 *) &pSirSmeRsp->bssDescription.ieFields) + curLen,
+                vos_mem_copy( ((tANI_U8 *) &pSirSmeRsp->bssDescription.ieFields) + curLen,
                            pMac->sch.schObject.gSchBeaconFrameEnd,
                           (tANI_U32)pMac->sch.schObject.gSchBeaconOffsetEnd);
 
@@ -558,9 +572,9 @@
                 size += ieLen - sizeof(tANI_U32);
         }
 
+            
 
-
-
+        
     }
 
     pSirSmeRsp->messageType     = msgType;
@@ -571,8 +585,8 @@
     pSirSmeRsp->transactionId   = smetransactionId;
     pSirSmeRsp->statusCode      = resultCode;
     if(psessionEntry != NULL )
-    pSirSmeRsp->staId           = psessionEntry->staId; //else it will be always zero smeRsp StaID = 0
-
+    pSirSmeRsp->staId           = psessionEntry->staId; //else it will be always zero smeRsp StaID = 0 
+      
 
     mmhMsg.type = msgType;
     mmhMsg.bodyptr = pSirSmeRsp;
@@ -585,7 +599,7 @@
     {
         MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, mmhMsg.type));
     }
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
     limDiagEventReport(pMac, WLAN_PE_DIAG_START_BSS_RSP_EVENT, psessionEntry, (tANI_U16)resultCode, 0);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
 
@@ -653,11 +667,12 @@
     bssCount = 0;
     msgLen = 0;
     allocLength = LIM_MAX_NUM_OF_SCAN_RESULTS_REPORTED * LIM_SIZE_OF_EACH_BSS;
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeScanRsp, allocLength))
+    pSirSmeScanRsp = vos_mem_malloc(allocLength);
+    if ( NULL == pSirSmeScanRsp )
     {
         // Log error
         limLog(pMac, LOGP,
-                   FL("call to palAllocateMemory failed for eWNI_SME_SCAN_RSP"));
+                   FL("call to AllocateMemory failed for eWNI_SME_SCAN_RSP"));
 
         return;
     }
@@ -693,11 +708,12 @@
                 mmhMsg.bodyval = 0;
                 MTRACE(macTraceMsgTx(pMac, NO_SESSION, mmhMsg.type));
                 limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
-                if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeScanRsp, allocLength))
+                pSirSmeScanRsp = vos_mem_malloc(allocLength);
+                if ( NULL == pSirSmeScanRsp )
                 {
                     // Log error
                     limLog(pMac, LOGP,
-                                 FL("call to palAllocateMemory failed for eWNI_SME_SCAN_RSP"));
+                                 FL("call to AllocateMemory failed for eWNI_SME_SCAN_RSP"));
                     return;
                 }
                 msgLen = sizeof(tSirSmeScanRsp) -
@@ -713,9 +729,9 @@
                           msgLen, ptemp->bssDescription.length);)
             pDesc->length
                     = ptemp->bssDescription.length;
-            palCopyMemory( pMac->hHdd, (tANI_U8 *) &pDesc->bssId,
-                              (tANI_U8 *) &ptemp->bssDescription.bssId,
-                              ptemp->bssDescription.length);
+            vos_mem_copy( (tANI_U8 *) &pDesc->bssId,
+                          (tANI_U8 *) &ptemp->bssDescription.bssId,
+                           ptemp->bssDescription.length);
 
             PELOG2(limLog(pMac, LOG2, FL("BssId "));
             limPrintMacAddr(pMac, ptemp->bssDescription.bssId, LOG2);)
@@ -732,7 +748,7 @@
        limPostSmeScanRspMessage(pMac, length, resultCode, smesessionId, smetranscationId);
        if (NULL != pSirSmeScanRsp)
        {
-           palFreeMemory( pMac->hHdd, pSirSmeScanRsp);
+           vos_mem_free( pSirSmeScanRsp);
            pSirSmeScanRsp = NULL;
        }
     }
@@ -815,12 +831,12 @@
     bssCount = 0;
     msgLen = 0;
     allocLength = LIM_MAX_NUM_OF_SCAN_RESULTS_REPORTED * LIM_SIZE_OF_EACH_BSS;
-    if ( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                                (void **)&pSirSmeScanRsp, allocLength))
+    pSirSmeScanRsp = vos_mem_malloc(allocLength);
+    if ( NULL == pSirSmeScanRsp )
     {
         // Log error
         limLog(pMac, LOGP,
-                   FL("call to palAllocateMemory failed for eWNI_SME_SCAN_RSP\n"));
+                   FL("call to AllocateMemory failed for eWNI_SME_SCAN_RSP\n"));
 
         return;
     }
@@ -856,13 +872,12 @@
                 mmhMsg.bodyval = 0;
                 MTRACE(macTraceMsgTx(pMac, NO_SESSION, mmhMsg.type));
                 limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
-                if (eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,
-                                                   (void **)&pSirSmeScanRsp,
-                                                   allocLength))
+                pSirSmeScanRsp = vos_mem_malloc(allocLength);
+                if ( NULL == pSirSmeScanRsp )
                 {
                     // Log error
                     limLog(pMac, LOGP,
-                                 FL("call to palAllocateMemory failed for eWNI_SME_SCAN_RSP\n"));
+                                 FL("call to AllocateMemory failed for eWNI_SME_SCAN_RSP\n"));
                     return;
                 }
                 msgLen = sizeof(tSirSmeScanRsp) -
@@ -878,9 +893,9 @@
                           msgLen, ptemp->bssDescription.length);)
             pDesc->length
                     = ptemp->bssDescription.length;
-            palCopyMemory( pMac->hHdd, (tANI_U8 *) &pDesc->bssId,
-                              (tANI_U8 *) &ptemp->bssDescription.bssId,
-                              ptemp->bssDescription.length);
+            vos_mem_copy( (tANI_U8 *) &pDesc->bssId,
+                          (tANI_U8 *) &ptemp->bssDescription.bssId,
+                           ptemp->bssDescription.length);
 
             PELOG2(limLog(pMac, LOG2, FL("BssId "));
             limPrintMacAddr(pMac, ptemp->bssDescription.bssId, LOG2);)
@@ -900,7 +915,7 @@
             ptemp = pMac->lim.gLimCachedScanHashTable[i];
             while(ptemp)
             {
-                if(palEqualMemory(pMac->hHdd, (tANI_U8* ) ptemp->bssDescription.ieFields+1,
+                if(vos_mem_compare((tANI_U8* ) ptemp->bssDescription.ieFields+1,
                                               (tANI_U8 *) &pSsid->length,
                                               (tANI_U8) (pSsid->length + 1)))
                 {
@@ -930,13 +945,12 @@
                         mmhMsg.bodyval = 0;
                         MTRACE(macTraceMsgTx(pMac, NO_SESSION, mmhMsg.type));
                         limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
-                        if (eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,
-                                                           (void **)&pSirSmeScanRsp,
-                                                           allocLength))
+                        pSirSmeScanRsp = vos_mem_malloc(allocLength);
+                        if ( NULL == pSirSmeScanRsp )
                         {
                             // Log error
                             limLog(pMac, LOGP,
-                                         FL("call to palAllocateMemory failed for eWNI_SME_SCAN_RSP\n"));
+                                         FL("call to AllocateMemory failed for eWNI_SME_SCAN_RSP\n"));
                             return;
                         }
                         msgLen = sizeof(tSirSmeScanRsp) -
@@ -952,7 +966,7 @@
                                   msgLen, ptemp->bssDescription.length);)
                     pDesc->length
                             = ptemp->bssDescription.length;
-                    palCopyMemory( pMac->hHdd, (tANI_U8 *) &pDesc->bssId,
+                    vos_mem_copy((tANI_U8 *) &pDesc->bssId,
                                       (tANI_U8 *) &ptemp->bssDescription.bssId,
                                       ptemp->bssDescription.length);
 
@@ -971,7 +985,7 @@
        limPostSmeScanRspMessage(pMac, length, resultCode, smesessionId, smetranscationId);
        if (NULL != pSirSmeScanRsp)
        {
-           palFreeMemory( pMac->hHdd, pSirSmeScanRsp);
+           vos_mem_free( pSirSmeScanRsp);
            pSirSmeScanRsp = NULL;
        }
     }
@@ -1019,7 +1033,7 @@
  */
 
 void
-limPostSmeScanRspMessage(tpAniSirGlobal    pMac,
+limPostSmeScanRspMessage(tpAniSirGlobal    pMac,     
                       tANI_U16               length,
                       tSirResultCodes   resultCode,tANI_U8 smesessionId, tANI_U16 smetransactionId)
 {
@@ -1030,12 +1044,13 @@
        FL("limPostSmeScanRspMessage: send SME_SCAN_RSP (len %d, reasonCode %s). "),
        length, limResultCodeStr(resultCode));)
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeScanRsp, length))
+    pSirSmeScanRsp = vos_mem_malloc(length);
+    if ( NULL == pSirSmeScanRsp )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for eWNI_SME_SCAN_RSP"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for eWNI_SME_SCAN_RSP"));
         return;
     }
-    palZeroMemory(pMac->hHdd, (void*)pSirSmeScanRsp, length);
+    vos_mem_set((void*)pSirSmeScanRsp, length, 0);
 
     pSirSmeScanRsp->messageType = eWNI_SME_SCAN_RSP;
     pSirSmeScanRsp->length      = length;
@@ -1050,13 +1065,13 @@
     /*Update SME session Id and transaction Id */
     pSirSmeScanRsp->sessionId = smesessionId;
     pSirSmeScanRsp->transcationId = smetransactionId;
-
+    
     mmhMsg.type = eWNI_SME_SCAN_RSP;
     mmhMsg.bodyptr = pSirSmeScanRsp;
     mmhMsg.bodyval = 0;
 
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, mmhMsg.type));
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
     limDiagEventReport(pMac, WLAN_PE_DIAG_SCAN_RSP_EVENT, NULL, (tANI_U16)resultCode, 0);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
 
@@ -1100,16 +1115,17 @@
     tLimMlmOemDataRsp*            pMlmOemDataRsp=NULL;
     tANI_U16                      msgLength;
 
-
+    
     //get the pointer to the mlm message
     pMlmOemDataRsp = (tLimMlmOemDataRsp*)(pMsgBuf);
 
     msgLength = sizeof(tSirOemDataRsp);
 
     //now allocate memory for the char buffer
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, (void**)&pSirSmeOemDataRsp, msgLength))
+    pSirSmeOemDataRsp = vos_mem_malloc(msgLength);
+    if (NULL == pSirSmeOemDataRsp)
     {
-        limLog(pMac, LOGP, FL("call to palAllocateMemory failed for pSirSmeOemDataRsp"));
+        limLog(pMac, LOGP, FL("call to AllocateMemory failed for pSirSmeOemDataRsp"));
         return;
     }
 
@@ -1121,10 +1137,10 @@
     pSirSmeOemDataRsp->messageType = eWNI_SME_OEM_DATA_RSP;
 #endif
 
-    palCopyMemory(pMac->hHdd, pSirSmeOemDataRsp->oemDataRsp, pMlmOemDataRsp->oemDataRsp, OEM_DATA_RSP_SIZE);
+    vos_mem_copy(pSirSmeOemDataRsp->oemDataRsp, pMlmOemDataRsp->oemDataRsp, OEM_DATA_RSP_SIZE);
 
     //Now free the memory from MLM Rsp Message
-    palFreeMemory(pMac->hHdd, pMlmOemDataRsp);
+    vos_mem_free(pMlmOemDataRsp);
 
     mmhMsg.type = eWNI_SME_OEM_DATA_RSP;
     mmhMsg.bodyptr = pSirSmeOemDataRsp;
@@ -1174,34 +1190,34 @@
     tSirMsgQ       mmhMsg;
     tSirSmeAuthRsp *pSirSmeAuthRsp;
 
-
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeAuthRsp, sizeof(tSirSmeAuthRsp)))
+    pSirSmeAuthRsp = vos_mem_malloc(sizeof(tSirSmeAuthRsp));
+    if (NULL == pSirSmeAuthRsp)
     {
         // Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for eWNI_SME_AUTH_RSP"));
+               FL("call to AllocateMemory failed for eWNI_SME_AUTH_RSP"));
 
         return;
     }
 
-
+   
 
     if(psessionEntry != NULL)
     {
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) pSirSmeAuthRsp->peerMacAddr,
+        vos_mem_copy( (tANI_U8 *) pSirSmeAuthRsp->peerMacAddr,
                   (tANI_U8 *) peerMacAddr, sizeof(tSirMacAddr));
         pSirSmeAuthRsp->authType    = authType;
-
+          
     }
 
     pSirSmeAuthRsp->messageType = eWNI_SME_AUTH_RSP;
     pSirSmeAuthRsp->length      = sizeof(tSirSmeAuthRsp);
     pSirSmeAuthRsp->statusCode  = statusCode;
     pSirSmeAuthRsp->protStatusCode = protStatusCode;
-
+    
     /* Update SME session and transaction Id*/
     pSirSmeAuthRsp->sessionId = smesessionId;
-    pSirSmeAuthRsp->transactionId = smetransactionId;
+    pSirSmeAuthRsp->transactionId = smetransactionId;  
 
     mmhMsg.type = eWNI_SME_AUTH_RSP;
     mmhMsg.bodyptr = pSirSmeAuthRsp;
@@ -1269,7 +1285,7 @@
     tSirSmeDisassocRsp      *pSirSmeDisassocRsp;
     tSirSmeDisassocInd      *pSirSmeDisassocInd;
     tANI_U32 *pMsg;
-
+    
     switch (disassocTrigger)
     {
         case eLIM_PEER_ENTITY_DISASSOC:
@@ -1281,11 +1297,12 @@
              * host triggered disassociation
              */
 
-            if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeDisassocRsp, sizeof(tSirSmeDisassocRsp)))
+            pSirSmeDisassocRsp = vos_mem_malloc(sizeof(tSirSmeDisassocRsp));
+            if ( NULL == pSirSmeDisassocRsp )
             {
                 // Log error
                 limLog(pMac, LOGP,
-                   FL("call to palAllocateMemory failed for eWNI_SME_DISASSOC_RSP"));
+                   FL("call to AllocateMemory failed for eWNI_SME_DISASSOC_RSP"));
 
                 return;
             }
@@ -1301,20 +1318,21 @@
             limCopyU16(pBuf, smetransactionId);
             pBuf += sizeof(tANI_U16);
 
-            //statusCode
+            //statusCode            
             limCopyU32(pBuf, reasonCode);
             pBuf += sizeof(tSirResultCodes);
 
             //peerMacAddr
-            palCopyMemory( pMac->hHdd, pBuf, peerMacAddr, sizeof(tSirMacAddr));
+            vos_mem_copy( pBuf, peerMacAddr, sizeof(tSirMacAddr));
             pBuf += sizeof(tSirMacAddr);
 
             // Clear Station Stats
             //for sta, it is always 1, IBSS is handled at halInitSta
 
 
+          
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
             limDiagEventReport(pMac, WLAN_PE_DIAG_DISASSOC_RSP_EVENT,
                                       psessionEntry, (tANI_U16)reasonCode, 0);
 #endif
@@ -1327,18 +1345,19 @@
              * frame reception from peer entity or due to
              * loss of link with peer entity.
              */
-            if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeDisassocInd, sizeof(tSirSmeDisassocInd)))
+            pSirSmeDisassocInd = vos_mem_malloc(sizeof(tSirSmeDisassocInd));
+            if ( NULL == pSirSmeDisassocInd )
             {
                 // Log error
                 limLog(pMac, LOGP,
-                   FL("call to palAllocateMemory failed for eWNI_SME_DISASSOC_IND"));
+                   FL("call to AllocateMemory failed for eWNI_SME_DISASSOC_IND"));
 
                 return;
             }
 
             pSirSmeDisassocInd->messageType = eWNI_SME_DISASSOC_IND;
             pSirSmeDisassocInd->length      = sizeof(tSirSmeDisassocInd);
-
+            
             /* Update SME session Id and Transaction Id */
             pSirSmeDisassocInd->sessionId = smesessionId;
             pSirSmeDisassocInd->transactionId = smetransactionId;
@@ -1348,13 +1367,13 @@
             limCopyU32(pBuf, reasonCode);
             pBuf += sizeof(tSirResultCodes);
 
-            palCopyMemory( pMac->hHdd, pBuf, psessionEntry->bssId, sizeof(tSirMacAddr));
+            vos_mem_copy( pBuf, psessionEntry->bssId, sizeof(tSirMacAddr));
             pBuf += sizeof(tSirMacAddr);
 
-            palCopyMemory( pMac->hHdd, pBuf, peerMacAddr, sizeof(tSirMacAddr));
+            vos_mem_copy( pBuf, peerMacAddr, sizeof(tSirMacAddr));
 
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
             limDiagEventReport(pMac, WLAN_PE_DIAG_DISASSOC_IND_EVENT,
                                               psessionEntry, (tANI_U16)reasonCode, 0);
 #endif
@@ -1369,7 +1388,7 @@
     {
         peDeleteSession(pMac,psessionEntry);
     }
-
+        
     limSendSmeDisassocDeauthNtf( pMac, eHAL_STATUS_SUCCESS,
                                               (tANI_U32*) pMsg );
 } /*** end limSendSmeDisassocNtf() ***/
@@ -1377,14 +1396,14 @@
 
 /** -----------------------------------------------------------------
   \brief limSendSmeDisassocInd() - sends SME_DISASSOC_IND
-
-  After receiving disassociation frame from peer entity, this
+   
+  After receiving disassociation frame from peer entity, this 
   function sends a eWNI_SME_DISASSOC_IND to SME with a specific
-  reason code.
-
+  reason code.  
+    
   \param pMac - global mac structure
-  \param pStaDs - station dph hash node
-  \return none
+  \param pStaDs - station dph hash node 
+  \return none 
   \sa
   ----------------------------------------------------------------- */
 void
@@ -1393,9 +1412,10 @@
     tSirMsgQ  mmhMsg;
     tSirSmeDisassocInd *pSirSmeDisassocInd;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeDisassocInd, sizeof(tSirSmeDisassocInd)))
+    pSirSmeDisassocInd = vos_mem_malloc(sizeof(tSirSmeDisassocInd));
+    if ( NULL == pSirSmeDisassocInd )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for eWNI_SME_DISASSOC_IND"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for eWNI_SME_DISASSOC_IND"));
         return;
     }
 
@@ -1407,9 +1427,9 @@
     pSirSmeDisassocInd->statusCode    =  pStaDs->mlmStaContext.disassocReason;
     pSirSmeDisassocInd->reasonCode    =  pStaDs->mlmStaContext.disassocReason;
 
-    palCopyMemory( pMac->hHdd, pSirSmeDisassocInd->bssId , psessionEntry->bssId , sizeof(tSirMacAddr));
+    vos_mem_copy( pSirSmeDisassocInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
 
-    palCopyMemory( pMac->hHdd, pSirSmeDisassocInd->peerMacAddr , pStaDs->staAddr, sizeof(tSirMacAddr));
+    vos_mem_copy( pSirSmeDisassocInd->peerMacAddr, pStaDs->staAddr, sizeof(tSirMacAddr));
 
     pSirSmeDisassocInd->staId = pStaDs->staIndex;
 
@@ -1418,36 +1438,37 @@
     mmhMsg.bodyval = 0;
 
     MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, mmhMsg.type));
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
-    limDiagEventReport(pMac, WLAN_PE_DIAG_DISASSOC_IND_EVENT, psessionEntry, 0, (tANI_U16)pStaDs->mlmStaContext.disassocReason);
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
+    limDiagEventReport(pMac, WLAN_PE_DIAG_DISASSOC_IND_EVENT, psessionEntry, 0, (tANI_U16)pStaDs->mlmStaContext.disassocReason); 
 #endif //FEATURE_WLAN_DIAG_SUPPORT
 
     limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
-
+ 
 } /*** end limSendSmeDisassocInd() ***/
 
 
 /** -----------------------------------------------------------------
   \brief limSendSmeDeauthInd() - sends SME_DEAUTH_IND
-
-  After receiving deauthentication frame from peer entity, this
+   
+  After receiving deauthentication frame from peer entity, this 
   function sends a eWNI_SME_DEAUTH_IND to SME with a specific
-  reason code.
-
+  reason code.  
+    
   \param pMac - global mac structure
-  \param pStaDs - station dph hash node
-  \return none
+  \param pStaDs - station dph hash node 
+  \return none 
   \sa
   ----------------------------------------------------------------- */
 void
-limSendSmeDeauthInd(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpPESession psessionEntry)
+limSendSmeDeauthInd(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpPESession psessionEntry)                   
 {
     tSirMsgQ  mmhMsg;
     tSirSmeDeauthInd  *pSirSmeDeauthInd;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeDeauthInd, sizeof(tSirSmeDeauthInd)))
+    pSirSmeDeauthInd = vos_mem_malloc(sizeof(tSirSmeDeauthInd));
+    if ( NULL == pSirSmeDeauthInd )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for eWNI_SME_DEAUTH_IND "));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for eWNI_SME_DEAUTH_IND "));
         return;
     }
 
@@ -1466,9 +1487,9 @@
         pSirSmeDeauthInd->statusCode = (tSirResultCodes)pStaDs->mlmStaContext.disassocReason;
     }
     //BSSID
-    palCopyMemory( pMac->hHdd, pSirSmeDeauthInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
+    vos_mem_copy( pSirSmeDeauthInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
     //peerMacAddr
-    palCopyMemory( pMac->hHdd, pSirSmeDeauthInd->peerMacAddr, pStaDs->staAddr, sizeof(tSirMacAddr));
+    vos_mem_copy( pSirSmeDeauthInd->peerMacAddr, pStaDs->staAddr, sizeof(tSirMacAddr));
     pSirSmeDeauthInd->reasonCode = pStaDs->mlmStaContext.disassocReason;
 
 
@@ -1479,7 +1500,7 @@
     mmhMsg.bodyval = 0;
 
     MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, mmhMsg.type));
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
     limDiagEventReport(pMac, WLAN_PE_DIAG_DEAUTH_IND_EVENT, psessionEntry, 0, pStaDs->mlmStaContext.cleanupTrigger);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
 
@@ -1513,9 +1534,10 @@
     tSirMsgQ  mmhMsg;
     tSirTdlsDelStaInd  *pSirTdlsDelStaInd;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirTdlsDelStaInd, sizeof(tSirTdlsDelStaInd)))
+    pSirTdlsDelStaInd = vos_mem_malloc(sizeof(tSirTdlsDelStaInd));
+    if ( NULL == pSirTdlsDelStaInd )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for eWNI_SME_TDLS_DEL_STA_IND "));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for eWNI_SME_TDLS_DEL_STA_IND "));
         return;
     }
 
@@ -1527,7 +1549,7 @@
     pSirTdlsDelStaInd->sessionId = psessionEntry->smeSessionId;
 
     //peerMacAddr
-    palCopyMemory( pMac->hHdd, pSirTdlsDelStaInd->peerMac, pStaDs->staAddr, sizeof(tSirMacAddr));
+    vos_mem_copy( pSirTdlsDelStaInd->peerMac, pStaDs->staAddr, sizeof(tSirMacAddr));
 
     //staId
     limCopyU16((tANI_U8*)(&pSirTdlsDelStaInd->staId), (tANI_U16)pStaDs->staIndex);
@@ -1568,9 +1590,10 @@
     tSirMsgQ  mmhMsg;
     tSirTdlsDelAllPeerInd  *pSirTdlsDelAllPeerInd;
 
-    if ( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirTdlsDelAllPeerInd, sizeof(tSirTdlsDelAllPeerInd)))
+    pSirTdlsDelAllPeerInd = vos_mem_malloc(sizeof(tSirTdlsDelAllPeerInd));
+    if ( NULL == pSirTdlsDelAllPeerInd )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for eWNI_SME_TDLS_DEL_ALL_PEER_IND"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for eWNI_SME_TDLS_DEL_ALL_PEER_IND"));
         return;
     }
 
@@ -1617,9 +1640,10 @@
     tSirMsgQ  mmhMsg;
     tSirMgmtTxCompletionInd  *pSirMgmtTxCompletionInd;
 
-    if ( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirMgmtTxCompletionInd, sizeof(tSirMgmtTxCompletionInd)))
+    pSirMgmtTxCompletionInd = vos_mem_malloc(sizeof(tSirMgmtTxCompletionInd));
+    if ( NULL == pSirMgmtTxCompletionInd )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for eWNI_SME_MGMT_FRM_TX_COMPLETION_IND"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for eWNI_SME_MGMT_FRM_TX_COMPLETION_IND"));
         return;
     }
 
@@ -1681,22 +1705,23 @@
     tANI_U8             sessionId;
     tANI_U32            *pMsg;
 
-    psessionEntry = peFindSessionByBssid(pMac,peerMacAddr,&sessionId);
+    psessionEntry = peFindSessionByBssid(pMac,peerMacAddr,&sessionId);  
     switch (deauthTrigger)
     {
         case eLIM_PEER_ENTITY_DEAUTH:
             return;
-
+            
         case eLIM_HOST_DEAUTH:
             /**
              * Deauthentication response to host triggered
              * deauthentication.
              */
-            if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeDeauthRsp, sizeof(tSirSmeDeauthRsp)))
+            pSirSmeDeauthRsp = vos_mem_malloc(sizeof(tSirSmeDeauthRsp));
+            if ( NULL == pSirSmeDeauthRsp )
             {
                 // Log error
                 limLog(pMac, LOGP,
-                   FL("call to palAllocateMemory failed for eWNI_SME_DEAUTH_RSP"));
+                   FL("call to AllocateMemory failed for eWNI_SME_DEAUTH_RSP"));
 
                 return;
             }
@@ -1705,12 +1730,12 @@
             pSirSmeDeauthRsp->length      = sizeof(tSirSmeDeauthRsp);
             pSirSmeDeauthRsp->statusCode = reasonCode;
             pSirSmeDeauthRsp->sessionId = smesessionId;
-            pSirSmeDeauthRsp->transactionId = smetransactionId;
+            pSirSmeDeauthRsp->transactionId = smetransactionId;  
 
             pBuf  = (tANI_U8 *) pSirSmeDeauthRsp->peerMacAddr;
-            palCopyMemory( pMac->hHdd, pBuf, peerMacAddr, sizeof(tSirMacAddr));
+            vos_mem_copy( pBuf, peerMacAddr, sizeof(tSirMacAddr));
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
             limDiagEventReport(pMac, WLAN_PE_DIAG_DEAUTH_RSP_EVENT,
                                       psessionEntry, 0, (tANI_U16)reasonCode);
 #endif
@@ -1724,11 +1749,12 @@
              * frame reception from peer entity or due to
              * loss of link with peer entity.
              */
-            if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeDeauthInd, sizeof(tSirSmeDeauthInd)))
+            pSirSmeDeauthInd = vos_mem_malloc(sizeof(tSirSmeDeauthInd));
+            if ( NULL == pSirSmeDeauthInd )
             {
                 // Log error
                 limLog(pMac, LOGP,
-                   FL("call to palAllocateMemory failed for eWNI_SME_DEAUTH_Ind"));
+                   FL("call to AllocateMemory failed for eWNI_SME_DEAUTH_Ind"));
 
                 return;
             }
@@ -1750,13 +1776,13 @@
             pBuf += sizeof(tSirResultCodes);
 
             //bssId
-            palCopyMemory( pMac->hHdd, pBuf, psessionEntry->bssId, sizeof(tSirMacAddr));
+            vos_mem_copy( pBuf, psessionEntry->bssId, sizeof(tSirMacAddr));
             pBuf += sizeof(tSirMacAddr);
 
             //peerMacAddr
-            palCopyMemory( pMac->hHdd, pSirSmeDeauthInd->peerMacAddr, peerMacAddr, sizeof(tSirMacAddr));
+            vos_mem_copy( pSirSmeDeauthInd->peerMacAddr, peerMacAddr, sizeof(tSirMacAddr));
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
             limDiagEventReport(pMac, WLAN_PE_DIAG_DEAUTH_IND_EVENT,
                                         psessionEntry, 0, (tANI_U16)reasonCode);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
@@ -1764,12 +1790,12 @@
 
             break;
     }
-
+    
     /*Delete the PE session  created */
     if(psessionEntry != NULL)
     {
         peDeleteSession(pMac,psessionEntry);
-    }
+    }   
 
     limSendSmeDisassocDeauthNtf( pMac, eHAL_STATUS_SUCCESS,
                                               (tANI_U32*) pMsg );
@@ -1807,17 +1833,11 @@
 {
     tSirMsgQ                  mmhMsg;
     tSirSmeWmStatusChangeNtf  *pSirSmeWmStatusChangeNtf;
-    eHalStatus                status;
-
-
-
-    status = palAllocateMemory( pMac->hHdd, (void **)&pSirSmeWmStatusChangeNtf,
-                                                    sizeof(tSirSmeWmStatusChangeNtf));
-    if (status != eHAL_STATUS_SUCCESS)
+    pSirSmeWmStatusChangeNtf = vos_mem_malloc(sizeof(tSirSmeWmStatusChangeNtf));
+    if ( NULL == pSirSmeWmStatusChangeNtf )
     {
         limLog(pMac, LOGE,
-          FL("call to palAllocateMemory failed for eWNI_SME_WM_STATUS_CHANGE_NTF, status = %d"),
-          status);
+          FL("call to AllocateMemory failed for eWNI_SME_WM_STATUS_CHANGE_NTF"));
           return;
     }
 
@@ -1849,7 +1869,8 @@
         pSirSmeWmStatusChangeNtf->sessionId = sessionId;
         if(sizeof(pSirSmeWmStatusChangeNtf->statusChangeInfo) >= infoLen)
         {
-            palCopyMemory( pMac->hHdd, (tANI_U8 *)&pSirSmeWmStatusChangeNtf->statusChangeInfo, (tANI_U8 *)pStatusChangeInfo, infoLen);
+            vos_mem_copy( (tANI_U8 *)&pSirSmeWmStatusChangeNtf->statusChangeInfo,
+                          (tANI_U8 *)pStatusChangeInfo, infoLen);
         }
         limLog(pMac, LOGE, FL("***---*** StatusChg: code 0x%x, length %d ***---***"),
                statusChangeCode, infoLen);
@@ -1860,7 +1881,7 @@
     MTRACE(macTraceMsgTx(pMac, sessionId, mmhMsg.type));
     if (eSIR_SUCCESS != limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT))
     {
-        palFreeMemory(pMac->hHdd, (void *) pSirSmeWmStatusChangeNtf);
+        vos_mem_free(pSirSmeWmStatusChangeNtf);
         limLog( pMac, LOGP, FL("limSysProcessMmhMsgApi failed"));
     }
 
@@ -1904,11 +1925,12 @@
     tSirMsgQ             mmhMsg;
     tSirSmeSetContextRsp *pSirSmeSetContextRsp;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeSetContextRsp, sizeof(tSirSmeSetContextRsp)))
+    pSirSmeSetContextRsp = vos_mem_malloc(sizeof(tSirSmeSetContextRsp));
+    if ( NULL == pSirSmeSetContextRsp )
     {
         // Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for SmeSetContextRsp"));
+               FL("call to AllocateMemory failed for SmeSetContextRsp"));
 
         return;
     }
@@ -1919,7 +1941,7 @@
 
     pBuf = pSirSmeSetContextRsp->peerMacAddr;
 
-    palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *) peerMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy( pBuf, (tANI_U8 *) peerMacAddr, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
 
 
@@ -1939,10 +1961,10 @@
         MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, mmhMsg.type));
     }
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
     limDiagEventReport(pMac, WLAN_PE_DIAG_SETCONTEXT_RSP_EVENT, psessionEntry, (tANI_U16)resultCode, 0);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
-
+    
     limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
 } /*** end limSendSmeSetContextRsp() ***/
 
@@ -1983,33 +2005,32 @@
     tSirMsgQ                mmhMsg;
     tSirSmeRemoveKeyRsp     *pSirSmeRemoveKeyRsp;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeRemoveKeyRsp, sizeof(tSirSmeRemoveKeyRsp)))
+    pSirSmeRemoveKeyRsp = vos_mem_malloc(sizeof(tSirSmeRemoveKeyRsp));
+    if ( NULL == pSirSmeRemoveKeyRsp )
     {
         // Log error
         limLog(pMac, LOGP,
-               FL("call to palAllocateMemory failed for SmeRemoveKeyRsp"));
+               FL("call to AllocateMemory failed for SmeRemoveKeyRsp"));
 
         return;
     }
 
-
+    
 
     if(psessionEntry != NULL)
     {
         pBuf = pSirSmeRemoveKeyRsp->peerMacAddr;
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *) peerMacAddr, sizeof(tSirMacAddr));
-        pBuf += sizeof(tSirMacAddr);
-        limCopyU32(pBuf, resultCode);
+        vos_mem_copy( pBuf, (tANI_U8 *) peerMacAddr, sizeof(tSirMacAddr));
     }
-
+    
     pSirSmeRemoveKeyRsp->messageType = eWNI_SME_REMOVEKEY_RSP;
     pSirSmeRemoveKeyRsp->length      = sizeof(tSirSmeRemoveKeyRsp);
     pSirSmeRemoveKeyRsp->statusCode  = resultCode;
-
+        
     /* Update SME session and transaction Id*/
     pSirSmeRemoveKeyRsp->sessionId = smesessionId;
-    pSirSmeRemoveKeyRsp->transactionId = smetransactionId;
-
+    pSirSmeRemoveKeyRsp->transactionId = smetransactionId;   
+    
     mmhMsg.type = eWNI_SME_REMOVEKEY_RSP;
     mmhMsg.bodyptr = pSirSmeRemoveKeyRsp;
     mmhMsg.bodyval = 0;
@@ -2053,10 +2074,11 @@
     tSirMsgQ   mmhMsg;
     tSirMbMsg  *pMbMsg;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMbMsg, sizeof(tSirMbMsg)))
+    pMbMsg = vos_mem_malloc(sizeof(tSirMbMsg));
+    if ( NULL == pMbMsg )
     {
         // Log error
-        limLog(pMac, LOGP, FL("call to palAllocateMemory failed"));
+        limLog(pMac, LOGP, FL("call to AllocateMemory failed"));
 
         return;
     }
@@ -2133,11 +2155,12 @@
      * and length of header itself
      */
     val = pBssDescr->bssDescription.length + sizeof(tANI_U16) + sizeof(tANI_U32) + sizeof(tANI_U8);
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pNewBssInd, val))
+    pNewBssInd = vos_mem_malloc(val);
+    if ( NULL == pNewBssInd )
     {
         // Log error
         limLog(pMac, LOGP,
-           FL("call to palAllocateMemory failed for eWNI_SME_NEIGHBOR_BSS_IND"));
+           FL("call to AllocateMemory failed for eWNI_SME_NEIGHBOR_BSS_IND"));
 
         return;
     }
@@ -2146,7 +2169,7 @@
     pNewBssInd->length      = (tANI_U16) val;
     pNewBssInd->sessionId = 0;
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pNewBssInd->bssDescription,
+    vos_mem_copy( (tANI_U8 *) pNewBssInd->bssDescription,
                   (tANI_U8 *) &pBssDescr->bssDescription,
                   pBssDescr->bssDescription.length + sizeof(tANI_U16));
 
@@ -2158,9 +2181,9 @@
 } /*** end limSendSmeNeighborBssInd() ***/
 
 /** -----------------------------------------------------------------
-  \brief limSendSmeAddtsRsp() - sends SME ADDTS RSP
-  \      This function sends a eWNI_SME_ADDTS_RSP to SME.
-  \      SME only looks at rc and tspec field.
+  \brief limSendSmeAddtsRsp() - sends SME ADDTS RSP    
+  \      This function sends a eWNI_SME_ADDTS_RSP to SME.   
+  \      SME only looks at rc and tspec field. 
   \param pMac - global mac structure
   \param rspReqd - is SmeAddTsRsp required
   \param status - status code of SME_ADD_TS_RSP
@@ -2168,8 +2191,8 @@
   \sa
   ----------------------------------------------------------------- */
 void
-limSendSmeAddtsRsp(tpAniSirGlobal pMac, tANI_U8 rspReqd, tANI_U32 status, tpPESession psessionEntry,
-        tSirMacTspecIE tspec, tANI_U8 smesessionId, tANI_U16 smetransactionId)
+limSendSmeAddtsRsp(tpAniSirGlobal pMac, tANI_U8 rspReqd, tANI_U32 status, tpPESession psessionEntry, 
+        tSirMacTspecIE tspec, tANI_U8 smesessionId, tANI_U16 smetransactionId)  
 {
     tpSirAddtsRsp     rsp;
     tSirMsgQ          mmhMsg;
@@ -2177,23 +2200,23 @@
     if (! rspReqd)
         return;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&rsp, sizeof(tSirAddtsRsp)))
+    rsp = vos_mem_malloc(sizeof(tSirAddtsRsp));
+    if ( NULL == rsp )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for ADDTS_RSP"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for ADDTS_RSP"));
         return;
     }
 
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) rsp, sizeof(*rsp));
+    vos_mem_set( (tANI_U8 *) rsp, sizeof(*rsp), 0);
     rsp->messageType = eWNI_SME_ADDTS_RSP;
     rsp->rc = status;
     rsp->rsp.status = (enum eSirMacStatusCodes) status;
-    //palCopyMemory( pMac->hHdd, (tANI_U8 *) &rsp->rsp.tspec, (tANI_U8 *) &addts->tspec, sizeof(addts->tspec));
+    //vos_mem_copy( (tANI_U8 *) &rsp->rsp.tspec, (tANI_U8 *) &addts->tspec, sizeof(addts->tspec));
     rsp->rsp.tspec = tspec;
-
     /* Update SME session Id and transcation Id */
     rsp->sessionId = smesessionId;
     rsp->transactionId = smetransactionId;
-
+    
     mmhMsg.type = eWNI_SME_ADDTS_RSP;
     mmhMsg.bodyptr = rsp;
     mmhMsg.bodyval = 0;
@@ -2205,10 +2228,10 @@
     {
         MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, mmhMsg.type));
     }
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
     limDiagEventReport(pMac, WLAN_PE_DIAG_ADDTS_RSP_EVENT, psessionEntry, 0, 0);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
-
+    
     limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
     return;
 }
@@ -2224,17 +2247,18 @@
            addts->tspec.tsinfo.traffic.tsid,
            addts->tspec.tsinfo.traffic.userPrio);
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&rsp, sizeof(tSirAddtsRsp)))
+    rsp = vos_mem_malloc(sizeof(tSirAddtsRsp));
+    if ( NULL == rsp )
     {
         // Log error
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for ADDTS_IND"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for ADDTS_IND"));
         return;
     }
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) rsp, sizeof(*rsp));
+    vos_mem_set( (tANI_U8 *) rsp, sizeof(*rsp), 0);
 
     rsp->messageType     = eWNI_SME_ADDTS_IND;
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &rsp->rsp, (tANI_U8 *) addts, sizeof(*addts));
+    vos_mem_copy( (tANI_U8 *) &rsp->rsp, (tANI_U8 *) addts, sizeof(*addts));
 
     mmhMsg.type = eWNI_SME_ADDTS_IND;
     mmhMsg.bodyptr = rsp;
@@ -2257,23 +2281,24 @@
     if (! delts->rspReqd)
         return;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&rsp, sizeof(tSirDeltsRsp)))
+    rsp = vos_mem_malloc(sizeof(tSirDeltsRsp));
+    if ( NULL == rsp )
     {
         // Log error
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for DELTS_RSP"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for DELTS_RSP"));
         return;
     }
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) rsp, sizeof(*rsp));
-
+    vos_mem_set( (tANI_U8 *) rsp, sizeof(*rsp), 0);
+  
     if(psessionEntry != NULL)
     {
-
+        
         rsp->aid             = delts->aid;
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) &rsp->macAddr[0], (tANI_U8 *) &delts->macAddr[0], 6);
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) &rsp->rsp, (tANI_U8 *) &delts->req, sizeof(tSirDeltsReqInfo));
-    }
+        vos_mem_copy( (tANI_U8 *) &rsp->macAddr[0], (tANI_U8 *) &delts->macAddr[0], 6);
+        vos_mem_copy( (tANI_U8 *) &rsp->rsp, (tANI_U8 *) &delts->req, sizeof(tSirDeltsReqInfo));
+    } 
 
-
+    
     rsp->messageType     = eWNI_SME_DELTS_RSP;
     rsp->rc              = status;
 
@@ -2292,10 +2317,10 @@
     {
         MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, mmhMsg.type));
     }
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
     limDiagEventReport(pMac, WLAN_PE_DIAG_DELTS_RSP_EVENT, psessionEntry, (tANI_U16)status, 0);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
-
+    
     limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
 }
 
@@ -2310,18 +2335,19 @@
            delts->tsinfo.traffic.tsid,
            delts->tsinfo.traffic.userPrio);
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&rsp, sizeof(tSirDeltsRsp)))
+    rsp = vos_mem_malloc(sizeof(tSirDeltsRsp));
+    if ( NULL == rsp )
     {
         // Log error
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for DELTS_IND"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for DELTS_IND"));
         return;
     }
-    palZeroMemory( pMac->hHdd, (tANI_U8 *) rsp, sizeof(*rsp));
+    vos_mem_set( (tANI_U8 *) rsp, sizeof(*rsp), 0);
 
     rsp->messageType     = eWNI_SME_DELTS_IND;
     rsp->rc              = eSIR_SUCCESS;
     rsp->aid             = aid;
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &rsp->rsp, (tANI_U8 *) delts, sizeof(*delts));
+    vos_mem_copy( (tANI_U8 *) &rsp->rsp, (tANI_U8 *) delts, sizeof(*delts));
 
     /* Update SME  session Id and SME transaction Id */
 
@@ -2332,7 +2358,7 @@
     mmhMsg.bodyptr = rsp;
     mmhMsg.bodyval = 0;
     MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, mmhMsg.type));
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
     limDiagEventReport(pMac, WLAN_PE_DIAG_DELTS_IND_EVENT, psessionEntry, 0, 0);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
 
@@ -2358,9 +2384,9 @@
  * NA
  *
  * @param pMac         Pointer to Global MAC structure
- * @param p80211Stats  Statistics sent in response
+ * @param p80211Stats  Statistics sent in response 
  * @param resultCode   TODO:
- *
+ * 
  *
  * @return none
  */
@@ -2384,18 +2410,18 @@
             break;
         case WDA_STAT_SUMM_RSP:
             mmhMsg.type = eWNI_SME_STAT_SUMM_RSP;
-            break;
+            break;      
         default:
             mmhMsg.type = msgType; //Response from within PE
             break;
     }
 
-    pMsgHdr->messageType = mmhMsg.type;
+    pMsgHdr->messageType = mmhMsg.type; 
 
     mmhMsg.bodyptr = stats;
     mmhMsg.bodyval = 0;
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, mmhMsg.type));
-    limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
+    limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);                                                  
 
     return;
 
@@ -2420,9 +2446,9 @@
  * NA
  *
  * @param pMac         Pointer to Global MAC structure
- * @param p80211Stats  Statistics sent in response
+ * @param p80211Stats  Statistics sent in response 
  * @param resultCode   TODO:
- *
+ * 
  *
  * @return none
  */
@@ -2444,9 +2470,9 @@
       //Fill the Session Id
       pPeStats->sessionId = pPeSessionEntry->smeSessionId;
     }
-
+ 
     pPeStats->msgType = eWNI_SME_GET_STATISTICS_RSP;
-
+    
 
     //msgType should be WDA_GET_STATISTICS_RSP
     mmhMsg.type = eWNI_SME_GET_STATISTICS_RSP;
@@ -2454,7 +2480,7 @@
     mmhMsg.bodyptr = stats;
     mmhMsg.bodyval = 0;
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, mmhMsg.type));
-    limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
+    limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);                                                  
 
     return;
 
@@ -2521,32 +2547,88 @@
 
 #endif
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+/**
+ * limSendSmePECcxTsmRsp()
+ *
+ *FUNCTION:
+ * This function is called to send tsm stats response to HDD.
+ * This function posts the result back to HDD. This is a response to
+ * HDD's request to get tsm stats.
+ *
+ *PARAMS:
+ * @param pMac   - Pointer to global pMac structure
+ * @param pStats - Pointer to TSM Stats
+ *
+ * @return none
+ */
+
+void
+limSendSmePECcxTsmRsp(tpAniSirGlobal pMac, tAniGetTsmStatsRsp *pStats)
+{
+    tSirMsgQ            mmhMsg;
+    tANI_U8             sessionId;
+    tAniGetTsmStatsRsp *pPeStats = (tAniGetTsmStatsRsp *) pStats;
+    tpPESession         pPeSessionEntry = NULL;
+
+    //Get the Session Id based on Sta Id
+    pPeSessionEntry = peFindSessionByStaId(pMac, pPeStats->staId, &sessionId);
+
+    //Fill the Session Id
+    if(NULL != pPeSessionEntry)
+    {
+      //Fill the Session Id
+      pPeStats->sessionId = pPeSessionEntry->smeSessionId;
+    }
+    else
+    {
+        PELOGE(limLog(pMac, LOGE, FL("Session not found for the Sta id(%d)"),
+            pPeStats->staId);)
+        return;
+    }
+
+    pPeStats->msgType = eWNI_SME_GET_TSM_STATS_RSP;
+    pPeStats->tsmMetrics.RoamingCount
+      = pPeSessionEntry->ccxContext.tsm.tsmMetrics.RoamingCount;
+    pPeStats->tsmMetrics.RoamingDly
+      = pPeSessionEntry->ccxContext.tsm.tsmMetrics.RoamingDly;
+
+    mmhMsg.type = eWNI_SME_GET_TSM_STATS_RSP;
+    mmhMsg.bodyptr = pStats;
+    mmhMsg.bodyval = 0;
+    MTRACE(macTraceMsgTx(pMac, sessionId, mmhMsg.type));
+    limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
+
+    return;
+} /*** end limSendSmePECcxTsmRsp() ***/
+
+#endif /* FEATURE_WLAN_CCX) && FEATURE_WLAN_CCX_UPLOAD */
 
 void
 limSendSmeIBSSPeerInd(
     tpAniSirGlobal      pMac,
     tSirMacAddr peerMacAddr,
-    tANI_U16    staIndex,
+    tANI_U16    staIndex, 
     tANI_U8     ucastIdx,
     tANI_U8     bcastIdx,
-    tANI_U8  *beacon,
-    tANI_U16 beaconLen,
+    tANI_U8  *beacon, 
+    tANI_U16 beaconLen, 
     tANI_U16 msgType,
     tANI_U8 sessionId)
 {
     tSirMsgQ                  mmhMsg;
     tSmeIbssPeerInd *pNewPeerInd;
-
-    if(eHAL_STATUS_SUCCESS !=
-        palAllocateMemory(pMac->hHdd,(void * *) &pNewPeerInd,(sizeof(tSmeIbssPeerInd) + beaconLen)))
+    
+    pNewPeerInd = vos_mem_malloc(sizeof(tSmeIbssPeerInd) + beaconLen);
+    if ( NULL == pNewPeerInd )
     {
         PELOGE(limLog(pMac, LOGE, FL("Failed to allocate memory"));)
         return;
     }
+    
+    vos_mem_set((void *) pNewPeerInd, (sizeof(tSmeIbssPeerInd) + beaconLen), 0);
 
-    palZeroMemory(pMac->hHdd, (void *) pNewPeerInd, (sizeof(tSmeIbssPeerInd) + beaconLen));
-
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pNewPeerInd->peerAddr,
+    vos_mem_copy( (tANI_U8 *) pNewPeerInd->peerAddr,
                    peerMacAddr, sizeof(tSirMacAddr));
     pNewPeerInd->staId= staIndex;
     pNewPeerInd->ucastSig = ucastIdx;
@@ -2557,7 +2639,8 @@
 
     if ( beacon != NULL )
     {
-        palCopyMemory(pMac->hHdd, (void*) ((tANI_U8*)pNewPeerInd+sizeof(tSmeIbssPeerInd)), (void*)beacon, beaconLen);
+        vos_mem_copy((void*) ((tANI_U8*)pNewPeerInd+sizeof(tSmeIbssPeerInd)),
+                     (void*)beacon, beaconLen);
     }
 
     mmhMsg.type    = msgType;
@@ -2565,19 +2648,19 @@
     mmhMsg.bodyptr = pNewPeerInd;
     MTRACE(macTraceMsgTx(pMac, sessionId, mmhMsg.type));
     limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
-
+    
 }
 
 
 /** -----------------------------------------------------------------
   \brief limSendExitBmpsInd() - sends exit bmps indication
-
+   
   This function sends a eWNI_PMC_EXIT_BMPS_IND with a specific reason
-  code to SME. This will trigger SME to get out of BMPS mode.
-
+  code to SME. This will trigger SME to get out of BMPS mode. 
+    
   \param pMac - global mac structure
   \param reasonCode - reason for which PE wish to exit BMPS
-  \return none
+  \return none 
   \sa
   ----------------------------------------------------------------- */
 void limSendExitBmpsInd(tpAniSirGlobal pMac, tExitBmpsReason reasonCode,
@@ -2586,14 +2669,15 @@
     tSirMsgQ  mmhMsg;
     tANI_U16  msgLen = 0;
     tpSirSmeExitBmpsInd  pExitBmpsInd;
-
+ 
     msgLen = sizeof(tSirSmeExitBmpsInd);
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pExitBmpsInd, msgLen ))
+    pExitBmpsInd = vos_mem_malloc(msgLen);
+    if ( NULL == pExitBmpsInd )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for PMC_EXIT_BMPS_IND "));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for PMC_EXIT_BMPS_IND "));
         return;
     }
-    palZeroMemory(pMac->hHdd, pExitBmpsInd, msgLen);
+    vos_mem_set(pExitBmpsInd, msgLen, 0);
 
     pExitBmpsInd->mesgType = eWNI_PMC_EXIT_BMPS_IND;
     pExitBmpsInd->mesgLen = msgLen;
@@ -2604,13 +2688,13 @@
     mmhMsg.type = eWNI_PMC_EXIT_BMPS_IND;
     mmhMsg.bodyptr = pExitBmpsInd;
     mmhMsg.bodyval = 0;
-
+  
     PELOG1(limLog(pMac, LOG1, FL("Sending eWNI_PMC_EXIT_BMPS_IND to SME. "));)
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, mmhMsg.type));
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT 
     limDiagEventReport(pMac, WLAN_PE_DIAG_EXIT_BMPS_IND_EVENT, peGetValidPowerSaveSession(pMac), 0, (tANI_U16)reasonCode);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
-
+    
     limSysProcessMmhMsgApi(pMac, &mmhMsg,  ePROT);
     return;
 
@@ -2652,16 +2736,16 @@
    }
 
 err:
-   palFreeMemory(pMac->hHdd, (void *)csa_params);
+   vos_mem_free(csa_params);
 }
 
 /*--------------------------------------------------------------------------
   \brief peDeleteSession() - Handle the Delete BSS Response from HAL.
 
-
+    
   \param pMac                   - pointer to global adapter context
   \param sessionId             - Message pointer.
-
+    
   \sa
   --------------------------------------------------------------------------*/
 
@@ -2677,22 +2761,22 @@
     if (psessionEntry->limSystemRole == eLIM_STA_IN_IBSS_ROLE)
     {
         limIbssDelBssRsp(pMac, MsgQ->bodyptr,psessionEntry);
-    }
+    }    
     else if(psessionEntry->limSystemRole == eLIM_UNKNOWN_ROLE)
     {
          limProcessSmeDelBssRsp(pMac, MsgQ->bodyval,psessionEntry);
     }
-
+           
     else
          limProcessMlmDelBssRsp(pMac,MsgQ,psessionEntry);
-
+    
 }
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
 /** -----------------------------------------------------------------
-  \brief limSendSmeAggrQosRsp() - sends SME FT AGGR QOS RSP
-  \      This function sends a eWNI_SME_FT_AGGR_QOS_RSP to SME.
-  \      SME only looks at rc and tspec field.
+  \brief limSendSmeAggrQosRsp() - sends SME FT AGGR QOS RSP    
+  \      This function sends a eWNI_SME_FT_AGGR_QOS_RSP to SME.   
+  \      SME only looks at rc and tspec field. 
   \param pMac - global mac structure
   \param rspReqd - is SmeAddTsRsp required
   \param status - status code of eWNI_SME_FT_AGGR_QOS_RSP
@@ -2700,7 +2784,7 @@
   \sa
   ----------------------------------------------------------------- */
 void
-limSendSmeAggrQosRsp(tpAniSirGlobal pMac, tpSirAggrQosRsp aggrQosRsp,
+limSendSmeAggrQosRsp(tpAniSirGlobal pMac, tpSirAggrQosRsp aggrQosRsp, 
                      tANI_U8 smesessionId)
 {
     tSirMsgQ         mmhMsg;
@@ -2708,7 +2792,7 @@
     mmhMsg.type = eWNI_SME_FT_AGGR_QOS_RSP;
     mmhMsg.bodyptr = aggrQosRsp;
     mmhMsg.bodyval = 0;
-    MTRACE(macTraceMsgTx(pMac, smesessionId , mmhMsg.type));
+    MTRACE(macTraceMsgTx(pMac, smesessionId, mmhMsg.type));
     limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
 
     return;
@@ -2716,13 +2800,13 @@
 #endif
 
 /** -----------------------------------------------------------------
-  \brief limSendSmePreChannelSwitchInd() - sends an indication to SME
+  \brief limSendSmePreChannelSwitchInd() - sends an indication to SME 
   before switching channels for spectrum manangement.
-
+   
   This function sends a eWNI_SME_PRE_SWITCH_CHL_IND to SME.
-
+    
   \param pMac - global mac structure
-  \return none
+  \return none 
   \sa
   ----------------------------------------------------------------- */
 void
@@ -2733,14 +2817,14 @@
     tpSirSmePreSwitchChannelInd  pPreSwitchChInd;
 
     msgLen = sizeof(tSirSmePreSwitchChannelInd);
-    if(eHAL_STATUS_SUCCESS !=
-       palAllocateMemory(pMac->hHdd, (void **)&pPreSwitchChInd, msgLen))
+    pPreSwitchChInd = vos_mem_malloc(msgLen);
+    if (NULL == pPreSwitchChInd)
     {
         limLog(pMac, LOGP,
-            FL("palAllocateMemory failed for eWNI_SME_PRE_SWITCH_CHL_IND "));
+            FL("Memory allocation failed for eWNI_SME_PRE_SWITCH_CHL_IND "));
         return;
     }
-    palZeroMemory(pMac->hHdd, pPreSwitchChInd, msgLen);
+    vos_mem_zero(pPreSwitchChInd, msgLen);
 
     pPreSwitchChInd->mesgType = eWNI_SME_PRE_SWITCH_CHL_IND;
     pPreSwitchChInd->mesgLen = msgLen;
@@ -2756,13 +2840,13 @@
 }
 
 /** -----------------------------------------------------------------
-  \brief limSendSmePostChannelSwitchInd() - sends an indication to SME
+  \brief limSendSmePostChannelSwitchInd() - sends an indication to SME 
   after channel switch for spectrum manangement is complete.
-
+   
   This function sends a eWNI_SME_POST_SWITCH_CHL_IND to SME.
-
+    
   \param pMac - global mac structure
-  \return none
+  \return none 
   \sa
   ----------------------------------------------------------------- */
 void
@@ -2785,17 +2869,17 @@
     tSirMsgQ         mmhMsg;
     tSmeMaxAssocInd *pSmeMaxAssocInd;
 
-    if(eHAL_STATUS_SUCCESS !=
-            palAllocateMemory(pMac->hHdd,(void **)&pSmeMaxAssocInd, sizeof(tSmeMaxAssocInd)))
+    pSmeMaxAssocInd = vos_mem_malloc(sizeof(tSmeMaxAssocInd));
+    if ( NULL == pSmeMaxAssocInd )
     {
         PELOGE(limLog(pMac, LOGE, FL("Failed to allocate memory"));)
         return;
-    }
-    palZeroMemory(pMac->hHdd, (void *) pSmeMaxAssocInd, sizeof(tSmeMaxAssocInd));
-    palCopyMemory( pMac->hHdd, (tANI_U8 *)pSmeMaxAssocInd->peerMac,
-            (tANI_U8 *)peerMacAddr, sizeof(tSirMacAddr));
+    }    
+    vos_mem_set((void *) pSmeMaxAssocInd, sizeof(tSmeMaxAssocInd),0);
+    vos_mem_copy( (tANI_U8 *)pSmeMaxAssocInd->peerMac,
+                  (tANI_U8 *)peerMacAddr, sizeof(tSirMacAddr));
     pSmeMaxAssocInd->mesgType  = eWNI_SME_MAX_ASSOC_EXCEEDED;
-    pSmeMaxAssocInd->mesgLen    = sizeof(tSmeMaxAssocInd);
+    pSmeMaxAssocInd->mesgLen    = sizeof(tSmeMaxAssocInd); 
     pSmeMaxAssocInd->sessionId = smesessionId;
     mmhMsg.type = pSmeMaxAssocInd->mesgType;
     mmhMsg.bodyptr = pSmeMaxAssocInd;
@@ -2827,11 +2911,10 @@
     tSirMsgQ  mmhMsg;
     tSirSmeCandidateFoundInd *pSirSmeCandidateFoundInd;
 
-    if ( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                                             (void **)&pSirSmeCandidateFoundInd,
-                                             sizeof(tSirSmeCandidateFoundInd)))
+    pSirSmeCandidateFoundInd = vos_mem_malloc(sizeof(tSirSmeCandidateFoundInd));
+    if ( NULL == pSirSmeCandidateFoundInd )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed for eWNI_SME_CANDIDATE_FOUND_IND\n"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed for eWNI_SME_CANDIDATE_FOUND_IND\n"));
         return;
     }
 
diff --git a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.h b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.h
index a1f421f..a0fd08f 100644
--- a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.h
+++ b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.h
@@ -91,6 +91,9 @@
 #if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
 void limSendSmePEGetRoamRssiRsp(tpAniSirGlobal pMac, tANI_U16 msgtype, void * stats);
 #endif
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+void limSendSmePECcxTsmRsp(tpAniSirGlobal pMac, tAniGetTsmStatsRsp *pStats);
+#endif
 void limSendSmeRemoveKeyRsp(tpAniSirGlobal pMac, tSirMacAddr peerMacAddr, tSirResultCodes resultCode,tpPESession,tANI_U8,tANI_U16);
 
 
@@ -113,6 +116,9 @@
 void limSendSmeTdlsDisRsp(tpAniSirGlobal pMac, tSirResultCodes statusCode, tANI_U16 msgType);
 void limSendSmeTdlsLinkStartRsp(tpAniSirGlobal pMac, tSirResultCodes statusCode, tSirMacAddr peerMac, tANI_U16 msgType);
 void limSendSmeTdlsTeardownRsp(tpAniSirGlobal pMac, tSirResultCodes statusCode, tSirMacAddr peerMac, tANI_U16 msgType);
+void limSendSmeTdlsLinkEstablishReqRsp(tpAniSirGlobal pMac,
+                                       tANI_U8 sessionId, tSirMacAddr peerMac, tDphHashNode   *pStaDs,
+                                       tANI_U8 status);
 #endif
 
 #endif /* __LIM_SEND_SME_RSP_H */
diff --git a/CORE/MAC/src/pe/lim/limSerDesUtils.c b/CORE/MAC/src/pe/lim/limSerDesUtils.c
index 2bce162..074ccde 100644
--- a/CORE/MAC/src/pe/lim/limSerDesUtils.c
+++ b/CORE/MAC/src/pe/lim/limSerDesUtils.c
@@ -120,7 +120,7 @@
     *lenUsed = len + sizeof(tANI_U16);
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pBssDescription->bssId,
+    vos_mem_copy( (tANI_U8 *) pBssDescription->bssId,
                   pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
@@ -128,7 +128,7 @@
         return eSIR_FAILURE;
 
     // Extract timer
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) (&pBssDescription->scanSysTimeMsec),
+    vos_mem_copy( (tANI_U8 *) (&pBssDescription->scanSysTimeMsec),
                   pBuf, sizeof(v_TIME_t));
     pBuf += sizeof(v_TIME_t);
     len  -= sizeof(v_TIME_t);
@@ -136,7 +136,7 @@
         return eSIR_FAILURE;
 
     // Extract timeStamp
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pBssDescription->timeStamp,
+    vos_mem_copy( (tANI_U8 *) pBssDescription->timeStamp,
                   pBuf, sizeof(tSirMacTimeStamp));
     pBuf += sizeof(tSirMacTimeStamp);
     len  -= sizeof(tSirMacTimeStamp);
@@ -266,7 +266,7 @@
          * if WscIeLen is not set properly, memory overwrite happen
          * Ended up with memory corruption and crash
          * Copy with Fixed size */
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) pBssDescription->WscIeProbeRsp,
+        vos_mem_copy( (tANI_U8 *) pBssDescription->WscIeProbeRsp,
                        pBuf,
                        WSCIE_PROBE_RSP_LEN);
 
@@ -285,7 +285,7 @@
 
     if (len > 0)
     {
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) pBssDescription->ieFields,
+        vos_mem_copy( (tANI_U8 *) pBssDescription->ieFields,
                        pBuf,
                        len);
     }
@@ -331,7 +331,7 @@
     pBuf       += sizeof(tANI_U16);
     len        += sizeof(tANI_U16);
 
-    palCopyMemory( pMac->hHdd, pBuf,
+    vos_mem_copy(  pBuf,
                   (tANI_U8 *) pBssDescription->bssId,
                   sizeof(tSirMacAddr));
     pBuf       += sizeof(tSirMacAddr);
@@ -342,7 +342,7 @@
        pBssDescription->channelId, pBssDescription->aniIndicator);
     limPrintMacAddr(pMac, pBssDescription->bssId, LOG3);)
 
-    palCopyMemory( pMac->hHdd, pBuf,
+    vos_mem_copy( pBuf,
                   (tANI_U8 *) (&pBssDescription->scanSysTimeMsec),
                   sizeof(v_TIME_t));
     pBuf       += sizeof(v_TIME_t);
@@ -380,7 +380,7 @@
     *pBuf++ = pBssDescription->channelId;
     len++;
 
-    palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *) &(pBssDescription->ieFields),
+    vos_mem_copy( pBuf, (tANI_U8 *) &(pBssDescription->ieFields),
                   limGetIElenFromBssDescription(pBssDescription));
 
     return (len + sizeof(tANI_U16));
@@ -424,7 +424,7 @@
     len  += sizeof(tAniKeyDirection);
     pBuf += sizeof(tAniKeyDirection);
 
-    palCopyMemory( pMac->hHdd, pKeyInfo->keyRsc, pBuf, WLAN_MAX_KEY_RSC_LEN);
+    vos_mem_copy( pKeyInfo->keyRsc, pBuf, WLAN_MAX_KEY_RSC_LEN);
     pBuf += WLAN_MAX_KEY_RSC_LEN;
     len  += WLAN_MAX_KEY_RSC_LEN;
 
@@ -434,7 +434,7 @@
     pKeyInfo->keyLength    = limGetU16(pBuf);
     pBuf += sizeof(tANI_U16);
     len  += sizeof(tANI_U16);
-    palCopyMemory( pMac->hHdd, pKeyInfo->key, pBuf, pKeyInfo->keyLength);
+    vos_mem_copy( pKeyInfo->key, pBuf, pKeyInfo->keyLength);
     pBuf += pKeyInfo->keyLength;
     len  += pKeyInfo->keyLength;
 
@@ -515,14 +515,14 @@
         return eSIR_FAILURE;
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pStartBssReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pStartBssReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
     // Extract selfMacAddr
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pStartBssReq->selfMacAddr, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pStartBssReq->selfMacAddr, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -566,7 +566,7 @@
         return eSIR_FAILURE;
     }
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pStartBssReq->ssId.ssId,
+    vos_mem_copy( (tANI_U8 *) pStartBssReq->ssId.ssId,
                   pBuf,
                   pStartBssReq->ssId.length);
     pBuf += pStartBssReq->ssId.length;
@@ -654,7 +654,6 @@
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
-
     // Extract bssPersona
     pStartBssReq->bssPersona = *pBuf++;
     len--;
@@ -682,7 +681,7 @@
         return eSIR_FAILURE;
     }
 
-    palCopyMemory( pMac->hHdd, pStartBssReq->rsnIE.rsnIEdata,
+    vos_mem_copy( pStartBssReq->rsnIE.rsnIEdata,
                   pBuf, pStartBssReq->rsnIE.length);
 
     len  -= (sizeof(tANI_U16) + pStartBssReq->rsnIE.length);
@@ -713,7 +712,7 @@
     if (len < pStartBssReq->operationalRateSet.numRates)
         return eSIR_FAILURE;
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pStartBssReq->operationalRateSet.rate,
+    vos_mem_copy( (tANI_U8 *) pStartBssReq->operationalRateSet.rate,
                   pBuf,
                   pStartBssReq->operationalRateSet.numRates);
     pBuf += pStartBssReq->operationalRateSet.numRates;
@@ -725,7 +724,7 @@
     if ((pStartBssReq->nwType == eSIR_11G_NW_TYPE) ||
         (pStartBssReq->nwType == eSIR_11N_NW_TYPE ))
     {
-        palCopyMemory( pMac->hHdd, pStartBssReq->extendedRateSet.rate,
+        vos_mem_copy( pStartBssReq->extendedRateSet.rate,
                        pBuf, pStartBssReq->extendedRateSet.numRates);
         pBuf += pStartBssReq->extendedRateSet.numRates;
         len  -= pStartBssReq->extendedRateSet.numRates;
@@ -737,8 +736,8 @@
        pStartBssReq->extendedRateSet.numRates = 0;
     }
 
-    palCopyMemory(pMac->hHdd, &(pStartBssReq->htConfig), pBuf,
-                  sizeof(tSirHTConfig));
+    vos_mem_copy(&(pStartBssReq->htConfig), pBuf,
+                 sizeof(tSirHTConfig));
     len -= sizeof(tSirHTConfig);
     pBuf += sizeof(tSirHTConfig);
     if (len)
@@ -817,7 +816,7 @@
     len -= sizeof(tSirResultCodes);
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pStopBssReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pStopBssReq->bssId, pBuf, sizeof(tSirMacAddr));
     len  -= sizeof(tSirMacAddr);
   
     if (len)
@@ -910,14 +909,14 @@
     // Extract ssId
     pJoinReq->ssId.length = *pBuf++;
     len--;
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pJoinReq->ssId.ssId, pBuf, pJoinReq->ssId.length);
+    vos_mem_copy( (tANI_U8 *) pJoinReq->ssId.ssId, pBuf, pJoinReq->ssId.length);
     pBuf += pJoinReq->ssId.length;
     len -= pJoinReq->ssId.length;
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
     // Extract selfMacAddr
-    palCopyMemory( pMac->hHdd, pJoinReq->selfMacAddr, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pJoinReq->selfMacAddr, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -960,7 +959,8 @@
     len--;
     if (pJoinReq->operationalRateSet.numRates)
     {
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) pJoinReq->operationalRateSet.rate, pBuf, pJoinReq->operationalRateSet.numRates);
+        vos_mem_copy( (tANI_U8 *) pJoinReq->operationalRateSet.rate, pBuf,
+                       pJoinReq->operationalRateSet.numRates);
         pBuf += pJoinReq->operationalRateSet.numRates;
         len -= pJoinReq->operationalRateSet.numRates;
         if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -972,7 +972,7 @@
     len--;
     if (pJoinReq->extendedRateSet.numRates)
     {
-        palCopyMemory( pMac->hHdd, pJoinReq->extendedRateSet.rate, pBuf, pJoinReq->extendedRateSet.numRates);
+        vos_mem_copy( pJoinReq->extendedRateSet.rate, pBuf, pJoinReq->extendedRateSet.numRates);
         pBuf += pJoinReq->extendedRateSet.numRates;
         len  -= pJoinReq->extendedRateSet.numRates;
         if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -995,7 +995,7 @@
                    pJoinReq->rsnIE.length);
             return eSIR_FAILURE;
         }
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) pJoinReq->rsnIE.rsnIEdata,
+        vos_mem_copy( (tANI_U8 *) pJoinReq->rsnIE.rsnIEdata,
                       pBuf, pJoinReq->rsnIE.length);
         pBuf += pJoinReq->rsnIE.length;
         len  -= pJoinReq->rsnIE.length; // skip RSN IE
@@ -1019,7 +1019,7 @@
                    pJoinReq->cckmIE.length, 2 + *(pBuf + 1));
             return eSIR_FAILURE;
         }
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) pJoinReq->cckmIE.cckmIEdata,
+        vos_mem_copy((tANI_U8 *) pJoinReq->cckmIE.cckmIEdata,
                       pBuf, pJoinReq->cckmIE.length);
         pBuf += pJoinReq->cckmIE.length;
         len  -= pJoinReq->cckmIE.length; // skip CCKM IE
@@ -1044,7 +1044,7 @@
             return eSIR_FAILURE;
         }
         // Check for P2P IE length (that includes length of type & length)
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) pJoinReq->addIEScan.addIEdata,
+        vos_mem_copy( (tANI_U8 *) pJoinReq->addIEScan.addIEdata,
                       pBuf, pJoinReq->addIEScan.length);
         pBuf += pJoinReq->addIEScan.length;
         len  -= pJoinReq->addIEScan.length; // skip add IE
@@ -1068,7 +1068,7 @@
             return eSIR_FAILURE;
         }
         // Check for P2P IE length (that includes length of type & length)
-        palCopyMemory( pMac->hHdd, (tANI_U8 *) pJoinReq->addIEAssoc.addIEdata,
+        vos_mem_copy( (tANI_U8 *) pJoinReq->addIEAssoc.addIEdata,
                       pBuf, pJoinReq->addIEAssoc.length);
         pBuf += pJoinReq->addIEAssoc.length;
         len  -= pJoinReq->addIEAssoc.length; // skip add IE
@@ -1106,6 +1106,13 @@
 #endif
 
 #ifdef FEATURE_WLAN_CCX
+    //CCX version IE
+    pJoinReq->isCCXFeatureIniEnabled = (tAniBool)limGetU32(pBuf);
+    pBuf += sizeof(tAniBool);
+    len -= sizeof(tAniBool);
+    if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
+       return eSIR_FAILURE;
+
     //isCCXconnection;
     pJoinReq->isCCXconnection = (tAniBool)limGetU32(pBuf);
     pBuf += sizeof(tAniBool);
@@ -1116,7 +1123,8 @@
     // TSPEC information
     pJoinReq->ccxTspecInfo.numTspecs = *pBuf++;
     len -= sizeof(tANI_U8);
-    palCopyMemory(pMac->hHdd, (void*)&pJoinReq->ccxTspecInfo.tspec[0], pBuf, (sizeof(tTspecInfo)* pJoinReq->ccxTspecInfo.numTspecs));
+    vos_mem_copy((void*)&pJoinReq->ccxTspecInfo.tspec[0], pBuf,
+                 (sizeof(tTspecInfo)* pJoinReq->ccxTspecInfo.numTspecs));
     pBuf += sizeof(tTspecInfo)*SIR_CCX_MAX_TSPEC_IES;
     len  -= sizeof(tTspecInfo)*SIR_CCX_MAX_TSPEC_IES;
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -1148,7 +1156,7 @@
         return eSIR_FAILURE;
 
     //HT Config
-    palCopyMemory(pMac->hHdd, &(pJoinReq->htConfig), pBuf, sizeof(tSirHTConfig));
+    vos_mem_copy(&(pJoinReq->htConfig), pBuf, sizeof(tSirHTConfig));
     len -= sizeof(tSirHTConfig);
     pBuf += sizeof(tSirHTConfig);
 
@@ -1200,6 +1208,11 @@
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
+    pJoinReq->isAmsduSupportInAMPDU= *pBuf++;
+    len--;
+    if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
+        return eSIR_FAILURE;
+
     // Extract Titan CB Neighbor BSS info
     pJoinReq->cbNeighbors.cbBssFoundPri = *pBuf;
     pBuf++;
@@ -1221,7 +1234,7 @@
 
     pJoinReq->supportedChannels.numChnl = *pBuf++;
     len--;
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pJoinReq->supportedChannels.channelList,
+    vos_mem_copy( (tANI_U8 *) pJoinReq->supportedChannels.channelList,
                       pBuf, pJoinReq->supportedChannels.numChnl);
     pBuf += pJoinReq->supportedChannels.numChnl;
     len-= pJoinReq->supportedChannels.numChnl;
@@ -1288,7 +1301,7 @@
     pBuf   += sizeof(tANI_U8);
 
      // Fill in peerMacAddr
-    palCopyMemory( pMac->hHdd, pBuf, pAssocInd->peerMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy( pBuf, pAssocInd->peerMacAddr, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     mLen += sizeof(tSirMacAddr);
 
@@ -1298,7 +1311,7 @@
     mLen += sizeof(tANI_U16);
 
    // Fill in bssId
-    palCopyMemory( pMac->hHdd, pBuf, psessionEntry->bssId, sizeof(tSirMacAddr));
+    vos_mem_copy( pBuf, psessionEntry->bssId, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     mLen += sizeof(tSirMacAddr);
 
@@ -1313,7 +1326,7 @@
     mLen += sizeof(tANI_U32);
 
     // Fill in ssId
-    palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *) &(pAssocInd->ssId), pAssocInd->ssId.length + 1);
+    vos_mem_copy( pBuf, (tANI_U8 *) &(pAssocInd->ssId), pAssocInd->ssId.length + 1);
     pBuf += (1 + pAssocInd->ssId.length);
     mLen += (1 + pAssocInd->ssId.length);
 
@@ -1321,7 +1334,7 @@
     limCopyU16(pBuf, pAssocInd->rsnIE.length);
     pBuf += sizeof(tANI_U16);
     mLen += sizeof(tANI_U16);
-    palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *) &(pAssocInd->rsnIE.rsnIEdata),
+    vos_mem_copy( pBuf, (tANI_U8 *) &(pAssocInd->rsnIE.rsnIEdata),
                   pAssocInd->rsnIE.length);
     pBuf += pAssocInd->rsnIE.length;
     mLen += pAssocInd->rsnIE.length;
@@ -1343,7 +1356,7 @@
         pBuf++;
         mLen++;
 
-      palCopyMemory( pMac->hHdd, pBuf,
+        vos_mem_copy( pBuf,
                      (tANI_U8 *) &(pAssocInd->supportedChannels.channelList),
                      pAssocInd->supportedChannels.numChnl);
 
@@ -1419,18 +1432,18 @@
     pBuf += sizeof(tSirResultCodes);
 
     // bssId
-    palCopyMemory( pMac->hHdd, pAssocCnf->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pAssocCnf->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
 
     // peerMacAddr
-    palCopyMemory( pMac->hHdd, pAssocCnf->peerMacAddr, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pAssocCnf->peerMacAddr, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
 
 
     pAssocCnf->aid = limGetU16(pBuf);
     pBuf += sizeof(tANI_U16);
     // alternateBssId
-    palCopyMemory( pMac->hHdd, pAssocCnf->alternateBssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pAssocCnf->alternateBssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
 
     // alternateChannelId
@@ -1489,10 +1502,10 @@
     pDisassocCnf->statusCode = (tSirResultCodes) limGetU32(pBuf);
     pBuf += sizeof(tSirResultCodes);
 
-    palCopyMemory( pMac->hHdd, pDisassocCnf->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pDisassocCnf->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
 
-    palCopyMemory( pMac->hHdd, pDisassocCnf->peerMacAddr, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pDisassocCnf->peerMacAddr, pBuf, sizeof(tSirMacAddr));
 
 
     return eSIR_SUCCESS;
@@ -1532,12 +1545,12 @@
     mLen += sizeof(tANI_U8);
 
     // Fill in peerMacAddr
-    palCopyMemory( pMac->hHdd, pBuf, pReassocInd->peerMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy( pBuf, pReassocInd->peerMacAddr, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     mLen += sizeof(tSirMacAddr);
 
     // Fill in oldMacAddr
-    palCopyMemory( pMac->hHdd, pBuf, pReassocInd->currentApAddr, sizeof(tSirMacAddr));
+    vos_mem_copy( pBuf, pReassocInd->currentApAddr, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     mLen += sizeof(tSirMacAddr);
 
@@ -1547,7 +1560,7 @@
     mLen += sizeof(tANI_U16);
  
     // Fill in bssId
-    palCopyMemory( pMac->hHdd, pBuf, psessionEntry->bssId, sizeof(tSirMacAddr));
+    vos_mem_copy( pBuf, psessionEntry->bssId, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     mLen += sizeof(tSirMacAddr);
 
@@ -1562,7 +1575,7 @@
     mLen += sizeof(tAniAuthType);
 
     // Fill in ssId
-    palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *) &(pReassocInd->ssId),
+    vos_mem_copy( pBuf, (tANI_U8 *) &(pReassocInd->ssId),
                   pReassocInd->ssId.length + 1);
     pBuf += 1 + pReassocInd->ssId.length;
     mLen += pReassocInd->ssId.length + 1;
@@ -1571,7 +1584,7 @@
     limCopyU16(pBuf, pReassocInd->rsnIE.length);
     pBuf += sizeof(tANI_U16);
     mLen += sizeof(tANI_U16);
-    palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *) &(pReassocInd->rsnIE.rsnIEdata),
+    vos_mem_copy( pBuf, (tANI_U8 *) &(pReassocInd->rsnIE.rsnIEdata),
                   pReassocInd->rsnIE.length);
     pBuf += pReassocInd->rsnIE.length;
     mLen += pReassocInd->rsnIE.length;
@@ -1580,7 +1593,7 @@
     limCopyU16(pBuf, pReassocInd->addIE.length);
     pBuf += sizeof(tANI_U16);
     mLen += sizeof(tANI_U16);
-    palCopyMemory( pMac->hHdd, pBuf, (tANI_U8*) &(pReassocInd->addIE.addIEdata),
+    vos_mem_copy( pBuf, (tANI_U8*) &(pReassocInd->addIE.addIEdata),
                    pReassocInd->addIE.length);
     pBuf += pReassocInd->addIE.length;
     mLen += pReassocInd->addIE.length;
@@ -1602,7 +1615,7 @@
         pBuf++;
         mLen++;
 
-        palCopyMemory( pMac->hHdd, pBuf,
+        vos_mem_copy( pBuf,
                        (tANI_U8 *) &(pReassocInd->supportedChannels.channelList),
                        pReassocInd->supportedChannels.numChnl);
 
@@ -1660,11 +1673,11 @@
     mLen += sizeof(tANI_U8);
 
     // BTAMP TODO:  Fill in bssId
-    palZeroMemory(pMac->hHdd, pBuf, sizeof(tSirMacAddr));
+    vos_mem_set(pBuf, sizeof(tSirMacAddr), 0);
     pBuf += sizeof(tSirMacAddr);
     mLen += sizeof(tSirMacAddr);
 
-    palCopyMemory( pMac->hHdd, pBuf, pAuthInd->peerMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy( pBuf, pAuthInd->peerMacAddr, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     mLen += sizeof(tSirMacAddr);
 
@@ -1748,13 +1761,13 @@
     len  -= sizeof(tANI_U16);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pSetContextReq->peerMacAddr,
+    vos_mem_copy( (tANI_U8 *) pSetContextReq->peerMacAddr,
                    pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
-    palCopyMemory( pMac->hHdd, pSetContextReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pSetContextReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -1869,7 +1882,7 @@
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pRemoveKeyReq->peerMacAddr,
+    vos_mem_copy( (tANI_U8 *) pRemoveKeyReq->peerMacAddr,
                   pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
@@ -1903,7 +1916,7 @@
         return eSIR_FAILURE;
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, pRemoveKeyReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pRemoveKeyReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -1994,14 +2007,14 @@
         return eSIR_FAILURE;
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pDisassocReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pDisassocReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
     // Extract peerMacAddr
-    palCopyMemory( pMac->hHdd, pDisassocReq->peerMacAddr, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pDisassocReq->peerMacAddr, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -2090,14 +2103,14 @@
         return eSIR_FAILURE;
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, pDeauthReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pDeauthReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
     // Extract peerMacAddr
-    palCopyMemory( pMac->hHdd, pDeauthReq->peerMacAddr, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( pDeauthReq->peerMacAddr, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -2298,7 +2311,7 @@
         return eSIR_FAILURE;
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pGetAssocSTAsReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pGetAssocSTAsReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -2403,7 +2416,7 @@
         return eSIR_FAILURE;
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pTkipCntrMeasReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pTkipCntrMeasReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -2479,12 +2492,12 @@
         return eSIR_FAILURE;
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pGetWPSPBCSessionsReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pGetWPSPBCSessionsReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
  
     // Extract MAC address of Station to be removed
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pGetWPSPBCSessionsReq->pRemoveMac, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pGetWPSPBCSessionsReq->pRemoveMac, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     
@@ -2591,7 +2604,7 @@
         return eSIR_FAILURE;
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pUpdateAPWPSIEsReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pUpdateAPWPSIEsReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -2604,7 +2617,7 @@
         return eSIR_FAILURE;
 
     // Extract APWPSIEs
-    palCopyMemory( pMac->hHdd, (tSirAPWPSIEs *) &pUpdateAPWPSIEsReq->APWPSIEs, pBuf, sizeof(tSirAPWPSIEs));
+    vos_mem_copy( (tSirAPWPSIEs *) &pUpdateAPWPSIEsReq->APWPSIEs, pBuf, sizeof(tSirAPWPSIEs));
     pBuf += sizeof(tSirAPWPSIEs);
     len  -= sizeof(tSirAPWPSIEs);
 
@@ -2675,7 +2688,7 @@
         return eSIR_FAILURE;
 
     // Extract bssId
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) pUpdateAPWPARSNIEsReq->bssId, pBuf, sizeof(tSirMacAddr));
+    vos_mem_copy( (tANI_U8 *) pUpdateAPWPARSNIEsReq->bssId, pBuf, sizeof(tSirMacAddr));
     pBuf += sizeof(tSirMacAddr);
     len  -= sizeof(tSirMacAddr);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -2688,7 +2701,7 @@
         return eSIR_FAILURE;
 
     // Extract APWPARSNIEs
-    palCopyMemory( pMac->hHdd, (tSirRSNie *) &pUpdateAPWPARSNIEsReq->APWPARSNIEs, pBuf, sizeof(tSirRSNie));
+    vos_mem_copy( (tSirRSNie *) &pUpdateAPWPARSNIEsReq->APWPARSNIEs, pBuf, sizeof(tSirRSNie));
     pBuf += sizeof(tSirRSNie);
     len  -= sizeof(tSirRSNie);
 
diff --git a/CORE/MAC/src/pe/lim/limSession.c b/CORE/MAC/src/pe/lim/limSession.c
index e20a9dd..098d66a 100644
--- a/CORE/MAC/src/pe/lim/limSession.c
+++ b/CORE/MAC/src/pe/lim/limSession.c
@@ -25,8 +25,6 @@
  * to the Linux Foundation.
  */
 
-/*
- * */
 /**=========================================================================
   
   \file  limSession.c
@@ -49,7 +47,7 @@
 #include "limDebug.h"
 #include "limSession.h"
 #include "limUtils.h"
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include "ccxApi.h"
 #endif
 
@@ -80,13 +78,13 @@
     psessionEntry->beaconParams.gHTObssMode = 0;
 
     // Number of legacy STAs associated 
-    palZeroMemory(pMac->hHdd, (void*)&psessionEntry->gLim11bParams, sizeof(tLimProtStaParams)); 
-    palZeroMemory(pMac->hHdd, (void*)&psessionEntry->gLim11aParams, sizeof(tLimProtStaParams)); 
-    palZeroMemory(pMac->hHdd, (void*)&psessionEntry->gLim11gParams, sizeof(tLimProtStaParams)); 
-    palZeroMemory(pMac->hHdd, (void*)&psessionEntry->gLimNonGfParams, sizeof(tLimProtStaParams)); 
-    palZeroMemory(pMac->hHdd, (void*)&psessionEntry->gLimHt20Params, sizeof(tLimProtStaParams)); 
-    palZeroMemory(pMac->hHdd, (void*)&psessionEntry->gLimLsigTxopParams, sizeof(tLimProtStaParams)); 
-    palZeroMemory(pMac->hHdd, (void*)&psessionEntry->gLimOlbcParams, sizeof(tLimProtStaParams));
+    vos_mem_set((void*)&psessionEntry->gLim11bParams, sizeof(tLimProtStaParams), 0);
+    vos_mem_set((void*)&psessionEntry->gLim11aParams, sizeof(tLimProtStaParams), 0);
+    vos_mem_set((void*)&psessionEntry->gLim11gParams, sizeof(tLimProtStaParams), 0);
+    vos_mem_set((void*)&psessionEntry->gLimNonGfParams, sizeof(tLimProtStaParams), 0);
+    vos_mem_set((void*)&psessionEntry->gLimHt20Params, sizeof(tLimProtStaParams), 0);
+    vos_mem_set((void*)&psessionEntry->gLimLsigTxopParams, sizeof(tLimProtStaParams), 0);
+    vos_mem_set((void*)&psessionEntry->gLimOlbcParams, sizeof(tLimProtStaParams), 0);
 }
 
 /*--------------------------------------------------------------------------
@@ -105,7 +103,7 @@
   \sa
   
   --------------------------------------------------------------------------*/
-tpPESession peCreateSession(tpAniSirGlobal pMac, tANI_U8 *bssid , tANI_U8* sessionId, tANI_U16 numSta)
+tpPESession peCreateSession(tpAniSirGlobal pMac, tANI_U8 *bssid, tANI_U8* sessionId, tANI_U16 numSta)
 {
     tANI_U8 i;
     for(i =0; i < pMac->lim.maxBssId; i++)
@@ -113,21 +111,23 @@
         /* Find first free room in session table */
         if(pMac->lim.gpSession[i].valid == FALSE)
         {
-            palZeroMemory(pMac, (void*)&pMac->lim.gpSession[i], sizeof(tPESession));
+            vos_mem_set((void*)&pMac->lim.gpSession[i], sizeof(tPESession), 0);
 
             //Allocate space for Station Table for this session.
-            if (eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,
-                     (void **) &pMac->lim.gpSession[i].dph.dphHashTable.pHashTable, sizeof(tpDphHashNode)*numSta))
+            pMac->lim.gpSession[i].dph.dphHashTable.pHashTable = vos_mem_malloc(
+                                                  sizeof(tpDphHashNode)*numSta);
+            if ( NULL == pMac->lim.gpSession[i].dph.dphHashTable.pHashTable )
             {
                 limLog(pMac, LOGE, FL("memory allocate failed!"));
                 return NULL;
             }
 
-            if (eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,
-                  (void **) &pMac->lim.gpSession[i].dph.dphHashTable.pDphNodeArray, sizeof(tDphHashNode)*numSta))
+            pMac->lim.gpSession[i].dph.dphHashTable.pDphNodeArray = vos_mem_malloc(
+                                                       sizeof(tDphHashNode)*numSta);
+            if ( NULL == pMac->lim.gpSession[i].dph.dphHashTable.pDphNodeArray )
             {
                 limLog(pMac, LOGE, FL("memory allocate failed!"));
-                palFreeMemory(pMac->hHdd,pMac->lim.gpSession[i].dph.dphHashTable.pHashTable);
+                vos_mem_free(pMac->lim.gpSession[i].dph.dphHashTable.pHashTable);
                 return NULL;
             }
             pMac->lim.gpSession[i].dph.dphHashTable.size = numSta;
@@ -135,17 +135,17 @@
             dphHashTableClassInit(pMac, 
                            &pMac->lim.gpSession[i].dph.dphHashTable);
 
-            if (eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd,
-                    (void **) &pMac->lim.gpSession[i].gpLimPeerIdxpool, 
-                    sizeof(*pMac->lim.gpSession[i].gpLimPeerIdxpool) * (numSta+1)))
+            pMac->lim.gpSession[i].gpLimPeerIdxpool = vos_mem_malloc(sizeof(
+                                *pMac->lim.gpSession[i].gpLimPeerIdxpool) * (numSta+1));
+            if ( NULL == pMac->lim.gpSession[i].gpLimPeerIdxpool )
             {
                 PELOGE(limLog(pMac, LOGE, FL("memory allocate failed!"));)
-                palFreeMemory(pMac->hHdd,pMac->lim.gpSession[i].dph.dphHashTable.pHashTable);
-                palFreeMemory(pMac->hHdd,pMac->lim.gpSession[i].dph.dphHashTable.pDphNodeArray);
+                vos_mem_free(pMac->lim.gpSession[i].dph.dphHashTable.pHashTable);
+                vos_mem_free(pMac->lim.gpSession[i].dph.dphHashTable.pDphNodeArray);
                 return NULL;
             }
-            palZeroMemory(pMac->hHdd, pMac->lim.gpSession[i].gpLimPeerIdxpool,
-                  sizeof(*pMac->lim.gpSession[i].gpLimPeerIdxpool) * (numSta+1));
+            vos_mem_set(pMac->lim.gpSession[i].gpLimPeerIdxpool,
+                  sizeof(*pMac->lim.gpSession[i].gpLimPeerIdxpool) * (numSta+1), 0);
             pMac->lim.gpSession[i].freePeerIdxHead = 0;
             pMac->lim.gpSession[i].freePeerIdxTail = 0;
             pMac->lim.gpSession[i].gLimNumOfCurrentSTAs = 0;
@@ -181,8 +181,8 @@
             pMac->lim.gpSession[i].htRecommendedTxWidthSet = 0;
             pMac->lim.gpSession[i].htSecondaryChannelOffset = 0;
 #ifdef FEATURE_WLAN_TDLS
-            palZeroMemory(pMac->hHdd, pMac->lim.gpSession[i].peerAIDBitmap,
-                  sizeof(pMac->lim.gpSession[i].peerAIDBitmap));
+            vos_mem_set(pMac->lim.gpSession[i].peerAIDBitmap,
+                  sizeof(pMac->lim.gpSession[i].peerAIDBitmap), 0);
 #endif
             pMac->lim.gpSession[i].fWaitForProbeRsp = 0;
             pMac->lim.gpSession[i].fIgnoreCapsChange = 0;
@@ -278,7 +278,7 @@
   
   \sa
   --------------------------------------------------------------------------*/
- tpPESession peFindSessionBySessionId(tpAniSirGlobal pMac , tANI_U8 sessionId)
+ tpPESession peFindSessionBySessionId(tpAniSirGlobal pMac, tANI_U8 sessionId)
 {
     if(sessionId >=  pMac->lim.maxBssId)
     {
@@ -366,68 +366,68 @@
         }
     }
     
-    if(psessionEntry->pLimStartBssReq != NULL)
+    if (psessionEntry->pLimStartBssReq != NULL)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->pLimStartBssReq );
+        vos_mem_free( psessionEntry->pLimStartBssReq );
         psessionEntry->pLimStartBssReq = NULL;
     }
 
-    if(psessionEntry->pLimJoinReq != NULL)
+    if (psessionEntry->pLimJoinReq != NULL)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->pLimJoinReq );
+        vos_mem_free( psessionEntry->pLimJoinReq );
         psessionEntry->pLimJoinReq = NULL;
     }
 
-    if(psessionEntry->pLimReAssocReq != NULL)
+    if (psessionEntry->pLimReAssocReq != NULL)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->pLimReAssocReq );
+        vos_mem_free( psessionEntry->pLimReAssocReq );
         psessionEntry->pLimReAssocReq = NULL;
     }
 
-    if(psessionEntry->pLimMlmJoinReq != NULL)
+    if (psessionEntry->pLimMlmJoinReq != NULL)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->pLimMlmJoinReq );
+        vos_mem_free( psessionEntry->pLimMlmJoinReq );
         psessionEntry->pLimMlmJoinReq = NULL;
     }
 
-    if(psessionEntry->dph.dphHashTable.pHashTable != NULL)
+    if (psessionEntry->dph.dphHashTable.pHashTable != NULL)
     {
-        palFreeMemory(pMac->hHdd, psessionEntry->dph.dphHashTable.pHashTable);
+        vos_mem_free(psessionEntry->dph.dphHashTable.pHashTable);
         psessionEntry->dph.dphHashTable.pHashTable = NULL;
     }
 
-    if(psessionEntry->dph.dphHashTable.pDphNodeArray != NULL)
+    if (psessionEntry->dph.dphHashTable.pDphNodeArray != NULL)
     {
-        palFreeMemory(pMac->hHdd, psessionEntry->dph.dphHashTable.pDphNodeArray);
+        vos_mem_free(psessionEntry->dph.dphHashTable.pDphNodeArray);
         psessionEntry->dph.dphHashTable.pDphNodeArray = NULL;
     }
 
-    if(psessionEntry->gpLimPeerIdxpool != NULL)
+    if (psessionEntry->gpLimPeerIdxpool != NULL)
     {
-        palFreeMemory(pMac->hHdd, psessionEntry->gpLimPeerIdxpool);
+        vos_mem_free(psessionEntry->gpLimPeerIdxpool);
         psessionEntry->gpLimPeerIdxpool = NULL;
     }
 
-    if(psessionEntry->beacon != NULL)
+    if (psessionEntry->beacon != NULL)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->beacon);
+        vos_mem_free( psessionEntry->beacon);
         psessionEntry->beacon = NULL;
     }
 
-    if(psessionEntry->assocReq != NULL)
+    if (psessionEntry->assocReq != NULL)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->assocReq);
+        vos_mem_free( psessionEntry->assocReq);
         psessionEntry->assocReq = NULL;
     }
 
-    if(psessionEntry->assocRsp != NULL)
+    if (psessionEntry->assocRsp != NULL)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->assocRsp);
+        vos_mem_free( psessionEntry->assocRsp);
         psessionEntry->assocRsp = NULL;
     }
 
 
-    if(psessionEntry->parsedAssocReq != NULL)
+    if (psessionEntry->parsedAssocReq != NULL)
     {
         // Cleanup the individual allocation first
         for (i=0; i < psessionEntry->dph.dphHashTable.size; i++)
@@ -436,40 +436,40 @@
             {
                 if( ((tpSirAssocReq)(psessionEntry->parsedAssocReq[i]))->assocReqFrame )
                 {
-                   palFreeMemory(pMac->hHdd, 
-                      ((tpSirAssocReq)(psessionEntry->parsedAssocReq[i]))->assocReqFrame);
+                   vos_mem_free(((tpSirAssocReq)
+                                (psessionEntry->parsedAssocReq[i]))->assocReqFrame);
                    ((tpSirAssocReq)(psessionEntry->parsedAssocReq[i]))->assocReqFrame = NULL;
                    ((tpSirAssocReq)(psessionEntry->parsedAssocReq[i]))->assocReqFrameLength = 0;
                 }
-                palFreeMemory(pMac->hHdd, (void *)psessionEntry->parsedAssocReq[i]);
+                vos_mem_free(psessionEntry->parsedAssocReq[i]);
                 psessionEntry->parsedAssocReq[i] = NULL;
             }
         }
         // Cleanup the whole block
-        palFreeMemory(pMac->hHdd, (void *)psessionEntry->parsedAssocReq);
+        vos_mem_free(psessionEntry->parsedAssocReq);
         psessionEntry->parsedAssocReq = NULL;
     }
     if (NULL != psessionEntry->limAssocResponseData)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->limAssocResponseData);
+        vos_mem_free( psessionEntry->limAssocResponseData);
         psessionEntry->limAssocResponseData = NULL;
     }
 
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
     if (NULL != psessionEntry->pLimMlmReassocRetryReq)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->pLimMlmReassocRetryReq);
+        vos_mem_free( psessionEntry->pLimMlmReassocRetryReq);
         psessionEntry->pLimMlmReassocRetryReq = NULL;
     }
 #endif
 
     if (NULL != psessionEntry->pLimMlmReassocReq)
     {
-        palFreeMemory( pMac->hHdd, psessionEntry->pLimMlmReassocReq);
+        vos_mem_free( psessionEntry->pLimMlmReassocReq);
         psessionEntry->pLimMlmReassocReq = NULL;
     }
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
     limCleanupCcxCtxt(pMac, psessionEntry); 
 #endif
 
diff --git a/CORE/MAC/src/pe/lim/limSmeReqUtils.c b/CORE/MAC/src/pe/lim/limSmeReqUtils.c
index 87d9d7e..bc87e57 100644
--- a/CORE/MAC/src/pe/lim/limSmeReqUtils.c
+++ b/CORE/MAC/src/pe/lim/limSmeReqUtils.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limSmeReqUtils.cc contains the utility functions
  * for processing SME request messages.
@@ -711,7 +710,7 @@
        Reject Join Req if the Self Mac Address and 
        the Ap's Mac Address is same
     */
-    if( palEqualMemory( pMac->hHdd, (tANI_U8* ) pJoinReq->selfMacAddr, 
+    if ( vos_mem_compare( (tANI_U8* ) pJoinReq->selfMacAddr,
                        (tANI_U8 *) pJoinReq->bssDescription.bssId, 
                        (tANI_U8) (sizeof(tSirMacAddr))))
     {
diff --git a/CORE/MAC/src/pe/lim/limTimerUtils.c b/CORE/MAC/src/pe/lim/limTimerUtils.c
index b0f5104..f686901 100644
--- a/CORE/MAC/src/pe/lim/limTimerUtils.c
+++ b/CORE/MAC/src/pe/lim/limTimerUtils.c
@@ -58,6 +58,11 @@
 
 //default beacon interval value used in HB timer interval calculation
 #define LIM_HB_TIMER_BEACON_INTERVAL             100
+
+/* This timer is a periodic timer which expires at every 1 sec to
+   convert  ACTIVE DFS channel to DFS channels */
+#define ACTIVE_TO_PASSIVE_CONVERISON_TIMEOUT     1000
+
 /**
  * limCreateTimers()
  *
@@ -593,10 +598,10 @@
                FL("could not retrieve mac preauth value"));
     }
     pMac->lim.gLimPreAuthTimerTable.numEntry = cfgValue;
-    if (palAllocateMemory(pMac->hHdd, (void **) &pMac->lim.gLimPreAuthTimerTable.pTable,
-          cfgValue*sizeof(tLimPreAuthNode)) != eHAL_STATUS_SUCCESS)
+    pMac->lim.gLimPreAuthTimerTable.pTable = vos_mem_malloc(cfgValue*sizeof(tLimPreAuthNode));
+    if(pMac->lim.gLimPreAuthTimerTable.pTable == NULL)
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory failed!"));
+        limLog(pMac, LOGP, FL("AllocateMemory failed!"));
         goto err_timer;
     }
 
@@ -657,7 +662,7 @@
     }
 #endif
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
     cfgValue = 5000;
     cfgValue = SYS_MS_TO_TICKS(cfgValue);
 
@@ -672,7 +677,7 @@
         limLog(pMac, LOGP, FL("could not create Join failure timer"));
         goto err_timer;
     }
-#endif
+#endif /* FEATURE_WLAN_CCX && !FEATURE_WLAN_CCX_UPLOAD */
 
     cfgValue = 1000;
     cfgValue = SYS_MS_TO_TICKS(cfgValue);
@@ -725,15 +730,27 @@
         goto err_timer;
     }
 
+    cfgValue = ACTIVE_TO_PASSIVE_CONVERISON_TIMEOUT;
+    cfgValue = SYS_MS_TO_TICKS(cfgValue);
+    if (tx_timer_create(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer,
+                                  "ACTIVE TO PASSIVE CHANNEL", limTimerHandler,
+                 SIR_LIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE, cfgValue, 0,
+                 TX_NO_ACTIVATE) != TX_SUCCESS)
+    {
+        limLog(pMac, LOGW,FL("could not create timer for passive channel to active channel"));
+        goto err_timer;
+    }
+
+
     return TX_SUCCESS;
 
     err_timer:
         tx_timer_delete(&pMac->lim.limTimers.gLimDeauthAckTimer);
         tx_timer_delete(&pMac->lim.limTimers.gLimDisassocAckTimer);
         tx_timer_delete(&pMac->lim.limTimers.gLimRemainOnChannelTimer);
-    #ifdef FEATURE_WLAN_CCX
+    #if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
         tx_timer_delete(&pMac->lim.limTimers.gLimCcxTsmTimer);
-    #endif
+    #endif /* FEATURE_WLAN_CCX && !FEATURE_WLAN_CCX_UPLOAD */
         tx_timer_delete(&pMac->lim.limTimers.gLimFTPreAuthRspTimer);
         tx_timer_delete(&pMac->lim.limTimers.gLimUpdateOlbcCacheTimer);
         while(((tANI_S32)--i) >= 0)
@@ -758,9 +775,10 @@
         tx_timer_delete(&pMac->lim.limTimers.gLimPeriodicProbeReqTimer);
         tx_timer_delete(&pMac->lim.limTimers.gLimMinChannelTimer);
         tx_timer_delete(&pMac->lim.limTimers.gLimP2pSingleShotNoaInsertTimer);
+        tx_timer_delete(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer);
 
         if(NULL != pMac->lim.gLimPreAuthTimerTable.pTable)
-            palFreeMemory(pMac->hHdd, pMac->lim.gLimPreAuthTimerTable.pTable);
+            vos_mem_free(pMac->lim.gLimPreAuthTimerTable.pTable);
 
         return TX_TIMER_ERROR;
 
@@ -934,7 +952,7 @@
             limLog(pMac, LOGW, FL("Reassoc request retry MAX(%d) reached"), LIM_MAX_REASSOC_RETRY_LIMIT);
             if(NULL != pMac->lim.pSessionEntry->pLimMlmReassocRetryReq)
             {
-                palFreeMemory( pMac->hHdd, pMac->lim.pSessionEntry->pLimMlmReassocRetryReq);
+                vos_mem_free( pMac->lim.pSessionEntry->pLimMlmReassocRetryReq);
                 pMac->lim.pSessionEntry->pLimMlmReassocRetryReq = NULL;
             }
         }
@@ -1389,7 +1407,7 @@
             }
             else
             {
-                limLog(pMac, LOGW, FL("HeartBeat timer value is changed = %lu"), val);
+                limLog(pMac, LOGW, FL("HeartBeat timer value is changed = %u"), val);
             }
             break;
 
@@ -1431,7 +1449,7 @@
             }
             else
             {
-                limLog(pMac, LOGW, FL("Probe after HB timer value is changed = %lu"), val);
+                limLog(pMac, LOGW, FL("Probe after HB timer value is changed = %u"), val);
             }
 
             break;
@@ -1640,7 +1658,7 @@
             }
             break;
 #endif
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
          case eLIM_TSM_TIMER:
              if (tx_timer_deactivate(&pMac->lim.limTimers.gLimCcxTsmTimer)
                                                                 != TX_SUCCESS)
@@ -1648,7 +1666,7 @@
                  limLog(pMac, LOGE, FL("Unable to deactivate TSM timer"));
              }
              break;
-#endif
+#endif /* FEATURE_WLAN_CCX && !FEATURE_WLAN_CCX_UPLOAD */
         case eLIM_REMAIN_CHN_TIMER:
             if (tx_timer_deactivate(&pMac->lim.limTimers.gLimRemainOnChannelTimer) != TX_SUCCESS)
             {
@@ -1672,6 +1690,32 @@
                 return;
             }
             break;
+
+    case eLIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE:
+            if (tx_timer_deactivate(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer) != TX_SUCCESS)
+            {
+                /**
+                ** Could not deactivate Active to passive channel timer.
+                ** Log error.
+                **/
+                limLog(pMac, LOGP, FL("Unable to Deactivate "
+                                      "Active to passive channel timer"));
+                return;
+            }
+            val = ACTIVE_TO_PASSIVE_CONVERISON_TIMEOUT;
+            val = SYS_MS_TO_TICKS(val);
+            if (tx_timer_change(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer,
+                                                val, 0) != TX_SUCCESS)
+            {
+                /**
+                * Could not change timer to check scan type for passive channel.
+                * timer. Log error.
+                */
+                limLog(pMac, LOGP, FL("Unable to change timer"));
+                return;
+            }
+            break;
+
     case eLIM_DISASSOC_ACK_TIMER:
             if (tx_timer_deactivate(&pMac->lim.limTimers.gLimDisassocAckTimer) != TX_SUCCESS)
             {
@@ -1764,37 +1808,48 @@
 void
 limHeartBeatDeactivateAndChangeTimer(tpAniSirGlobal pMac, tpPESession psessionEntry)
 {
-    tANI_U32    val, val1;
+   tANI_U32    val, val1;
 
-    MTRACE(macTrace(pMac, TRACE_CODE_TIMER_DEACTIVATE, psessionEntry->peSessionId, eLIM_HEART_BEAT_TIMER));
+   MTRACE(macTrace(pMac, TRACE_CODE_TIMER_DEACTIVATE, psessionEntry->peSessionId, eLIM_HEART_BEAT_TIMER));
 #ifdef WLAN_ACTIVEMODE_OFFLOAD_FEATURE
-    if(IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE)
-       return;
+   if(IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE)
+      return;
 #endif
 
-    if (tx_timer_deactivate(&pMac->lim.limTimers.gLimHeartBeatTimer) != TX_SUCCESS)
-        limLog(pMac, LOGP, FL("Fail to deactivate HeartBeatTimer "));
+   if (tx_timer_deactivate(&pMac->lim.limTimers.gLimHeartBeatTimer) != TX_SUCCESS)
+      limLog(pMac, LOGP, FL("Fail to deactivate HeartBeatTimer "));
 
-    /* HB Timer sessionisation: In case of 2 or more sessions, the HB interval keeps
-       changing. to avoid this problem, HeartBeat interval is made constant, by
-       fixing beacon interval to 100ms immaterial of the beacon interval of the session */
+   /* HB Timer sessionisation: In case of 2 or more sessions, the HB interval keeps
+      changing. to avoid this problem, HeartBeat interval is made constant, by
+      fixing beacon interval to 100ms immaterial of the beacon interval of the session */
 
-    //val = psessionEntry->beaconParams.beaconInterval;
-    val = LIM_HB_TIMER_BEACON_INTERVAL;
+   //val = psessionEntry->beaconParams.beaconInterval;
+   val = LIM_HB_TIMER_BEACON_INTERVAL;
 
-    if (wlan_cfgGetInt(pMac, WNI_CFG_HEART_BEAT_THRESHOLD, &val1) != eSIR_SUCCESS)
-        limLog(pMac, LOGP, FL("Fail to get WNI_CFG_HEART_BEAT_THRESHOLD "));
+   if (wlan_cfgGetInt(pMac, WNI_CFG_HEART_BEAT_THRESHOLD, &val1) != eSIR_SUCCESS)
+      limLog(pMac, LOGP, FL("Fail to get WNI_CFG_HEART_BEAT_THRESHOLD "));
 
-    PELOGW(limLog(pMac,LOGW,
-                 FL("HB Timer Int.=100ms * %d, Beacon Int.=%dms,Session Id=%d "),
-                 val1, psessionEntry->beaconParams.beaconInterval,
-                 psessionEntry->peSessionId);)
+   PELOGW(limLog(pMac,LOGW,
+            FL("HB Timer Int.=100ms * %d, Beacon Int.=%dms,Session Id=%d "),
+            val1, psessionEntry->beaconParams.beaconInterval,
+            psessionEntry->peSessionId);)
 
-    // Change timer to reactivate it in future
-    val = SYS_MS_TO_TICKS(val * val1);
+   /* The HB timer timeout value of 4 seconds (40 beacon intervals) is not
+    * enough to judge the peer device inactivity when 32 peers are connected.
+    * Hence increasing the HB timer timeout to
+    * HBtimeout = (TBTT * num_beacons * num_peers)
+    */
+   if (eSIR_IBSS_MODE == psessionEntry->bssType &&
+         pMac->lim.gLimNumIbssPeers > 0)
+   {
+      val1 = val1 * pMac->lim.gLimNumIbssPeers;
+   }
 
-    if (tx_timer_change(&pMac->lim.limTimers.gLimHeartBeatTimer, val, 0) != TX_SUCCESS)
-        limLog(pMac, LOGP, FL("Fail to change HeartBeatTimer"));
+   // Change timer to reactivate it in future
+   val = SYS_MS_TO_TICKS(val * val1);
+
+   if (tx_timer_change(&pMac->lim.limTimers.gLimHeartBeatTimer, val, 0) != TX_SUCCESS)
+      limLog(pMac, LOGP, FL("Fail to change HeartBeatTimer"));
 
 } /****** end limHeartBeatDeactivateAndChangeTimer() ******/
 
@@ -1825,13 +1880,38 @@
     MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE, psessionEntry->peSessionId, eLIM_HEART_BEAT_TIMER));
 
     //only start the hearbeat-timer if the timeout value is non-zero
-    if(pMac->lim.limTimers.gLimHeartBeatTimer.initScheduleTimeInMsecs > 0) {
-        if (tx_timer_activate(&pMac->lim.limTimers.gLimHeartBeatTimer)!= TX_SUCCESS)
-        {
-            limLog(pMac, LOGP,FL("could not activate Heartbeat timer"));
-        }
-        limLog(pMac, LOGW, FL("Reactivated heartbeat link monitoring"));
-        limResetHBPktCount(psessionEntry);
+    if(pMac->lim.limTimers.gLimHeartBeatTimer.initScheduleTimeInMsecs > 0)
+    {
+       /*
+        * There is increasing need to limit the apps wakeup due to WLAN
+        * activity. During HB monitoring, the beacons from peer are sent to
+        * the host causing the host to wakeup. Hence, offloading the HB
+        * monitoring to LMAC
+        */
+       if (psessionEntry->limSystemRole == eLIM_STA_IN_IBSS_ROLE &&
+             IS_IBSS_HEARTBEAT_OFFLOAD_FEATURE_ENABLE)
+       {
+          if (tx_timer_deactivate(&pMac->lim.limTimers.gLimHeartBeatTimer)!= TX_SUCCESS)
+          {
+             limLog(pMac, LOGP,FL("IBSS HeartBeat Offloaded, Could not deactivate Heartbeat timer"));
+          }
+          else
+          {
+             limLog(pMac, LOGE, FL("IBSS HeartBeat Offloaded, Deactivated heartbeat link monitoring"));
+          }
+       }
+       else
+       {
+          if (tx_timer_activate(&pMac->lim.limTimers.gLimHeartBeatTimer)!= TX_SUCCESS)
+          {
+             limLog(pMac, LOGP,FL("could not activate Heartbeat timer"));
+          }
+          else
+          {
+             limLog(pMac, LOGW, FL("Reactivated heartbeat link monitoring"));
+          }
+       }
+       limResetHBPktCount(psessionEntry);
     }
 
 } /****** end limReactivateHeartBeatTimer() ******/
@@ -1851,17 +1931,18 @@
  * @note   staId for eLIM_AUTH_RSP_TIMER is auth Node Index.
  *
  * @param  pMac    - Pointer to Global MAC structure
+ * @param  psessionEntry - Session Entry
  *
  * @return TX_SUCCESS - timer is activated
  *         errors - fail to start the timer
  */
-v_UINT_t limActivateHearBeatTimer(tpAniSirGlobal pMac)
+v_UINT_t limActivateHearBeatTimer(tpAniSirGlobal pMac, tpPESession psessionEntry)
 {
     v_UINT_t status = TX_TIMER_ERROR;
 
 #ifdef WLAN_ACTIVEMODE_OFFLOAD_FEATURE
     if(IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE)
-       return (status);
+       return (TX_SUCCESS);
 #endif
 
     if(TX_AIRGO_TMR_SIGNATURE == pMac->lim.limTimers.gLimHeartBeatTimer.tmrSignature)
@@ -1869,12 +1950,39 @@
         //consider 0 interval a ok case
         if( pMac->lim.limTimers.gLimHeartBeatTimer.initScheduleTimeInMsecs )
         {
-            status = tx_timer_activate(&pMac->lim.limTimers.gLimHeartBeatTimer);
-            if( TX_SUCCESS != status )
-            {
-                PELOGE(limLog(pMac, LOGE,
-                   FL("could not activate Heartbeat timer status(%d)"), status);)
-            }
+           if (psessionEntry->limSystemRole == eLIM_STA_IN_IBSS_ROLE &&
+               IS_IBSS_HEARTBEAT_OFFLOAD_FEATURE_ENABLE)
+           {
+              /* HB offload in IBSS mode */
+              status = tx_timer_deactivate(&pMac->lim.limTimers.gLimHeartBeatTimer);
+              if (TX_SUCCESS != status)
+              {
+                 PELOGE(limLog(pMac, LOGE,
+                 FL("IBSS HB Offload, Could not deactivate HB timer status(%d)"),
+                 status);)
+              }
+              else
+              {
+                 PELOGE(limLog(pMac, LOGE,
+                 FL("%s] IBSS HB Offloaded, Heartbeat timer deactivated"),
+                 __func__);)
+              }
+
+           }
+           else
+           {
+              status = tx_timer_activate(&pMac->lim.limTimers.gLimHeartBeatTimer);
+              if ( TX_SUCCESS != status )
+              {
+                 PELOGE(limLog(pMac, LOGE,
+                 FL("could not activate Heartbeat timer status(%d)"), status);)
+              }
+              else
+              {
+                 PELOGE(limLog(pMac, LOGW,
+                 FL("%s] Activated Heartbeat timer status(%d)"), __func__, status);)
+              }
+           }
         }
         else
         {
diff --git a/CORE/MAC/src/pe/lim/limTimerUtils.h b/CORE/MAC/src/pe/lim/limTimerUtils.h
index 4e20afe..d37a771 100644
--- a/CORE/MAC/src/pe/lim/limTimerUtils.h
+++ b/CORE/MAC/src/pe/lim/limTimerUtils.h
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file limTimerUtils.h contains the utility definitions
  * LIM uses for timer handling.
@@ -83,6 +82,7 @@
     eLIM_DEAUTH_ACK_TIMER,
     eLIM_PERIODIC_JOIN_PROBE_REQ_TIMER,
     eLIM_INSERT_SINGLESHOT_NOA_TIMER,
+    eLIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE
 };
 
 #define LIM_DISASSOC_DEAUTH_ACK_TIMEOUT         500
@@ -127,11 +127,12 @@
  * @note   staId for eLIM_AUTH_RSP_TIMER is auth Node Index.
  *
  * @param  pMac    - Pointer to Global MAC structure
+ * @param  psessionEntry - Pointer to PE session entry
  *
  * @return TX_SUCCESS - timer is activated
  *         errors - fail to start the timer
  */
-v_UINT_t limActivateHearBeatTimer(tpAniSirGlobal pMac);
+v_UINT_t limActivateHearBeatTimer(tpAniSirGlobal pMac, tpPESession psessionEntry);
 
 #if 0
 void limWPSOverlapTimerHandler(void *pMacGlobal, tANI_U32 param);
diff --git a/CORE/MAC/src/pe/lim/limTrace.c b/CORE/MAC/src/pe/lim/limTrace.c
index 563cf38..522b3c8 100644
--- a/CORE/MAC/src/pe/lim/limTrace.c
+++ b/CORE/MAC/src/pe/lim/limTrace.c
@@ -92,6 +92,7 @@
         CASE_RETURN_STRING(eLIM_DEAUTH_ACK_TIMER);
         CASE_RETURN_STRING(eLIM_PERIODIC_JOIN_PROBE_REQ_TIMER);
         CASE_RETURN_STRING(eLIM_INSERT_SINGLESHOT_NOA_TIMER);
+        CASE_RETURN_STRING(eLIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE);
         default:
             return( "UNKNOWN" );
             break;
diff --git a/CORE/MAC/src/pe/lim/limTypes.h b/CORE/MAC/src/pe/lim/limTypes.h
index 8d43214..c86a536 100644
--- a/CORE/MAC/src/pe/lim/limTypes.h
+++ b/CORE/MAC/src/pe/lim/limTypes.h
@@ -122,13 +122,13 @@
 #define LIM_MIN_MEM_ASSOC       4
 
 /// Verifies whether given mac addr matches the CURRENT Bssid
-#define IS_CURRENT_BSSID(pMac, addr,psessionEntry)  (palEqualMemory(pMac->hHdd, addr, \
-                                                                                                psessionEntry->bssId, \
-                                                                                                sizeof(psessionEntry->bssId)))
+#define IS_CURRENT_BSSID(pMac, addr,psessionEntry)  (vos_mem_compare( addr, \
+                                                                      psessionEntry->bssId, \
+                                                                      sizeof(psessionEntry->bssId)))
 /// Verifies whether given addr matches the REASSOC Bssid
-#define IS_REASSOC_BSSID(pMac, addr,psessionEntry)  (palEqualMemory(pMac->hHdd, addr, \
-                                                                                                psessionEntry->limReAssocbssId, \
-                                                                                                sizeof(psessionEntry->limReAssocbssId)))
+#define IS_REASSOC_BSSID(pMac, addr,psessionEntry)  (vos_mem_compare( addr, \
+                                                                      psessionEntry->limReAssocbssId, \
+                                                                      sizeof(psessionEntry->limReAssocbssId)))
 
 #define REQ_TYPE_REGISTRAR                   (0x2)
 #define REQ_TYPE_WLAN_MANAGER_REGISTRAR      (0x3)
@@ -705,7 +705,7 @@
 tSirRetStatus limSendRadioMeasureReportActionFrame(tpAniSirGlobal, tANI_U8, tANI_U8, tpSirMacRadioMeasureReport, tSirMacAddr, tpPESession);
 #endif
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 void limProcessIappFrame(tpAniSirGlobal, tANI_U8 *,tpPESession);
 #endif
 
@@ -727,6 +727,8 @@
                                                            tANI_U32 *pMsgBuf);
 tSirRetStatus limProcessSmeTdlsAddStaReq(tpAniSirGlobal pMac, 
                                                            tANI_U32 *pMsgBuf);
+tSirRetStatus limProcesSmeTdlsLinkEstablishReq(tpAniSirGlobal pMac,
+                                                           tANI_U32 *pMsgBuf);
 tSirRetStatus limProcessSmeTdlsDelStaReq(tpAniSirGlobal pMac, 
                                                            tANI_U32 *pMsgBuf);
 void limSendSmeTDLSDeleteAllPeerInd(tpAniSirGlobal pMac, tpPESession psessionEntry);
@@ -824,6 +826,8 @@
 void limSendHalFinishScanReq( tpAniSirGlobal, tLimLimHalScanState);
 
 void limContinuePostChannelScan(tpAniSirGlobal pMac);
+void limCovertChannelScanType(tpAniSirGlobal pMac,tANI_U8 channelNum, tANI_BOOLEAN passiveToActive);
+void limSetDFSChannelList(tpAniSirGlobal pMac,tANI_U8 channelNum, tSirDFSChannelList *dfsChannelList);
 void limContinueChannelLearn( tpAniSirGlobal );
 //WLAN_SUSPEND_LINK Related
 tANI_U8 limIsLinkSuspended(tpAniSirGlobal pMac);
@@ -859,6 +863,15 @@
 tSirRetStatus limSendSaQueryResponseFrame( tpAniSirGlobal pMac, 
                    tANI_U8 *transId, tSirMacAddr peer,tpPESession psessionEntry);
 #endif
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+void limProcessRMCMessages(tpAniSirGlobal pMac, eRmcMessageType msgType,
+                             tANI_U32 *pMsgBuf);
+tSirRetStatus limSendRMCActionFrame(tpAniSirGlobal  pMac,
+                 tSirMacAddr peerMacAddr, tSirRMCInfo  *pRMC,
+                 tpPESession psessionEntry);
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
 // Inline functions
 
 /**
@@ -1054,6 +1067,7 @@
                     tANI_S8 rxRssi);
 void limProcessRemainOnChnTimeout(tpAniSirGlobal pMac);
 void limProcessInsertSingleShotNOATimeout(tpAniSirGlobal pMac);
+void limConvertActiveChannelToPassiveChannel(tpAniSirGlobal pMac);
 void limSendP2PActionFrame(tpAniSirGlobal pMac, tpSirMsgQ pMsg);
 void limAbortRemainOnChan(tpAniSirGlobal pMac, tANI_U8 sessionId);
 tSirRetStatus __limProcessSmeNoAUpdate(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf);
@@ -1090,5 +1104,8 @@
 #endif
 
 void limProcessRxScanEvent(tpAniSirGlobal mac, void *buf);
+
+int limProcessRemainOnChnlReq(tpAniSirGlobal pMac, tANI_U32 *pMsg);
+void limRemainOnChnRsp(tpAniSirGlobal pMac, eHalStatus status, tANI_U32 *data);
 #endif /* __LIM_TYPES_H */
 
diff --git a/CORE/MAC/src/pe/lim/limUtils.c b/CORE/MAC/src/pe/lim/limUtils.c
index 68d15b4..7cfac44 100644
--- a/CORE/MAC/src/pe/lim/limUtils.c
+++ b/CORE/MAC/src/pe/lim/limUtils.c
@@ -79,14 +79,14 @@
 {
     static tANI_U8 token;
     tpDialogueToken pCurrNode;
-    if(eHAL_STATUS_SUCCESS !=
-          palAllocateMemory(pMac->hHdd, (void **) &pCurrNode, sizeof(tDialogueToken)))
+    pCurrNode = vos_mem_malloc(sizeof(tDialogueToken));
+    if ( NULL == pCurrNode )
     {
-        PELOGE(limLog(pMac, LOGE, FL("palAllocateMemory failed"));)
+        PELOGE(limLog(pMac, LOGE, FL("AllocateMemory failed"));)
         return NULL;
     }
 
-    palZeroMemory(pMac->hHdd, (void *) pCurrNode, sizeof(tDialogueToken));
+    vos_mem_set((void *) pCurrNode, sizeof(tDialogueToken), 0);
     //first node in the list is being added.
     if(NULL == pMac->lim.pDialogueTokenHead)
     {
@@ -100,7 +100,12 @@
     //assocId and tid of the node will be filled in by caller.
     pCurrNode->next = NULL;
     pCurrNode->token = token++;
-    PELOG4(limLog(pMac, LOG4, FL("token assigned = %d"), token);)
+
+    /* Dialog token should be a non-zero value */
+    if (0 == pCurrNode->token)
+       pCurrNode->token = token;
+
+    PELOG4(limLog(pMac, LOG4, FL("token assigned = %d"), pCurrNode->token);)
     return pCurrNode;
 }
 
@@ -134,7 +139,7 @@
         //there was only one node in the list. So tail pointer also needs to be adjusted.
         if(NULL == pMac->lim.pDialogueTokenHead)
             pMac->lim.pDialogueTokenTail = NULL;
-        palFreeMemory(pMac->hHdd, (void *) pCurrNode);
+        vos_mem_free(pCurrNode);
         return eSIR_SUCCESS;
     }
 
@@ -159,6 +164,7 @@
         //if the node being deleted is the last one then we also need to move the tail pointer to the prevNode.
         if(NULL == pCurrNode->next)
               pMac->lim.pDialogueTokenTail = pPrevNode;
+        vos_mem_free(pCurrNode);
         return eSIR_SUCCESS;
     }
 
@@ -183,7 +189,7 @@
     {
         pCurrNode = pMac->lim.pDialogueTokenHead;    
         pMac->lim.pDialogueTokenHead = pMac->lim.pDialogueTokenHead->next;
-        palFreeMemory(pMac->hHdd, (void *) pCurrNode);
+        vos_mem_free(pCurrNode);
         pCurrNode = NULL;
     }
     pMac->lim.pDialogueTokenTail = NULL;
@@ -197,22 +203,22 @@
 
     if (pMh->fc.toDS == 1 && pMh->fc.fromDS == 0)
     {
-        palCopyMemory( pMac->hHdd, bssId, pMh->addr1, 6);
+        vos_mem_copy( bssId, pMh->addr1, 6);
         *pIgnore = 1;
     }
     else if (pMh->fc.toDS == 0 && pMh->fc.fromDS == 1)
     {
-        palCopyMemory( pMac->hHdd, bssId, pMh->addr2, 6);
+        vos_mem_copy ( bssId, pMh->addr2, 6);
         *pIgnore = 1;
     }
     else if (pMh->fc.toDS == 0 && pMh->fc.fromDS == 0)
     {
-        palCopyMemory( pMac->hHdd, bssId, pMh->addr3, 6);
+        vos_mem_copy( bssId, pMh->addr3, 6);
         *pIgnore = 0;
     }
     else
     {
-        palCopyMemory( pMac->hHdd, bssId, pMh->addr1, 6);
+        vos_mem_copy( bssId, pMh->addr1, 6);
         *pIgnore = 1;
     }
 }
@@ -663,6 +669,12 @@
             return "eWNI_PMC_EXIT_BMPS_IND";
         case eWNI_SME_SET_BCN_FILTER_REQ:
             return "eWNI_SME_SET_BCN_FILTER_REQ";
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+        case eWNI_SME_GET_TSM_STATS_REQ:
+            return "eWNI_SME_GET_TSM_STATS_REQ";
+        case eWNI_SME_GET_TSM_STATS_RSP:
+            return "eWNI_SME_GET_TSM_STATS_RSP";
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
         default:
             return "INVALID SME message";
     }
@@ -1059,11 +1071,11 @@
         tx_timer_deactivate(&pMac->lim.limTimers.gLimRemainOnChannelTimer);
         tx_timer_delete(&pMac->lim.limTimers.gLimRemainOnChannelTimer);
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
         // Deactivate and delete TSM
         tx_timer_deactivate(&pMac->lim.limTimers.gLimCcxTsmTimer);
         tx_timer_delete(&pMac->lim.limTimers.gLimCcxTsmTimer);
-#endif
+#endif /* FEATURE_WLAN_CCX && !FEATURE_WLAN_CCX_UPLOAD */
 
         tx_timer_deactivate(&pMac->lim.limTimers.gLimDisassocAckTimer);
         tx_timer_delete(&pMac->lim.limTimers.gLimDisassocAckTimer);
@@ -1074,6 +1086,9 @@
         tx_timer_deactivate(&pMac->lim.limTimers.gLimP2pSingleShotNoaInsertTimer);
         tx_timer_delete(&pMac->lim.limTimers.gLimP2pSingleShotNoaInsertTimer);
 
+        tx_timer_deactivate(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer);
+        tx_timer_delete(&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer);
+
         pMac->lim.gLimTimersCreated = 0;
     }
 
@@ -1382,8 +1397,8 @@
     /*
     ** save the message to the queue and advanced the write pointer
     **/
-    palCopyMemory(pMac->hHdd,
-                  (tANI_U8 *)&pMac->lim.gLimDeferredMsgQ.deferredQueue[pMac->lim.gLimDeferredMsgQ.write++],
+    vos_mem_copy( (tANI_U8 *)&pMac->lim.gLimDeferredMsgQ.deferredQueue[
+                    pMac->lim.gLimDeferredMsgQ.write++],
                   (tANI_U8 *)limMsg,
                   sizeof(tSirMsgQ));
     return TX_SUCCESS;
@@ -1592,7 +1607,7 @@
         return;
     }
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&beaconParams, sizeof( tUpdateBeaconParams) );
+    vos_mem_set( ( tANI_U8* )&beaconParams, sizeof( tUpdateBeaconParams), 0);
     beaconParams.bssIdx = psessionEntry->bssIdx;
     
     beaconParams.paramChangeBitmap = 0;
@@ -1789,7 +1804,7 @@
           PELOG1(limLog(pMac, LOG1, FL("Addr: "));)
           PELOG1(limPrintMacAddr(pMac, psessionEntry->protStaCache[i].addr, LOG1);)
 
-          if (palEqualMemory( pMac->hHdd,
+          if (vos_mem_compare(
               psessionEntry->protStaCache[i].addr,
               peerMacAddr, sizeof(tSirMacAddr)))
           {
@@ -1811,7 +1826,7 @@
       return;
   }
 
-  palCopyMemory( pMac->hHdd, psessionEntry->protStaCache[i].addr,
+  vos_mem_copy( psessionEntry->protStaCache[i].addr,
                 peerMacAddr,
                 sizeof(tSirMacAddr));
 
@@ -2021,7 +2036,7 @@
                 if ((psessionEntry->limSystemRole == eLIM_AP_ROLE )  &&
                      psessionEntry->gLimNoShortParams.staNoShortCache[i].active)
                     {
-                        if (palEqualMemory( pMac->hHdd,
+                        if (vos_mem_compare(
                                     psessionEntry->gLimNoShortParams.staNoShortCache[i].addr,
                                     peerMacAddr, sizeof(tSirMacAddr)))
                             return;
@@ -2029,7 +2044,7 @@
                 {
                     if (pMac->lim.gLimNoShortParams.staNoShortCache[i].active)
                      {
-                         if (palEqualMemory( pMac->hHdd,
+                         if (vos_mem_compare(
                                              pMac->lim.gLimNoShortParams.staNoShortCache[i].addr,
                                              peerMacAddr, sizeof(tSirMacAddr)))
                              return;
@@ -2069,14 +2084,14 @@
             }
 
 
-            if(psessionEntry->limSystemRole == eLIM_AP_ROLE){
-                palCopyMemory( pMac->hHdd, psessionEntry->gLimNoShortParams.staNoShortCache[i].addr,
+            if (psessionEntry->limSystemRole == eLIM_AP_ROLE){
+                vos_mem_copy( psessionEntry->gLimNoShortParams.staNoShortCache[i].addr,
                         peerMacAddr,  sizeof(tSirMacAddr));
                 psessionEntry->gLimNoShortParams.staNoShortCache[i].active = true;
                 psessionEntry->gLimNoShortParams.numNonShortPreambleSta++;
             }else
             {
-                palCopyMemory( pMac->hHdd, pMac->lim.gLimNoShortParams.staNoShortCache[i].addr,
+                vos_mem_copy(  pMac->lim.gLimNoShortParams.staNoShortCache[i].addr,
                                peerMacAddr,  sizeof(tSirMacAddr));
                 pMac->lim.gLimNoShortParams.staNoShortCache[i].active = true;
                 pMac->lim.gLimNoShortParams.numNonShortPreambleSta++;        
@@ -2133,7 +2148,7 @@
                 if ((psessionEntry->limSystemRole == eLIM_AP_ROLE ) &&
                      psessionEntry->gLimNoShortSlotParams.staNoShortSlotCache[i].active)
                 {
-                    if (palEqualMemory( pMac->hHdd,
+                    if (vos_mem_compare(
                          psessionEntry->gLimNoShortSlotParams.staNoShortSlotCache[i].addr,
                          peerMacAddr, sizeof(tSirMacAddr)))
                         return;
@@ -2142,7 +2157,7 @@
                 {
                     if (pMac->lim.gLimNoShortSlotParams.staNoShortSlotCache[i].active)
                     {
-                        if (palEqualMemory( pMac->hHdd,
+                        if (vos_mem_compare(
                             pMac->lim.gLimNoShortSlotParams.staNoShortSlotCache[i].addr,
                             peerMacAddr, sizeof(tSirMacAddr)))
                             return;
@@ -2180,13 +2195,13 @@
 
 
             if(psessionEntry->limSystemRole == eLIM_AP_ROLE){
-                palCopyMemory( pMac->hHdd, psessionEntry->gLimNoShortSlotParams.staNoShortSlotCache[i].addr,
+                vos_mem_copy(  psessionEntry->gLimNoShortSlotParams.staNoShortSlotCache[i].addr,
                                peerMacAddr, sizeof(tSirMacAddr));
                 psessionEntry->gLimNoShortSlotParams.staNoShortSlotCache[i].active = true;
                 psessionEntry->gLimNoShortSlotParams.numNonShortSlotSta++;
             }else
             {
-                palCopyMemory( pMac->hHdd, pMac->lim.gLimNoShortSlotParams.staNoShortSlotCache[i].addr,
+                vos_mem_copy( pMac->lim.gLimNoShortSlotParams.staNoShortSlotCache[i].addr,
                           peerMacAddr, sizeof(tSirMacAddr));
                 pMac->lim.gLimNoShortSlotParams.staNoShortSlotCache[i].active = true;
                 pMac->lim.gLimNoShortSlotParams.numNonShortSlotSta++;
@@ -2578,6 +2593,8 @@
                         eSIR_MAC_UNSPEC_FAILURE_REASON);
         return;
     }
+    limCovertChannelScanType(pMac, psessionEntry->currentOperChannel, false);
+    pMac->lim.dfschannelList.timeStamp[psessionEntry->currentOperChannel] = 0;
     switch(psessionEntry->gLimChannelSwitch.state)
     {
         case eLIM_CHANNEL_SWITCH_PRIMARY_ONLY:
@@ -3084,7 +3101,7 @@
 void limStartQuietTimer(tpAniSirGlobal pMac, tANI_U8 sessionId)
 {
     tpPESession psessionEntry;
-    psessionEntry = peFindSessionBySessionId(pMac , sessionId);
+    psessionEntry = peFindSessionBySessionId(pMac, sessionId);
 
     if(psessionEntry == NULL) {
         limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
@@ -3217,7 +3234,8 @@
    }
    
    mmhMsg.type = eWNI_SME_SWITCH_CHL_REQ;
-   if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pSirSmeSwitchChInd, sizeof(tSirSmeSwitchChannelInd)))
+   pSirSmeSwitchChInd = vos_mem_malloc(sizeof(tSirSmeSwitchChannelInd));
+   if ( NULL == pSirSmeSwitchChInd )
    {
       limLog(pMac, LOGP, FL("Failed to allocate buffer for buffer descriptor"));
       return;
@@ -3228,7 +3246,7 @@
    pSirSmeSwitchChInd->newChannelId = psessionEntry->gLimChannelSwitch.primaryChannel;
    pSirSmeSwitchChInd->sessionId = psessionEntry->smeSessionId;
    //BSS ID
-   palCopyMemory( pMac->hHdd, pSirSmeSwitchChInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
+   vos_mem_copy( pSirSmeSwitchChInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
    mmhMsg.bodyptr = pSirSmeSwitchChInd;
    mmhMsg.bodyval = 0;
    
@@ -3716,7 +3734,7 @@
 
 void limGetMyMacAddr(tpAniSirGlobal pMac, tANI_U8 *mac)
 {
-    palCopyMemory( pMac->hHdd, mac, pMac->lim.gLimMyMacAddr, sizeof(tSirMacAddr));
+    vos_mem_copy( mac, pMac->lim.gLimMyMacAddr, sizeof(tSirMacAddr));
     return;
 }
 
@@ -4228,7 +4246,7 @@
                     psessionEntry->htOperMode = eSIR_HT_OP_MODE_OVERLAP_LEGACY;
                 }
                 limEnableHtRifsProtection(pMac, true, overlap, pBeaconParams,psessionEntry);
-                limEnableHtOBSSProtection(pMac,  true , overlap, pBeaconParams, psessionEntry);
+                limEnableHtOBSSProtection(pMac,  true, overlap, pBeaconParams, psessionEntry);
             }
             else
             {
@@ -4239,7 +4257,7 @@
                 {
                     psessionEntry->htOperMode = eSIR_HT_OP_MODE_MIXED;
                     limEnableHtRifsProtection(pMac, true, overlap, pBeaconParams,psessionEntry);
-                    limEnableHtOBSSProtection(pMac,  true , overlap, pBeaconParams,psessionEntry);        
+                    limEnableHtOBSSProtection(pMac,  true, overlap, pBeaconParams,psessionEntry);
                 }
             }
         }else if(eLIM_BT_AMP_AP_ROLE == psessionEntry->limSystemRole)
@@ -4266,7 +4284,7 @@
                 {
                     pMac->lim.gHTOperMode = eSIR_HT_OP_MODE_MIXED;
                     limEnableHtRifsProtection(pMac, true, overlap, pBeaconParams,psessionEntry);
-                    limEnableHtOBSSProtection(pMac,  true , overlap, pBeaconParams,psessionEntry);        
+                    limEnableHtOBSSProtection(pMac,  true, overlap, pBeaconParams,psessionEntry);
                 }
             }
         }
@@ -5078,7 +5096,7 @@
 #endif
 #endif
 
-  if(free)
+  if (free)
      palPktFree( pMac->hHdd,
                  HAL_TXRX_FRM_802_11_MGMT,
                  (void *) NULL, /* this is ignored and will likely be removed */
@@ -5215,7 +5233,7 @@
  */
 
 void limUpdateStaRunTimeHTInfo( tpAniSirGlobal  pMac,
-                                tDot11fIEHTInfo *pHTInfo , tpPESession psessionEntry)
+                                tDot11fIEHTInfo *pHTInfo, tpPESession psessionEntry)
 {
     if ( psessionEntry->htRecommendedTxWidthSet != ( tANI_U8 )pHTInfo->recommendedTxWidthSet )
     {
@@ -5312,14 +5330,14 @@
       break;
 
     default:
-      palFreeMemory(pMac->hHdd, msgParam);
+      vos_mem_free(msgParam);
       limLog(pMac, LOGP, FL("invalid message id = %d received"), msgId);
       return eSIR_FAILURE;
   }
 
   if (limPostMsgApi(pMac, &msg) != eSIR_SUCCESS)
   {
-    palFreeMemory(pMac->hHdd, msgParam);
+    vos_mem_free(msgParam);
     limLog(pMac, LOGP, FL("limPostMsgApi failed for msgid = %d"), msg.type);
     return eSIR_FAILURE;
   }
@@ -5449,7 +5467,12 @@
            psessionEntry->gLimEdcaParams[upToAc(tsinfo->traffic.userPrio)].aci.acm)
       {
         //send message to HAL to delete TS
-        if(eSIR_SUCCESS != limSendHalMsgDelTs(pMac, pSta->staIndex, tspecIdx, pDeltsReq->req, psessionEntry->peSessionId))
+        if(eSIR_SUCCESS != limSendHalMsgDelTs(pMac,
+                                              pSta->staIndex,
+                                              tspecIdx,
+                                              pDeltsReq->req,
+                                              psessionEntry->peSessionId,
+                                              psessionEntry->bssId))
         {
           limLog(pMac, LOGW, FL("DelTs with UP %d failed in limSendHalMsgDelTs - ignoring request"),
                            tsinfo->traffic.userPrio);
@@ -5472,9 +5495,10 @@
     tSirMsgQ msg;
     tpHalIndCB pHalCB;
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pHalCB, sizeof(tHalIndCB)))
+    pHalCB = vos_mem_malloc(sizeof(tHalIndCB));
+    if ( NULL == pHalCB )
     {
-       limLog(pMac, LOGP, FL("palAllocateMemory() failed"));
+       limLog(pMac, LOGP, FL("AllocateMemory() failed"));
        return;
     }
 
@@ -5487,7 +5511,7 @@
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, msg.type));
     if(eSIR_SUCCESS != wdaPostCtrlMsg(pMac, &msg))
     {
-        palFreeMemory(pMac->hHdd, pHalCB);
+        vos_mem_free(pHalCB);
         limLog(pMac, LOGP, FL("wdaPostCtrlMsg() failed"));
     }
     
@@ -5530,7 +5554,7 @@
     if ((psessionEntry = peFindSessionByBssid(pMac,pBaActivityInd->bssId,&sessionId))== NULL)
     {
         limLog(pMac, LOGE,FL("session does not exist for given BSSId"));
-        palFreeMemory(pMac->hHdd, limMsg->bodyptr);
+        vos_mem_free(limMsg->bodyptr);
         return;
     }
        
@@ -5541,7 +5565,7 @@
     if ((baCandidateCnt  > pMac->lim.maxStation) || !psessionEntry->htCapability )
 #endif
     {
-        palFreeMemory(pMac->hHdd, limMsg->bodyptr);
+        vos_mem_free(limMsg->bodyptr);
         return;
     }
 
@@ -5566,7 +5590,7 @@
     }
     if (!htCapable)
     {
-        palFreeMemory(pMac->hHdd, limMsg->bodyptr);
+        vos_mem_free(limMsg->bodyptr);
         return;
     }
 #endif
@@ -5592,66 +5616,136 @@
             }
         }
     }
-    palFreeMemory(pMac->hHdd, limMsg->bodyptr);
+    vos_mem_free(limMsg->bodyptr);
     return;
 }
 
 
 /** -------------------------------------------------------------
-\fn limDelAllBASessions
-\brief Deletes all the exisitng BA sessions.
-\        Note : This API is provided for Mac OSx only. The reason for this is that Mac OSx may not
-\                  restart after CFG update.
+\fn      limDeleteBASessions
+\brief   Deletes all the exisitng BA sessions for given session
+         and BA direction.
 \param   tpAniSirGlobal pMac
-\return None
+\param   tpPESession pSessionEntry
+\param   tANI_U32 baDirection
+\return  None
 -------------------------------------------------------------*/
 
 void 
-limDelAllBASessions(tpAniSirGlobal pMac)
+limDeleteBASessions(tpAniSirGlobal pMac, tpPESession pSessionEntry,
+                    tANI_U32 baDirection)
 {
     tANI_U32 i;
     tANI_U8 tid;
     tpDphHashNode pSta;
 
-    tpPESession psessionEntry =  &pMac->lim.gpSession[0]; //TBD-RAJESH HOW TO GET sessionEntry?????
-    for(tid = 0; tid < STACFG_MAX_TC; tid++)
+    if (NULL == pSessionEntry)
     {
-        if((eLIM_AP_ROLE == psessionEntry->limSystemRole) ||(psessionEntry->limSystemRole == eLIM_BT_AMP_AP_ROLE)||
-              (eLIM_STA_IN_IBSS_ROLE == psessionEntry->limSystemRole))
+        limLog(pMac, LOGE, FL("Session does not exist"));
+    }
+    else
+    {
+        for(tid = 0; tid < STACFG_MAX_TC; tid++)
         {
-            for(i = 0; i < pMac->lim.maxStation; i++)
+            if ((eLIM_AP_ROLE == pSessionEntry->limSystemRole) ||
+                (pSessionEntry->limSystemRole == eLIM_BT_AMP_AP_ROLE) ||
+                (eLIM_STA_IN_IBSS_ROLE == pSessionEntry->limSystemRole) ||
+                (pSessionEntry->limSystemRole == eLIM_P2P_DEVICE_GO))
             {
-                pSta = psessionEntry->dph.dphHashTable.pDphNodeArray + i;
-                if (pSta && pSta->added)
+                for (i = 0; i < pMac->lim.maxStation; i++)
                 {
-                    if(eBA_ENABLE == pSta->tcCfg[tid].fUseBATx)
+                    pSta = pSessionEntry->dph.dphHashTable.pDphNodeArray + i;
+                    if (pSta && pSta->added)
                     {
-                        limPostMlmDelBAReq(pMac, pSta, eBA_INITIATOR, tid, eSIR_MAC_UNSPEC_FAILURE_REASON,psessionEntry);
-                    }
-                    else if(eBA_ENABLE == pSta->tcCfg[tid].fUseBARx)
-                    {
-                        limPostMlmDelBAReq(pMac, pSta, eBA_RECIPIENT, tid, eSIR_MAC_UNSPEC_FAILURE_REASON,psessionEntry);
+                        if ((eBA_ENABLE == pSta->tcCfg[tid].fUseBATx) &&
+                                       (baDirection & BA_INITIATOR))
+                        {
+                            limPostMlmDelBAReq(pMac, pSta, eBA_INITIATOR, tid,
+                                               eSIR_MAC_UNSPEC_FAILURE_REASON,
+                                               pSessionEntry);
+                        }
+                        if ((eBA_ENABLE == pSta->tcCfg[tid].fUseBARx) &&
+                                        (baDirection & BA_RECIPIENT))
+                        {
+                            limPostMlmDelBAReq(pMac, pSta, eBA_RECIPIENT, tid,
+                                               eSIR_MAC_UNSPEC_FAILURE_REASON,
+                                               pSessionEntry);
+                        }
                     }
                 }
             }
-        }
-        else if((eLIM_STA_ROLE == psessionEntry->limSystemRole)||(eLIM_BT_AMP_STA_ROLE == psessionEntry->limSystemRole))
-        {
-            pSta = dphGetHashEntry(pMac, DPH_STA_HASH_INDEX_PEER, &psessionEntry->dph.dphHashTable);
-            if (pSta && pSta->added)
+            else if ((eLIM_STA_ROLE == pSessionEntry->limSystemRole) ||
+                     (eLIM_BT_AMP_STA_ROLE == pSessionEntry->limSystemRole) ||
+                     (eLIM_P2P_DEVICE_ROLE == pSessionEntry->limSystemRole))
             {
-                if(eBA_ENABLE == pSta->tcCfg[tid].fUseBATx)
+                pSta = dphGetHashEntry(pMac, DPH_STA_HASH_INDEX_PEER,
+                                       &pSessionEntry->dph.dphHashTable);
+                if (pSta && pSta->added)
                 {
-                    limPostMlmDelBAReq(pMac, pSta, eBA_INITIATOR, tid, eSIR_MAC_UNSPEC_FAILURE_REASON,psessionEntry);
-                }
-                if(eBA_ENABLE == pSta->tcCfg[tid].fUseBARx)
-                {
-                    limPostMlmDelBAReq(pMac, pSta, eBA_RECIPIENT, tid, eSIR_MAC_UNSPEC_FAILURE_REASON,psessionEntry);
+                    if ((eBA_ENABLE == pSta->tcCfg[tid].fUseBATx) &&
+                                    (baDirection & BA_INITIATOR))
+                    {
+                        limPostMlmDelBAReq(pMac, pSta, eBA_INITIATOR, tid,
+                                           eSIR_MAC_UNSPEC_FAILURE_REASON,
+                                           pSessionEntry);
+                    }
+                    if ((eBA_ENABLE == pSta->tcCfg[tid].fUseBARx) &&
+                                    (baDirection & BA_RECIPIENT))
+                    {
+                        limPostMlmDelBAReq(pMac, pSta, eBA_RECIPIENT, tid,
+                                           eSIR_MAC_UNSPEC_FAILURE_REASON,
+                                           pSessionEntry);
+                    }
                 }
             }
         }
     }
 }
+
+/** -------------------------------------------------------------
+\fn     limDelAllBASessions
+\brief  Deletes all the exisitng BA sessions.
+\param  tpAniSirGlobal pMac
+\return None
+-------------------------------------------------------------*/
+
+void limDelAllBASessions(tpAniSirGlobal pMac)
+{
+    tANI_U32 i;
+    tpPESession pSessionEntry;
+
+    for (i = 0; i < pMac->lim.maxBssId; i++)
+    {
+        pSessionEntry = peFindSessionBySessionId(pMac, i);
+        if (pSessionEntry)
+        {
+            limDeleteBASessions(pMac, pSessionEntry, BA_BOTH_DIRECTIONS);
+        }
+    }
+}
+
+/** -------------------------------------------------------------
+\fn     limDelAllBASessionsBtc
+\brief  Deletes all the exisitng BA receipent sessions in 2.4GHz
+        band.
+\param  tpAniSirGlobal pMac
+\return None
+-------------------------------------------------------------*/
+
+void limDelPerBssBASessionsBtc(tpAniSirGlobal pMac)
+{
+    tANI_U8 sessionId;
+    tpPESession pSessionEntry;
+    pSessionEntry = peFindSessionByBssid(pMac,pMac->btc.btcBssfordisableaggr,
+                                                                &sessionId);
+    if (pSessionEntry)
+    {
+        PELOGW(limLog(pMac, LOGW,
+        "Deleting the BA for session %d as host got BTC event", sessionId);)
+        limDeleteBASessions(pMac, pSessionEntry, BA_RECIPIENT);
+    }
+}
+
 /** -------------------------------------------------------------
 \fn limProcessDelTsInd
 \brief handles the DeleteTS indication coming from HAL or generated by PE itself in some error cases.
@@ -5675,7 +5769,7 @@
 if((psessionEntry = peFindSessionByBssid(pMac,pDelTsParam->bssId,&sessionId))== NULL)
     {
          limLog(pMac, LOGE,FL("session does not exist for given BssId"));
-         palFreeMemory(pMac->hHdd, (void *)(limMsg->bodyptr));
+         vos_mem_free(limMsg->bodyptr);
          return;
     }
 
@@ -5694,18 +5788,19 @@
     goto error1;
   }
 
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pDelTsReq, sizeof(tSirDeltsReq)))
+  pDelTsReq = vos_mem_malloc(sizeof(tSirDeltsReq));
+  if ( NULL == pDelTsReq )
   {
-     PELOGE(limLog(pMac, LOGE, FL("palAllocateMemory() failed"));)
+     PELOGE(limLog(pMac, LOGE, FL("AllocateMemory() failed"));)
      goto error1;
   }
 
-  palZeroMemory( pMac->hHdd, (tANI_U8 *)pDelTsReq, sizeof(tSirDeltsReq));
+  vos_mem_set( (tANI_U8 *)pDelTsReq, sizeof(tSirDeltsReq), 0);
 
   if(pSta->wmeEnabled)
-    palCopyMemory(pMac->hHdd, &(pDelTsReq->req.tspec), &(pTspecInfo->tspec), sizeof(tSirMacTspecIE));
+    vos_mem_copy( &(pDelTsReq->req.tspec), &(pTspecInfo->tspec), sizeof(tSirMacTspecIE));
   else
-    palCopyMemory(pMac->hHdd, &(pDelTsReq->req.tsinfo), &(pTspecInfo->tspec.tsinfo), sizeof(tSirMacTSInfo));
+    vos_mem_copy( &(pDelTsReq->req.tsinfo), &(pTspecInfo->tspec.tsinfo), sizeof(tSirMacTSInfo));
 
 
   //validate the req
@@ -5722,26 +5817,27 @@
           psessionEntry);
 
   // prepare and send an sme indication to HDD
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pDelTsReqInfo, sizeof(tSirDeltsReqInfo)))
+  pDelTsReqInfo = vos_mem_malloc(sizeof(tSirDeltsReqInfo));
+  if ( NULL == pDelTsReqInfo )
   {
-     PELOGE(limLog(pMac, LOGE, FL("palAllocateMemory() failed"));)
+     PELOGE(limLog(pMac, LOGE, FL("AllocateMemory() failed"));)
      goto error3;
   }
-  palZeroMemory( pMac->hHdd, (tANI_U8 *)pDelTsReqInfo, sizeof(tSirDeltsReqInfo));
+  vos_mem_set( (tANI_U8 *)pDelTsReqInfo, sizeof(tSirDeltsReqInfo), 0);
 
   if(pSta->wmeEnabled)
-    palCopyMemory(pMac->hHdd, &(pDelTsReqInfo->tspec), &(pTspecInfo->tspec), sizeof(tSirMacTspecIE));
+    vos_mem_copy( &(pDelTsReqInfo->tspec), &(pTspecInfo->tspec), sizeof(tSirMacTspecIE));
   else
-    palCopyMemory(pMac->hHdd, &(pDelTsReqInfo->tsinfo), &(pTspecInfo->tspec.tsinfo), sizeof(tSirMacTSInfo));
+    vos_mem_copy( &(pDelTsReqInfo->tsinfo), &(pTspecInfo->tspec.tsinfo), sizeof(tSirMacTSInfo));
 
   limSendSmeDeltsInd(pMac, pDelTsReqInfo, pDelTsReq->aid,psessionEntry);
 
 error3:
-  palFreeMemory(pMac->hHdd, (void *) pDelTsReqInfo);
+  vos_mem_free(pDelTsReqInfo);
 error2:
-  palFreeMemory(pMac->hHdd, (void *) pDelTsReq);
+  vos_mem_free(pDelTsReq);
 error1:
-  palFreeMemory(pMac->hHdd, (void *)(limMsg->bodyptr));
+  vos_mem_free(limMsg->bodyptr);
   return;
 }
 
@@ -5777,19 +5873,18 @@
     //return eSIR_SUCCESS;
 
   // Allocate for LIM_MLM_ADDBA_REQ
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                                   (void **) &pMlmAddBAReq,
-                                   sizeof( tLimMlmAddBAReq )))
+  pMlmAddBAReq = vos_mem_malloc(sizeof( tLimMlmAddBAReq ));
+  if ( NULL == pMlmAddBAReq )
   {
-    limLog( pMac, LOGP, FL("palAllocateMemory failed"));
+    limLog( pMac, LOGP, FL("AllocateMemory failed"));
     status = eSIR_MEM_ALLOC_FAILED;
     goto returnFailure;
   }
 
-  palZeroMemory( pMac->hHdd, (void *) pMlmAddBAReq, sizeof( tLimMlmAddBAReq ));
+  vos_mem_set( (void *) pMlmAddBAReq, sizeof( tLimMlmAddBAReq ), 0);
 
   // Copy the peer MAC
-  palCopyMemory( pMac->hHdd,
+  vos_mem_copy(
       pMlmAddBAReq->peerMacAddr,
       pStaDs->staAddr,
       sizeof( tSirMacAddr ));
@@ -5854,7 +5949,7 @@
   return eSIR_SUCCESS;
 
 returnFailure:
-  palFreeMemory(pMac->hHdd, pMlmAddBAReq);
+  vos_mem_free(pMlmAddBAReq);
   return status;
 }
 
@@ -5899,22 +5994,21 @@
 tpLimMlmAddBARsp pMlmAddBARsp;
 
   // Allocate for LIM_MLM_ADDBA_RSP
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-        (void **) &pMlmAddBARsp,
-        sizeof( tLimMlmAddBARsp )))
+  pMlmAddBARsp = vos_mem_malloc(sizeof( tLimMlmAddBARsp ));
+  if ( NULL == pMlmAddBARsp )
   {
     limLog( pMac, LOGE,
-        FL("palAllocateMemory failed with error code %d"),
+        FL("AllocateMemory failed with error code %d"),
         status );
 
     status = eSIR_MEM_ALLOC_FAILED;
     goto returnFailure;
   }
 
-  palZeroMemory( pMac->hHdd, (void *) pMlmAddBARsp, sizeof( tLimMlmAddBARsp ));
+  vos_mem_set( (void *) pMlmAddBARsp, sizeof( tLimMlmAddBARsp ), 0);
 
   // Copy the peer MAC
-  palCopyMemory( pMac->hHdd,
+  vos_mem_copy(
       pMlmAddBARsp->peerMacAddr,
       peerMacAddr,
       sizeof( tSirMacAddr ));
@@ -5989,22 +6083,21 @@
   }
 
   // Allocate for LIM_MLM_DELBA_REQ
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-        (void **) &pMlmDelBAReq,
-        sizeof( tLimMlmDelBAReq )))
+  pMlmDelBAReq = vos_mem_malloc(sizeof( tLimMlmDelBAReq ));
+  if ( NULL == pMlmDelBAReq )
   {
     limLog( pMac, LOGE,
-        FL("palAllocateMemory failed with error code %d"),
+        FL("AllocateMemory failed with error code %d"),
         status );
 
     status = eSIR_MEM_ALLOC_FAILED;
     goto returnFailure;
   }
 
-  palZeroMemory( pMac->hHdd, (void *) pMlmDelBAReq, sizeof( tLimMlmDelBAReq ));
+  vos_mem_set( (void *) pMlmDelBAReq, sizeof( tLimMlmDelBAReq ), 0);
 
   // Copy the peer MAC
-  palCopyMemory( pMac->hHdd,
+  vos_mem_copy(
       pMlmDelBAReq->peerMacAddr,
       pSta->staAddr,
       sizeof( tSirMacAddr ));
@@ -6027,7 +6120,7 @@
             (status = limSendDelBAInd( pMac, pMlmDelBAReq,psessionEntry)))
           status = eSIR_FAILURE;
   
-        palFreeMemory(pMac->hHdd, (void*) pMlmDelBAReq);
+        vos_mem_free(pMlmDelBAReq);
         return status;
   }
 
@@ -6086,7 +6179,6 @@
 {
 tpAddBAParams pAddBAParams = NULL;
 tSirRetStatus retCode = eSIR_SUCCESS;
-eHalStatus status;
 tSirMsgQ msgQ;
 
 #ifdef WLAN_SOFTAP_VSTA_FEATURE
@@ -6099,23 +6191,21 @@
 #endif //WLAN_SOFTAP_VSTA_FEATURE
 
   // Allocate for WDA_ADDBA_REQ
-  if( eHAL_STATUS_SUCCESS !=
-      (status = palAllocateMemory( pMac->hHdd,
-                                   (void **) &pAddBAParams,
-                                   sizeof( tAddBAParams ))))
+  pAddBAParams = vos_mem_malloc(sizeof( tAddBAParams ));
+  if ( NULL == pAddBAParams )
   {
     limLog( pMac, LOGE,
-        FL("palAllocateMemory failed with error code %d"),
-        status );
+        FL("AllocateMemory failed")
+         );
 
     retCode = eSIR_MEM_ALLOC_FAILED;
     goto returnFailure;
   }
 
-  palZeroMemory( pMac->hHdd, (void *) pAddBAParams, sizeof( tAddBAParams ));
+  vos_mem_set( (void *) pAddBAParams, sizeof( tAddBAParams ), 0);
 
   // Copy the peer MAC address
-  palCopyMemory( pMac->hHdd,
+  vos_mem_copy(
       (void *) pAddBAParams->peerMacAddr,
       (void *) pSta->staAddr,
       sizeof( tSirMacAddr ));
@@ -6167,7 +6257,7 @@
 
   // Clean-up...
   if( NULL != pAddBAParams )
-    palFreeMemory( pMac->hHdd, (void *) pAddBAParams );
+    vos_mem_free( pAddBAParams );
 
   return retCode;
 
@@ -6200,24 +6290,21 @@
 {
 tpDelBAParams pDelBAParams = NULL;
 tSirRetStatus retCode = eSIR_SUCCESS;
-eHalStatus status;
 tSirMsgQ msgQ;
 
   // Allocate for SIR_HAL_DELBA_IND
-  if( eHAL_STATUS_SUCCESS !=
-      (status = palAllocateMemory( pMac->hHdd,
-                                   (void **) &pDelBAParams,
-                                   sizeof( tDelBAParams ))))
+  pDelBAParams = vos_mem_malloc(sizeof( tDelBAParams ));
+  if ( NULL == pDelBAParams )
   {
     limLog( pMac, LOGE,
-        FL("palAllocateMemory failed with error code %d"),
-        status );
+        FL("AllocateMemory failed")
+        );
 
     retCode = eSIR_MEM_ALLOC_FAILED;
     goto returnFailure;
   }
 
-  palZeroMemory( pMac->hHdd, (void *) pDelBAParams, sizeof( tDelBAParams ));
+  vos_mem_set( (void *) pDelBAParams, sizeof( tDelBAParams ), 0);
 
   // Populate the REQ parameters
   pDelBAParams->staIdx = pSta->staIndex;
@@ -6274,7 +6361,7 @@
 
   // Clean-up...
   if( NULL != pDelBAParams )
-    palFreeMemory( pMac->hHdd, (void *) pDelBAParams );
+    vos_mem_free( pDelBAParams );
 
   return retCode;
 
@@ -6303,16 +6390,16 @@
 {
     tSirRetStatus             retCode = eSIR_SUCCESS;
     tSirMsgQ                    msgQ;
-    eHalStatus                 status;
     tpSetMIMOPS            pMIMO_PSParams;
 
     msgQ.reserved = 0;
     msgQ.type = WDA_SET_MIMOPS_REQ;
 
     // Allocate for WDA_SET_MIMOPS_REQ
-    status = palAllocateMemory( pMac->hHdd, (void **) &pMIMO_PSParams, sizeof( tSetMIMOPS));
-    if( eHAL_STATUS_SUCCESS !=  status) {
-        limLog( pMac, LOGP,FL(" palAllocateMemory failed with error code %d"), status );
+    pMIMO_PSParams = vos_mem_malloc(sizeof(tSetMIMOPS));
+    if ( NULL == pMIMO_PSParams )
+    {
+        limLog( pMac, LOGP,FL(" AllocateMemory failed"));
         return eSIR_MEM_ALLOC_FAILED;
     }
 
@@ -6329,7 +6416,7 @@
     if (eSIR_SUCCESS != retCode)
     {
         limLog( pMac, LOGP, FL("Posting WDA_SET_MIMOPS_REQ to HAL failed! Reason = %d"), retCode );
-        palFreeMemory(pMac->hHdd, (void *) pMIMO_PSParams);
+        vos_mem_free(pMIMO_PSParams);
         return retCode;
     }
     
@@ -6379,7 +6466,7 @@
 
 void limRessetScanChannelInfo(tpAniSirGlobal pMac)
 {
-    palZeroMemory(pMac->hHdd, &pMac->lim.scanChnInfo, sizeof(tLimScanChnInfo));
+    vos_mem_set(&pMac->lim.scanChnInfo, sizeof(tLimScanChnInfo), 0);
 }
 
 
@@ -6536,27 +6623,19 @@
      * Make it to align to 4 byte boundary  */
     nBytes = (tANI_U8)HALMSG_NUMBYTES_STATION_BITMAP(pMac->lim.maxStation);
 
-    status = palAllocateMemory(pMac->hHdd, (void **) &pTxCtrlMsg,
-                                    (sizeof(*pTxCtrlMsg) + nBytes));
-    if (status != eHAL_STATUS_SUCCESS)
+    pTxCtrlMsg = vos_mem_malloc(sizeof(*pTxCtrlMsg) + nBytes);
+    if ( NULL == pTxCtrlMsg )
     {
-        limLog(pMac, LOGP, FL("palAllocateMemory() failed"));
+        limLog(pMac, LOGP, FL("AllocateMemory() failed"));
         return;
     }
 
-    status = palZeroMemory(pMac->hHdd, (void *) pTxCtrlMsg,
-                                       (sizeof(*pTxCtrlMsg) + nBytes));
-    if (status != eHAL_STATUS_SUCCESS)
-    {
-        palFreeMemory(pMac->hHdd, (void *) pTxCtrlMsg);
-        limLog(pMac, LOGP, FL("palZeroMemory() failed, status = %d"), status);
-        return;
-    }
-    
+    vos_mem_set((void *) pTxCtrlMsg,
+               (sizeof(*pTxCtrlMsg) + nBytes), 0);
     status = __limFillTxControlParams(pMac, pTxCtrlMsg, type, mode);
     if (status != eHAL_STATUS_SUCCESS)
     {
-        palFreeMemory(pMac->hHdd, (void *) pTxCtrlMsg);
+        vos_mem_free(pTxCtrlMsg);
         limLog(pMac, LOGP, FL("__limFillTxControlParams failed, status = %d"), status);
         return;
     }
@@ -6569,7 +6648,7 @@
     MTRACE(macTraceMsgTx(pMac, NO_SESSION, msgQ.type));
     if(wdaPostCtrlMsg( pMac, &msgQ) != eSIR_SUCCESS)
     {
-        palFreeMemory(pMac->hHdd, (void *) pTxCtrlMsg);
+        vos_mem_free(pTxCtrlMsg);
         limLog( pMac, LOGP, FL("Posting Message to HAL failed"));
         return;
     }
@@ -6637,7 +6716,8 @@
 
         if (val > 0 && TX_TIMER_VALID(pMac->lim.limTimers.gLimBackgroundScanTimer))
         {
-            MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE, psessionEntry->peSessionId, eLIM_BACKGROUND_SCAN_TIMER));
+            MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE,
+                     psessionEntry->peSessionId, eLIM_BACKGROUND_SCAN_TIMER));
             if(tx_timer_activate(&pMac->lim.limTimers.gLimBackgroundScanTimer) != TX_SUCCESS)
             {
                 limLog(pMac, LOGP, FL("Could not restart background scan timer, doing LOGP"));
@@ -6650,8 +6730,10 @@
     /* Enable heartbeat timer */
     if (TX_TIMER_VALID(pMac->lim.limTimers.gLimHeartBeatTimer))
     {
-        MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE, psessionEntry->peSessionId, eLIM_HEART_BEAT_TIMER));
-        if((limActivateHearBeatTimer(pMac) != TX_SUCCESS) && (!IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE))
+        MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE,
+                 psessionEntry->peSessionId, eLIM_HEART_BEAT_TIMER));
+        if((limActivateHearBeatTimer(pMac, psessionEntry) != TX_SUCCESS) &&
+              (!IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE))
         {
             limLog(pMac, LOGP, FL("Could not restart heartbeat timer, doing LOGP"));
             return (eSIR_FAILURE);
@@ -6713,7 +6795,7 @@
     if (TX_TIMER_VALID(pMac->lim.limTimers.gLimHeartBeatTimer))
     {
         MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE, psessionEntry->peSessionId, eLIM_HEART_BEAT_TIMER));
-        if(limActivateHearBeatTimer(pMac) != TX_SUCCESS)
+        if(limActivateHearBeatTimer(pMac, psessionEntry) != TX_SUCCESS)
         {
             limLog(pMac, LOGP, FL("Could not restart heartbeat timer, doing LOGP"));
             return (eSIR_FAILURE);
@@ -7100,7 +7182,7 @@
     if((psessionEntry = peFindSessionBySessionId(pMac,pAddStaParams->sessionId))==NULL)
     {
         limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
-        palFreeMemory(pMac, pAddStaParams);
+        vos_mem_free(pAddStaParams);
         return;
     }
     psessionEntry->csaOffloadEnable = pAddStaParams->csaOffloadEnable;
@@ -7165,9 +7247,13 @@
             {
                 limLog(pMac, LOGE, FL("Probe_hb_failure: SME %d, MLME %d, HB-Count %d"),psessionEntry->limSmeState,
                         psessionEntry->limMlmState, psessionEntry->LimRxedBeaconCntDuringHB);
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
+                limDiagEventReport(pMac, WLAN_PE_DIAG_HB_FAILURE_TIMEOUT, psessionEntry, 0, 0);
+#endif
                 if (psessionEntry->limMlmState == eLIM_MLM_LINK_ESTABLISHED_STATE)
                 {
-                    if (!LIM_IS_CONNECTION_ACTIVE(psessionEntry))
+                    if ((!LIM_IS_CONNECTION_ACTIVE(psessionEntry))&&
+                                                  (psessionEntry->limSmeState != eLIM_SME_WT_DISASSOC_STATE))
                     {
                         limLog(pMac, LOGE, FL("Probe_hb_failure: for session:%d " ),psessionEntry->peSessionId);
                         /* AP did not respond to Probe Request. Tear down link with it.*/
@@ -7243,7 +7329,7 @@
             vos_pkt_return_packet((vos_pkt_t*)pLimMsg->bodyptr);
         }
       else if(pLimMsg->bodyptr != NULL)
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pLimMsg->bodyptr);
+            vos_mem_free( pLimMsg->bodyptr);
 
 }
 
@@ -7264,18 +7350,18 @@
     tSirMacAddr nullBssid = { 0, 0, 0, 0, 0, 0 };
     WLAN_VOS_DIAG_EVENT_DEF(peEvent, vos_event_wlan_pe_payload_type);
 
-    palZeroMemory(pMac->hHdd, &peEvent, sizeof(vos_event_wlan_pe_payload_type));
+    vos_mem_set(&peEvent, sizeof(vos_event_wlan_pe_payload_type), 0);
 
     if (NULL == pSessionEntry)
     {
-       palCopyMemory(pMac->hHdd, peEvent.bssid, nullBssid, sizeof(tSirMacAddr));
+       vos_mem_copy( peEvent.bssid, nullBssid, sizeof(tSirMacAddr));
        peEvent.sme_state = (tANI_U16)pMac->lim.gLimSmeState;
        peEvent.mlm_state = (tANI_U16)pMac->lim.gLimMlmState;
 
     }
     else
     {
-       palCopyMemory(pMac->hHdd, peEvent.bssid, pSessionEntry->bssId, sizeof(tSirMacAddr));
+       vos_mem_copy(peEvent.bssid, pSessionEntry->bssId, sizeof(tSirMacAddr));
        peEvent.sme_state = (tANI_U16)pSessionEntry->limSmeState;
        peEvent.mlm_state = (tANI_U16)pSessionEntry->limMlmState;
     }
@@ -7299,23 +7385,24 @@
    
    pAddStaSelfParams = (tpAddStaSelfParams)limMsgQ->bodyptr;    
 
-   if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pRsp, sizeof(tSirSmeAddStaSelfRsp)))
+   pRsp = vos_mem_malloc(sizeof(tSirSmeAddStaSelfRsp));
+   if ( NULL == pRsp )
    {
       /// Buffer not available. Log error
-      limLog(pMac, LOGP, FL("call to palAllocateMemory failed for Add Sta self RSP"));
-      palFreeMemory( pMac->hHdd, (tANI_U8 *)pAddStaSelfParams);
+      limLog(pMac, LOGP, FL("call to AllocateMemory failed for Add Sta self RSP"));
+      vos_mem_free(pAddStaSelfParams);
       return;
    }
 
-   palZeroMemory(pMac, (tANI_U8*)pRsp, sizeof(tSirSmeAddStaSelfRsp));
+   vos_mem_set((tANI_U8*)pRsp, sizeof(tSirSmeAddStaSelfRsp), 0);
 
    pRsp->mesgType = eWNI_SME_ADD_STA_SELF_RSP;
    pRsp->mesgLen = (tANI_U16) sizeof(tSirSmeAddStaSelfRsp);
    pRsp->status = pAddStaSelfParams->status;
 
-   palCopyMemory( pMac->hHdd, pRsp->selfMacAddr, pAddStaSelfParams->selfMacAddr, sizeof(tSirMacAddr) );
+   vos_mem_copy( pRsp->selfMacAddr, pAddStaSelfParams->selfMacAddr, sizeof(tSirMacAddr) );
 
-   palFreeMemory( pMac->hHdd, (tANI_U8 *)pAddStaSelfParams);
+   vos_mem_free(pAddStaSelfParams);
 
    mmhMsg.type = eWNI_SME_ADD_STA_SELF_RSP;
    mmhMsg.bodyptr = pRsp;
@@ -7335,23 +7422,24 @@
    
    pDelStaSelfParams = (tpDelStaSelfParams)limMsgQ->bodyptr;    
 
-   if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pRsp, sizeof(tSirSmeDelStaSelfRsp)))
+   pRsp = vos_mem_malloc(sizeof(tSirSmeDelStaSelfRsp));
+   if ( NULL == pRsp )
    {
       /// Buffer not available. Log error
-      limLog(pMac, LOGP, FL("call to palAllocateMemory failed for Add Sta self RSP"));
-      palFreeMemory( pMac->hHdd, (tANI_U8 *)pDelStaSelfParams);
+      limLog(pMac, LOGP, FL("call to AllocateMemory failed for Add Sta self RSP"));
+      vos_mem_free(pDelStaSelfParams);
       return;
    }
 
-   palZeroMemory(pMac, (tANI_U8*)pRsp, sizeof(tSirSmeDelStaSelfRsp));
+   vos_mem_set((tANI_U8*)pRsp, sizeof(tSirSmeDelStaSelfRsp), 0);
 
    pRsp->mesgType = eWNI_SME_DEL_STA_SELF_RSP;
    pRsp->mesgLen = (tANI_U16) sizeof(tSirSmeDelStaSelfRsp);
    pRsp->status = pDelStaSelfParams->status;
 
-   palCopyMemory( pMac->hHdd, pRsp->selfMacAddr, pDelStaSelfParams->selfMacAddr, sizeof(tSirMacAddr) );
+   vos_mem_copy( pRsp->selfMacAddr, pDelStaSelfParams->selfMacAddr, sizeof(tSirMacAddr) );
 
-   palFreeMemory( pMac->hHdd, (tANI_U8 *)pDelStaSelfParams);
+   vos_mem_free(pDelStaSelfParams);
 
    mmhMsg.type = eWNI_SME_DEL_STA_SELF_RSP;
    mmhMsg.bodyptr = pRsp;
@@ -7369,7 +7457,7 @@
 *****************************************************************/
 tANI_U8 limUnmapChannel(tANI_U8 mapChannel)
 {
-    return WDA_MapChannel(mapChannel);
+   return WDA_MapChannel(mapChannel);
 }
 
 
@@ -7454,8 +7542,8 @@
 
     ptr[length++] = SIR_MAC_EID_VENDOR;
     ptr[length++] = ie_len + SIR_MAC_P2P_OUI_SIZE;
-    palCopyMemory( pMac->hHdd, &ptr[length], SIR_MAC_P2P_OUI, SIR_MAC_P2P_OUI_SIZE);
-    palCopyMemory( pMac->hHdd, &ptr[length + SIR_MAC_P2P_OUI_SIZE], data, ie_len);
+    vos_mem_copy(&ptr[length], SIR_MAC_P2P_OUI, SIR_MAC_P2P_OUI_SIZE);
+    vos_mem_copy(&ptr[length + SIR_MAC_P2P_OUI_SIZE], data, ie_len);
     return (ie_len + SIR_P2P_IE_HEADER_LEN);
 }
 
@@ -7464,12 +7552,20 @@
 v_U8_t limGetNoaAttrStreamInMultP2pIes(tpAniSirGlobal pMac,v_U8_t* noaStream,v_U8_t noaLen,v_U8_t overFlowLen)
 {
    v_U8_t overFlowP2pStream[SIR_MAX_NOA_ATTR_LEN];
-   palCopyMemory( pMac->hHdd, overFlowP2pStream, noaStream + noaLen - overFlowLen, overFlowLen); 
-   noaStream[noaLen - overFlowLen] = SIR_MAC_EID_VENDOR;
-   noaStream[noaLen - overFlowLen+1] = overFlowLen + SIR_MAC_P2P_OUI_SIZE;
-   palCopyMemory( pMac->hHdd, noaStream+ noaLen - overFlowLen+2,SIR_MAC_P2P_OUI,SIR_MAC_P2P_OUI_SIZE);
-   
-   palCopyMemory( pMac->hHdd, noaStream+ noaLen - overFlowLen+2+SIR_MAC_P2P_OUI_SIZE,overFlowP2pStream,overFlowLen);
+
+   if ((noaLen <= (SIR_MAX_NOA_ATTR_LEN+SIR_P2P_IE_HEADER_LEN)) &&
+       (noaLen >= overFlowLen) && (overFlowLen <= SIR_MAX_NOA_ATTR_LEN))
+   {
+       vos_mem_copy(overFlowP2pStream,
+                     noaStream + noaLen - overFlowLen, overFlowLen);
+       noaStream[noaLen - overFlowLen] = SIR_MAC_EID_VENDOR;
+       noaStream[noaLen - overFlowLen + 1] = overFlowLen + SIR_MAC_P2P_OUI_SIZE;
+       vos_mem_copy(noaStream+noaLen-overFlowLen + 2,
+                     SIR_MAC_P2P_OUI, SIR_MAC_P2P_OUI_SIZE);
+       vos_mem_copy(noaStream+noaLen + 2 + SIR_MAC_P2P_OUI_SIZE - overFlowLen,
+                    overFlowP2pStream, overFlowLen);
+   }
+
    return (noaLen + SIR_P2P_IE_HEADER_LEN);
 
 }
@@ -7630,8 +7726,8 @@
     tempParam.opMode = chanWidth;
     tempParam.staId  = staId;
     tempParam.smesessionId = psessionEntry->smeSessionId;
-    palCopyMemory( pMac->hHdd,  tempParam.peer_mac, psessionEntry->bssId,
-                   sizeof( tSirMacAddr ));
+    vos_mem_copy(tempParam.peer_mac, psessionEntry->bssId,
+                 sizeof(tSirMacAddr));
 
 
     limSendModeUpdate( pMac, &tempParam, psessionEntry );
@@ -7649,7 +7745,7 @@
     tempParamMembership.membership = membership;
     tempParamMembership.staId  = staId;
     tempParamMembership.smesessionId = psessionEntry->smeSessionId;
-    palCopyMemory( pMac->hHdd,  tempParamMembership.peer_mac, psessionEntry->bssId,
+    vos_mem_copy(tempParamMembership.peer_mac, psessionEntry->bssId,
                    sizeof( tSirMacAddr ));
 
 
@@ -7658,7 +7754,7 @@
     tempParamUserPosition.userPos = userPosition;
     tempParamUserPosition.staId  = staId;
     tempParamUserPosition.smesessionId = psessionEntry->smeSessionId;
-    palCopyMemory( pMac->hHdd,  tempParamUserPosition.peer_mac, psessionEntry->bssId,
+    vos_mem_copy(tempParamUserPosition.peer_mac, psessionEntry->bssId,
                    sizeof( tSirMacAddr ));
 
 
diff --git a/CORE/MAC/src/pe/lim/limUtils.h b/CORE/MAC/src/pe/lim/limUtils.h
index 9f3f226..ff179de 100644
--- a/CORE/MAC/src/pe/lim/limUtils.h
+++ b/CORE/MAC/src/pe/lim/limUtils.h
@@ -335,6 +335,8 @@
 
 void limDeleteStaContext(tpAniSirGlobal pMac, tpSirMsgQ limMsg);
 void limProcessAddBaInd(tpAniSirGlobal pMac, tpSirMsgQ limMsg);
+void limDeleteBASessions(tpAniSirGlobal pMac, tpPESession pSessionEntry, tANI_U32 baDirection);
+void limDelPerBssBASessionsBtc(tpAniSirGlobal pMac);
 void limDelAllBASessions(tpAniSirGlobal pMac);
 void limDeleteDialogueTokenList(tpAniSirGlobal pMac);
 tSirRetStatus limSearchAndDeleteDialogueToken(tpAniSirGlobal pMac, tANI_U8 token, tANI_U16 assocId, tANI_U16 tid);
@@ -455,6 +457,12 @@
     WLAN_PE_DIAG_HAL_ADDBA_REQ_EVENT,
     WLAN_PE_DIAG_HAL_ADDBA_RSP_EVENT,
     WLAN_PE_DIAG_HAL_DELBA_IND_EVENT,
+    WLAN_PE_DIAG_HB_FAILURE_TIMEOUT,
+    WLAN_PE_DIAG_PRE_AUTH_REQ_EVENT,
+    WLAN_PE_DIAG_PRE_AUTH_RSP_EVENT,
+    WLAN_PE_DIAG_PREAUTH_DONE,
+    WLAN_PE_DIAG_REASSOCIATING,
+    WLAN_PE_DIAG_CONNECTED,
 }WLAN_PE_DIAG_EVENT_TYPE;
 
 void limDiagEventReport(tpAniSirGlobal pMac, tANI_U16 eventType, tpPESession pSessionEntry, tANI_U16 status, tANI_U16 reasonCode);
diff --git a/CORE/MAC/src/pe/pmm/pmmApi.c b/CORE/MAC/src/pe/pmm/pmmApi.c
index ee8d739..77e53c6 100644
--- a/CORE/MAC/src/pe/pmm/pmmApi.c
+++ b/CORE/MAC/src/pe/pmm/pmmApi.c
@@ -307,10 +307,6 @@
 
     tPmmState origState = pMac->pmm.gPmmState;
 
-#ifdef FEATURE_WLAN_DIAG_SUPPORT 
-    limDiagEventReport(pMac, WLAN_PE_DIAG_EXIT_BMPS_REQ_EVENT, peGetValidPowerSaveSession(pMac), 0, (tANI_U16)pExitBmpsInfo->exitBmpsReason);
-#endif //FEATURE_WLAN_DIAG_SUPPORT
-
     if (NULL == pExitBmpsInfo)
     {
         respStatus = eSIR_SME_BMPS_REQ_REJECT;
@@ -318,6 +314,12 @@
         goto failure;
     }
 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+    limDiagEventReport(pMac, WLAN_PE_DIAG_EXIT_BMPS_REQ_EVENT,
+                       peGetValidPowerSaveSession(pMac), 0,
+                       (tANI_U16)pExitBmpsInfo->exitBmpsReason);
+#endif //FEATURE_WLAN_DIAG_SUPPORT
+
     /* PMC is not aware of Background scan, which is done in
      * BMPS mode while Nth Beacon is delivered. Essentially, PMC
      * can request the device to get out of power-save while
@@ -340,7 +342,7 @@
          * checked when PMM receives SIR_HAL_EXIT_BMPS_RSP from HAL
          */
         pMac->pmm.gPmmExitBmpsReasonCode = pExitBmpsInfo->exitBmpsReason;
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pExitBmpsInfo);
+        vos_mem_free(pExitBmpsInfo);
 
         PELOGW(pmmLog(pMac, LOGW, 
             FL("pmmBmps: Rcvd EXIT_BMPS with reason code%d "), pMac->pmm.gPmmExitBmpsReasonCode);)
@@ -369,7 +371,7 @@
 
         respStatus = eSIR_SME_INVALID_PMM_STATE;
         pmmBmpsUpdateInvalidStateCnt(pMac);
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pExitBmpsInfo);
+        vos_mem_free(pExitBmpsInfo);
         goto failure;
     }
     return;
@@ -540,9 +542,10 @@
     tpPESession psessionEntry;
     tANI_U8  currentOperatingChannel = limGetCurrentOperatingChannel(pMac);
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pExitBmpsParams, sizeof(*pExitBmpsParams)) )
+    pExitBmpsParams = vos_mem_malloc(sizeof(*pExitBmpsParams));
+    if ( NULL == pExitBmpsParams )
     {
-        pmmLog(pMac, LOGW, FL("palAllocateMemory() failed"));
+        pmmLog(pMac, LOGW, FL("Failed to allocate memory"));
         retStatus = eSIR_MEM_ALLOC_FAILED;
         return retStatus;
     }
@@ -550,11 +553,11 @@
     if((psessionEntry = peGetValidPowerSaveSession(pMac)) == NULL )
     {
         retStatus = eSIR_FAILURE;
-        palFreeMemory(pMac->hHdd, (tANI_U8*)pExitBmpsParams);
+        vos_mem_free(pExitBmpsParams);
         return retStatus;
     }
 
-    palZeroMemory( pMac->hHdd, (tANI_U8 *)pExitBmpsParams, sizeof(*pExitBmpsParams));
+    vos_mem_set( (tANI_U8 *)pExitBmpsParams, sizeof(*pExitBmpsParams), 0);
     msgQ.type = WDA_EXIT_BMPS_REQ;
     msgQ.reserved = 0;
     msgQ.bodyptr = pExitBmpsParams;
@@ -582,7 +585,7 @@
     if( eSIR_SUCCESS != retStatus )
     {
         PELOGE(pmmLog( pMac, LOGE, FL("Sending WDA_EXIT_BMPS_REQ failed, reason=%X "), retStatus );)
-        palFreeMemory(pMac->hHdd, (tANI_U8*)pExitBmpsParams);
+        vos_mem_free(pExitBmpsParams);
         return retStatus;
     }
 
@@ -618,9 +621,8 @@
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
     tpEnterBmpsParams pBmpsParams = NULL;
-    tANI_U8     i = 0;
     tANI_U32    rssiFilterPeriod = 5;
-    tANI_U32    numBeaconPerRssiAverage = 5;
+    tANI_U32    numBeaconPerRssiAverage = 20;
     tANI_U32    bRssiFilterEnable = FALSE;
 
     if(psessionEntry->currentBssBeaconCnt == 0 )
@@ -629,7 +631,8 @@
         return eSIR_FAILURE;
     }
 
-    if (palAllocateMemory(pMac->hHdd, (void **)&pBmpsParams, sizeof(tEnterBmpsParams)) != eHAL_STATUS_SUCCESS)
+    pBmpsParams = vos_mem_malloc(sizeof(tEnterBmpsParams));
+    if ( NULL == pBmpsParams )
     {
         pmmLog(pMac, LOGP, "PMM: Not able to allocate memory for Enter Bmps");
         return eSIR_FAILURE;
@@ -643,52 +646,23 @@
     pBmpsParams->dtimPeriod = psessionEntry->lastBeaconDtimPeriod;
     pBmpsParams->bssIdx = psessionEntry->bssIdx;
 
+    /* TODO: Config parameters (Rssi filter period, FW RSSI Monitoring
+       and Number of beacons per RSSI average) values sent down to FW during
+       initial exchange (driver load) is same as ENTER_BMPS_REQ.
+       Sending these values again in ENTER_BMPS_REQ is not required
+       (can be removed). This is kept as-is for now to support
+       backward compatibility with the older host running on new FW. */
+
     if(wlan_cfgGetInt(pMac, WNI_CFG_RSSI_FILTER_PERIOD, &rssiFilterPeriod) != eSIR_SUCCESS)
         pmmLog(pMac, LOGP, FL("pmmCfg: cfgGet failed for Rssi filter period"));
+    pBmpsParams->rssiFilterPeriod = (tANI_U8)rssiFilterPeriod;
 
-    // This flag can be overwritten when 11r/CCXEnabled=1 or FastTransition=1
     if(wlan_cfgGetInt(pMac, WNI_CFG_PS_ENABLE_RSSI_MONITOR, &bRssiFilterEnable) != eSIR_SUCCESS)
         pmmLog(pMac, LOGP, FL("pmmCfg: cfgGet failed for Rssi monitor enable flag"));
     pBmpsParams->bRssiFilterEnable = bRssiFilterEnable;
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX)
-    // If there is a CCX assoc or 11r assoc we need to pick up the rssiFilterPeriod from the
-    // FT config value.
-    if (TRUE != pBmpsParams->bRssiFilterEnable)
-    {
-        for (i = 0; i < pMac->lim.maxBssId; i++)
-        {
-            if (limisFastTransitionRequired(pMac, i))
-            {
-                // We need to override the ini value to enable
-                // FW RSSI Monitoring. Basically if CCX or FT are enabled
-                // then enable FW RSSI Monitoring
-                pBmpsParams->bRssiFilterEnable = TRUE;
-                break;
-            }
-        }
-    }
-#endif
-
-#ifdef FEATURE_WLAN_LFR
-    /* if LFR is enabled, then enabled FW RSSI Monitoring */
-    if (TRUE != pBmpsParams->bRssiFilterEnable)
-    {
-        for (i = 0; i < pMac->lim.maxBssId; i++)
-        {
-            if (limIsFastRoamEnabled(pMac, i))
-            {
-                pBmpsParams->bRssiFilterEnable = TRUE;
-                break;
-            }
-        }
-    }
-#endif
-
-    pBmpsParams->rssiFilterPeriod = (tANI_U8)rssiFilterPeriod;
-
-    /* The numBeaconPerRssiAverage should be less than the max allowed (default set to 20 in CFG)
-     */
+    /* The numBeaconPerRssiAverage should be less than
+       the max allowed (default set to 20 in CFG) */
     if(wlan_cfgGetInt(pMac, WNI_CFG_NUM_BEACON_PER_RSSI_AVERAGE, &numBeaconPerRssiAverage) != eSIR_SUCCESS)
         pmmLog(pMac, LOGP, FL("pmmCfg: cfgGet failed for num beacon per rssi"));
 
@@ -715,7 +689,7 @@
     MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, msgQ.type));
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
-        palFreeMemory(pMac->hHdd, pBmpsParams);
+        vos_mem_free(pBmpsParams);
         PELOGE(pmmLog( pMac, LOGE,
             FL("Posting WDA_ENTER_BMPS_REQ to HAL failed, reason=%X"),
             retCode );)
@@ -803,7 +777,7 @@
     pUpdatedPwrSaveCfg->ignoreDtim = (tANI_U8) ignoreDtim;
 
     //Save a copy of the CFG in global pmm context.
-    palCopyMemory( pMac->hHdd, (tANI_U8 *) &pMac->pmm.gPmmCfg,  pUpdatedPwrSaveCfg, sizeof(tSirPowerSaveCfg));
+    vos_mem_copy( (tANI_U8 *) &pMac->pmm.gPmmCfg,  pUpdatedPwrSaveCfg, sizeof(tSirPowerSaveCfg));
 
 
     msgQ.type = WDA_PWR_SAVE_CFG;
@@ -827,7 +801,7 @@
     /* In case of failure, we need to free the memory */
     if (NULL != pUpdatedPwrSaveCfg)
     {
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pUpdatedPwrSaveCfg);
+        vos_mem_free(pUpdatedPwrSaveCfg);
     }
     return retCode;
 }
@@ -870,7 +844,7 @@
 
     if((psessionEntry = peFindSessionBySessionId(pMac,PowersavesessionId))==NULL)
     {
-        limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
+        pmmLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
         return;
     }
 
@@ -981,7 +955,7 @@
 
     if((psessionEntry = peFindSessionBySessionId(pMac,pwrSaveSessionId))==NULL)
     {
-        limLog(pMac, LOGE,FL("Session Does not exist for given sessionID"));
+        pmmLog(pMac, LOGE,FL("Session Does not exist for given sessionID"));
         return;
     }
 
@@ -1076,7 +1050,8 @@
 
     if(psessionEntry == NULL)
     {
-      PELOGE(limLog(pMac, LOGE,FL("Session does Not exist with given sessionId :%d "),powersavesessionId);)
+      PELOGE(pmmLog(pMac, LOGE,
+             FL("Session does Not exist with given sessionId :%d "),powersavesessionId);)
       return;
     }
 
@@ -1195,11 +1170,12 @@
             tpSirPowerSaveCfg pPSCfg;
             tSirMbMsg *pMbMsg = (tSirMbMsg *)pMsg->bodyptr;
 
-            if (palAllocateMemory(pMac->hHdd, (void **)&pPSCfg, sizeof(tSirPowerSaveCfg)) != eHAL_STATUS_SUCCESS)
+            pPSCfg = vos_mem_malloc(sizeof(tSirPowerSaveCfg));
+            if ( NULL == pPSCfg )
             {
                 pmmLog(pMac, LOGP, "PMM: Not able to allocate memory for PMC Config");
             }
-            (void) palCopyMemory(pMac->hHdd, pPSCfg, pMbMsg->data, sizeof(tSirPowerSaveCfg));
+            (void) vos_mem_copy(pPSCfg, pMbMsg->data, sizeof(tSirPowerSaveCfg));
             (void) pmmSendPowerSaveCfg(pMac, pPSCfg);
         }
             break;
@@ -1217,11 +1193,12 @@
             tpExitBmpsInfo  pExitBmpsInfo;
             tSirMbMsg      *pMbMsg = (tSirMbMsg *)pMsg->bodyptr;
 
-            if (palAllocateMemory(pMac->hHdd, (void **)&pExitBmpsInfo, sizeof(tExitBmpsInfo)) != eHAL_STATUS_SUCCESS)
+            pExitBmpsInfo = vos_mem_malloc(sizeof(tExitBmpsInfo));
+            if ( NULL == pExitBmpsInfo )
             {
                 pmmLog(pMac, LOGP, "PMM: Failed to allocate memory for Exit BMPS Info ");
             }
-            (void) palCopyMemory(pMac->hHdd, pExitBmpsInfo, pMbMsg->data, sizeof(tExitBmpsInfo));
+            (void) vos_mem_copy(pExitBmpsInfo, pMbMsg->data, sizeof(tExitBmpsInfo));
             (void) pmmExitBmpsRequestHandler(pMac, pExitBmpsInfo);
         }
             break;
@@ -1310,7 +1287,7 @@
 
     if (NULL != pMsg->bodyptr)
     {
-        palFreeMemory(pMac->hHdd, (tANI_U8 *)pMsg->bodyptr);
+        vos_mem_free(pMsg->bodyptr);
         pMsg->bodyptr = NULL;
     }
 }
@@ -1841,7 +1818,7 @@
 
     if((psessionEntry = peFindSessionBySessionId(pMac,PowersavesessionId))==NULL)
     {
-        limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
+        pmmLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
         return;
     }
 
@@ -1981,7 +1958,7 @@
     PowersavesessionId = pMac->pmm.sessionId;
     if((psessionEntry = peFindSessionBySessionId(pMac,PowersavesessionId))==NULL)
     {
-        limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
+        pmmLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
         return;
     }
 
@@ -2035,12 +2012,13 @@
     tSirRetStatus          retCode = eSIR_SUCCESS;
     tSirMsgQ               msgQ;
 
-    if (palAllocateMemory(pMac->hHdd, (void **)&pBcastPtrn, sizeof(*pBcastPtrn)) != eHAL_STATUS_SUCCESS)
+    pBcastPtrn = vos_mem_malloc(sizeof(*pBcastPtrn));
+    if ( NULL == pBcastPtrn )
     {
         pmmLog(pMac, LOGP, FL("Fail to allocate memory for WoWLAN Add Bcast Pattern "));
         return;
     }
-    (void) palCopyMemory(pMac->hHdd, pBcastPtrn, pMbMsg->data, sizeof(*pBcastPtrn));
+    (void) vos_mem_copy(pBcastPtrn, pMbMsg->data, sizeof(*pBcastPtrn));
 
     if (NULL == pBcastPtrn)
     {
@@ -2061,7 +2039,7 @@
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
         if (pBcastPtrn != NULL)
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pBcastPtrn);
+            vos_mem_free(pBcastPtrn);
         pmmLog( pMac, LOGP, FL("Posting WDA_WOWL_ADD_BCAST_PTRN failed, reason=%X"), retCode );
     }
     return;
@@ -2082,12 +2060,13 @@
     tSirRetStatus           retCode = eSIR_SUCCESS;
     tSirMsgQ                msgQ;
 
-    if (palAllocateMemory(pMac->hHdd, (void **)&pDeletePtrn, sizeof(*pDeletePtrn)) != eHAL_STATUS_SUCCESS)
+    pDeletePtrn = vos_mem_malloc(sizeof(*pDeletePtrn));
+    if ( NULL == pDeletePtrn )
     {
         pmmLog(pMac, LOGP, FL("Fail to allocate memory for WoWLAN Delete Bcast Pattern "));
         return;
     }
-    (void) palCopyMemory(pMac->hHdd, pDeletePtrn, pMbMsg->data, sizeof(*pDeletePtrn));
+    (void) vos_mem_copy(pDeletePtrn, pMbMsg->data, sizeof(*pDeletePtrn));
 
     if (NULL == pDeletePtrn)
     {
@@ -2108,7 +2087,7 @@
     if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
     {
         if (NULL != pDeletePtrn)
-            palFreeMemory( pMac->hHdd, (tANI_U8 *) pDeletePtrn);
+            vos_mem_free(pDeletePtrn);
         pmmLog( pMac, LOGP, FL("Posting WDA_WOWL_DEL_BCAST_PTRN failed, reason=%X"), retCode );
     }
     return;
@@ -2140,7 +2119,7 @@
     pSmeWowlParams = (tpSirSmeWowlEnterParams)(pMbMsg->data);
     if (NULL == pSmeWowlParams)
     {
-        limLog(pMac, LOGE,
+        pmmLog(pMac, LOGE,
                FL("NULL message received"));
         return;
     }
@@ -2152,7 +2131,7 @@
                                          &peSessionId);
     if (NULL == pSessionEntry)
     {
-        limLog(pMac, LOGE,
+        pmmLog(pMac, LOGE,
                FL("session does not exist for given BSSId"));
         goto end;
     }
@@ -2178,17 +2157,19 @@
 
 skip_pmm_state_check:
 
-    if (palAllocateMemory(pMac->hHdd, (void **)&pHalWowlParams, sizeof(*pHalWowlParams)) != eHAL_STATUS_SUCCESS)
+    pHalWowlParams = vos_mem_malloc(sizeof(*pHalWowlParams));
+    if ( NULL == pHalWowlParams )
     {
         pmmLog(pMac, LOGP, FL("Fail to allocate memory for Enter Wowl Request "));
         goto end;
     }
-    (void) palZeroMemory(pMac->hHdd, (tANI_U8 *)pHalWowlParams, sizeof(*pHalWowlParams) );
+    (void) vos_mem_set((tANI_U8 *)pHalWowlParams, sizeof(*pHalWowlParams), 0);
 
     // fill in the message field
     pHalWowlParams->ucMagicPktEnable = pSmeWowlParams->ucMagicPktEnable;
     pHalWowlParams->ucPatternFilteringEnable = pSmeWowlParams->ucPatternFilteringEnable;
-    (void)palCopyMemory( pMac->hHdd, (tANI_U8 *)pHalWowlParams->magicPtrn, (tANI_U8 *)pSmeWowlParams->magicPtrn, sizeof(tSirMacAddr) );
+    (void)vos_mem_copy( (tANI_U8 *)pHalWowlParams->magicPtrn, (tANI_U8 *)pSmeWowlParams->magicPtrn,
+                         sizeof(tSirMacAddr) );
 
 #ifdef WLAN_WAKEUP_EVENTS
     pHalWowlParams->ucWoWEAPIDRequestEnable = pSmeWowlParams->ucWoWEAPIDRequestEnable;
@@ -2203,42 +2184,42 @@
 
     if(wlan_cfgGetInt(pMac, WNI_CFG_WOWLAN_UCAST_PATTERN_FILTER_ENABLE, &cfgValue) != eSIR_SUCCESS)
     {
-        limLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_UCAST_PATTERN_FILTER_ENABLE"));
+        pmmLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_UCAST_PATTERN_FILTER_ENABLE"));
         goto end;
     }
     pHalWowlParams->ucUcastPatternFilteringEnable = (tANI_U8)cfgValue;
 
     if(wlan_cfgGetInt(pMac, WNI_CFG_WOWLAN_CHANNEL_SWITCH_ENABLE, &cfgValue) != eSIR_SUCCESS)
     {
-        limLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_CHANNEL_SWITCH_ENABLE"));
+        pmmLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_CHANNEL_SWITCH_ENABLE"));
         goto end;
     }
     pHalWowlParams->ucWowChnlSwitchRcv = (tANI_U8)cfgValue;
 
     if(wlan_cfgGetInt(pMac, WNI_CFG_WOWLAN_DEAUTH_ENABLE, &cfgValue) != eSIR_SUCCESS)
     {
-       limLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_DEAUTH_ENABLE "));
+       pmmLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_DEAUTH_ENABLE "));
        goto end;
     }
     pHalWowlParams->ucWowDeauthRcv = (tANI_U8)cfgValue;
 
     if(wlan_cfgGetInt(pMac, WNI_CFG_WOWLAN_DISASSOC_ENABLE, &cfgValue) != eSIR_SUCCESS)
     {
-        limLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_DEAUTH_ENABLE "));
+        pmmLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_DEAUTH_ENABLE "));
         goto end;
     }
     pHalWowlParams->ucWowDisassocRcv = (tANI_U8)cfgValue;
 
     if(wlan_cfgGetInt(pMac, WNI_CFG_WOWLAN_MAX_MISSED_BEACON, &cfgValue) != eSIR_SUCCESS)
     {
-        limLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_MAX_MISSED_BEACON "));
+        pmmLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_MAX_MISSED_BEACON "));
         goto end;
     }
     pHalWowlParams->ucWowMaxMissedBeacons = (tANI_U8)cfgValue;
 
     if(wlan_cfgGetInt(pMac, WNI_CFG_WOWLAN_MAX_SLEEP_PERIOD, &cfgValue) != eSIR_SUCCESS)
     {
-        limLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_MAX_SLEEP_PERIOD "));
+        pmmLog(pMac, LOGP, FL("cfgGet failed for WNI_CFG_WOWLAN_MAX_SLEEP_PERIOD "));
         goto end;
     }
     pHalWowlParams->ucWowMaxSleepUsec = (tANI_U8)cfgValue;
@@ -2255,7 +2236,7 @@
 
 end:
     if (pHalWowlParams != NULL)
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pHalWowlParams);
+        vos_mem_free(pHalWowlParams);
     return;
 }
 
@@ -2377,14 +2358,15 @@
 
     if((pSessionEntry = peFindSessionBySessionId(pMac,PowersavesessionId)) == NULL )
     {
-        PELOGW(pmmLog(pMac, LOGE, FL("pmmWowl :palAllocateMemory() failed"));)
+        PELOGW(pmmLog(pMac, LOGE, FL("pmmWowl : failed to allocate memory"));)
         smeRspCode = eSIR_SME_WOWL_EXIT_REQ_FAILED;
         goto failure;
     }
 
 skip_pe_session_lookup:
 
-    if (palAllocateMemory(pMac->hHdd, (void **)&pHalWowlMsg, sizeof(*pHalWowlMsg)) != eHAL_STATUS_SUCCESS)
+    pHalWowlMsg = vos_mem_malloc(sizeof(*pHalWowlMsg));
+    if ( NULL == pHalWowlMsg )
     {
         pmmLog(pMac, LOGP, FL("Fail to allocate memory for WoWLAN Add Bcast Pattern "));
         smeRspCode = eSIR_SME_WOWL_EXIT_REQ_FAILED;
@@ -2404,10 +2386,10 @@
         goto failure;
     }
 
-    (void) palZeroMemory(pMac->hHdd, (tANI_U8 *)pHalWowlMsg, sizeof(*pHalWowlMsg) );
+    (void) vos_mem_set((tANI_U8 *)pHalWowlMsg, sizeof(*pHalWowlMsg), 0);
 
     if (!pMac->psOffloadEnabled)
-        pHalWowlMsg->bssIdx = pSessionEntry->bssIdx;
+          pHalWowlMsg->bssIdx = pSessionEntry->bssIdx;
 
     pHalWowlMsg->sessionId = pSmeWowlParams->sessionId;
     if((retStatus = pmmSendExitWowlReq(pMac, pHalWowlMsg)) != eSIR_SUCCESS)
@@ -2422,7 +2404,7 @@
 
 failure:
     if (pHalWowlMsg != NULL)
-        palFreeMemory( pMac->hHdd, (tANI_U8 *) pHalWowlMsg);
+       vos_mem_free(pHalWowlMsg);
     limSendSmeRsp(pMac, eWNI_PMC_EXIT_WOWL_RSP, smeRspCode, 0, 0);
     return;
 }
@@ -2589,21 +2571,22 @@
 
     if((pSessionEntry = peGetValidPowerSaveSession(pMac)) == NULL )
     {
-        PELOGW(pmmLog(pMac, LOGW, FL("pmmUapsd :palAllocateMemory() failed"));)
+        PELOGW(pmmLog(pMac, LOGW, FL("pmmUapsd : failed to allocate memory"));)
         retStatus = eSIR_FAILURE;
         return retStatus;
     }
 
     if (SIR_PM_SLEEP_MODE == mode)
     {
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pUapsdParams, sizeof(tUapsdParams)) )
+        pUapsdParams = vos_mem_malloc(sizeof(tUapsdParams));
+        if ( NULL == pUapsdParams )
         {
-            PELOGW(pmmLog(pMac, LOGW, FL("pmmUapsd :palAllocateMemory() failed"));)
+            PELOGW(pmmLog(pMac, LOGW, FL("pmmUapsd : failed to allocate memory"));)
             retStatus = eSIR_MEM_ALLOC_FAILED;
             return retStatus;
         }
 
-        palZeroMemory( pMac->hHdd, (tANI_U8 *)pUapsdParams, sizeof(tUapsdParams));
+        vos_mem_set( (tANI_U8 *)pUapsdParams, sizeof(tUapsdParams), 0);
         msgQ.type = WDA_ENTER_UAPSD_REQ;
         msgQ.bodyptr = pUapsdParams;
 
@@ -2620,19 +2603,19 @@
         pUapsdParams->voTriggerEnabled = LIM_UAPSD_GET(ACVO, uapsdTriggerMask);
         pUapsdParams->bssIdx = pSessionEntry->bssIdx;
 
-        PELOGE(pmmLog(pMac, LOGE, 
+        PELOGW(pmmLog(pMac, LOGW,
                       FL("UAPSD Mask:  static = 0x%x, DeliveryEnabled = 0x%x, TriggerEnabled = 0x%x "),
             pMac->lim.gUapsdPerAcBitmask,
             pMac->lim.gUapsdPerAcDeliveryEnableMask,
             pMac->lim.gUapsdPerAcTriggerEnableMask);)
 
-        PELOG1(pmmLog(pMac, LOG1, FL("Delivery Enabled: BK=%d, BE=%d, Vi=%d, Vo=%d "),
+        PELOGW(pmmLog(pMac, LOGW, FL("Delivery Enabled: BK=%d, BE=%d, Vi=%d, Vo=%d "),
             pUapsdParams->bkDeliveryEnabled, 
             pUapsdParams->beDeliveryEnabled, 
             pUapsdParams->viDeliveryEnabled, 
             pUapsdParams->voDeliveryEnabled);)
 
-        PELOG1(pmmLog(pMac, LOG1, FL("Trigger Enabled: BK=%d, BE=%d, Vi=%d, Vo=%d "),
+        PELOGW(pmmLog(pMac, LOGW, FL("Trigger Enabled: BK=%d, BE=%d, Vi=%d, Vo=%d "),
             pUapsdParams->bkTriggerEnabled, 
             pUapsdParams->beTriggerEnabled, 
             pUapsdParams->viTriggerEnabled, 
@@ -2642,14 +2625,15 @@
     }
     else
     {
-        if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pExitUapsdParams, sizeof(tExitUapsdParams)) )
+        pExitUapsdParams = vos_mem_malloc(sizeof(tExitUapsdParams));
+        if ( NULL == pExitUapsdParams )
         {
-            PELOGW(pmmLog(pMac, LOGW, FL("pmmUapsd :palAllocateMemory() failed"));)
+            PELOGW(pmmLog(pMac, LOGW, FL("pmmUapsd : failed to allocate memory"));)
             retStatus = eSIR_MEM_ALLOC_FAILED;
             return retStatus;
         }
 
-        palZeroMemory( pMac->hHdd, (tANI_U8 *)pExitUapsdParams, sizeof(tExitUapsdParams));
+        vos_mem_set( (tANI_U8 *)pExitUapsdParams, sizeof(tExitUapsdParams), 0);
         msgQ.type = WDA_EXIT_UAPSD_REQ;
         msgQ.bodyptr = pExitUapsdParams;
         pExitUapsdParams->bssIdx = pSessionEntry->bssIdx;
@@ -2671,9 +2655,9 @@
             FL("pmmUapsd: WDA_ENTER/EXIT_UAPSD_REQ to HAL failed, reason=%X"),
             retStatus);)
         if (SIR_PM_SLEEP_MODE == mode)
-            palFreeMemory(pMac->hHdd, (tANI_U8*)pUapsdParams);
+            vos_mem_free(pUapsdParams);
         else
-            palFreeMemory(pMac->hHdd, (tANI_U8*)pExitUapsdParams);
+            vos_mem_free(pExitUapsdParams);
     }
 
     return retStatus;
@@ -3191,16 +3175,16 @@
         return eSIR_SUCCESS;
     }
 
-    if(eHAL_STATUS_SUCCESS !=
-       palAllocateMemory(pMac->hHdd, (void **)&pEnablePsReqParams,
-                         sizeof(tEnablePsParams)))
+    pEnablePsReqParams = vos_mem_malloc(sizeof(tEnablePsParams));
+    if (NULL == pEnablePsReqParams)
     {
-        pmmLog(pMac, LOGE, FL("palAllocateMemory() failed"));
+        pmmLog(pMac, LOGE,
+               FL("Memory allocation failed for pEnablePsReqParams"));
         return eSIR_MEM_ALLOC_FAILED;
     }
 
     /* Fill the BSSID  corresponding to PS Req */
-    palCopyMemory(pMac->hHdd, pEnablePsReqParams->bssid, psReqData->bssId,
+    vos_mem_copy(pEnablePsReqParams->bssid, psReqData->bssId,
                  sizeof(tSirMacAddr));
 
     /* Fill the Sme Session Id */
@@ -3223,7 +3207,7 @@
     if(eSIR_SUCCESS != wdaPostCtrlMsg(pMac, &msgQ))
     {
         pmmLog(pMac, LOGE, FL("Posting WDA_ENTER_BMPS_REQ failed"));
-        palFreeMemory(pMac->hHdd, pEnablePsReqParams);
+        vos_mem_free(pEnablePsReqParams);
         return eSIR_FAILURE;
     }
     /*
@@ -3327,16 +3311,15 @@
         return eSIR_FAILURE;
     }
 
-    if(eHAL_STATUS_SUCCESS !=
-       palAllocateMemory(pMac->hHdd, (void **)&pDisablePsReqParams,
-                         sizeof(tDisablePsParams)))
+    pDisablePsReqParams = vos_mem_malloc(sizeof(tDisablePsParams));
+    if (NULL == pDisablePsReqParams)
     {
-        pmmLog(pMac, LOGE, FL("palAllocateMemory() failed"));
+        pmmLog(pMac, LOGE, FL("Memory allocation failed for tDisablePsParams"));
         return eSIR_MEM_ALLOC_FAILED;
     }
 
     /* Fill the BSSID  corresponding to PS Req */
-    palCopyMemory(pMac->hHdd, pDisablePsReqParams->bssid, psReqData->bssId,
+    vos_mem_copy(pDisablePsReqParams->bssid, psReqData->bssId,
                  sizeof(tSirMacAddr));
 
     /* Fill the Sme Session Id */
@@ -3350,7 +3333,7 @@
     if(eSIR_SUCCESS != wdaPostCtrlMsg(pMac, &msgQ))
     {
         pmmLog(pMac, LOGE, FL("Posting WDA_EXIT_BMPS_REQ failed"));
-        palFreeMemory(pMac->hHdd, pDisablePsReqParams);
+        vos_mem_free(pDisablePsReqParams);
         return eSIR_FAILURE;
     }
     /*
@@ -3447,11 +3430,11 @@
         return eSIR_FAILURE;
     }
 
-    if(eHAL_STATUS_SUCCESS !=
-       palAllocateMemory(pMac->hHdd, (void **)&pEnableUapsdReqParams,
-                         sizeof(tEnableUapsdParams)))
+    pEnableUapsdReqParams = vos_mem_malloc(sizeof(tEnableUapsdParams));
+    if (NULL == pEnableUapsdReqParams)
     {
-        pmmLog(pMac, LOGE, FL("palAllocateMemory() failed"));
+        pmmLog(pMac, LOGE,
+               FL("Memory allocation failed for pEnableUapsdReqParams"));
         return eSIR_MEM_ALLOC_FAILED;
     }
 
@@ -3486,7 +3469,7 @@
                              LIM_UAPSD_GET(ACVO, uapsdTriggerMask);
 
     /* Fill the BSSID  corresponding to PS Req */
-    palCopyMemory(pMac->hHdd, pEnableUapsdReqParams->bssid, psReqData->bssId,
+    vos_mem_copy(pEnableUapsdReqParams->bssid, psReqData->bssId,
                  sizeof(tSirMacAddr));
 
     /* Fill the Sme Session Id */
@@ -3500,7 +3483,7 @@
     if(eSIR_SUCCESS != wdaPostCtrlMsg(pMac, &msgQ))
     {
         pmmLog(pMac, LOGE, FL("Posting WDA_ENTER_UAPSD_REQ failed"));
-        palFreeMemory(pMac->hHdd, pEnableUapsdReqParams);
+        vos_mem_free(pEnableUapsdReqParams);
         return eSIR_FAILURE;
     }
 
@@ -3593,17 +3576,17 @@
         return eSIR_FAILURE;
     }
 
-    if(eHAL_STATUS_SUCCESS !=
-       palAllocateMemory(pMac->hHdd, (void **)&pDisableUapsdReqParams,
-                         sizeof(tDisablePsParams)))
+    pDisableUapsdReqParams = vos_mem_malloc(sizeof(tDisablePsParams));
+    if (NULL == pDisableUapsdReqParams)
     {
-        pmmLog(pMac, LOGE, FL("palAllocateMemory() failed"));
+        pmmLog(pMac, LOGE,
+               FL("Memory allocation failed for pDisableUapsdReqParams"));
         return eSIR_MEM_ALLOC_FAILED;
     }
 
     /* Fill the BSSID  corresponding to PS Req */
-    palCopyMemory(pMac->hHdd, pDisableUapsdReqParams->bssid, psReqData->bssId,
-                  sizeof(tSirMacAddr));
+    vos_mem_copy(pDisableUapsdReqParams->bssid, psReqData->bssId,
+                 sizeof(tSirMacAddr));
 
     /* Fill the Sme Session Id */
     pDisableUapsdReqParams->sessionid = psessionEntry->smeSessionId;
@@ -3616,7 +3599,7 @@
     if(eSIR_SUCCESS != wdaPostCtrlMsg(pMac, &msgQ))
     {
         pmmLog(pMac, LOGE, FL("Posting WDA_EXIT_UAPSD_REQ failed"));
-        palFreeMemory(pMac->hHdd, pDisableUapsdReqParams);
+        vos_mem_free(pDisableUapsdReqParams);
         return eSIR_FAILURE;
     }
 
@@ -3753,7 +3736,7 @@
 
     if (NULL != pMsg->bodyptr)
     {
-        palFreeMemory(pMac->hHdd, pMsg->bodyptr);
+        vos_mem_free(pMsg->bodyptr);
         pMsg->bodyptr = NULL;
     }
 }
diff --git a/CORE/MAC/src/pe/pmm/pmmDebug.c b/CORE/MAC/src/pe/pmm/pmmDebug.c
index b0c902f..6003037 100644
--- a/CORE/MAC/src/pe/pmm/pmmDebug.c
+++ b/CORE/MAC/src/pe/pmm/pmmDebug.c
@@ -39,23 +39,23 @@
   
   ========================================================================*/
 
+#include "vos_trace.h"
 #include "pmmDebug.h"
+#define LOG_SIZE 256
 
-void pmmLog(tpAniSirGlobal pMac, tANI_U32 loglevel, const char *pString,...) 
-{
-#ifdef WLAN_DEBUG
-    // Verify against current log level
-    if ( loglevel > pMac->utils.gLogDbgLevel[LOG_INDEX_FOR_MODULE( SIR_PMM_MODULE_ID )] )
-        return;
-    else
-    {
-        va_list marker;
+void pmmLog(tpAniSirGlobal pMac, tANI_U32 loglevel, const char *pString, ...)
+ {
+       VOS_TRACE_LEVEL  vosDebugLevel;
+       char    logBuffer[LOG_SIZE];
+       va_list marker;
 
-        va_start( marker, pString );     /* Initialize variable arguments. */
+       /*  getting proper Debug level  */
+       vosDebugLevel = getVosDebugLevel(loglevel);
 
-        logDebug(pMac, SIR_PMM_MODULE_ID, loglevel, pString, marker);
-        
-        va_end( marker );              /* Reset variable arguments.      */
-    }
-#endif
-}
+       /* extracting arguments from pstring */
+       va_start( marker, pString );
+       vsnprintf(logBuffer, LOG_SIZE, pString, marker);
+
+       VOS_TRACE(VOS_MODULE_ID_PMC, vosDebugLevel, "%s", logBuffer);
+       va_end( marker );
+ }
diff --git a/CORE/MAC/src/pe/rrm/rrmApi.c b/CORE/MAC/src/pe/rrm/rrmApi.c
index 559c3f4..ce13dc1 100644
--- a/CORE/MAC/src/pe/rrm/rrmApi.c
+++ b/CORE/MAC/src/pe/rrm/rrmApi.c
@@ -25,17 +25,18 @@
  * to the Linux Foundation.
  */
 
+
 /**=========================================================================
-  
-  \file  rrmApi.c
-  
-  \brief implementation for PE RRM APIs
-  
+
+   \file  rrmApi.c
+
+   \brief implementation for PE RRM APIs
+
    Copyright 2008 (c) Qualcomm Technologies, Inc.  All Rights Reserved.
-   
+
    Qualcomm Technologies Confidential and Proprietary.
-  
-  ========================================================================*/
+
+========================================================================*/
 
 /* $Header$ */
 
@@ -61,7 +62,7 @@
 rrmGetMinOfMaxTxPower(tPowerdBm regMax, tPowerdBm apTxPower)
 {
     tANI_U8 maxTxPower = 0;
-    tANI_U8 txPower = VOS_MIN( regMax , (apTxPower) );
+    tANI_U8 txPower = VOS_MIN( regMax, (apTxPower) );
     if((txPower >= RRM_MIN_TX_PWR_CAP) && (txPower <= RRM_MAX_TX_PWR_CAP))
         maxTxPower =  txPower;
     else if (txPower < RRM_MIN_TX_PWR_CAP)
@@ -154,8 +155,8 @@
       PELOGE(limLog(pMac, LOGE, FL(" Inavalid parameters"));)
       return eSIR_FAILURE;
    }
-   if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-            (void **) &pMaxTxParams, sizeof(tMaxTxPowerParams) ) ) 
+   pMaxTxParams = vos_mem_malloc(sizeof(tMaxTxPowerParams));
+   if ( NULL == pMaxTxParams )
    {
       limLog( pMac, LOGP, FL("Unable to allocate memory for pMaxTxParams ") );
       return eSIR_MEM_ALLOC_FAILED;
@@ -165,8 +166,8 @@
    PELOGE(limLog( pMac, LOGE, FL(" Allocated memory for pMaxTxParams...will be freed in other module") );)
 #endif
    pMaxTxParams->power = txPower;
-   palCopyMemory( pMac->hHdd, pMaxTxParams->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr) );
-   palCopyMemory( pMac->hHdd, pMaxTxParams->selfStaMacAddr, pSessionEntry->selfMacAddr, sizeof(tSirMacAddr) );
+   vos_mem_copy(pMaxTxParams->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr));
+   vos_mem_copy(pMaxTxParams->selfStaMacAddr, pSessionEntry->selfMacAddr, sizeof(tSirMacAddr));
 
 
    msgQ.type = WDA_SET_MAX_TX_POWER_REQ;
@@ -180,7 +181,7 @@
    if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
    {
       limLog( pMac, LOGP, FL("Posting WDA_SET_MAX_TX_POWER_REQ to HAL failed, reason=%X"), retCode );
-      palFreeMemory( pMac->hHdd, (tANI_U8 *) pMaxTxParams );
+      vos_mem_free(pMaxTxParams);
       return retCode;
    }
    return retCode;
@@ -209,19 +210,34 @@
    tSirRetStatus  retCode = eSIR_SUCCESS;
    tpMaxTxPowerParams pMaxTxParams = (tpMaxTxPowerParams) limMsgQ->bodyptr;
    tpPESession     pSessionEntry;
-   tANI_U8 sessionId;
+   tANI_U8  sessionId, i;
+   tSirMacAddr bssid = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 
-   if((pSessionEntry = peFindSessionByBssid(pMac, pMaxTxParams->bssId, &sessionId))==NULL)
+   if( vos_mem_compare(bssid, pMaxTxParams->bssId, sizeof(tSirMacAddr)))
    {
-      PELOGE(limLog(pMac, LOGE, FL("Unable to find session:") );)
-      retCode = eSIR_FAILURE;
+      for (i =0;i < pMac->lim.maxBssId;i++)
+      {
+         if ( (pMac->lim.gpSession[i].valid == TRUE ))
+         {
+            pSessionEntry = &pMac->lim.gpSession[i];
+            rrmCacheMgmtTxPower ( pMac, pMaxTxParams->power, pSessionEntry );
+         }
+      }
    }
    else
    {
-      rrmCacheMgmtTxPower ( pMac, pMaxTxParams->power, pSessionEntry );
+      if((pSessionEntry = peFindSessionByBssid(pMac, pMaxTxParams->bssId, &sessionId))==NULL)
+      {
+         PELOGE(limLog(pMac, LOGE, FL("Unable to find session:") );)
+         retCode = eSIR_FAILURE;
+      }
+      else
+      {
+         rrmCacheMgmtTxPower ( pMac, pMaxTxParams->power, pSessionEntry );
+      }
    }
 
-   palFreeMemory(pMac->hHdd, (void*)limMsgQ->bodyptr);
+   vos_mem_free(limMsgQ->bodyptr);
    limMsgQ->bodyptr = NULL;
    return retCode;
 }
@@ -257,7 +273,7 @@
 #endif
    if( pRxPacketInfo == NULL || pLinkReq == NULL || pSessionEntry == NULL )
    {
-      PELOGE(limLog( pMac, LOGE, "%s:%d: Invalid parameters - Ignoring the request");)
+      PELOGE(limLog( pMac, LOGE, FL("Invalid parameters - Ignoring the request"));)
       return eSIR_FAILURE;
    }
    pHdr = WDA_GET_RX_MAC_HEADER( pRxPacketInfo );
@@ -393,14 +409,14 @@
             (sizeof( tSirNeighborBssDescription ) * (pNeighborRep->num_NeighborReport - 1) ) ; 
             
    //Prepare the request to send to SME.
-   if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-            (void **) &pSmeNeighborRpt, length ) )
+   pSmeNeighborRpt = vos_mem_malloc(length);
+   if( NULL == pSmeNeighborRpt )
    {
       PELOGE(limLog( pMac, LOGP, FL("Unable to allocate memory") );)
       return eSIR_MEM_ALLOC_FAILED;
 
    }
-   palZeroMemory( pMac->hHdd, pSmeNeighborRpt, length ); 
+   vos_mem_set(pSmeNeighborRpt, length, 0);
 #if defined WLAN_VOWIFI_DEBUG
    PELOGE(limLog( pMac, LOGE, FL(" Allocated memory for pSmeNeighborRpt...will be freed by other module") );)
 #endif
@@ -408,8 +424,9 @@
    for( i = 0 ; i < pNeighborRep->num_NeighborReport ; i++ )
    {
       pSmeNeighborRpt->sNeighborBssDescription[i].length = sizeof( tSirNeighborBssDescription ); /*+ any optional ies */
-      palCopyMemory( pMac->hHdd, pSmeNeighborRpt->sNeighborBssDescription[i].bssId,
-            pNeighborRep->NeighborReport[i].bssid, sizeof(tSirMacAddr) );
+      vos_mem_copy(pSmeNeighborRpt->sNeighborBssDescription[i].bssId,
+                   pNeighborRep->NeighborReport[i].bssid,
+                   sizeof(tSirMacAddr));
       pSmeNeighborRpt->sNeighborBssDescription[i].bssidInfo.rrmInfo.fApPreauthReachable = pNeighborRep->NeighborReport[i].APReachability;
       pSmeNeighborRpt->sNeighborBssDescription[i].bssidInfo.rrmInfo.fSameSecurityMode = pNeighborRep->NeighborReport[i].Security;
       pSmeNeighborRpt->sNeighborBssDescription[i].bssidInfo.rrmInfo.fSameAuthenticator = pNeighborRep->NeighborReport[i].KeyScope;
@@ -429,7 +446,7 @@
    pSmeNeighborRpt->messageType = eWNI_SME_NEIGHBOR_REPORT_IND;
    pSmeNeighborRpt->length = length;
    pSmeNeighborRpt->numNeighborReports = pNeighborRep->num_NeighborReport;
-   palCopyMemory( pMac->hHdd, pSmeNeighborRpt->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr) );
+   vos_mem_copy(pSmeNeighborRpt->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr));
 
    //Send request to SME.
    mmhMsg.type    = pSmeNeighborRpt->messageType;
@@ -481,13 +498,13 @@
    PELOGE(limLog( pMac, LOGE, "SSID present = %d ", pNeighborReq->noSSID );)
 #endif
 
-   palZeroMemory( pMac->hHdd, &NeighborReportReq, sizeof( tSirMacNeighborReportReq ) );
+   vos_mem_set(&NeighborReportReq,sizeof( tSirMacNeighborReportReq ), 0);
 
    NeighborReportReq.dialogToken = ++pMac->rrm.rrmPEContext.DialogToken;
    NeighborReportReq.ssid_present = !pNeighborReq->noSSID; 
    if( NeighborReportReq.ssid_present )
    {
-      palCopyMemory( pMac->hHdd, &NeighborReportReq.ssid, &pNeighborReq->ucSSID, sizeof(tSirMacSSid) );
+      vos_mem_copy(&NeighborReportReq.ssid, &pNeighborReq->ucSSID, sizeof(tSirMacSSid));
 #if defined WLAN_VOWIFI_DEBUG
       PELOGE(sirDumpBuf( pMac, SIR_LIM_MODULE_ID, LOGE, (tANI_U8*) NeighborReportReq.ssid.ssId, NeighborReportReq.ssid.length );)
 #endif
@@ -583,21 +600,21 @@
 
    if( pBeaconReq->measurement_request.Beacon.RequestedInfo.present )
    {
-      if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void**) &pCurrentReq->request.Beacon.reqIes.pElementIds, 
-                                                    ( sizeof( tANI_U8) * 
-                                                    pBeaconReq->measurement_request.Beacon.RequestedInfo.num_requested_eids ) ) )
+      pCurrentReq->request.Beacon.reqIes.pElementIds = vos_mem_malloc(sizeof(tANI_U8) *
+                      pBeaconReq->measurement_request.Beacon.RequestedInfo.num_requested_eids);
+      if ( NULL == pCurrentReq->request.Beacon.reqIes.pElementIds )
       {
             limLog( pMac, LOGP,
-               FL( "Unable to PAL allocate memory for request IEs buffer" ));
+               FL( "Unable to allocate memory for request IEs buffer" ));
             return eRRM_FAILURE;
       }
 #if defined WLAN_VOWIFI_DEBUG
       PELOGE(limLog( pMac, LOGE, FL(" Allocated memory for pElementIds") );)
 #endif
       pCurrentReq->request.Beacon.reqIes.num = pBeaconReq->measurement_request.Beacon.RequestedInfo.num_requested_eids;
-      palCopyMemory ( pMac->hHdd, pCurrentReq->request.Beacon.reqIes.pElementIds, 
-            pBeaconReq->measurement_request.Beacon.RequestedInfo.requested_eids, 
-            pCurrentReq->request.Beacon.reqIes.num );      
+      vos_mem_copy(pCurrentReq->request.Beacon.reqIes.pElementIds,
+                   pBeaconReq->measurement_request.Beacon.RequestedInfo.requested_eids,
+                   pCurrentReq->request.Beacon.reqIes.num);
    }
 
    if( pBeaconReq->measurement_request.Beacon.num_APChannelReport )
@@ -607,39 +624,37 @@
    }
 
    //Prepare the request to send to SME.
-   if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-            (void **) &pSmeBcnReportReq,
-            (sizeof( tSirBeaconReportReqInd ) + num_channels) ) )
+   pSmeBcnReportReq = vos_mem_malloc(sizeof( tSirBeaconReportReqInd ));
+   if ( NULL == pSmeBcnReportReq )
    {
       limLog( pMac, LOGP,
-            FL( "Unable to PAL allocate memory during Beacon Report Req Ind to SME" ));
+            FL( "Unable to allocate memory during Beacon Report Req Ind to SME" ));
 
       return eRRM_FAILURE;
 
    }
 
-   palZeroMemory( pMac->hHdd, pSmeBcnReportReq, sizeof( tSirBeaconReportReqInd ) + num_channels );
+   vos_mem_set(pSmeBcnReportReq,sizeof( tSirBeaconReportReqInd ),0);
 
 #if defined WLAN_VOWIFI_DEBUG
    PELOGE(limLog( pMac, LOGE, FL(" Allocated memory for pSmeBcnReportReq....will be freed by other module") );)
 #endif
-   palCopyMemory( pMac->hHdd, pSmeBcnReportReq->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr) );
+   vos_mem_copy(pSmeBcnReportReq->bssId, pSessionEntry->bssId, sizeof(tSirMacAddr));
    pSmeBcnReportReq->messageType = eWNI_SME_BEACON_REPORT_REQ_IND;
-   pSmeBcnReportReq->length = sizeof( tSirBeaconReportReqInd ) + num_channels;
+   pSmeBcnReportReq->length = sizeof( tSirBeaconReportReqInd );
    pSmeBcnReportReq->uDialogToken = pBeaconReq->measurement_token;
-   //pSmeBcnReportReq->measurementDuration = SYS_TU_TO_MS(pBeaconReq->measurement_request.Beacon.meas_duration);
-   pSmeBcnReportReq->measurementDuration = SYS_TU_TO_MS(measDuration /*pBeaconReq->measurement_request.Beacon.meas_duration*/);
    pSmeBcnReportReq->randomizationInterval = SYS_TU_TO_MS (pBeaconReq->measurement_request.Beacon.randomization);
-   pSmeBcnReportReq->fMeasurementtype = pBeaconReq->measurement_request.Beacon.meas_mode;
    pSmeBcnReportReq->channelInfo.regulatoryClass = pBeaconReq->measurement_request.Beacon.regClass;
    pSmeBcnReportReq->channelInfo.channelNum = pBeaconReq->measurement_request.Beacon.channel;
-   palCopyMemory( pMac->hHdd, pSmeBcnReportReq->macaddrBssid, pBeaconReq->measurement_request.Beacon.BSSID, sizeof(tSirMacAddr) );
+   vos_mem_copy(pSmeBcnReportReq->macaddrBssid, pBeaconReq->measurement_request.Beacon.BSSID,
+                sizeof(tSirMacAddr));
 
    if( pBeaconReq->measurement_request.Beacon.SSID.present )
    {
       pSmeBcnReportReq->ssId.length = pBeaconReq->measurement_request.Beacon.SSID.num_ssid;
-      palCopyMemory( pMac->hHdd, pSmeBcnReportReq->ssId.ssId,  pBeaconReq->measurement_request.Beacon.SSID.ssid, 
-            pSmeBcnReportReq->ssId.length );
+      vos_mem_copy(pSmeBcnReportReq->ssId.ssId,
+                   pBeaconReq->measurement_request.Beacon.SSID.ssid,
+                   pSmeBcnReportReq->ssId.length);
    }
 
    pCurrentReq->token = pBeaconReq->measurement_token;
@@ -650,11 +665,13 @@
       tANI_U8 *pChanList = pSmeBcnReportReq->channelList.channelNumber;
       for( num_APChanReport = 0 ; num_APChanReport < pBeaconReq->measurement_request.Beacon.num_APChannelReport ; num_APChanReport++ )
       {
-         palCopyMemory( pMac->hHdd, pChanList, 
-               pBeaconReq->measurement_request.Beacon.APChannelReport[num_APChanReport].channelList, 
-               pBeaconReq->measurement_request.Beacon.APChannelReport[num_APChanReport].num_channelList );
+         vos_mem_copy(pChanList,
+          pBeaconReq->measurement_request.Beacon.APChannelReport[num_APChanReport].channelList,
+          pBeaconReq->measurement_request.Beacon.APChannelReport[num_APChanReport].num_channelList);
 
          pChanList += pBeaconReq->measurement_request.Beacon.APChannelReport[num_APChanReport].num_channelList;
+         pSmeBcnReportReq->measurementDuration[num_APChanReport] = SYS_TU_TO_MS(measDuration /*pBeaconReq->measurement_request.Beacon.meas_duration*/);
+         pSmeBcnReportReq->fMeasurementtype[num_APChanReport] = pBeaconReq->measurement_request.Beacon.meas_mode;
       }
    }
 
@@ -732,7 +749,7 @@
 #if defined WLAN_VOWIFI_DEBUG
             PELOGE(limLog( pMac, LOGE, "Adding Eid %d, len=%d", *pBcnIes, len );)
 #endif
-            palCopyMemory( pMac->hHdd, pIes, pBcnIes, len ); 
+            vos_mem_copy(pIes, pBcnIes, len);
             pIes += len;
             *pNumIes += len;
             count++;
@@ -787,6 +804,9 @@
       return eSIR_FAILURE;
    }
 
+   pBcnReport->numBssDesc = (pBcnReport->numBssDesc == RRM_BCN_RPT_NO_BSS_INFO)?
+                            RRM_BCN_RPT_MIN_RPT : pBcnReport->numBssDesc;
+
    if (NULL == pCurrentReq)
    {
       PELOGE(limLog( pMac, LOGE,
@@ -909,8 +929,12 @@
 #if defined WLAN_VOWIFI_DEBUG
    PELOGE(limLog( pMac, LOGE, "Sending Action frame ");)
 #endif
-   limSendRadioMeasureReportActionFrame( pMac, pCurrentReq->dialog_token, bssDescCnt,
-            pReport, pBcnReport->bssId, pSessionEntry );
+   limSendRadioMeasureReportActionFrame( pMac,
+                                         pCurrentReq->dialog_token,
+                                         bssDescCnt,
+                                         pReport,
+                                         pBcnReport->bssId,
+                                         pSessionEntry );
 
 
    if( pBcnReport->fMeasureDone )
@@ -931,15 +955,14 @@
     tpSirMacRadioMeasureReport pReport = NULL;
     tpRRMReq pCurrentReq = pMac->rrm.rrmPEContext.pCurrentReq; 
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-               (void **) &pReport,
-               sizeof( tSirMacRadioMeasureReport ) ) )
+    pReport = vos_mem_malloc(sizeof( tSirMacRadioMeasureReport ));
+    if ( NULL == pReport )
     {
          limLog( pMac, LOGP,
-               FL( "Unable to PAL allocate memory during RRM Req processing" ));
+               FL( "Unable to allocate memory during RRM Req processing" ));
          return;
     }
-    palZeroMemory( pMac->hHdd, pReport, sizeof(tSirMacRadioMeasureReport) );
+    vos_mem_set(pReport, sizeof(tSirMacRadioMeasureReport), 0);
     pReport->token = pCurrentReq->token;
     pReport->type = SIR_MAC_RRM_BEACON_TYPE;
 
@@ -953,14 +976,14 @@
             break;
         default:
             PELOGE(limLog( pMac, LOGE, FL(" Beacon request processing failed no report sent with status %d "), status););
-            palFreeMemory( pMac->hHdd, pReport );
+            vos_mem_free(pReport);
             return;
     }
 
     limSendRadioMeasureReportActionFrame( pMac, pCurrentReq->dialog_token, 1, 
                                                         pReport, peer, pSessionEntry );
 
-    palFreeMemory( pMac->hHdd, pReport );
+    vos_mem_free(pReport);
 #if defined WLAN_VOWIFI_DEBUG
     PELOGE(limLog( pMac, LOGE, FL(" Free memory for pReport") );)
 #endif
@@ -1003,15 +1026,14 @@
    {
       //No measurement requests....
       //
-      if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-               (void **) &pReport,
-               sizeof( tSirMacRadioMeasureReport ) ) )
+      pReport = vos_mem_malloc(sizeof( tSirMacRadioMeasureReport ));
+      if ( NULL ==  pReport )
       {
          limLog( pMac, LOGP,
-               FL( "Unable to PAL allocate memory during RRM Req processing" ));
+               FL( "Unable to allocate memory during RRM Req processing" ));
          return eSIR_MEM_ALLOC_FAILED;
       }
-      palZeroMemory( pMac->hHdd, pReport, sizeof(tSirMacRadioMeasureReport) );
+      vos_mem_set(pReport, sizeof(tSirMacRadioMeasureReport),0);
 #if defined WLAN_VOWIFI_DEBUG
       PELOGE(limLog( pMac, LOGE, FL(" Allocated memory for pReport") );)
 #endif
@@ -1019,7 +1041,7 @@
       num_report = 1;
       limSendRadioMeasureReportActionFrame( pMac, pRRMReq->DialogToken.token, num_report,
                   pReport, peer, pSessionEntry );
-      palFreeMemory( pMac->hHdd, pReport );
+      vos_mem_free(pReport);
       PELOGE(limLog( pMac, LOGE, "No requestIes in the measurement request" );)
       return eSIR_FAILURE;
    }
@@ -1028,15 +1050,14 @@
    if( pRRMReq->NumOfRepetitions.repetitions > 0 )
    {
       //Send a report with incapable bit set. Not supporting repetitions.
-      if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-               (void **) &pReport,
-               sizeof( tSirMacRadioMeasureReport ) ) )
+      pReport = vos_mem_malloc(sizeof( tSirMacRadioMeasureReport ));
+      if ( NULL == pReport )
       {
          limLog( pMac, LOGP,
-               FL( "Unable to PAL allocate memory during RRM Req processing" ));
+               FL( "Unable to allocate memory during RRM Req processing" ));
          return eSIR_MEM_ALLOC_FAILED;
       }
-      palZeroMemory( pMac->hHdd, pReport, sizeof(tSirMacRadioMeasureReport) );
+      vos_mem_set(pReport, sizeof(tSirMacRadioMeasureReport), 0);
 #if defined WLAN_VOWIFI_DEBUG
       PELOGE(limLog( pMac, LOGE, FL(" Allocated memory for pReport") );)
 #endif
@@ -1057,15 +1078,18 @@
             {
                if ( pReport == NULL ) //Allocate memory to send reports for any subsequent requests.
                {
-                  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                           (void **) &pReport,
-                           sizeof( tSirMacRadioMeasureReport ) * (pRRMReq->num_MeasurementRequest - i) ) )
+                  pReport = vos_mem_malloc(sizeof( tSirMacRadioMeasureReport )
+                                           * (pRRMReq->num_MeasurementRequest - i));
+                  if ( NULL == pReport )
                   {
                      limLog( pMac, LOGP,
-                           FL( "Unable to PAL allocate memory during RRM Req processing" ));
+                           FL( "Unable to allocate memory during RRM Req processing" ));
                      return eSIR_MEM_ALLOC_FAILED;
                   }
-                  palZeroMemory( pMac->hHdd, pReport, sizeof( tSirMacRadioMeasureReport ) * (pRRMReq->num_MeasurementRequest - i) ); 
+                  vos_mem_set(pReport,
+                              sizeof( tSirMacRadioMeasureReport )
+                              * (pRRMReq->num_MeasurementRequest - i),
+                              0);
 #if defined WLAN_VOWIFI_DEBUG
                   limLog( pMac, LOGE, FL(" Allocated memory for pReport") );
 #endif
@@ -1079,19 +1103,18 @@
             }
             else
             {
-               if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                        (void **) &pCurrentReq,
-                        sizeof( *pCurrentReq ) ) )
+               pCurrentReq = vos_mem_malloc(sizeof( *pCurrentReq ));
+               if ( NULL == pCurrentReq )
                {
                   limLog( pMac, LOGP,
-                        FL( "Unable to PAL allocate memory during RRM Req processing" ));
-                  palFreeMemory( pMac->hHdd, pReport );
+                        FL( "Unable to allocate memory during RRM Req processing" ));
+                  vos_mem_free(pReport);
                   return eSIR_MEM_ALLOC_FAILED;
                }
 #if defined WLAN_VOWIFI_DEBUG
                PELOGE(limLog( pMac, LOGE, FL(" Allocated memory for pCurrentReq") );)
 #endif
-               palZeroMemory( pMac->hHdd, pCurrentReq, sizeof( *pCurrentReq ) );
+                vos_mem_set(pCurrentReq, sizeof( *pCurrentReq ), 0);
                pCurrentReq->dialog_token = pRRMReq->DialogToken.token;
                pCurrentReq->token = pRRMReq->MeasurementRequest[i].measurement_token;
                pMac->rrm.rrmPEContext.pCurrentReq = pCurrentReq;
@@ -1107,15 +1130,18 @@
             //Send a report with incapabale bit set.
             if ( pReport == NULL ) //Allocate memory to send reports for any subsequent requests.
             {
-               if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                        (void **) &pReport,
-                        sizeof( tSirMacRadioMeasureReport ) * (pRRMReq->num_MeasurementRequest - i) ) )
+               pReport = vos_mem_malloc(sizeof( tSirMacRadioMeasureReport )
+                                         * (pRRMReq->num_MeasurementRequest - i));
+               if ( NULL == pReport )
                {
                   limLog( pMac, LOGP,
-                        FL( "Unable to PAL allocate memory during RRM Req processing" ));
+                        FL( "Unable to allocate memory during RRM Req processing" ));
                   return eSIR_MEM_ALLOC_FAILED;
                }
-               palZeroMemory( pMac->hHdd, pReport, sizeof( tSirMacRadioMeasureReport ) * (pRRMReq->num_MeasurementRequest - i) ); 
+               vos_mem_set(pReport,
+                           sizeof( tSirMacRadioMeasureReport )
+                           * (pRRMReq->num_MeasurementRequest - i),
+                           0);
 #if defined WLAN_VOWIFI_DEBUG
                PELOGE(limLog( pMac, LOGE, FL(" Allocated memory for pReport") );)
 #endif
@@ -1135,7 +1161,7 @@
       limSendRadioMeasureReportActionFrame( pMac, pRRMReq->DialogToken.token, num_report, 
             pReport, peer, pSessionEntry );
 
-      palFreeMemory( pMac->hHdd, pReport );
+      vos_mem_free(pReport);
 #if defined WLAN_VOWIFI_DEBUG
       PELOGE(limLog( pMac, LOGE, FL(" Free memory for pReport") );)
 #endif
@@ -1291,7 +1317,7 @@
 
    pMac->rrm.rrmPEContext.rrmEnable = 0;
 
-   palZeroMemory( pMac->hHdd, pRRMCaps, sizeof(tRRMCaps) );
+   vos_mem_set(pRRMCaps, sizeof(tRRMCaps), 0);
    pRRMCaps->LinkMeasurement = 1;
    pRRMCaps->NeighborRpt = 1;
    pRRMCaps->BeaconPassive = 1;
@@ -1332,13 +1358,13 @@
    {
       if( pMac->rrm.rrmPEContext.pCurrentReq->request.Beacon.reqIes.pElementIds )
       {
-         palFreeMemory( pMac->hHdd, pMac->rrm.rrmPEContext.pCurrentReq->request.Beacon.reqIes.pElementIds );
+         vos_mem_free(pMac->rrm.rrmPEContext.pCurrentReq->request.Beacon.reqIes.pElementIds);
 #if defined WLAN_VOWIFI_DEBUG
          PELOGE(limLog( pMac, LOGE, FL(" Free memory for pElementIds") );)
 #endif
       }
 
-      palFreeMemory( pMac->hHdd, pMac->rrm.rrmPEContext.pCurrentReq ); 
+      vos_mem_free(pMac->rrm.rrmPEContext.pCurrentReq);
 #if defined WLAN_VOWIFI_DEBUG
       PELOGE(limLog( pMac, LOGE, FL(" Free memory for pCurrentReq") );)
 #endif
diff --git a/CORE/MAC/src/pe/sch/schApi.c b/CORE/MAC/src/pe/sch/schApi.c
index 9a7f90e..3917054 100644
--- a/CORE/MAC/src/pe/sch/schApi.c
+++ b/CORE/MAC/src/pe/sch/schApi.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file schApi.cc contains functions related to the API exposed
  * by scheduler module
@@ -278,18 +277,17 @@
  */
 tSirRetStatus schSendBeaconReq( tpAniSirGlobal pMac, tANI_U8 *beaconPayload, tANI_U16 size, tpPESession psessionEntry)
 {
-    tSirMsgQ msgQ;
-    tpSendbeaconParams beaconParams = NULL;
-    tSirRetStatus retCode;
+  tSirMsgQ msgQ;
+  tpSendbeaconParams beaconParams = NULL;
+  tSirRetStatus retCode;
 
   schLog( pMac, LOG2,
-      FL( "Indicating HAL to copy the beacon template [%d bytes] to memory" ),
-      size );
+         FL( "Indicating HAL to copy the beacon template [%d bytes] to memory" ),
+         size );
 
-  if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-          (void **) &beaconParams,
-          sizeof( tSendbeaconParams )))
-    return eSIR_FAILURE;
+  beaconParams = vos_mem_malloc(sizeof(tSendbeaconParams));
+  if ( NULL == beaconParams )
+      return eSIR_FAILURE;
 
   msgQ.type = WDA_SEND_BEACON_REQ;
 
@@ -299,7 +297,7 @@
   // Fill in tSendbeaconParams members
   /* Knock off all pMac global addresses */
   // limGetBssid( pMac, beaconParams->bssId);
-  palCopyMemory(pMac, beaconParams->bssId, psessionEntry->bssId, sizeof(psessionEntry->bssId));
+  vos_mem_copy(beaconParams->bssId, psessionEntry->bssId, sizeof(psessionEntry->bssId));
 
   beaconParams->timIeOffset = pMac->sch.schObject.gSchBeaconOffsetBegin;
   /* p2pIeOffset should be atleast greater than timIeOffset */
@@ -327,15 +325,16 @@
   // free previous copy of the beacon
   if (psessionEntry->beacon )
   {
-    palFreeMemory(pMac->hHdd, psessionEntry->beacon);
+    vos_mem_free(psessionEntry->beacon);
   }
 
   psessionEntry->bcnLen = 0;
   psessionEntry->beacon = NULL;
 
-  if ( eHAL_STATUS_SUCCESS == palAllocateMemory( pMac->hHdd,(void **) &psessionEntry->beacon, size)) 
+  psessionEntry->beacon = vos_mem_malloc(size);
+  if ( psessionEntry->beacon != NULL )
   {
-    palCopyMemory(pMac->hHdd, psessionEntry->beacon, beaconPayload, size);
+    vos_mem_copy(psessionEntry->beacon, beaconPayload, size);
     psessionEntry->bcnLen = size;
   }
 
@@ -367,7 +366,7 @@
 }
 
 tANI_U32 limSendProbeRspTemplateToHal(tpAniSirGlobal pMac,tpPESession psessionEntry
-                                    ,tANI_U32* IeBitmap)
+                                  ,tANI_U32* IeBitmap)
 {
     tSirMsgQ  msgQ;
     tANI_U8 *pFrame2Hal = pMac->sch.schObject.gSchProbeRspTemplate;
@@ -408,8 +407,8 @@
     if (addnIEPresent)
     {
         //Probe rsp IE available
-        if ( (palAllocateMemory(pMac->hHdd, (void**)&addIE,
-             WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN )) != eHAL_STATUS_SUCCESS)
+        addIE = vos_mem_malloc(WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN);
+        if ( NULL == addIE )
         {
              schLog(pMac, LOGE,
                  FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 length"));
@@ -422,7 +421,7 @@
             schLog(pMac, LOGE,
                 FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 length"));
 
-            palFreeMemory(pMac->hHdd, addIE);
+            vos_mem_free(addIE);
             return retCode;
         }
 
@@ -436,7 +435,7 @@
                schLog(pMac, LOGE,
                    FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 String"));
 
-               palFreeMemory(pMac->hHdd, addIE);
+                vos_mem_free(addIE);
                return retCode;
             }
         }
@@ -451,7 +450,7 @@
     }
 
     // Paranoia:
-    palZeroMemory( pMac->hHdd, pFrame2Hal, nBytes );
+    vos_mem_set(pFrame2Hal, nBytes, 0);
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = limPopulateMacHeader( pMac, pFrame2Hal, SIR_MAC_MGMT_FRAME,
@@ -463,7 +462,7 @@
                                "tor for a Probe Response (%d)."),
                 nSirStatus );
 
-        palFreeMemory(pMac->hHdd, addIE);
+        vos_mem_free(addIE);
         return retCode;
     }
 
@@ -480,7 +479,7 @@
         schLog( pMac, LOGE, FL("Failed to pack a Probe Response (0x%08x)."),
                 nStatus );
 
-        palFreeMemory(pMac->hHdd, addIE);
+        vos_mem_free(addIE);
         return retCode;                 // allocated!
     }
     else if ( DOT11F_WARNED( nStatus ) )
@@ -491,23 +490,15 @@
 
     if (addnIEPresent)
     {
-        if (palCopyMemory ( pMac->hHdd, &pFrame2Hal[nBytes - addnIELen],
-                             &addIE[0], addnIELen) != eHAL_STATUS_SUCCESS)
-        {
-            schLog( pMac, LOGE,
-                FL("Additional Probe Rsp IE request failed while Appending "));
-
-            palFreeMemory(pMac->hHdd, addIE);
-            return retCode;
-        }
+        vos_mem_copy ( &pFrame2Hal[nBytes - addnIELen],
+                             &addIE[0], addnIELen);
     }
 
     /* free the allocated Memory */
-    palFreeMemory(pMac->hHdd, addIE);
+    vos_mem_free(addIE);
 
-    if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd,
-                                                (void **) &pprobeRespParams,
-                                                sizeof( tSendProbeRespParams )))
+    pprobeRespParams = vos_mem_malloc(sizeof( tSendProbeRespParams ));
+    if ( NULL == pprobeRespParams )
     {
         schLog( pMac, LOGE, FL("limSendProbeRspTemplateToHal: HAL probe response params malloc failed for bytes %d"), nBytes );
     }
@@ -519,11 +510,10 @@
                             nBytes);)
         */
 
-        sirCopyMacAddr( pprobeRespParams->bssId  ,  psessionEntry->bssId);
+        sirCopyMacAddr( pprobeRespParams->bssId, psessionEntry->bssId);
         pprobeRespParams->pProbeRespTemplate   = pFrame2Hal;
         pprobeRespParams->probeRespTemplateLen = nBytes;
-        palCopyMemory(pMac,pprobeRespParams->ucProxyProbeReqValidIEBmap,IeBitmap,
-                            (sizeof(tANI_U32) * 8));
+        vos_mem_copy(pprobeRespParams->ucProxyProbeReqValidIEBmap,IeBitmap,(sizeof(tANI_U32) * 8));
         msgQ.type     = WDA_UPDATE_PROBE_RSP_TEMPLATE_IND;
         msgQ.reserved = 0;
         msgQ.bodyptr  = pprobeRespParams;
@@ -532,8 +522,8 @@
         if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
         {
             /* free the allocated Memory */
-            schLog( pMac,LOGE, FL("limSendProbeRspTemplateToHal: FAIL bytes %d retcode[%X]"), nBytes , retCode );
-            palFreeMemory(pMac->hHdd,pprobeRespParams);
+            schLog( pMac,LOGE, FL("limSendProbeRspTemplateToHal: FAIL bytes %d retcode[%X]"), nBytes, retCode );
+            vos_mem_free(pprobeRespParams);
         }
         else
         {
diff --git a/CORE/MAC/src/pe/sch/schBeaconGen.c b/CORE/MAC/src/pe/sch/schBeaconGen.c
index ade5d42..fa11974 100644
--- a/CORE/MAC/src/pe/sch/schBeaconGen.c
+++ b/CORE/MAC/src/pe/sch/schBeaconGen.c
@@ -80,7 +80,7 @@
     {
         if(*pExtraIe == 0xDD)
         {
-            if(palEqualMemory(NULL, (void *)(pExtraIe+2), &P2pOui, sizeof(P2pOui)))
+            if ( vos_mem_compare ( (void *)(pExtraIe+2), &P2pOui, sizeof(P2pOui) ) )
             {
                 status = eSIR_SUCCESS;
                 break;
@@ -105,7 +105,7 @@
      if((status = wlan_cfgGetInt(pMac, WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG,
                                  &present)) != eSIR_SUCCESS)
     {
-        limLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG"));
+        schLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG"));
         return status;
     }
 
@@ -114,7 +114,7 @@
         if((status = wlan_cfgGetStrLen(pMac, WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA,
                                        &len)) != eSIR_SUCCESS)
         {
-            limLog(pMac, LOGP,
+            schLog(pMac, LOGP,
                 FL("Unable to get WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA length"));
             return status;
         }
@@ -144,7 +144,7 @@
                         }
                         else
                         {
-                            limLog(pMac, LOGE,
+                            schLog(pMac, LOGE,
                                FL("Not able to insert NoA because of length constraint"));
                         }
                     }
@@ -192,27 +192,27 @@
     tANI_U16 p2pIeOffset = 0;
     tSirRetStatus status = eSIR_SUCCESS;
 
-    status = palAllocateMemory(pMac->hHdd, (void **)&pBcn1, sizeof(tDot11fBeacon1));
-    if(status != eSIR_SUCCESS)
+    pBcn1 = vos_mem_malloc(sizeof(tDot11fBeacon1));
+    if ( NULL == pBcn1 )
     {
         schLog(pMac, LOGE, FL("Failed to allocate memory") );
         return eSIR_FAILURE;
     }
 
-    status = palAllocateMemory(pMac->hHdd, (void **)&pBcn2, sizeof(tDot11fBeacon2));
-    if(status != eSIR_SUCCESS)
+    pBcn2 = vos_mem_malloc(sizeof(tDot11fBeacon2));
+    if ( NULL == pBcn2 )
     {
         schLog(pMac, LOGE, FL("Failed to allocate memory") );
-        palFreeMemory(pMac->hHdd, pBcn1);
+        vos_mem_free(pBcn1);
         return eSIR_FAILURE;
     }
 
-    status = palAllocateMemory(pMac->hHdd, (void **)&pWscProbeRes, sizeof(tDot11fIEWscProbeRes));
-    if(status != eSIR_SUCCESS)
+    pWscProbeRes = vos_mem_malloc(sizeof(tDot11fIEWscProbeRes));
+    if ( NULL == pWscProbeRes )
     {
         schLog(pMac, LOGE, FL("Failed to allocate memory") );
-        palFreeMemory(pMac->hHdd, pBcn1);
-        palFreeMemory(pMac->hHdd, pBcn2);
+        vos_mem_free(pBcn1);
+        vos_mem_free(pBcn2);
         return eSIR_FAILURE;
     }
 
@@ -225,7 +225,7 @@
     // set the TFP headers
 
     // set the mac header
-    palZeroMemory( pMac->hHdd, ( tANI_U8*) &pBeacon->macHdr, sizeof( tSirMacMgmtHdr ) );
+    vos_mem_set(( tANI_U8*) &pBeacon->macHdr, sizeof( tSirMacMgmtHdr ),0);
     mac = (tpSirMacMgmtHdr) &pBeacon->macHdr;
     mac->fc.type = SIR_MAC_MGMT_FRAME;
     mac->fc.subType = SIR_MAC_MGMT_BEACON;
@@ -237,8 +237,8 @@
     /* limGetMyMacAddr(pMac, mac->sa); */
     /* limGetBssid(pMac, mac->bssId); */
 
-    palCopyMemory(pMac->hHdd, mac->sa, psessionEntry->selfMacAddr, sizeof(psessionEntry->selfMacAddr));
-    palCopyMemory(pMac->hHdd, mac->bssId, psessionEntry->bssId, sizeof (psessionEntry->bssId));
+    vos_mem_copy(mac->sa, psessionEntry->selfMacAddr, sizeof(psessionEntry->selfMacAddr));
+    vos_mem_copy(mac->bssId, psessionEntry->bssId, sizeof (psessionEntry->bssId));
 
     mac->fc.fromDS = 0;
     mac->fc.toDS = 0;
@@ -247,7 +247,7 @@
      * Now set the beacon body
      */
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8*) pBcn1, sizeof( tDot11fBeacon1 ) );
+    vos_mem_set(( tANI_U8*) pBcn1, sizeof( tDot11fBeacon1 ), 0);
 
     // Skip over the timestamp (it'll be updated later).
 
@@ -277,10 +277,11 @@
         && (psessionEntry->proxyProbeRspEn))
     {
         /* Initialize the default IE bitmap to zero */
-        palZeroMemory( pMac->hHdd, ( tANI_U8* )&(psessionEntry->DefProbeRspIeBitmap), (sizeof( tANI_U32 ) * 8));
+        vos_mem_set(( tANI_U8* )&(psessionEntry->DefProbeRspIeBitmap), (sizeof( tANI_U32 ) * 8), 0);
 
         /* Initialize the default IE bitmap to zero */
-        palZeroMemory( pMac->hHdd, ( tANI_U8* )&(psessionEntry->probeRespFrame), sizeof(psessionEntry->probeRespFrame));
+        vos_mem_set(( tANI_U8* )&(psessionEntry->probeRespFrame),
+                    sizeof(psessionEntry->probeRespFrame), 0);
 
         /* Can be efficiently updated whenever new IE added  in Probe response in future */
         limUpdateProbeRspTemplateIeBitmapBeacon1(pMac,pBcn1,&psessionEntry->DefProbeRspIeBitmap[0],
@@ -294,9 +295,9 @@
     {
       schLog( pMac, LOGE, FL("Failed to packed a tDot11fBeacon1 (0x%0"
                              "8x.)."), nStatus );
-      palFreeMemory(pMac->hHdd, pBcn1);
-      palFreeMemory(pMac->hHdd, pBcn2);
-      palFreeMemory(pMac->hHdd, pWscProbeRes);
+      vos_mem_free(pBcn1);
+      vos_mem_free(pBcn2);
+      vos_mem_free(pWscProbeRes);
       return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( nStatus ) )
@@ -305,7 +306,7 @@
                              "t11fBeacon1 (0x%08x.)."), nStatus );
     }
     /*changed  to correct beacon corruption */
-    palZeroMemory( pMac->hHdd, ( tANI_U8*) pBcn2, sizeof( tDot11fBeacon2 ) );
+    vos_mem_set(( tANI_U8*) pBcn2, sizeof( tDot11fBeacon2 ), 0);
     pMac->sch.schObject.gSchBeaconOffsetBegin = offset + ( tANI_U16 )nBytes;
     schLog( pMac, LOG1, FL("Initialized beacon begin, offset %d"), offset );
 
@@ -338,7 +339,7 @@
 #ifdef WLAN_FEATURE_11AC
     if(psessionEntry->vhtCapability)
     {        
-        limLog( pMac, LOGW, FL("Populate VHT IEs in Beacon"));
+        schLog( pMac, LOGW, FL("Populate VHT IEs in Beacon"));
         PopulateDot11fVHTCaps( pMac, psessionEntry, &pBcn2->VHTCaps );
         PopulateDot11fVHTOperation( pMac, &pBcn2->VHTOperation);
         // we do not support multi users yet
@@ -356,8 +357,8 @@
     {
           PopulateDot11fWPA( pMac, &psessionEntry->pLimStartBssReq->rsnIE,
                        &pBcn2->WPA );
-          PopulateDot11fRSN( pMac, &psessionEntry->pLimStartBssReq->rsnIE,
-                       &pBcn2->RSN );
+          PopulateDot11fRSNOpaque( pMac, &psessionEntry->pLimStartBssReq->rsnIE,
+                       &pBcn2->RSNOpaque );
     }
 
     if(psessionEntry->limWmeEnabled)
@@ -374,7 +375,7 @@
     else
     {
         if (wlan_cfgGetInt(pMac, (tANI_U16) WNI_CFG_WPS_ENABLE, &tmp) != eSIR_SUCCESS)
-            limLog(pMac, LOGP,"Failed to cfg get id %d", WNI_CFG_WPS_ENABLE );
+            schLog(pMac, LOGP,"Failed to cfg get id %d", WNI_CFG_WPS_ENABLE );
 
         wpsApEnable = tmp & WNI_CFG_WPS_ENABLE_AP;
 
@@ -418,10 +419,9 @@
             if(pWscProbeRes->present)
             {
                 SetProbeRspIeBitmap(&psessionEntry->DefProbeRspIeBitmap[0],SIR_MAC_WPA_EID);
-                palCopyMemory(pMac->hHdd,
-                            (void *)&psessionEntry->probeRespFrame.WscProbeRes,
-                            (void *)pWscProbeRes,
-                            sizeof(tDot11fIEWscProbeRes));
+                vos_mem_copy((void *)&psessionEntry->probeRespFrame.WscProbeRes,
+                             (void *)pWscProbeRes,
+                             sizeof(tDot11fIEWscProbeRes));
             }
         }
 
@@ -434,9 +434,9 @@
     {
       schLog( pMac, LOGE, FL("Failed to packed a tDot11fBeacon2 (0x%0"
                              "8x.)."), nStatus );
-      palFreeMemory(pMac->hHdd, pBcn1);
-      palFreeMemory(pMac->hHdd, pBcn2);
-      palFreeMemory(pMac->hHdd, pWscProbeRes);
+      vos_mem_free(pBcn1);
+      vos_mem_free(pBcn2);
+      vos_mem_free(pWscProbeRes);
       return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( nStatus ) )
@@ -476,9 +476,9 @@
             pMac->sch.schObject.gSchBeaconOffsetEnd );
 
     pMac->sch.schObject.fBeaconChanged = 1;
-    palFreeMemory(pMac->hHdd, pBcn1);
-    palFreeMemory(pMac->hHdd, pBcn2);
-    palFreeMemory(pMac->hHdd, pWscProbeRes);
+    vos_mem_free(pBcn1);
+    vos_mem_free(pBcn2);
+    vos_mem_free(pWscProbeRes);
     return eSIR_SUCCESS;
 }
 
@@ -488,33 +488,30 @@
                                               tDot11fProbeResponse* prb_rsp)
 {
     prb_rsp->BeaconInterval = beacon1->BeaconInterval;
-    palCopyMemory(pMac->hHdd,(void *)&prb_rsp->Capabilities,
-                            (void *)&beacon1->Capabilities,
-                            sizeof(beacon1->Capabilities));
+    vos_mem_copy((void *)&prb_rsp->Capabilities, (void *)&beacon1->Capabilities,
+                 sizeof(beacon1->Capabilities));
 
     /* SSID */
     if(beacon1->SSID.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_SSID_EID);
-        /* populating it , because probe response has to go with SSID even in hidden case */
+        /* populating it, because probe response has to go with SSID even in hidden case */
         PopulateDot11fSSID2( pMac, &prb_rsp->SSID );
     }
     /* supported rates */
     if(beacon1->SuppRates.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_RATESET_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->SuppRates,
-                            (void *)&beacon1->SuppRates,
-                            sizeof(beacon1->SuppRates));
+        vos_mem_copy((void *)&prb_rsp->SuppRates, (void *)&beacon1->SuppRates,
+                     sizeof(beacon1->SuppRates));
 
     }
     /* DS Parameter set */
     if(beacon1->DSParams.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_DS_PARAM_SET_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->DSParams,
-                            (void *)&beacon1->DSParams,
-                            sizeof(beacon1->DSParams));
+        vos_mem_copy((void *)&prb_rsp->DSParams, (void *)&beacon1->DSParams,
+                      sizeof(beacon1->DSParams));
 
     }
 
@@ -531,45 +528,40 @@
     if(beacon2->Country.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_COUNTRY_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->Country,
-                            (void *)&beacon2->Country,
-                            sizeof(beacon2->Country));
+        vos_mem_copy((void *)&prb_rsp->Country, (void *)&beacon2->Country,
+                     sizeof(beacon2->Country));
 
     }
     /* Power constraint */
     if(beacon2->PowerConstraints.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_PWR_CONSTRAINT_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->PowerConstraints,
-                            (void *)&beacon2->PowerConstraints,
-                            sizeof(beacon2->PowerConstraints));
+        vos_mem_copy((void *)&prb_rsp->PowerConstraints, (void *)&beacon2->PowerConstraints,
+                     sizeof(beacon2->PowerConstraints));
 
     }
     /* Channel Switch Annoouncement SIR_MAC_CHNL_SWITCH_ANN_EID */
     if(beacon2->ChanSwitchAnn.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_CHNL_SWITCH_ANN_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->ChanSwitchAnn,
-                            (void *)&beacon2->ChanSwitchAnn,
-                            sizeof(beacon2->ChanSwitchAnn));
+        vos_mem_copy((void *)&prb_rsp->ChanSwitchAnn, (void *)&beacon2->ChanSwitchAnn,
+                     sizeof(beacon2->ChanSwitchAnn));
 
     }
     /* ERP information */
     if(beacon2->ERPInfo.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_ERP_INFO_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->ERPInfo,
-                            (void *)&beacon2->ERPInfo,
-                            sizeof(beacon2->ERPInfo));
+        vos_mem_copy((void *)&prb_rsp->ERPInfo, (void *)&beacon2->ERPInfo,
+                     sizeof(beacon2->ERPInfo));
 
     }
     /* Extended supported rates */
     if(beacon2->ExtSuppRates.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_EXTENDED_RATE_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->ExtSuppRates,
-                            (void *)&beacon2->ExtSuppRates,
-                            sizeof(beacon2->ExtSuppRates));
+        vos_mem_copy((void *)&prb_rsp->ExtSuppRates, (void *)&beacon2->ExtSuppRates,
+                     sizeof(beacon2->ExtSuppRates));
 
     }
 
@@ -577,20 +569,17 @@
     if(beacon2->WPA.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_WPA_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->WPA,
-                            (void *)&beacon2->WPA,
-                            sizeof(beacon2->WPA));
+        vos_mem_copy((void *)&prb_rsp->WPA, (void *)&beacon2->WPA,
+                     sizeof(beacon2->WPA));
 
     }
 
     /* RSN */
-    if(beacon2->RSN.present)
+    if(beacon2->RSNOpaque.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_RSN_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->RSN,
-                            (void *)&beacon2->RSN,
-                            sizeof(beacon2->RSN));
-
+        vos_mem_copy((void *)&prb_rsp->RSNOpaque, (void *)&beacon2->RSNOpaque,
+                     sizeof(beacon2->RSNOpaque));
     }
 /*
     // BSS load
@@ -603,9 +592,8 @@
     if(beacon2->EDCAParamSet.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_EDCA_PARAM_SET_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->EDCAParamSet,
-                            (void *)&beacon2->EDCAParamSet,
-                            sizeof(beacon2->EDCAParamSet));
+        vos_mem_copy((void *)&prb_rsp->EDCAParamSet, (void *)&beacon2->EDCAParamSet,
+                     sizeof(beacon2->EDCAParamSet));
 
     }
     /* Vendor specific - currently no vendor specific IEs added */
@@ -614,40 +602,35 @@
     if(beacon2->HTCaps.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_HT_CAPABILITIES_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->HTCaps,
-                            (void *)&beacon2->HTCaps,
-                            sizeof(beacon2->HTCaps));
+        vos_mem_copy((void *)&prb_rsp->HTCaps, (void *)&beacon2->HTCaps,
+                     sizeof(beacon2->HTCaps));
     }
     // HT Info IE
     if(beacon2->HTInfo.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_HT_INFO_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->HTInfo,
-                            (void *)&beacon2->HTInfo,
-                            sizeof(beacon2->HTInfo));
+        vos_mem_copy((void *)&prb_rsp->HTInfo, (void *)&beacon2->HTInfo,
+                     sizeof(beacon2->HTInfo));
     }
 
 #ifdef WLAN_FEATURE_11AC
     if(beacon2->VHTCaps.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_VHT_CAPABILITIES_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->VHTCaps,
-                            (void *)&beacon2->VHTCaps,
-                            sizeof(beacon2->VHTCaps));
+        vos_mem_copy((void *)&prb_rsp->VHTCaps, (void *)&beacon2->VHTCaps,
+                     sizeof(beacon2->VHTCaps));
     }
     if(beacon2->VHTOperation.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_VHT_OPERATION_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->VHTOperation,
-                            (void *)&beacon2->VHTOperation,
-                            sizeof(beacon2->VHTOperation));
+        vos_mem_copy((void *)&prb_rsp->VHTOperation, (void *)&beacon2->VHTOperation,
+                     sizeof(beacon2->VHTOperation));
     }
     if(beacon2->VHTExtBssLoad.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_VHT_EXT_BSS_LOAD_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->VHTExtBssLoad,
-                            (void *)&beacon2->VHTExtBssLoad,
-                            sizeof(beacon2->VHTExtBssLoad));
+        vos_mem_copy((void *)&prb_rsp->VHTExtBssLoad, (void *)&beacon2->VHTExtBssLoad,
+                     sizeof(beacon2->VHTExtBssLoad));
     }
 #endif
 
@@ -655,17 +638,15 @@
     if(beacon2->WMMParams.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_WPA_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->WMMParams,
-                            (void *)&beacon2->WMMParams,
-                            sizeof(beacon2->WMMParams));
+        vos_mem_copy((void *)&prb_rsp->WMMParams, (void *)&beacon2->WMMParams,
+                     sizeof(beacon2->WMMParams));
     }
     //WMM capability - most of the case won't be present
     if(beacon2->WMMCaps.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap,SIR_MAC_WPA_EID);
-        palCopyMemory(pMac->hHdd,(void *)&prb_rsp->WMMCaps,
-                            (void *)&beacon2->WMMCaps,
-                            sizeof(beacon2->WMMCaps));
+        vos_mem_copy((void *)&prb_rsp->WMMCaps, (void *)&beacon2->WMMCaps,
+                     sizeof(beacon2->WMMCaps));
     }
 
 }
@@ -748,7 +729,8 @@
         //
 
         size = (size + 3) & (~3);
-        if( eSIR_SUCCESS != schSendBeaconReq( pMac, pMac->sch.schObject.gSchBeaconFrameBegin, size , psessionEntry))
+        if( eSIR_SUCCESS != schSendBeaconReq( pMac, pMac->sch.schObject.gSchBeaconFrameBegin,
+                                              size, psessionEntry))
             PELOGE(schLog(pMac, LOGE, FL("schSendBeaconReq() returned an error (zsize %d)"), size);)
         else
         {
@@ -828,6 +810,6 @@
     }
 
 end:
-    palFreeMemory(pMac->hHdd, (void*)pMsg);
+      vos_mem_free(pMsg);
 
 }
diff --git a/CORE/MAC/src/pe/sch/schBeaconProcess.c b/CORE/MAC/src/pe/sch/schBeaconProcess.c
index 2c11ec5..9fb0d83 100644
--- a/CORE/MAC/src/pe/sch/schBeaconProcess.c
+++ b/CORE/MAC/src/pe/sch/schBeaconProcess.c
@@ -339,8 +339,11 @@
     tpSirMacMgmtHdr    pMh = WDA_GET_RX_MAC_HEADER(pRxPacketInfo);
     tANI_U16  aid;
     tANI_U8  operMode;
+    tANI_U8  chWidth = 0;
 #endif
-
+#if defined FEATURE_WLAN_CCX || defined FEATURE_WLAN_VOWIFI
+     tPowerdBm regMax = 0,maxTxPower = 0;
+#endif
 
     beaconParams.paramChangeBitmap = 0;
 
@@ -356,18 +359,16 @@
         *  -- Infra STA receving beacons from AP  
         *  -- BTAMP_STA receving beacons from BTAMP_AP
         */
-        
-    
         //Always save the beacon into LIM's cached scan results
         limCheckAndAddBssDescription(pMac, pBeacon, pRxPacketInfo, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_FALSE);
-        
+
         /**
                * This is the Beacon received from the AP  we're currently associated with. Check
                * if there are any changes in AP's capabilities 
                */
         if((tANI_U8) pBeacon->channelNumber != psessionEntry->currentOperChannel)
         {
-            PELOGE(limLog(pMac, LOGE, FL("Channel Change from %d --> %d  - "
+            PELOGE(schLog(pMac, LOGE, FL("Channel Change from %d --> %d  - "
                                          "Ignoring beacon!"),
                           psessionEntry->currentOperChannel, pBeacon->channelNumber);)
            goto fail;
@@ -376,7 +377,8 @@
         if(limGetStaHashBssidx(pMac, DPH_STA_HASH_INDEX_PEER, &bssIdx, psessionEntry) != eSIR_SUCCESS)
             goto fail;
         beaconParams.bssIdx = bssIdx;
-        palCopyMemory( pMac->hHdd, ( tANI_U8* )&psessionEntry->lastBeaconTimeStamp, ( tANI_U8* )pBeacon->timeStamp, sizeof(tANI_U64) );
+        vos_mem_copy(( tANI_U8* )&psessionEntry->lastBeaconTimeStamp,
+                     ( tANI_U8* )pBeacon->timeStamp, sizeof(tANI_U64));
         psessionEntry->lastBeaconDtimCount = pBeacon->tim.dtimCount;
         psessionEntry->lastBeaconDtimPeriod= pBeacon->tim.dtimPeriod;
         psessionEntry->currentBssBeaconCnt++;
@@ -412,7 +414,6 @@
             //SMAC already parses TIM bit.
         }
 
-        
         if(pMac->lim.gLimProtectionControl != WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
 
         limDecideStaProtection(pMac, pBeacon, &beaconParams, psessionEntry);
@@ -444,7 +445,7 @@
                         limSendEdcaParams(pMac, psessionEntry->gLimEdcaParamsActive, pStaDs->bssId, eANI_BOOLEAN_FALSE);
                 }
                 else
-                    PELOGE(limLog(pMac, LOGE, FL("Self Entry missing in Hash Table"));)
+                    PELOGE(schLog(pMac, LOGE, FL("Self Entry missing in Hash Table"));)
             }
         }
         else if( (pBeacon->qosCapabilityPresent && psessionEntry->limQosEnabled) &&
@@ -469,101 +470,171 @@
         else if (psessionEntry->gLimSpecMgmt.dot11hChanSwState == eLIM_11H_CHANSW_RUNNING)
         {
             limCancelDot11hChannelSwitch(pMac, psessionEntry);
-        }   
+        }
     }
 
 #ifdef WLAN_FEATURE_11AC
-    if ( (psessionEntry->limSystemRole == eLIM_STA_ROLE) ||(psessionEntry->limSystemRole == eLIM_BT_AMP_STA_ROLE) || (psessionEntry->limSystemRole == eLIM_STA_IN_IBSS_ROLE) ) 
+    if ((psessionEntry->limSystemRole == eLIM_STA_ROLE) ||
+        (psessionEntry->limSystemRole == eLIM_BT_AMP_STA_ROLE) ||
+        (psessionEntry->limSystemRole == eLIM_STA_IN_IBSS_ROLE))
     {
-        // check for VHT capability
-        if(psessionEntry->vhtCapability && pBeacon->OperatingMode.present)
-        {
-            pStaDs = dphLookupHashEntry(pMac, pMh->sa, &aid, &psessionEntry->dph.dphHashTable);
-            operMode = pStaDs->vhtSupportedChannelWidthSet ? eHT_CHANNEL_WIDTH_80MHZ : pStaDs->htSupportedChannelWidthSet ? eHT_CHANNEL_WIDTH_40MHZ: eHT_CHANNEL_WIDTH_20MHZ;
-            if( operMode != pBeacon->OperatingMode.chanWidth)
-            {
-                PELOG1(limLog(pMac, LOG1, FL(" received Chanwidth %d, staIdx = %d"),
-                                          pBeacon->OperatingMode.chanWidth, 
-                                          pStaDs->staIndex);)
-                PELOG1(limLog(pMac, LOG1, FL(" MAC - %0x:%0x:%0x:%0x:%0x:%0x"),
-                                          pMh->sa[0],
-                                          pMh->sa[1],
-                                          pMh->sa[2],
-                                          pMh->sa[3],
-                                          pMh->sa[4],
-                                          pMh->sa[5]);)
-                
-                if(pBeacon->OperatingMode.chanWidth == eHT_CHANNEL_WIDTH_80MHZ)
-                {
-                    pStaDs->vhtSupportedChannelWidthSet =  WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ;
-                    pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_40MHZ ;
-                }
-                else if(pBeacon->OperatingMode.chanWidth == eHT_CHANNEL_WIDTH_40MHZ)
-                {
-                    pStaDs->vhtSupportedChannelWidthSet = WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
-                    pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_40MHZ;
-                }
-                else if(pBeacon->OperatingMode.chanWidth == eHT_CHANNEL_WIDTH_20MHZ)
-                {
-                    pStaDs->vhtSupportedChannelWidthSet = WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
-                    pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_20MHZ;
-                }
-                limCheckVHTOpModeChange(pMac, psessionEntry, pBeacon->OperatingMode.chanWidth, pStaDs->staIndex);
-            }
-        }
+       // check for VHT capability
+       pStaDs = dphLookupHashEntry(pMac, pMh->sa, &aid,
+             &psessionEntry->dph.dphHashTable);
+       if (NULL != pStaDs)
+       {
+          if (psessionEntry->vhtCapability && pBeacon->OperatingMode.present )
+          {
+             operMode = pStaDs->vhtSupportedChannelWidthSet ?
+                eHT_CHANNEL_WIDTH_80MHZ :
+                pStaDs->htSupportedChannelWidthSet ?
+                eHT_CHANNEL_WIDTH_40MHZ: eHT_CHANNEL_WIDTH_20MHZ;
+             if (operMode != pBeacon->OperatingMode.chanWidth)
+             {
+                PELOG1(schLog(pMac, LOG1,
+                         FL(" received OpMode Chanwidth %d, staIdx = %d"),
+                         pBeacon->OperatingMode.chanWidth,
+                         pStaDs->staIndex);)
+                   PELOG1(schLog(pMac, LOG1, FL(" MAC - %0x:%0x:%0x:%0x:%0x:%0x"),
+                            pMh->sa[0],
+                            pMh->sa[1],
+                            pMh->sa[2],
+                            pMh->sa[3],
+                            pMh->sa[4],
+                            pMh->sa[5]);)
+
+                   if (pBeacon->OperatingMode.chanWidth == eHT_CHANNEL_WIDTH_80MHZ)
+                   {
+                      PELOG1(schLog(pMac, LOG1,
+                               FL("Updating the CH Width to 80MHz"));)
+                         pStaDs->vhtSupportedChannelWidthSet =
+                         WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ;
+                      pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_40MHZ;
+                   }
+                   else if (pBeacon->OperatingMode.chanWidth == eHT_CHANNEL_WIDTH_40MHZ)
+                   {
+                      PELOG1(schLog(pMac, LOG1,
+                               FL("Updating the CH Width to 40MHz"));)
+                         pStaDs->vhtSupportedChannelWidthSet =
+                         WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
+                      pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_40MHZ;
+                   }
+                   else if (pBeacon->OperatingMode.chanWidth ==
+                         eHT_CHANNEL_WIDTH_20MHZ)
+                   {
+                      PELOG1(schLog(pMac, LOG1,
+                               FL("Updating the CH Width to 20MHz"));)
+                         pStaDs->vhtSupportedChannelWidthSet =
+                         WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
+                      pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_20MHZ;
+                   }
+                limCheckVHTOpModeChange(pMac, psessionEntry,
+                      pBeacon->OperatingMode.chanWidth,
+                      pStaDs->staIndex);
+             }
+          }
+          else if (psessionEntry->vhtCapability && pBeacon->VHTOperation.present)
+          {
+             operMode = pStaDs->vhtSupportedChannelWidthSet;
+             if (operMode != pBeacon->VHTOperation.chanWidth)
+             {
+                PELOG1(schLog(pMac, LOG1,
+                         FL(" received VHTOP CHWidth %d staIdx = %d"),
+                         pBeacon->VHTOperation.chanWidth,
+                         pStaDs->staIndex);)
+                   PELOG1(schLog(pMac, LOG1, FL(" MAC - %0x:%0x:%0x:%0x:%0x:%0x"),
+                            pMh->sa[0],
+                            pMh->sa[1],
+                            pMh->sa[2],
+                            pMh->sa[3],
+                            pMh->sa[4],
+                            pMh->sa[5]);)
+
+                   if (pBeacon->VHTOperation.chanWidth ==
+                         WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ)
+                   {
+                      PELOG1(schLog(pMac, LOG1,
+                               FL("Updating the CH Width to 80MHz"));)
+                         pStaDs->vhtSupportedChannelWidthSet =
+                         WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ;
+                      pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_40MHZ;
+                      chWidth = eHT_CHANNEL_WIDTH_80MHZ;
+                   }
+                   else if (pBeacon->VHTOperation.chanWidth ==
+                         WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ)
+                   {
+                      pStaDs->vhtSupportedChannelWidthSet =
+                         WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
+                      if (pBeacon->HTCaps.supportedChannelWidthSet)
+                      {
+                         PELOG1(schLog(pMac, LOG1,
+                                  FL("Updating the CH Width to 40MHz"));)
+                            pStaDs->htSupportedChannelWidthSet =
+                            eHT_CHANNEL_WIDTH_40MHZ;
+                         chWidth = eHT_CHANNEL_WIDTH_40MHZ;
+                      }
+                      else
+                      {
+                         PELOG1(schLog(pMac, LOG1,
+                                  FL("Updating the CH Width to 20MHz"));)
+                            pStaDs->htSupportedChannelWidthSet =
+                            eHT_CHANNEL_WIDTH_20MHZ;
+                         chWidth = eHT_CHANNEL_WIDTH_20MHZ;
+                      }
+                   }
+                limCheckVHTOpModeChange(pMac, psessionEntry,
+                      chWidth, pStaDs->staIndex);
+             }
+          }
+       }
     }
 #endif
 
+#if defined (FEATURE_WLAN_CCX) || defined (FEATURE_WLAN_VOWIFI)
+    /* Obtain the Max Tx power for the current regulatory  */
+    regMax = cfgGetRegulatoryMaxTransmitPower( pMac, psessionEntry->currentOperChannel );
+#endif
+
+#if defined FEATURE_WLAN_VOWIFI
+    {
+        tPowerdBm  localRRMConstraint = 0;
+        if ( pMac->rrm.rrmPEContext.rrmEnable && pBeacon->powerConstraintPresent )
+        {
+            localRRMConstraint = pBeacon->localPowerConstraint.localPowerConstraints;
+        }
+        else
+        {
+            localRRMConstraint = 0;
+        }
+        maxTxPower = VOS_MIN(regMax,(regMax - localRRMConstraint));
+    }
+#elif defined FEATURE_WLAN_CCX
+    maxTxPower = regMax;
+#endif
+
 #if defined FEATURE_WLAN_CCX
-        if( psessionEntry->isCCXconnection )
+    if( psessionEntry->isCCXconnection )
+    {
+        tPowerdBm  localCCXConstraint = 0;
+        if (pBeacon->ccxTxPwr.present)
         {
-           tPowerdBm  localConstraint = 0, regMax = 0, maxTxPower = 0;
-           if (pBeacon->ccxTxPwr.present)
-           {
-              localConstraint = pBeacon->ccxTxPwr.power_limit;
-              regMax = cfgGetRegulatoryMaxTransmitPower( pMac, psessionEntry->currentOperChannel ); 
-              maxTxPower = limGetMaxTxPower(regMax, localConstraint, pMac->roam.configParam.nTxPowerCap);
+            localCCXConstraint = pBeacon->ccxTxPwr.power_limit;
+            maxTxPower = limGetMaxTxPower(maxTxPower, localCCXConstraint, pMac->roam.configParam.nTxPowerCap);
+        }
+        schLog( pMac, LOG1, "RegMax = %d, localCcxCons = %d, MaxTx = %d", regMax, localCCXConstraint, maxTxPower );
+    }
+#endif
 
-              //If maxTxPower is increased or decreased
-             if( maxTxPower != psessionEntry->maxTxPower )
-             {
-                limLog( pMac, LOG1, "RegMax = %d, lpc = %d, MaxTx = %d", regMax, localConstraint, maxTxPower );
-                limLog( pMac, LOG1, "Local power constraint change..updating new maxTx power to HAL");
-                if( limSendSetMaxTxPowerReq ( pMac, maxTxPower, psessionEntry ) == eSIR_SUCCESS )
+#if defined (FEATURE_WLAN_CCX) || defined (FEATURE_WLAN_VOWIFI)
+    {
+        //If maxTxPower is increased or decreased
+        if( maxTxPower != psessionEntry->maxTxPower )
+        {
+             schLog( pMac, LOG1, "Local power constraint change..updating new maxTx power %d to HAL",maxTxPower);
+             if( limSendSetMaxTxPowerReq ( pMac, maxTxPower, psessionEntry ) == eSIR_SUCCESS )
                    psessionEntry->maxTxPower = maxTxPower;
-             }
-           }
         }
-#endif
-
-
-#if defined WLAN_FEATURE_VOWIFI
-        if( pMac->rrm.rrmPEContext.rrmEnable )
-        {
-           tPowerdBm  localConstraint = 0, regMax = 0, maxTxPower = 0;
-           if (pBeacon->powerConstraintPresent && pMac->rrm.rrmPEContext.rrmEnable)
-           {
-              localConstraint = pBeacon->localPowerConstraint.localPowerConstraints;
-           }
-           else
-           {
-              localConstraint = 0;
-           }
-           regMax = cfgGetRegulatoryMaxTransmitPower( pMac, psessionEntry->currentOperChannel );
-           //Get the maxTxPower in the range of 13 to 19
-           maxTxPower = rrmGetMinOfMaxTxPower(regMax, (regMax - localConstraint));
-           //If maxTxPower is increased or decreased
-           if( maxTxPower != psessionEntry->maxTxPower )
-           {
-#if defined WLAN_VOWIFI_DEBUG
-              limLog( pMac, LOGE, "Regulatory max = %d, local power constraint = %d, max tx = %d", regMax, localConstraint, maxTxPower );
-              limLog( pMac, LOGE, "Local power constraint change..updating mew maxTx power to HAL");
-#endif
-              if( rrmSendSetMaxTxPowerReq ( pMac, maxTxPower, psessionEntry ) == eSIR_SUCCESS )
-                 psessionEntry->maxTxPower = maxTxPower;
-
-           }
-        }
+    }
 #endif
 
     // Indicate to LIM that Beacon is received
diff --git a/CORE/MAC/src/pe/sch/schDebug.c b/CORE/MAC/src/pe/sch/schDebug.c
index f2ad4e6..3f800bd 100644
--- a/CORE/MAC/src/pe/sch/schDebug.c
+++ b/CORE/MAC/src/pe/sch/schDebug.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file schDebug.cc contains some debug functions.
  *
@@ -39,26 +38,28 @@
  */
 
 
+#include "vos_trace.h"
 #include "schDebug.h"
+#define LOG_SIZE 256
 
-void schLog(tpAniSirGlobal pMac, tANI_U32 loglevel, const char *pString,...)
+void schLog(tpAniSirGlobal pMac, tANI_U32 loglevel, const char *pString, ...)
 {
-#ifdef WLAN_DEBUG
-    // Verify against current log level
-    if ( loglevel > pMac->utils.gLogDbgLevel[LOG_INDEX_FOR_MODULE( SIR_SCH_MODULE_ID )] )
-        return;
-    else
-    {
-        va_list marker;
 
-        va_start( marker, pString );     /* Initialize variable arguments. */
+       VOS_TRACE_LEVEL  vosDebugLevel;
+       char    logBuffer[LOG_SIZE];
+       va_list marker;
 
-        logDebug(pMac, SIR_SCH_MODULE_ID, loglevel, pString, marker);
+      /* getting proper Debug level*/
+       vosDebugLevel = getVosDebugLevel(loglevel);
 
-        va_end( marker );              /* Reset variable arguments.      */
-    }
-#endif
-}
+      /* extracting arguments from pstring */
+       va_start( marker, pString );
+       vsnprintf(logBuffer, LOG_SIZE, pString, marker);
+       VOS_TRACE(VOS_MODULE_ID_PE, vosDebugLevel, "%s", logBuffer);
+       va_end( marker );
+ }
+
 
 
 // --------------------------------------------------------------------
+
diff --git a/CORE/SAP/inc/sapApi.h b/CORE/SAP/inc/sapApi.h
index ce4e6f1..165297b 100644
--- a/CORE/SAP/inc/sapApi.h
+++ b/CORE/SAP/inc/sapApi.h
@@ -97,8 +97,7 @@
   ------------------------------------------------------------------------*/
 
 #define       MAX_SSID_LEN                 32
-#define       MAX_MAC_ADDRESS_ACCEPTED     16
-#define       MAX_MAC_ADDRESS_DENIED       MAX_MAC_ADDRESS_ACCEPTED
+#define       MAX_ACL_MAC_ADDRESS          16
 #define       AUTO_CHANNEL_SELECT          0
 #define       MAX_ASSOC_IND_IE_LEN         255
 
@@ -318,6 +317,11 @@
     v_MACADDR_t staMac;     /*MAC address of Station that is associated*/
     v_U8_t      assocId;        /*Association ID for the station that is associated*/
     v_U8_t      staId;            /*Station Id that is allocated to the station*/
+    v_U8_t      ShortGI40Mhz;
+    v_U8_t      ShortGI20Mhz;
+    v_U8_t      Support40Mhz;
+    v_U32_t     requestedMCRate;
+    tSirSupportedRates supportedRates;
 } tSap_AssocMacAddr, *tpSap_AssocMacAddr;
 
 /*struct corresponding to SAP_ASSOC_STA_CALLBACK_EVENT */
@@ -405,11 +409,11 @@
     tSap_SSIDInfo_t SSIDinfo;
     eSapPhyMode     SapHw_mode; /* Wireless Mode */
     eSapMacAddrACL  SapMacaddr_acl;
-    v_MACADDR_t     accept_mac[MAX_MAC_ADDRESS_ACCEPTED]; /* MAC filtering */
+    v_MACADDR_t     accept_mac[MAX_ACL_MAC_ADDRESS]; /* MAC filtering */
     v_BOOL_t        ieee80211d;      /*Specify if 11D is enabled or disabled*/
     v_BOOL_t        protEnabled;     /*Specify if protection is enabled or disabled*/
     v_BOOL_t        obssProtEnabled; /*Specify if OBSS protection is enabled or disabled*/
-    v_MACADDR_t     deny_mac[MAX_MAC_ADDRESS_DENIED]; /* MAC filtering */
+    v_MACADDR_t     deny_mac[MAX_ACL_MAC_ADDRESS]; /* MAC filtering */
     v_MACADDR_t     self_macaddr; //self macaddress or BSSID
    
     v_U8_t          channel;         /* Operation channel */
@@ -923,6 +927,7 @@
     v_PVOID_t  pvosGCtx,
     tsap_Config_t *pConfig
 );
+
 /*==========================================================================
   FUNCTION    WLANSAP_Stop
 
diff --git a/CORE/SAP/src/sapChSelect.c b/CORE/SAP/src/sapChSelect.c
index cb44a4e..9aed4e3 100644
--- a/CORE/SAP/src/sapChSelect.c
+++ b/CORE/SAP/src/sapChSelect.c
@@ -28,17 +28,16 @@
 /*===========================================================================
 
                       s a p C h S e l e c t . C
-                                               
   OVERVIEW:
-  
+
   This software unit holds the implementation of the WLAN SAP modules
-  functions for channel selection.  
+  functions for channel selection.
 
-  DEPENDENCIES: 
+  DEPENDENCIES:
 
-  Are listed for each API below. 
-  
-  
+  Are listed for each API below.
+
+
   Copyright (c) 2010 Qualcomm Technologies, Inc.
   All Rights Reserved.
   Qualcomm Technologies Confidential and Proprietary
@@ -82,6 +81,11 @@
 --------------------------------------------------------------------------*/
 #define SAP_DEBUG
 
+#define IS_RSSI_VALID( extRssi, rssi ) \
+( \
+   ((extRssi < rssi)?eANI_BOOLEAN_TRUE:eANI_BOOLEAN_FALSE) \
+)
+
 /*==========================================================================
   FUNCTION    sapCleanupChannelList
 
@@ -204,10 +208,22 @@
     }
 
     /*getting the first argument ie the number of channels*/
-    sscanf(param, "%d ", &tempInt);
+    if (sscanf(param, "%d ", &tempInt) != 1)
+    {
+        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                   "%s: Cannot get number of channels from input", __func__);
+        return -EINVAL;
+    }
 
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, 
-               "Number of channel added are: %d", tempInt);
+               "%s: Number of channel added are: %d", __func__, tempInt);
+
+    if (tempInt <= 0 || tempInt > 255)
+    {
+        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                   "%s: Invalid Number of channel received", __func__);
+        return -EINVAL;
+    }
 
     /*allocating space for the desired number of channels*/
     pSapCtx->SapChnlList.channelList = (v_U8_t *)vos_mem_malloc(tempInt);
@@ -244,12 +260,26 @@
             return -EINVAL;
         }
 
-        sscanf(param, "%d ", &tempInt);
+        if (sscanf(param, "%d ", &tempInt) != 1)
+        {
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                       "%s: Cannot read channel number", __func__);
+            sapCleanupChannelList();
+            return -EINVAL;
+        }
+        if (tempInt < 0 || tempInt > 255)
+        {
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                       "%s: Invalid channel number received", __func__);
+            sapCleanupChannelList();
+            return -EINVAL;
+        }
+
         pSapCtx->SapChnlList.channelList[j] = tempInt;
 
         VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, 
-                   "Channel %d added to preferred channel list",
-                   pSapCtx->SapChnlList.channelList[j] );
+                   "%s: Channel %d added to preferred channel list",
+                   __func__, pSapCtx->SapChnlList.channelList[j] );
 
     }
 
@@ -426,7 +456,7 @@
     // Weight from RSSI
     rssiWeight = SOFTAP_RSSI_WEIGHT * (rssi - SOFTAP_MIN_RSSI)
                  /(SOFTAP_MAX_RSSI - SOFTAP_MIN_RSSI);
-                 
+
     if(rssiWeight > SOFTAP_RSSI_WEIGHT)
         rssiWeight = SOFTAP_RSSI_WEIGHT;
     else if (rssiWeight < 0)
@@ -435,12 +465,12 @@
     // Weight from data count
     countWeight = SOFTAP_COUNT_WEIGHT * (count - SOFTAP_MIN_COUNT)
                   /(SOFTAP_MAX_COUNT - SOFTAP_MIN_COUNT);
-                      
+
     if(countWeight > SOFTAP_COUNT_WEIGHT)
         countWeight = SOFTAP_COUNT_WEIGHT;
     else if (countWeight < 0)
         countWeight = 0;
-        
+
     rssicountWeight =  rssiWeight + countWeight;      
 
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, rssiWeight=%d, countWeight=%d, rssicountWeight=%d",
@@ -472,184 +502,716 @@
 void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
 {
     tSapSpectChInfo *pExtSpectCh = NULL;
+    v_S31_t rssi;
+
     switch(pSpectCh->chNum)
     {
         case CHANNEL_1:
             pExtSpectCh = (pSpectCh + 1);
-            if(pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL)
             {
                 ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 2);
-            if(pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL)
             {
                 ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
                 if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 3);
-            if(pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL)
             {
                 ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
                 if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 4);
-            if(pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL)
             {
                 ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
         break;
+
         case CHANNEL_2:
             pExtSpectCh = (pSpectCh - 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 3);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 4);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            break;
+        case CHANNEL_3:
+            pExtSpectCh = (pSpectCh - 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 3);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 4);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            break;
+        case CHANNEL_4:
+            pExtSpectCh = (pSpectCh - 3);
             if(pExtSpectCh != NULL)
             {
                 ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
                 if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 3);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 4);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            break;
+
+        case CHANNEL_5:
+        case CHANNEL_6:
+        case CHANNEL_7:
+            pExtSpectCh = (pSpectCh - 4);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 3);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 1);
             if(pExtSpectCh != NULL)
             {
                 ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 2);
             if(pExtSpectCh != NULL)
             {
                 ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 3);
             if(pExtSpectCh != NULL)
             {
                 ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 4);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
                 if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             break;
-        case CHANNEL_3:
-        case CHANNEL_4:
-        case CHANNEL_5:
-        case CHANNEL_6:
-        case CHANNEL_7:
+
         case CHANNEL_8:
-        case CHANNEL_9:
-            pExtSpectCh = (pSpectCh - 1);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            pExtSpectCh = (pSpectCh + 1);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            pExtSpectCh = (pSpectCh - 2);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            pExtSpectCh = (pSpectCh + 2);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            break;
-        case CHANNEL_10:
-            pExtSpectCh = (pSpectCh - 1);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            pExtSpectCh = (pSpectCh + 1);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            pExtSpectCh = (pSpectCh - 2);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            pExtSpectCh = (pSpectCh - 3);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            break;
-        case CHANNEL_11:
-            pExtSpectCh = (pSpectCh - 1);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            pExtSpectCh = (pSpectCh - 2);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
-            pExtSpectCh = (pSpectCh - 3);
-            if(pExtSpectCh != NULL)
-            {
-                ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
-                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-            }
             pExtSpectCh = (pSpectCh - 4);
             if(pExtSpectCh != NULL)
             {
                 ++pExtSpectCh->bssCount;
-                pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY);
-                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+
+            pExtSpectCh = (pSpectCh - 3);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 3);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             break;
+
+        case CHANNEL_9:
+            pExtSpectCh = (pSpectCh - 4);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+
+            pExtSpectCh = (pSpectCh - 3);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            break;
+
+        case CHANNEL_10:
+            pExtSpectCh = (pSpectCh - 4);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+
+            pExtSpectCh = (pSpectCh - 3);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 2);
+            if(pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh + 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            break;
+
+        case CHANNEL_11:
+            pExtSpectCh = (pSpectCh - 1);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FIRST_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 2);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_SEC_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 3);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_THIRD_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            pExtSpectCh = (pSpectCh - 4);
+            if (pExtSpectCh != NULL)
+            {
+                ++pExtSpectCh->bssCount;
+                rssi = pSpectCh->rssiAgr +
+                       SAP_24GHZ_FOURTH_OVERLAP_CHAN_RSSI_EFFECT_PRIMARY;
+                if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                {
+                    pExtSpectCh->rssiAgr = rssi;
+                }
+                if (pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
+                    pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
+            }
+            break;
+
         default:
             break;
     }
@@ -678,8 +1240,8 @@
   
   SIDE EFFECTS 
 ============================================================================*/
-void sapComputeSpectWeight( tSapChSelSpectInfo* pSpectInfoParams, 
-                                 tHalHandle halHandle, tScanResultHandle pResult)
+void sapComputeSpectWeight( tSapChSelSpectInfo* pSpectInfoParams,
+                             tHalHandle halHandle, tScanResultHandle pResult)
 {
     v_S7_t rssi = 0;
     v_U8_t chn_num = 0;
@@ -696,14 +1258,13 @@
     tSirProbeRespBeacon *pBeaconStruct;
     tpAniSirGlobal  pMac = (tpAniSirGlobal) halHandle;
 
-    if(eHAL_STATUS_SUCCESS != palAllocateMemory(pMac->hHdd, 
-                                                (void **)&pBeaconStruct, sizeof(tSirProbeRespBeacon)))
+    pBeaconStruct = vos_mem_malloc(sizeof(tSirProbeRespBeacon));
+    if ( NULL == pBeaconStruct )
     {
-        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,"Unable to PAL allocate memory in sapComputeSpectWeight\n");
+        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+                   "Unable to allocate memory in sapComputeSpectWeight\n");
         return;
     }
-    
-    
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, Computing spectral weight", __func__);
 
     /**
@@ -711,7 +1272,7 @@
     */
     ccmCfgGetInt( halHandle, WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND, &operatingBand);
 
-    pScanResult = sme_ScanResultGetFirst(halHandle, pResult);    
+    pScanResult = sme_ScanResultGetFirst(halHandle, pResult);
 
     while (pScanResult) {
         pSpectCh = pSpectInfoParams->pSpectCh;
@@ -720,15 +1281,15 @@
         secondaryChannelOffset = PHY_SINGLE_CHANNEL_CENTERED;
         vhtSupport = 0;
         centerFreq = 0;
-        
-        if(pScanResult->BssDescriptor.ieFields != NULL) 
+
+        if (pScanResult->BssDescriptor.ieFields != NULL)
         {
             ieLen = (pScanResult->BssDescriptor.length + sizeof(tANI_U16) + sizeof(tANI_U32) - sizeof(tSirBssDescription));
-            palZeroMemory(pMac->hHdd, (tANI_U8 *) pBeaconStruct, sizeof(tSirProbeRespBeacon));
-            
+            vos_mem_set((tANI_U8 *) pBeaconStruct, sizeof(tSirProbeRespBeacon), 0);
+
             if ((sirParseBeaconIE(pMac, pBeaconStruct,(tANI_U8 *)( pScanResult->BssDescriptor.ieFields), ieLen)) == eSIR_SUCCESS)
             {
-                if(pBeaconStruct->HTCaps.present && pBeaconStruct->HTInfo.present)
+                if (pBeaconStruct->HTCaps.present && pBeaconStruct->HTInfo.present)
                 {
                     channelWidth = pBeaconStruct->HTCaps.supportedChannelWidthSet;
                     secondaryChannelOffset = pBeaconStruct->HTInfo.secondaryChannelOffset;
@@ -756,7 +1317,7 @@
             else
                 channel_id = pScanResult->BssDescriptor.channelId;
 
-            if (channel_id == pSpectCh->chNum) {        
+            if (channel_id == pSpectCh->chNum) {
                 if (pSpectCh->rssiAgr < pScanResult->BssDescriptor.rssi)
                     pSpectCh->rssiAgr = pScanResult->BssDescriptor.rssi;
 
@@ -765,8 +1326,8 @@
                 if(operatingBand) // Connsidering the Extension Channel only in a channels
                 {
                     /* Updating the received ChannelWidth */
-                    if (pSpectCh->channelWidth != channelWidth) 
-                        pSpectCh->channelWidth = channelWidth; 
+                    if (pSpectCh->channelWidth != channelWidth)
+                        pSpectCh->channelWidth = channelWidth;
                     /* If received ChannelWidth is other than HT20, we need to update the extension channel Params as well */
                     /* channelWidth == 0, HT20 */
                     /* channelWidth == 1, HT40 */
@@ -782,17 +1343,26 @@
                                     if(pExtSpectCh != NULL)
                                     {
                                         ++pExtSpectCh->bssCount;
+                                        rssi = pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY;
                                         // REducing the rssi by -20 and assigning it to Extension channel
-                                        pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY);
+                                        if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                        {
+                                            pExtSpectCh->rssiAgr = rssi;
+                                        }
                                         if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                             pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                     }
                                 break;
+
                                 case PHY_DOUBLE_CHANNEL_HIGH_PRIMARY: // Below the Primary channel
                                     pExtSpectCh = (pSpectCh - 1);
                                     if(pExtSpectCh != NULL) 
                                     {
-                                        pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY);
+                                        rssi = pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY;
+                                        if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                        {
+                                            pExtSpectCh->rssiAgr = rssi;
+                                        }
                                         if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                             pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                         ++pExtSpectCh->bssCount;
@@ -808,7 +1378,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY); // Reducing the rssi by -20 and assigning it to Subband 1
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi; // Reducing the rssi by -20 and assigning it to Subband 1
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -816,7 +1390,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND2_RSSI_EFFECT_PRIMARY); // Reducing the rssi by -30 and assigning it to Subband 2
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND2_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi; // Reducing the rssi by -30 and assigning it to Subband 2
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -824,10 +1402,14 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND3_RSSI_EFFECT_PRIMARY); // Reducing the rssi by -40 and assigning it to Subband 3
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND3_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi; // Reducing the rssi by -40 and assigning it to Subband 3
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
-                                }  
+                                }
                             }
                             else if((centerFreq - channel_id) == 2)
                             {
@@ -836,7 +1418,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY);
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi;
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -844,7 +1430,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY);
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi;
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -852,7 +1442,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND2_RSSI_EFFECT_PRIMARY);
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND2_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi;
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -864,7 +1458,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY);
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi;
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -872,7 +1470,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND2_RSSI_EFFECT_PRIMARY);
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND2_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi;
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -880,7 +1482,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY);
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi;
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -892,7 +1498,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY);
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND1_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi;
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -900,7 +1510,11 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND2_RSSI_EFFECT_PRIMARY);
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND2_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi;
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
@@ -908,14 +1522,18 @@
                                 if(pExtSpectCh != NULL)
                                 {
                                     ++pExtSpectCh->bssCount;
-                                    pExtSpectCh->rssiAgr = (pSpectCh->rssiAgr + SAP_SUBBAND3_RSSI_EFFECT_PRIMARY);
+                                    rssi = pSpectCh->rssiAgr + SAP_SUBBAND3_RSSI_EFFECT_PRIMARY;
+                                    if (IS_RSSI_VALID(pExtSpectCh->rssiAgr, rssi))
+                                    {
+                                        pExtSpectCh->rssiAgr = rssi;
+                                    }
                                     if(pExtSpectCh->rssiAgr < SOFTAP_MIN_RSSI)
                                         pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
                                 }
                             }
                         break;
                     }
-                } 
+                }
                 else if(operatingBand == RF_SUBBAND_2_4_GHZ)
                 {
                      sapInterferenceRssiCount(pSpectCh);
@@ -940,7 +1558,7 @@
     VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, Spectrum Channels Weight", __func__);
 
     for (chn_num = 0; chn_num < (pSpectInfoParams->numSpectChans); chn_num++) {
-    
+
         /*
           rssi : Maximum received signal strength among all BSS on that channel
           bssCount : Number of BSS on that channel
@@ -950,13 +1568,15 @@
 
         pSpectCh->weight = SAPDFS_NORMALISE_1000 * sapweightRssiCount(rssi, pSpectCh->bssCount);
 
-        //------ Debug Info ------ 
-        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, Chan=%d Weight= %d rssiAgr=%d bssCount=%d", __func__, pSpectCh->chNum,
-            pSpectCh->weight, pSpectCh->rssiAgr, pSpectCh->bssCount);
-        //------ Debug Info ------ 
+        //------ Debug Info ------
+        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+             "In %s, Chan=%d Weight= %d rssiAgr=%d bssCount=%d", __func__,
+             pSpectCh->chNum, pSpectCh->weight,
+             pSpectCh->rssiAgr, pSpectCh->bssCount);
+        //------ Debug Info ------
         pSpectCh++;
     }
-    palFreeMemory(pMac->hHdd, pBeaconStruct);
+    vos_mem_free(pBeaconStruct);
 }
 
 /*==========================================================================
@@ -1056,68 +1676,6 @@
 }
 
 /*==========================================================================
-  FUNCTION    sapComputeNonOverlapChannel
-
-  DESCRIPTION
-    Checking for the Free Non Overlapping Channel
-
-  DEPENDENCIES
-    NA.
-
-  PARAMETERS
-
-    IN
-    pSpectInfoParams: Spectrum Info params
-    startChannelNum: Allowed start channel number
-    endChannelNum: Allowed end channel number
-
-  RETURN VALUE
-    v_U8_t          : Success - Bit mask
-
-  SIDE EFFECTS
-============================================================================*/
-v_U8_t  sapComputeNonOverlapChannel(tSapChSelSpectInfo* pSpectInfoParams,
-                                    v_U32_t startChannelNum, v_U32_t endChannelNum)
-{
-    v_U8_t nonOverlap = 0;
-    tSapSpectChInfo *pSpectCh   = NULL;
-    v_U8_t chn_num = 0;
-    pSpectCh = pSpectInfoParams->pSpectCh;
-    for (chn_num = 0; chn_num < (pSpectInfoParams->numSpectChans); chn_num++) {
-
-        if (startChannelNum > pSpectCh->chNum || endChannelNum < pSpectCh->chNum)
-        {
-            // Channel is not in allowed range
-            pSpectCh++;
-            continue;
-        }
-
-        if(pSpectCh->chNum == CHANNEL_1 || pSpectCh->chNum == CHANNEL_6 || pSpectCh->chNum == CHANNEL_11)
-        {
-            switch(pSpectCh->chNum)
-            {
-                case 1:
-                if(pSpectCh->weight == 0)
-                    nonOverlap |= 0x1; //Bit 0 For channel 1
-                break;
-                case 6:
-                if(pSpectCh->weight == 0)
-                    nonOverlap |= 0x2; // Bit 1 For Channel 6
-                break;
-                case 11:
-                if(pSpectCh->weight == 0)
-                    nonOverlap |= 0x4; // Bit 2 for Channel 11
-                break;
-                default:
-                break;
-            }
-        }
-        pSpectCh++;
-    }
-    return nonOverlap;
-}
-
-/*==========================================================================
   FUNCTION    sapSelectChannel
 
   DESCRIPTION 
@@ -1143,7 +1701,6 @@
     // DFS param object holding all the data req by the algo
     tSapChSelSpectInfo oSpectInfoParams = {NULL,0}; 
     tSapChSelSpectInfo *pSpectInfoParams = &oSpectInfoParams; // Memory? NB    
-    v_U8_t nonOverlap = 0;
     v_U8_t bestChNum = 0;
 #ifdef SOFTAP_CHANNEL_RANGE
     v_U32_t startChannelNum;
@@ -1173,60 +1730,49 @@
     ccmCfgGetInt( halHandle, WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL, &endChannelNum);
     ccmCfgGetInt( halHandle, WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND, &operatingBand);
 
-    // Calculating the Non overlapping Channel Availability */
-    if(operatingBand == RF_SUBBAND_2_4_GHZ)
-        nonOverlap = sapComputeNonOverlapChannel(pSpectInfoParams, startChannelNum,
-                                                 endChannelNum);
-
     /*Loop till get the best channel in the given range */
     for(count=0; count < pSpectInfoParams->numSpectChans ; count++)
     {
         if((startChannelNum <= pSpectInfoParams->pSpectCh[count].chNum)&&
           ( endChannelNum >= pSpectInfoParams->pSpectCh[count].chNum))
         {
-            bestChNum = (v_U8_t)pSpectInfoParams->pSpectCh[count].chNum;
-            break;
-        }
-    }
-
+            if(bestChNum == 0)
+            {
+                bestChNum = (v_U8_t)pSpectInfoParams->pSpectCh[count].chNum;
+            }
+            else
+            {
+                if(operatingBand == RF_SUBBAND_2_4_GHZ)
+                {
+                    /* Give preference to Non-overlap channels */
+                    if(((pSpectInfoParams->pSpectCh[count].chNum == CHANNEL_1) ||
+                      (pSpectInfoParams->pSpectCh[count].chNum == CHANNEL_6) ||
+                      (pSpectInfoParams->pSpectCh[count].chNum == CHANNEL_11))&&
+                      (pSpectInfoParams->pSpectCh[count].weight == 0))
+                      {
+                           bestChNum = (v_U8_t)pSpectInfoParams->pSpectCh[count].chNum;
+                           break;
+                      }
+                }
+            }
+         }
+      }
 #else
     // Get the first channel in sorted array as best 20M Channel
     bestChNum = (v_U8_t)pSpectInfoParams->pSpectCh[0].chNum;
-
 #endif
-   
+
     //Select Best Channel from Channel List if Configured
     bestChNum = sapSelectPreferredChannelFromChannelList(bestChNum, pSapCtx, pSpectInfoParams);
 
-    if(operatingBand == RF_SUBBAND_2_4_GHZ)
-    {
-        if(nonOverlap)
-        {
-            switch(nonOverlap)
-            {
-                case 0x1:
-                    bestChNum = CHANNEL_1;
-                break;
-                case 0x2:
-                    bestChNum = CHANNEL_6;
-                break;
-                case 0x4:
-                    bestChNum = CHANNEL_11;
-                break;
-                default:
-                break;
-            }
-        }
-    }
-
     // Free all the allocated memory
     sapChanSelExit(pSpectInfoParams);
 
     VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, Running SAP Ch select Completed, Ch=%d",
-                __func__, bestChNum);
-
+                        __func__, bestChNum);
     if (bestChNum > 0 && bestChNum <= 252)
         return bestChNum;
     else
         return SAP_CHANNEL_NOT_SELECTED;
 }
+
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 7d85166..c2e0c0c 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -327,11 +327,10 @@
     eHalStatus halStatus;
     tANI_U32 type, subType;
     VOS_STATUS status = VOS_STATUS_E_FAILURE;
-    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-
 
     /*- - - - - - - - TODO:once configs from hdd available - - - - - - - - -*/
     char key_material[32]={ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1,};
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     sapContext->key_type = 0x05;
     sapContext->key_length = 32;
     vos_mem_copy(sapContext->key_material, key_material, sizeof(key_material));  /* Need a key size define */
diff --git a/CORE/SAP/src/sapInternal.h b/CORE/SAP/src/sapInternal.h
index c6f646e..653e7b7 100644
--- a/CORE/SAP/src/sapInternal.h
+++ b/CORE/SAP/src/sapInternal.h
@@ -190,9 +190,9 @@
 
     // Mac filtering settings
     eSapMacAddrACL      eSapMacAddrAclMode;
-    v_MACADDR_t         acceptMacList[MAX_MAC_ADDRESS_ACCEPTED];
+    v_MACADDR_t         acceptMacList[MAX_ACL_MAC_ADDRESS];
     v_U8_t              nAcceptMac;
-    v_MACADDR_t         denyMacList[MAX_MAC_ADDRESS_DENIED];
+    v_MACADDR_t         denyMacList[MAX_ACL_MAC_ADDRESS];
     v_U8_t              nDenyMac;
 
     // QOS config
@@ -581,26 +581,28 @@
 
   FUNCTION    sapAddMacToACL
 
-  DESCRIPTION 
+  DESCRIPTION
     Function to ADD a mac address in an ACL.
     The function ensures that the ACL list remains sorted after the addition.
-    This API does not take care of buffer overflow i.e. if the list is already maxed out while adding a mac address,
-    it will still try to add. 
-    The caller must take care that the ACL size is less than MAX_MAC_ADDRESS_ACCEPTED before calling this function.
+    This API does not take care of buffer overflow i.e. if the list is already
+    maxed out while adding a mac address, it will still try to add.
+    The caller must take care that the ACL size is less than MAX_ACL_MAC_ADDRESS
+    before calling this function.
 
-  DEPENDENCIES 
+  DEPENDENCIES
 
-  PARAMETERS 
+  PARAMETERS
 
     IN
        macList          : ACL list of mac addresses (black/white list)
-       size (I/O)       : size of the ACL. It is an I/O arg. The API takes care of incrementing the size by 1.
+       size (I/O)       : size of the ACL. It is an I/O arg. The API takes care
+                          of incrementing the size by 1.
        peerMac          : Mac address of the peer to be added
 
  RETURN VALUE
     None.
 
-  SIDE EFFECTS 
+  SIDE EFFECTS
 
 ============================================================================*/
 void
diff --git a/CORE/SAP/src/sapModule.c b/CORE/SAP/src/sapModule.c
index 4f0f6b2..4db9f9e 100644
--- a/CORE/SAP/src/sapModule.c
+++ b/CORE/SAP/src/sapModule.c
@@ -625,7 +625,7 @@
             //present or not doesn't maater as we have to follow whatever
             //STA session does)
             if ((0 == sme_GetConcurrentOperationChannel(hHal)) &&
-                 pConfig->ieee80211d)
+                pConfig->ieee80211d)
             {
                 /* Setting the region/country  information */
                 sme_setRegInfo(hHal, pConfig->countryCode);
@@ -661,7 +661,6 @@
     return vosStatus;
 }// WLANSAP_StartBss
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,4,0))
 /*==========================================================================
   FUNCTION    WLANSAP_SetMacACL
 
@@ -700,42 +699,44 @@
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                  "WLANSAP_SetMacACL");
 
-    if (VOS_STA_SAP_MODE != vos_get_conparam ())
+    if (VOS_STA_SAP_MODE == vos_get_conparam ())
+    {
+        pSapCtx = VOS_GET_SAP_CB(pvosGCtx);
+        if ( NULL == pSapCtx )
+        {
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+                       "%s: Invalid SAP pointer from pvosGCtx", __func__);
+            return VOS_STATUS_E_FAULT;
+        }
+
+        // Copy MAC filtering settings to sap context
+        pSapCtx->eSapMacAddrAclMode = pConfig->SapMacaddr_acl;
+
+        if (eSAP_DENY_UNLESS_ACCEPTED == pSapCtx->eSapMacAddrAclMode)
+        {
+            vos_mem_copy(pSapCtx->acceptMacList, pConfig->accept_mac,
+                                                 sizeof(pConfig->accept_mac));
+            pSapCtx->nAcceptMac = pConfig->num_accept_mac;
+            sapSortMacList(pSapCtx->acceptMacList, pSapCtx->nAcceptMac);
+        }
+        else if (eSAP_ACCEPT_UNLESS_DENIED == pSapCtx->eSapMacAddrAclMode)
+        {
+            vos_mem_copy(pSapCtx->denyMacList, pConfig->deny_mac,
+                                               sizeof(pConfig->deny_mac));
+            pSapCtx->nDenyMac = pConfig->num_deny_mac;
+            sapSortMacList(pSapCtx->denyMacList, pSapCtx->nDenyMac);
+        }
+    }
+    else
     {
         VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                    "%s : SoftAp role has not been enabled", __func__);
+                       "%s : SoftAp role has not been enabled", __func__);
         return VOS_STATUS_E_FAULT;
     }
 
-    pSapCtx = VOS_GET_SAP_CB(pvosGCtx);
-    if ( NULL == pSapCtx )
-    {
-        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-                    "%s: Invalid SAP pointer from pvosGCtx", __func__);
-        return VOS_STATUS_E_FAULT;
-    }
-
-    // Copy MAC filtering settings to sap context
-    pSapCtx->eSapMacAddrAclMode = pConfig->SapMacaddr_acl;
-
-    if (eSAP_DENY_UNLESS_ACCEPTED == pSapCtx->eSapMacAddrAclMode)
-    {
-        vos_mem_copy(pSapCtx->acceptMacList, pConfig->accept_mac,
-                                sizeof(pConfig->accept_mac));
-        pSapCtx->nAcceptMac = pConfig->num_accept_mac;
-        sapSortMacList(pSapCtx->acceptMacList, pSapCtx->nAcceptMac);
-    }
-    else if (eSAP_ACCEPT_UNLESS_DENIED == pSapCtx->eSapMacAddrAclMode)
-    {
-        vos_mem_copy(pSapCtx->denyMacList, pConfig->deny_mac,
-                                sizeof(pConfig->deny_mac));
-        pSapCtx->nDenyMac = pConfig->num_deny_mac;
-        sapSortMacList(pSapCtx->denyMacList, pSapCtx->nDenyMac);
-    }
-
     return vosStatus;
 }//WLANSAP_SetMacACL
-#endif
+
 /*==========================================================================
   FUNCTION    WLANSAP_StopBss
 
@@ -1073,7 +1074,7 @@
             {
                 //error check
                 // if list is already at max, return failure
-                if (pSapCtx->nAcceptMac == MAX_MAC_ADDRESS_ACCEPTED)
+                if (pSapCtx->nAcceptMac == MAX_ACL_MAC_ADDRESS)
                 {
                     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
                             "White list is already maxed out. Cannot accept %02x:%02x:%02x:%02x:%02x:%02x",
@@ -1136,7 +1137,7 @@
             {
                 //error check
                 // if list is already at max, return failure
-                if (pSapCtx->nDenyMac == MAX_MAC_ADDRESS_ACCEPTED)
+                if (pSapCtx->nDenyMac == MAX_ACL_MAC_ADDRESS)
                 {
                     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
                             "Black list is already maxed out. Cannot accept %02x:%02x:%02x:%02x:%02x:%02x",
@@ -2162,7 +2163,7 @@
         }
 
         halStatus = sme_RemainOnChannel( hHal, pSapCtx->sessionId,
-                          channel, duration, callback, pContext );
+                          channel, duration, callback, pContext, TRUE );
 
         if( eHAL_STATUS_SUCCESS == halStatus )
         {
diff --git a/CORE/SERVICES/BMI/ol_fw.c b/CORE/SERVICES/BMI/ol_fw.c
index 31e9b0a..1d34ffd 100644
--- a/CORE/SERVICES/BMI/ol_fw.c
+++ b/CORE/SERVICES/BMI/ol_fw.c
@@ -486,7 +486,7 @@
 		ol_target_coredump(ramdump_scn, ramdump_base, TOTAL_DUMP_SIZE);
 
 		printk("%s: RAM dump collecting completed!\n", __func__);
-		msleep(1000);
+		msleep(500);
 	} else {
 		printk("No RAM dump will be collected since ramdump_scn is NULL!\n");
 	}
@@ -931,7 +931,7 @@
 
 	/*
 	* SECTION = REGISTER
-	* START   = 0x4000
+	* START   = Vary in target type
 	* LENGTH  = 0x6c000
 	*
 	* SECTION = DRAM
diff --git a/CORE/SERVICES/COMMON/wma_api.h b/CORE/SERVICES/COMMON/wma_api.h
index e98cfcb..1fa59dc 100644
--- a/CORE/SERVICES/COMMON/wma_api.h
+++ b/CORE/SERVICES/COMMON/wma_api.h
@@ -113,7 +113,8 @@
 			int param_id, int vpdev);
 eHalStatus wma_set_htconfig(tANI_U8 vdev_id, tANI_U16 ht_capab, int value);
 eHalStatus WMA_SetCountryCode(v_VOID_t *client_ctx, tANI_U8 *countrycode);
-eHalStatus WMA_SetRegDomain(void * clientCtxt, v_REGDOMAIN_t regId);
+eHalStatus WMA_SetRegDomain(void * clientCtxt, v_REGDOMAIN_t regId,
+		tAniBool sendRegHint);
 
 #ifndef QCA_WIFI_ISOC
 int wma_suspend_target(WMA_HANDLE handle, int disable_target_intr);
diff --git a/CORE/SERVICES/COMMON/wmi_tlv_defs.h b/CORE/SERVICES/COMMON/wmi_tlv_defs.h
index 3d2d930..385069b 100644
--- a/CORE/SERVICES/COMMON/wmi_tlv_defs.h
+++ b/CORE/SERVICES/COMMON/wmi_tlv_defs.h
@@ -368,7 +368,7 @@
     WMITLV_TAG_STRUC_wmi_vdev_mcc_set_tbtt_mode_cmd_fixed_param,
     WMITLV_TAG_STRUC_wmi_roam_chan_list_fixed_param,
     WMITLV_TAG_STRUC_wmi_vdev_mcc_bcn_intvl_change_event_fixed_param,
-    WMITLV_TAG_STRUC_wmi_resmgr_adaptive_ocs_disable_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param,
     WMITLV_TAG_STRUC_wmi_resmgr_set_chan_time_quota_cmd_fixed_param,
     WMITLV_TAG_STRUC_wmi_resmgr_set_chan_latency_cmd_fixed_param,
     WMITLV_TAG_STRUC_wmi_ba_req_ssn_cmd_fixed_param,
@@ -525,7 +525,7 @@
     OP(WMI_TDLS_PEER_UPDATE_CMDID) \
     OP(WMI_FWTEST_VDEV_MCC_SET_TBTT_MODE_CMDID) \
     OP(WMI_ROAM_CHAN_LIST)  \
-    OP(WMI_RESMGR_ADAPTIVE_OCS_DISABLE_CMDID)\
+    OP(WMI_RESMGR_ADAPTIVE_OCS_ENABLE_DISABLE_CMDID)\
     OP(WMI_RESMGR_SET_CHAN_TIME_QUOTA_CMDID)    \
     OP(WMI_RESMGR_SET_CHAN_LATENCY_CMDID) \
     OP(WMI_BA_REQ_SSN_CMDID) \
@@ -1329,12 +1329,12 @@
 
 WMITLV_CREATE_PARAM_STRUC(WMI_TDLS_PEER_UPDATE_CMDID);
 
-/* Resmgr Disable Adaptive OCS CMD */
-#define WMITLV_TABLE_WMI_RESMGR_ADAPTIVE_OCS_DISABLE_CMDID(id,op,buf,len) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_resmgr_adaptive_ocs_disable_cmd_fixed_param, \
-            wmi_resmgr_adaptive_ocs_disable_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+/* Resmgr Enable/Disable Adaptive OCS CMD */
+#define WMITLV_TABLE_WMI_RESMGR_ADAPTIVE_OCS_ENABLE_DISABLE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param, \
+            wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 
-WMITLV_CREATE_PARAM_STRUC(WMI_RESMGR_ADAPTIVE_OCS_DISABLE_CMDID);
+WMITLV_CREATE_PARAM_STRUC(WMI_RESMGR_ADAPTIVE_OCS_ENABLE_DISABLE_CMDID);
 
 /* Resmgr Set Channel Time Quota CMD */
 #define WMITLV_TABLE_WMI_RESMGR_SET_CHAN_TIME_QUOTA_CMDID(id,op,buf,len) \
diff --git a/CORE/SERVICES/COMMON/wmi_unified.h b/CORE/SERVICES/COMMON/wmi_unified.h
index de3f0c7..7d20bab 100644
--- a/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/CORE/SERVICES/COMMON/wmi_unified.h
@@ -522,7 +522,7 @@
     /** Adaptive OCS is enabled by default in the FW. This command is used to
      * disable FW based adaptive OCS.
      */
-    WMI_RESMGR_ADAPTIVE_OCS_DISABLE_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_RESMGR),
+    WMI_RESMGR_ADAPTIVE_OCS_ENABLE_DISABLE_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_RESMGR),
     /** set the requested channel time quota for the home channels */
     WMI_RESMGR_SET_CHAN_TIME_QUOTA_CMDID,
     /** set the requested latency for the home channels */
@@ -3164,6 +3164,11 @@
      * Enable QPower
      */
     WMI_STA_PS_ENABLE_QPOWER = 6,
+
+            /**
+             * Number of TX frames before the entering the Active state
+             */
+            WMI_STA_PS_PARAM_QPOWER_MAX_TX_BEFORE_WAKE = 7,
         };
 
         typedef struct {
@@ -5604,12 +5609,16 @@
     A_UINT32 new_bcn_intvl;
 } wmi_vdev_mcc_bcn_intvl_change_event_fixed_param;
 
-/* WMI_RESMGR_ADAPTIVE_OCS_DISABLE_CMDID */
+/* WMI_RESMGR_ADAPTIVE_OCS_ENABLE_DISABLE_CMDID */
 typedef struct {
-    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_resmgr_adaptive_ocs_disable_cmd_fixed_param */
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param */
     A_UINT32 tlv_header;
     A_UINT32 reserved0;
-} wmi_resmgr_adaptive_ocs_disable_cmd_fixed_param;
+    /** 1: enable fw based adaptive ocs,
+     *  0: disable fw based adaptive ocs
+     */
+    A_UINT32 enable;
+} wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param;
 
 /* WMI_RESMGR_SET_CHAN_TIME_QUOTA_CMDID */
 typedef struct {
diff --git a/CORE/SERVICES/COMMON/wmi_version.h b/CORE/SERVICES/COMMON/wmi_version.h
index f1acdda..e59195f 100644
--- a/CORE/SERVICES/COMMON/wmi_version.h
+++ b/CORE/SERVICES/COMMON/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 23
+#define __WMI_REVISION_ 24
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work
diff --git a/CORE/SERVICES/HIF/PCIe/hif_pci.c b/CORE/SERVICES/HIF/PCIe/hif_pci.c
index 4db4fc7..54b5780 100644
--- a/CORE/SERVICES/HIF/PCIe/hif_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/hif_pci.c
@@ -25,6 +25,7 @@
  * to the Linux Foundation.
  */
 
+
 /*
  * Implementation of the Host-side Host InterFace (HIF) API
  * for a Host/Target interconnect using Copy Engines over PCIe.
@@ -1520,6 +1521,9 @@
         }
     }
 
+    adf_os_timer_cancel(&hif_state->sleep_timer);
+    adf_os_timer_free(&hif_state->sleep_timer);
+
     hif_state->started = FALSE;
     AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-%s\n",__FUNCTION__));
 }
@@ -1937,6 +1941,34 @@
         ASSERT(rv == A_OK);
 }
 
+#define HIF_MIN_SLEEP_INACTIVITY_TIME_MS     10
+#define HIF_SLEEP_INACTIVITY_TIMER_PERIOD_MS 20
+static void
+HIF_sleep_entry(void *arg)
+{
+	struct HIF_CE_state *hif_state = (struct HIF_CE_state *)arg;
+	A_target_id_t pci_addr = TARGID_TO_PCI_ADDR(hif_state->targid);
+	struct hif_pci_softc *sc = hif_state->sc;
+	u_int32_t idle_ms;
+
+	adf_os_spin_lock(&hif_state->keep_awake_lock);
+	if (hif_state->verified_awake == FALSE) {
+		idle_ms = adf_os_ticks_to_msecs(adf_os_ticks()
+					- hif_state->sleep_ticks);
+		if (idle_ms >= HIF_MIN_SLEEP_INACTIVITY_TIME_MS) {
+			A_PCI_WRITE32(pci_addr + PCIE_LOCAL_BASE_ADDRESS +
+				PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_RESET);
+			hif_state->fake_sleep = FALSE;
+		} else {
+			adf_os_timer_start(&hif_state->sleep_timer,
+				HIF_SLEEP_INACTIVITY_TIMER_PERIOD_MS);
+		}
+	} else {
+		adf_os_timer_start(&hif_state->sleep_timer,
+			HIF_SLEEP_INACTIVITY_TIMER_PERIOD_MS);
+	}
+	adf_os_spin_unlock(&hif_state->keep_awake_lock);
+}
 
 /*
  * Called from PCI layer whenever a new PCI device is probed.
@@ -1972,6 +2004,11 @@
 
     hif_state->keep_awake_count = 0;
 
+    hif_state->fake_sleep = FALSE;
+    hif_state->sleep_ticks = 0;
+    adf_os_timer_init(NULL, &hif_state->sleep_timer,
+                      HIF_sleep_entry, (void *)hif_state);
+
     hif_state->fw_indicator_address = FW_INDICATOR_ADDRESS;
     hif_state->targid = A_TARGET_ID(sc->hif_device);
 #if CONFIG_ATH_PCIE_MAX_PERF || CONFIG_ATH_PCIE_AWAKE_WHILE_DRIVER_LOAD
@@ -2245,14 +2282,29 @@
         if (hif_state->keep_awake_count == 0) {
             /* Allow sleep */
             hif_state->verified_awake = FALSE;
-            A_PCI_WRITE32(pci_addr + PCIE_LOCAL_BASE_ADDRESS + PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_RESET);
+            hif_state->sleep_ticks = adf_os_ticks();
+        }
+        if (hif_state->fake_sleep == FALSE) {
+            /* Set the Fake Sleep */
+            hif_state->fake_sleep = TRUE;
+
+            /* Start the Sleep Timer */
+            adf_os_timer_cancel(&hif_state->sleep_timer);
+            adf_os_timer_start(&hif_state->sleep_timer,
+                HIF_SLEEP_INACTIVITY_TIMER_PERIOD_MS);
         }
         adf_os_spin_unlock(&hif_state->keep_awake_lock);
     } else {
         adf_os_spin_lock(&hif_state->keep_awake_lock);
-        if (hif_state->keep_awake_count == 0) {
-            /* Force AWAKE */
-            A_PCI_WRITE32(pci_addr + PCIE_LOCAL_BASE_ADDRESS + PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_V_MASK);
+
+        if (hif_state->fake_sleep) {
+            hif_state->verified_awake = TRUE;
+        } else {
+            if (hif_state->keep_awake_count == 0) {
+                /* Force AWAKE */
+                A_PCI_WRITE32(pci_addr + PCIE_LOCAL_BASE_ADDRESS +
+                              PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_V_MASK);
+            }
         }
         hif_state->keep_awake_count++;
         adf_os_spin_unlock(&hif_state->keep_awake_lock);
diff --git a/CORE/SERVICES/HIF/PCIe/hif_pci.h b/CORE/SERVICES/HIF/PCIe/hif_pci.h
index a873310..adb35a5 100644
--- a/CORE/SERVICES/HIF/PCIe/hif_pci.h
+++ b/CORE/SERVICES/HIF/PCIe/hif_pci.h
@@ -93,6 +93,9 @@
     adf_os_spinlock_t keep_awake_lock;
     unsigned int keep_awake_count;
     A_BOOL verified_awake;
+    A_BOOL fake_sleep;
+    adf_os_timer_t sleep_timer;
+    unsigned long sleep_ticks;
 
     //struct task_struct *pci_dev_inserted_thread;
     //struct completion pci_dev_inserted_thread_done;
diff --git a/CORE/SERVICES/HIF/PCIe/if_pci.c b/CORE/SERVICES/HIF/PCIe/if_pci.c
index 61255fb..4195aad 100644
--- a/CORE/SERVICES/HIF/PCIe/if_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/if_pci.c
@@ -38,6 +38,7 @@
 #include <osapi_linux.h>
 #include "vos_api.h"
 #include "wma_api.h"
+#include "adf_os_atomic.h"
 #if defined(QCA_WIFI_2_0) && !defined(QCA_WIFI_ISOC)
 #include "wlan_hdd_power.h"
 #endif
diff --git a/CORE/SERVICES/WMA/inc/legacy/halMsgApi.h b/CORE/SERVICES/WMA/inc/legacy/halMsgApi.h
index 79d2d49..d7f68f0 100644
--- a/CORE/SERVICES/WMA/inc/legacy/halMsgApi.h
+++ b/CORE/SERVICES/WMA/inc/legacy/halMsgApi.h
@@ -25,8 +25,6 @@
  * to the Linux Foundation.
  */
 
-/*
- * */
 #ifndef _HALMSGAPI_H_
 #define _HALMSGAPI_H_
 
@@ -285,7 +283,12 @@
     tANI_U8    vhtTxChannelWidthSet;
     tANI_U8    vhtTxBFCapable;
     tANI_U8    vhtTxMUBformeeCapable;
+    tANI_U8    enableVhtpAid;
+    tANI_U8    enableVhtGid;
 #endif
+    tANI_U8    enableAmpduPs;
+    tANI_U8    enableHtSmps;
+    tANI_U8    htSmpsconfig;
 
     tANI_U8    htLdpcCapable;
     tANI_U8    vhtLdpcCapable;
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index d14a803..8b1fc76 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -96,9 +96,11 @@
 #include "dbglog_host.h"
 /* FIXME: Inclusion of .c looks odd but this is how it is in internal codebase */
 #include "wmi_version_whitelist.c"
+#include "csrApi.h"
 
 /* ################### defines ################### */
 #define WMA_2_4_GHZ_MAX_FREQ  3000
+#define WOW_CSA_EVENT_OFFSET 12
 
 #define WMA_DEFAULT_SCAN_PRIORITY            1
 #define WMA_DEFAULT_SCAN_REQUESTER_ID        1
@@ -143,6 +145,11 @@
 
 static tANI_U32 gFwWlanFeatCaps;
 
+static eHalStatus wma_set_ppsconfig(tANI_U8 vdev_id, tANI_U16 pps_param,
+                                    int value);
+static eHalStatus wma_set_mimops(tp_wma_handle wma_handle,
+                                 tANI_U8 vdev_id, int value);
+
 #if defined(QCA_WIFI_FTM) && !defined(QCA_WIFI_ISOC)
 void wma_utf_attach(tp_wma_handle wma_handle);
 void wma_utf_detach(tp_wma_handle wma_handle);
@@ -361,6 +368,23 @@
 	return req_msg;
 }
 
+tSmpsModeValue host_map_smps_mode (A_UINT32 fw_smps_mode)
+{
+	tSmpsModeValue smps_mode = SMPS_MODE_DISABLED;
+	switch (fw_smps_mode) {
+		case WMI_SMPS_FORCED_MODE_STATIC:
+			smps_mode = STATIC_SMPS_MODE;
+			break;
+		case WMI_SMPS_FORCED_MODE_DYNAMIC:
+			smps_mode = DYNAMIC_SMPS_MODE;
+			break;
+		default:
+			smps_mode = SMPS_MODE_DISABLED;
+	}
+
+	return smps_mode;
+}
+
 static void wma_vdev_start_rsp(tp_wma_handle wma,
 			tpAddBssParams add_bss,
 			wmi_vdev_start_response_event_fixed_param *resp_event)
@@ -413,6 +437,8 @@
 #endif
 	add_bss->status = VOS_STATUS_SUCCESS;
 	add_bss->bssIdx = resp_event->vdev_id;
+	add_bss->chainMask = resp_event->chain_mask;
+	add_bss->smpsMode = host_map_smps_mode(resp_event->smps_mode);
 send_fail_resp:
 	WMA_LOGD("%s: Sending add bss rsp to umac(vdev %d status %d)\n",
 		 __func__, resp_event->vdev_id, add_bss->status);
@@ -447,6 +473,8 @@
 			(tpSwitchChannelParams) req_msg->user_data;
 		WMA_LOGD("%s: Send channel switch resp vdev %d status %d\n",
 			 __func__, resp_event->vdev_id, resp_event->status);
+		params->chainMask = resp_event->chain_mask;
+		params->smpsMode = host_map_smps_mode(resp_event->smps_mode);
 		params->status = resp_event->status;
 		wma_send_msg(wma, WDA_SWITCH_CHANNEL_RSP, (void *)params, 0);
 	} else if (req_msg->msg_type == WDA_ADD_BSS_REQ) {
@@ -1310,7 +1338,6 @@
 	vos_mem_copy(&pStartOemDataRsp->oemDataRsp[0], data, datalen);
 
 	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)pStartOemDataRsp, 0);
-	vos_mem_free(data);
 	return 0;
 }
 
@@ -1349,7 +1376,6 @@
 	vos_mem_copy(&pStartOemDataRsp->oemDataRsp[0], data, datalen);
 
 	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)data, 0);
-	vos_mem_free(data);
 	return 0;
 }
 #endif /* FEATURE_OEM_DATA_SUPPORT */
@@ -2037,6 +2063,40 @@
 		 max_unresponsive_time);
 }
 
+static VOS_STATUS wma_set_enable_disable_mcc_adaptive_scheduler(tANI_U32 mcc_adaptive_scheduler)
+{
+	int ret = -1;
+	wmi_buf_t buf = 0;
+	wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param *cmd = NULL;
+	tp_wma_handle wma = NULL;
+	void *vos_context = NULL;
+	u_int16_t len = sizeof(wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param);
+
+	vos_context = vos_get_global_context(VOS_MODULE_ID_WDA, NULL);
+	wma = vos_get_context(VOS_MODULE_ID_WDA, vos_context);
+
+	buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGP("%s : wmi_buf_alloc failed", __func__);
+		return VOS_STATUS_E_NOMEM;
+	}
+	cmd = (wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param *) wmi_buf_data(buf);
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		WMITLV_TAG_STRUC_wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param,
+		WMITLV_GET_STRUCT_TLVLEN(
+			wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param));
+	cmd->enable = mcc_adaptive_scheduler;
+
+	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+				WMI_RESMGR_ADAPTIVE_OCS_ENABLE_DISABLE_CMDID);
+	if (ret) {
+		WMA_LOGP("Failed to send enable/disable MCC adaptive scheduler command");
+		adf_nbuf_free(buf);
+	}
+	return VOS_STATUS_SUCCESS;
+}
+
 /* function   : wma_vdev_attach
  * Descriptin :
  * Args       :
@@ -2197,6 +2257,18 @@
 						  WMI_VDEV_PARAM_ROAM_FW_OFFLOAD, 1);
 	}
 
+	if (wlan_cfgGetInt(mac, WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED,
+	        &cfg_val) == eSIR_SUCCESS) {
+	        WMA_LOGD("\n%s: setting ini value for WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED: %d\n",
+			 __func__, cfg_val);
+		ret = wma_set_enable_disable_mcc_adaptive_scheduler(cfg_val);
+		if (ret != VOS_STATUS_SUCCESS) {
+			WMA_LOGE("Failed to set WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED");
+		}
+	} else {
+		WMA_LOGE("Failed to get value for WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED, leaving unchanged");
+	}
+
 end:
 	self_sta_req->status = status;
 
@@ -2403,7 +2475,8 @@
 	if (!scan_req->p2pScanType) {
 		WMA_LOGD("Normal Scan request");
 		cmd->scan_ctrl_flags |= WMI_SCAN_ADD_CCK_RATES;
-		cmd->scan_ctrl_flags |= WMI_SCAN_ADD_BCAST_PROBE_REQ;
+                if (!scan_req->numSsid)
+                        cmd->scan_ctrl_flags |= WMI_SCAN_ADD_BCAST_PROBE_REQ;
 		if (scan_req->scanType == eSIR_PASSIVE_SCAN)
 			cmd->scan_ctrl_flags |= WMI_SCAN_FLAG_PASSIVE;
 		cmd->scan_ctrl_flags |= WMI_SCAN_FILTER_PROBE_REQ;
@@ -2526,6 +2599,140 @@
 
 }
 
+/*AR9888/AR6320  noise floor approx value
+ * similar to the mentioned the TLSHIM
+ */
+#define WMA_TGT_NOISE_FLOOR_DBM (-96)
+/*
+ * WMI event handler for periodic target stats event
+ */
+
+static int wmi_unified_update_stats_event_handler(void* handle,
+				u_int8_t *data, u_int32_t datalen)
+{
+	wmi_stats_event_fixed_param *ev;
+	A_UINT8 *temp;
+	A_UINT8 i;
+	WMI_UPDATE_STATS_EVENTID_param_tlvs *param_buf;
+	tp_wma_handle wma = (tp_wma_handle) handle;
+	A_UINT8 rssi = 0;
+	tAniGetRssiReq *pGetRssiReq = (tAniGetRssiReq*)wma->pGetRssiReq;
+	u_int8_t vdev_id = 0;
+	wmi_vdev_stats *vdev_stats = NULL;
+
+	if(NULL != pGetRssiReq)
+		vdev_id = pGetRssiReq->sessionId;
+	WMA_LOGD("%s: vdev_id %d\n", __func__,  vdev_id);
+	param_buf = (WMI_UPDATE_STATS_EVENTID_param_tlvs *)data;
+	if (!param_buf) {
+		WMA_LOGE("%s: Received NULL buf ptr from FW", __func__);
+		return VOS_STATUS_E_NOMEM;
+	}
+	ev = param_buf->fixed_param;
+	if (NULL != param_buf->data)
+		temp = (A_UINT8 *)param_buf->data;
+	if (NULL != ev) {
+		for (i = 0; i < ev->num_vdev_stats; i++) {
+			if(NULL == temp )
+				continue ;
+			vdev_stats = (wmi_vdev_stats *)temp;
+			if(NULL == vdev_stats)
+				continue;
+			WMA_LOGE("vdev id %d beancon snr %d data snr %d\n",
+				vdev_stats->vdev_id, vdev_stats->vdev_snr.bcn_snr,
+				vdev_stats->vdev_snr.dat_snr);
+			/* if the data average rssi present return that,
+			 * else return beacon average rssi
+			 */
+			if (vdev_stats->vdev_id == vdev_id) {
+				if((vdev_stats->vdev_snr.dat_snr > 0) && (vdev_stats->vdev_snr.bcn_snr > 0))
+					rssi = (vdev_stats->vdev_snr.dat_snr + vdev_stats->vdev_snr.bcn_snr)/2;
+				else
+					rssi = vdev_stats->vdev_snr.bcn_snr;
+				/* Get the absolute rssi value from the current rssi value
+				 * the sinr value is hardcoded into 0 in the core stack
+				 */
+				rssi = rssi + WMA_TGT_NOISE_FLOOR_DBM;
+				WMA_LOGE("Average Rssi = %d, vdev id= %d",(int)rssi, vdev_id);
+
+				/* update the average rssi value to UMAC layer */
+				if ((NULL != pGetRssiReq) && (NULL != pGetRssiReq->rssiCallback)) {
+					((tCsrRssiCallback)(pGetRssiReq->rssiCallback))(rssi,pGetRssiReq->staId,
+						 pGetRssiReq->pDevContext);
+					pGetRssiReq->rssiCallback = NULL;
+					vos_mem_free(pGetRssiReq);
+					wma->pGetRssiReq = NULL;
+				}
+				else {
+					WMA_LOGE("WMA pGetRssiReq->rssiCallback is NULL");
+					if (NULL != pGetRssiReq) {
+						vos_mem_free(pGetRssiReq);
+						wma->pGetRssiReq = NULL;
+					}
+				}
+				break;
+			}
+
+			temp += sizeof(wmi_vdev_stats);
+		}
+	}
+
+	return VOS_STATUS_SUCCESS;
+}
+
+
+/*
+ * Return the data rssi for the given peer.
+ */
+VOS_STATUS wma_send_snr_request(tp_wma_handle wma_handle, void *pGetRssiReq)
+{
+	wmi_buf_t buf;
+	wmi_request_stats_cmd_fixed_param *cmd;
+	u_int8_t len = sizeof(wmi_request_stats_cmd_fixed_param);
+	tAniGetRssiReq *pRssiBkUp = NULL;
+
+	/* command is in progess */
+	if(NULL != wma_handle->pGetRssiReq)
+		return VOS_STATUS_SUCCESS;
+
+	/* create a copy of csrRssiCallback to send rssi value
+	 * after wmi event
+	 */
+	if(pGetRssiReq) {
+		pRssiBkUp = adf_os_mem_alloc(NULL, sizeof(tAniGetRssiReq));
+		if(!pRssiBkUp) {
+			WMA_LOGE("Failed to allocate memory for tAniGetRssiReq");
+			vos_mem_free(pRssiBkUp);
+			wma_handle->pGetRssiReq = NULL;
+			return VOS_STATUS_E_FAILURE;
+		}
+		adf_os_mem_set(pRssiBkUp, 0, sizeof(tAniGetRssiReq));
+		pRssiBkUp->sessionId = ((tAniGetRssiReq*)pGetRssiReq)->sessionId;
+		pRssiBkUp->rssiCallback = ((tAniGetRssiReq*)pGetRssiReq)->rssiCallback;
+		pRssiBkUp->pDevContext = ((tAniGetRssiReq*)pGetRssiReq)->pDevContext;
+		wma_handle->pGetRssiReq = (void*)pRssiBkUp;
+	}
+
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	cmd = (wmi_request_stats_cmd_fixed_param *)wmi_buf_data(buf);
+	WMITLV_SET_HDR(&cmd->tlv_header, WMITLV_TAG_STRUC_wmi_request_stats_cmd_fixed_param,
+				WMITLV_GET_STRUCT_TLVLEN(wmi_request_stats_cmd_fixed_param));
+	cmd->stats_id = WMI_REQUEST_VDEV_STAT;
+	if (wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,WMI_REQUEST_STATS_CMDID)) {
+		WMA_LOGE("Failed to send host stats request to fw");
+		wmi_buf_free(buf);
+		vos_mem_free(pRssiBkUp);
+		wma_handle->pGetRssiReq = NULL;
+		return VOS_STATUS_E_FAILURE;
+	}
+	return VOS_STATUS_SUCCESS;
+}
+
 /* function   : wma_start_scan
  * Descriptin :
  * Args       :
@@ -3270,7 +3477,7 @@
     wmi_ap_profile ap_profile;
     tpAniSirGlobal pMac = (tpAniSirGlobal)vos_get_context(VOS_MODULE_ID_PE,
                 wma_handle->vos_context);
-	A_INT8      noise_floor = WMI_DEFAULT_NOISE_FLOOR_DBM;
+	A_INT32      noise_floor = WMI_DEFAULT_NOISE_FLOOR_DBM;
 
     WMA_LOGI("%s: command 0x%x\n", __func__, roam_req->Command);
 	if (!pMac->roam.configParam.isFastRoamIniFeatureEnabled) {
@@ -4775,6 +4982,7 @@
 	struct wma_target_req *msg;
 	u_int8_t vdev_id, peer_id;
 	VOS_STATUS status;
+	tPowerdBm maxTxPower;
 
 	pdev = vos_get_context(VOS_MODULE_ID_TXRX, wma->vos_context);
 	vdev = wma_find_vdev_by_addr(wma, add_bss->bssId, &vdev_id);
@@ -4812,8 +5020,10 @@
         req.vht_capable = add_bss->vhtCapable;
 #if defined WLAN_FEATURE_VOWIFI
 	req.max_txpow = add_bss->maxTxPower;
+	maxTxPower = add_bss->maxTxPower;
 #else
 	req.max_txpow = 0;
+	maxTxPower = 0;
 #endif
 	req.beacon_intval = add_bss->beaconInterval;
 	req.dtim_period = add_bss->dtimPeriod;
@@ -4832,12 +5042,11 @@
 		goto peer_cleanup;
 	}
 
-	/* Initialize protection mode to no protection */
-	if (wmi_unified_vdev_set_param_send(wma->wmi_handle, vdev_id,
-					    WMI_VDEV_PARAM_PROTECTION_MODE,
-					    IEEE80211_PROT_NONE)) {
-		WMA_LOGE("Failed to initialize protection mode");
-	}
+	/* Configure rest of bss info once the vdev started */
+	wma_vdev_set_bss_params(wma, vdev_id,
+		add_bss->beaconInterval, add_bss->dtimPeriod,
+		add_bss->shortSlotTimeSupported, add_bss->llbCoexist,
+		maxTxPower);
 
 	return;
 
@@ -5507,6 +5716,30 @@
 		status = VOS_STATUS_E_FAILURE;
 	}
 
+        /* Sta is now associated, configure various params */
+
+        /* SM power save, configure the h/w as configured
+         * in the ini file. SMPS is not published in assoc
+         * request. Once configured, fw sends the required
+         * action frame to AP.
+         */
+        if (params->enableHtSmps)
+            wma_set_mimops(wma, params->smesessionId,
+                           params->htSmpsconfig);
+
+#ifdef WLAN_FEATURE_11AC
+        /* Partial AID match power save, enable when SU bformee*/
+        if (params->enableVhtpAid && params->vhtTxBFCapable)
+            wma_set_ppsconfig(params->smesessionId,
+                              WMA_VHT_PPS_PAID_MATCH, 1);
+#endif
+
+        /* Enable AMPDU power save, if htCapable/vhtCapable */
+        if (params->enableAmpduPs &&
+                   (params->htCapable || params->vhtCapable))
+               wma_set_ppsconfig(params->smesessionId,
+                                 WMA_VHT_PPS_DELIM_CRC_FAIL, 1);
+
 out:
 	params->status = status;
 	WMA_LOGD("%s: statype %d vdev_id %d aid %d bssid %pM staIdx %d status %d\n",
@@ -6693,7 +6926,17 @@
 		/* override normal configuration and force station asleep */
 		rx_wake_policy = WMI_STA_PS_RX_WAKE_POLICY_POLL_UAPSD;
 		tx_wake_threshold = WMI_STA_PS_TX_WAKE_THRESHOLD_NEVER;
-		pspoll_count = WMI_STA_PS_PSPOLL_COUNT_NO_MAX;
+
+		if (wlan_cfgGetInt(mac, WNI_CFG_MAX_PS_POLL,
+			&cfg_data_val ) != eSIR_SUCCESS) {
+			VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get value for WNI_CFG_MAX_PS_POLL");
+		}
+		if (cfg_data_val)
+			pspoll_count = (u_int32_t)cfg_data_val;
+		else
+			pspoll_count = WMA_DEFAULT_MAX_PSPOLL_BEFORE_WAKE;
+
 		inactivity_time = 0;
 		psmode = WMI_STA_PS_MODE_ENABLED;
 	} else {
@@ -6825,7 +7068,7 @@
 		(struct sAniSirGlobal*)vos_get_context(VOS_MODULE_ID_PE,
 		wma->vos_context);
 	u_int32_t tx_wake_threshold = WMA_DEFAULT_QPOWER_TX_WAKE_THRESHOLD;
-	u_int32_t pspoll_count = WMA_DEFAULT_QPOWER_MAX_PSPOLL_BEFORE_WAKE;
+	u_int32_t pspoll_count = WMA_DEFAULT_MAX_PSPOLL_BEFORE_WAKE;
 
 	WMA_LOGE("Set QPower Force(1)/Normal(0) Sleep vdevId %d val %d",
 		vdev_id, enable);
@@ -7127,8 +7370,7 @@
 {
 	wmi_sta_uapsd_auto_trig_cmd_fixed_param *cmd;
 	int32_t ret;
-	u_int32_t param_len = (num_ac - 1) *
-				sizeof(wmi_sta_uapsd_auto_trig_param);
+	u_int32_t param_len = num_ac * sizeof(wmi_sta_uapsd_auto_trig_param);
 	u_int32_t cmd_len = sizeof(*cmd) + param_len + WMI_TLV_HDR_SIZE;
 	u_int32_t i;
 	wmi_buf_t buf;
@@ -7605,6 +7847,15 @@
 		}
 	}
 
+	if (wake_info->wake_reason == WOW_REASON_CSA_EVENT) {
+		WMI_CSA_HANDLING_EVENTID_param_tlvs param;
+
+		WMA_LOGD("Host woken up because of CSA IE");
+		param.fixed_param =  (wmi_csa_event_fixed_param *) (((u_int8_t *) wake_info) +
+				sizeof(WOW_EVENT_INFO_fixed_param) + WOW_CSA_EVENT_OFFSET);
+		wma_csa_offload_handler(handle, (u_int8_t *)&param, sizeof(param));
+	}
+
 	return 0;
 }
 
@@ -7935,7 +8186,13 @@
 		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 		0x00, 0x00, 0x00, 0x00, 0xff, 0xff /* port 67 */ };
 	u_int8_t dhcp_offset = 0;
-	VOS_STATUS ret;
+	VOS_STATUS ret = VOS_STATUS_SUCCESS;
+
+	if (!wma->interfaces[vdev_id].vdev_up ||
+	    !WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
+				WMI_SERVICE_BEACON_OFFLOAD)) {
+		return ret;
+	}
 
 	WMA_LOGD("Configuring default AP mode wow pattern for vdev %d",
 		  vdev_id);
@@ -8112,7 +8369,8 @@
 
 		if (!iface->handle ||
 		    !iface->ptrn_match_enable ||
-		    !iface->conn_state)
+		    (!wma_is_vdev_in_ap_mode(wma, vdev_id) &&
+					  !iface->conn_state))
 			continue;
 
 		if (wma_is_wow_prtn_cached(wma, vdev_id)) {
@@ -8372,25 +8630,40 @@
 
 	wma->no_of_suspend_ind = 0;
 
-	/* At-least one vdev should be in connected state to enable WOW */
+	/*
+	 * Enable WOW if any one of the condition meets,
+	 *  1) Is any one of vdev in beaconning mode (in AP mode) ?
+	 *  2) Is any one of vdev in connected state (in STA mode) ?
+	 *  3) Is PNO in progress in any one of vdev ?
+	 */
+	for (i = 0; i < wma->max_bssid; i++) {
+		if (wma_is_vdev_in_ap_mode(wma, i) &&
+		    wma->interfaces[i].vdev_up &&
+		    WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
+                                   WMI_SERVICE_BEACON_OFFLOAD)) {
+			WMA_LOGD("vdev %d is in beaconning mode, enabling wow",
+				 i);
+			goto enable_wow;
+		}
+	}
 	for (i = 0; i < wma->max_bssid; i++) {
 		if (wma->interfaces[i].conn_state) {
 			connected = TRUE;
 			break;
 		}
 		if (wma->interfaces[i].pno_in_progress) {
-			WMA_LOGD("PNO is in progress during suspend");
+			WMA_LOGD("PNO is in progress, enabling wow");
 			pno_in_progress = TRUE;
 			break;
 		}
 	}
-
 	if (!connected && !pno_in_progress) {
 		WMA_LOGD("All vdev are in disconnected state, skipping wow");
 		vos_mem_free(info);
 		goto send_ready_to_suspend;
 	}
 
+enable_wow:
 	WMA_LOGD("WOW Suspend");
 
 	/*
@@ -8610,119 +8883,6 @@
 	return;
 }
 #endif /* FEATURE_OEM_DATA_SUPPORT */
-static int wma_process_receive_filter_set_filter_req(tp_wma_handle wma_handle,
-						tSirRcvPktFilterCfgType *rcv_filter_param)
-{
-	wmi_chatter_coalescing_add_filter_cmd_fixed_param *cmd;
-	chatter_pkt_coalescing_filter *cmd_filter;
-	u_int8_t *buf_ptr;
-	wmi_buf_t buf;
-	int num_rules = 1; /* Only one rule at a time */
-	int len;
-	int err;
-	int i;
-
-	/* allocate the memory */
-	len = sizeof(*cmd) + WMI_TLV_HDR_SIZE + sizeof(*cmd_filter) * num_rules;
-	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
-	if (!buf) {
-		WMA_LOGE("Failed to allocate buffer to send set_param cmd");
-		vos_mem_free(rcv_filter_param);
-		return -ENOMEM;
-	}
-	buf_ptr = (u_int8_t *) wmi_buf_data(buf);
-
-	/* fill the fixed part */
-	cmd = (wmi_chatter_coalescing_add_filter_cmd_fixed_param *) buf_ptr;
-	WMITLV_SET_HDR(&cmd->tlv_header,
-			WMITLV_TAG_STRUC_wmi_chatter_coalescing_add_filter_cmd_fixed_param,
-			WMITLV_GET_STRUCT_TLVLEN(
-					wmi_chatter_coalescing_add_filter_cmd_fixed_param));
-	cmd->num_of_filters = num_rules;
-
-	/* specify the type of data in the subsequent buffer */
-	buf_ptr += sizeof(*cmd);
-	cmd_filter = (chatter_pkt_coalescing_filter *) buf_ptr;
-	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
-			num_rules * sizeof(chatter_pkt_coalescing_filter));
-
-	/* fill the actual filter data */
-	buf_ptr += WMI_TLV_HDR_SIZE;
-	cmd_filter = (chatter_pkt_coalescing_filter *) buf_ptr;
-
-	WMITLV_SET_HDR(&cmd_filter->tlv_header,
-			WMITLV_TAG_STRUC_wmi_chatter_pkt_coalescing_filter,
-			WMITLV_GET_STRUCT_TLVLEN(chatter_pkt_coalescing_filter));
-
-	cmd_filter->filter_id = rcv_filter_param->filterId;
-	cmd_filter->max_coalescing_delay = rcv_filter_param->coalesceTime;
-	cmd_filter->pkt_type = CHATTER_COALESCING_PKT_TYPE_UNICAST |
-				CHATTER_COALESCING_PKT_TYPE_MULTICAST |
-				CHATTER_COALESCING_PKT_TYPE_BROADCAST;
-	cmd_filter->num_of_test_field = MIN(rcv_filter_param->numFieldParams,
-						CHATTER_MAX_FIELD_TEST);
-
-	for (i = 0; i < cmd_filter->num_of_test_field; i++) {
-		cmd_filter->test_fields[i].offset = rcv_filter_param->paramsData[i].dataOffset;
-		cmd_filter->test_fields[i].length = MIN(rcv_filter_param->paramsData[i].dataLength,
-							CHATTER_MAX_TEST_FIELD_LEN32);
-		cmd_filter->test_fields[i].test = rcv_filter_param->paramsData[i].cmpFlag;
-		memcpy(&cmd_filter->test_fields[i].value, rcv_filter_param->paramsData[i].compareData,
-			cmd_filter->test_fields[i].length);
-		memcpy(&cmd_filter->test_fields[i].mask, rcv_filter_param->paramsData[i].dataMask,
-			cmd_filter->test_fields[i].length);
-	}
-	WMA_LOGD("Chatter packets, adding filter with id: %d, num_test_fields=%d",cmd_filter->filter_id,
-		cmd_filter->num_of_test_field);
-	/* send the command along with data */
-	err = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
-					WMI_CHATTER_ADD_COALESCING_FILTER_CMDID);
-	if (err) {
-		WMA_LOGE("Failed to send set_param cmd");
-		wmi_buf_free(buf);
-		vos_mem_free(rcv_filter_param);
-		return -EIO;
-	}
-	vos_mem_free(rcv_filter_param);
-	return 0; /* SUCCESS */
-}
-
-static int wma_process_receive_filter_clear_filter_req(tp_wma_handle wma_handle,
-						tSirRcvFltPktClearParam *rcv_clear_param)
-{
-	wmi_chatter_coalescing_delete_filter_cmd_fixed_param *cmd;
-	wmi_buf_t buf;
-	int err;
-
-	/* allocate the memory */
-	buf = wmi_buf_alloc(wma_handle->wmi_handle, sizeof(*cmd));
-	if (!buf) {
-		WMA_LOGE("Failed to allocate buffer to send set_param cmd");
-		vos_mem_free(rcv_clear_param);
-		return -ENOMEM;
-	}
-
-	/* fill the fixed part */
-	cmd = (wmi_chatter_coalescing_delete_filter_cmd_fixed_param *) wmi_buf_data(buf);
-	WMITLV_SET_HDR(&cmd->tlv_header,
-			WMITLV_TAG_STRUC_wmi_chatter_coalescing_delete_filter_cmd_fixed_param,
-			WMITLV_GET_STRUCT_TLVLEN(
-					wmi_chatter_coalescing_delete_filter_cmd_fixed_param));
-	cmd->filter_id = rcv_clear_param->filterId;
-	WMA_LOGD("Chatter packets, clearing filter with id: %d",cmd->filter_id);
-
-	/* send the command along with data */
-	err = wmi_unified_cmd_send(wma_handle->wmi_handle, buf,
-				sizeof(*cmd), WMI_CHATTER_DELETE_COALESCING_FILTER_CMDID);
-	if (err) {
-		WMA_LOGE("Failed to send set_param cmd");
-		wmi_buf_free(buf);
-		vos_mem_free(rcv_clear_param);
-		return -EIO;
-	}
-	vos_mem_free(rcv_clear_param);
-	return 0; /* SUCCESS */
-}
 
 #ifdef FEATURE_WLAN_CCX
 
@@ -8941,6 +9101,120 @@
 	wma_send_msg(wma, WDA_ADD_TS_RSP, msg, 0);
 }
 
+static int wma_process_receive_filter_set_filter_req(tp_wma_handle wma_handle,
+						tSirRcvPktFilterCfgType *rcv_filter_param)
+{
+	wmi_chatter_coalescing_add_filter_cmd_fixed_param *cmd;
+	chatter_pkt_coalescing_filter *cmd_filter;
+	u_int8_t *buf_ptr;
+	wmi_buf_t buf;
+	int num_rules = 1; /* Only one rule at a time */
+	int len;
+	int err;
+	int i;
+
+	/* allocate the memory */
+	len = sizeof(*cmd) + WMI_TLV_HDR_SIZE + sizeof(*cmd_filter) * num_rules;
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGE("Failed to allocate buffer to send set_param cmd");
+		vos_mem_free(rcv_filter_param);
+		return -ENOMEM;
+	}
+	buf_ptr = (u_int8_t *) wmi_buf_data(buf);
+
+	/* fill the fixed part */
+	cmd = (wmi_chatter_coalescing_add_filter_cmd_fixed_param *) buf_ptr;
+	WMITLV_SET_HDR(&cmd->tlv_header,
+			WMITLV_TAG_STRUC_wmi_chatter_coalescing_add_filter_cmd_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(
+					wmi_chatter_coalescing_add_filter_cmd_fixed_param));
+	cmd->num_of_filters = num_rules;
+
+	/* specify the type of data in the subsequent buffer */
+	buf_ptr += sizeof(*cmd);
+	cmd_filter = (chatter_pkt_coalescing_filter *) buf_ptr;
+	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+			num_rules * sizeof(chatter_pkt_coalescing_filter));
+
+	/* fill the actual filter data */
+	buf_ptr += WMI_TLV_HDR_SIZE;
+	cmd_filter = (chatter_pkt_coalescing_filter *) buf_ptr;
+
+	WMITLV_SET_HDR(&cmd_filter->tlv_header,
+			WMITLV_TAG_STRUC_wmi_chatter_pkt_coalescing_filter,
+			WMITLV_GET_STRUCT_TLVLEN(chatter_pkt_coalescing_filter));
+
+	cmd_filter->filter_id = rcv_filter_param->filterId;
+	cmd_filter->max_coalescing_delay = rcv_filter_param->coalesceTime;
+	cmd_filter->pkt_type = CHATTER_COALESCING_PKT_TYPE_UNICAST |
+				CHATTER_COALESCING_PKT_TYPE_MULTICAST |
+				CHATTER_COALESCING_PKT_TYPE_BROADCAST;
+	cmd_filter->num_of_test_field = MIN(rcv_filter_param->numFieldParams,
+						CHATTER_MAX_FIELD_TEST);
+
+	for (i = 0; i < cmd_filter->num_of_test_field; i++) {
+		cmd_filter->test_fields[i].offset = rcv_filter_param->paramsData[i].dataOffset;
+		cmd_filter->test_fields[i].length = MIN(rcv_filter_param->paramsData[i].dataLength,
+							CHATTER_MAX_TEST_FIELD_LEN32);
+		cmd_filter->test_fields[i].test = rcv_filter_param->paramsData[i].cmpFlag;
+		memcpy(&cmd_filter->test_fields[i].value, rcv_filter_param->paramsData[i].compareData,
+			cmd_filter->test_fields[i].length);
+		memcpy(&cmd_filter->test_fields[i].mask, rcv_filter_param->paramsData[i].dataMask,
+			cmd_filter->test_fields[i].length);
+	}
+	WMA_LOGD("Chatter packets, adding filter with id: %d, num_test_fields=%d",cmd_filter->filter_id,
+		cmd_filter->num_of_test_field);
+	/* send the command along with data */
+	err = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
+					WMI_CHATTER_ADD_COALESCING_FILTER_CMDID);
+	if (err) {
+		WMA_LOGE("Failed to send set_param cmd");
+		wmi_buf_free(buf);
+		vos_mem_free(rcv_filter_param);
+		return -EIO;
+	}
+	vos_mem_free(rcv_filter_param);
+	return 0; /* SUCCESS */
+}
+
+static int wma_process_receive_filter_clear_filter_req(tp_wma_handle wma_handle,
+						tSirRcvFltPktClearParam *rcv_clear_param)
+{
+	wmi_chatter_coalescing_delete_filter_cmd_fixed_param *cmd;
+	wmi_buf_t buf;
+	int err;
+
+	/* allocate the memory */
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, sizeof(*cmd));
+	if (!buf) {
+		WMA_LOGE("Failed to allocate buffer to send set_param cmd");
+		vos_mem_free(rcv_clear_param);
+		return -ENOMEM;
+	}
+
+	/* fill the fixed part */
+	cmd = (wmi_chatter_coalescing_delete_filter_cmd_fixed_param *) wmi_buf_data(buf);
+	WMITLV_SET_HDR(&cmd->tlv_header,
+			WMITLV_TAG_STRUC_wmi_chatter_coalescing_delete_filter_cmd_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(
+					wmi_chatter_coalescing_delete_filter_cmd_fixed_param));
+	cmd->filter_id = rcv_clear_param->filterId;
+	WMA_LOGD("Chatter packets, clearing filter with id: %d",cmd->filter_id);
+
+	/* send the command along with data */
+	err = wmi_unified_cmd_send(wma_handle->wmi_handle, buf,
+				sizeof(*cmd), WMI_CHATTER_DELETE_COALESCING_FILTER_CMDID);
+	if (err) {
+		WMA_LOGE("Failed to send set_param cmd");
+		wmi_buf_free(buf);
+		vos_mem_free(rcv_clear_param);
+		return -EIO;
+	}
+	vos_mem_free(rcv_clear_param);
+	return 0; /* SUCCESS */
+}
+
 static void wma_data_tx_ack_work_handler(struct work_struct *ack_work)
 {
 	struct wma_tx_ack_work_ctx *work = container_of(ack_work,
@@ -9893,6 +10167,35 @@
 	return VOS_STATUS_SUCCESS;
 }
 
+#ifdef WLAN_FEATURE_11AC
+static void wma_process_update_membership(tp_wma_handle wma_handle,
+                                tUpdateMembership *membership)
+{
+        WMA_LOGD("%s: membership = %x \n", __func__,
+                  membership->membership);
+
+        wma_set_peer_param(wma_handle, membership->peer_mac,
+                           WMI_PEER_MEMBERSHIP, membership->membership,
+                           membership->smesessionId);
+}
+
+static void wma_process_update_userpos(tp_wma_handle wma_handle,
+                                tUpdateUserPos *userpos)
+{
+        WMA_LOGD("%s: userPos = %x \n", __func__, userpos->userPos);
+
+        wma_set_peer_param(wma_handle, userpos->peer_mac,
+                           WMI_PEER_USERPOS, userpos->userPos,
+                           userpos->smesessionId);
+
+       /* Now that membership/userpos is updated in fw,
+        * enable GID PPS.
+        */
+        wma_set_ppsconfig(userpos->smesessionId,
+                          WMA_VHT_PPS_GID_MATCH, 1);
+
+}
+#endif
 /* function   : wma_mc_process_msg
  * Descriptin :
  * Args       :
@@ -9969,7 +10272,6 @@
 		case WDA_UPDATE_CHAN_LIST_REQ:
 			wma_update_channel_list(wma_handle,
 					(tSirUpdateChanList *)msg->bodyptr);
-			vos_mem_free(msg->bodyptr);
 			break;
 		case WDA_SET_LINK_STATE:
 			wma_set_linkstate(wma_handle,
@@ -10085,6 +10387,16 @@
                         wma_process_update_opmode(wma_handle,
                                        (tUpdateVHTOpMode *)msg->bodyptr);
                         break;
+#ifdef WLAN_FEATURE_11AC
+                case WDA_UPDATE_MEMBERSHIP:
+                        wma_process_update_membership(wma_handle,
+                                       (tUpdateMembership *)msg->bodyptr);
+                        break;
+                case WDA_UPDATE_USERPOS:
+                        wma_process_update_userpos(wma_handle,
+                                       (tUpdateUserPos *)msg->bodyptr);
+                        break;
+#endif
 		case WDA_UPDATE_BEACON_IND:
 			wma_process_update_beacon_params(wma_handle,
 					(tUpdateBeaconParams *)msg->bodyptr);
@@ -10167,7 +10479,7 @@
 			wma_enable_arp_ns_offload(wma_handle, (tpSirHostOffloadReq)msg->bodyptr, false);
 			break;
 #endif /*WLAN_NS_OFFLOAD */
-		case WDA_START_ROAM_CANDIDATE_LOOKUP_REQ:
+                case WDA_ROAM_SCAN_OFFLOAD_REQ:
 			/*
 			 * Main entry point or roaming directives from CSR.
 			 */
@@ -10657,6 +10969,14 @@
 		vos_status = VOS_STATUS_E_FAILURE;
 		goto end;
 	}
+	/* register target stats event handler */
+	status = wmi_unified_register_event_handler(wma_handle->wmi_handle, WMI_UPDATE_STATS_EVENTID,
+						wmi_unified_update_stats_event_handler);
+	if (status) {
+		WMA_LOGP("Failed to register stats event handler");
+		vos_status = VOS_STATUS_E_FAILURE;
+		goto end;
+	}
 
 #ifdef FEATURE_WLAN_SCAN_PNO
 	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
@@ -10985,6 +11305,8 @@
 	if (WMI_SERVICE_IS_ENABLED(wh->wmi_service_bitmap, WMI_SERVICE_NLO))
 		cfg->pno_offload = TRUE;
 #endif
+	cfg->lte_coex_ant_share = WMI_SERVICE_IS_ENABLED(wh->wmi_service_bitmap,
+					WMI_SERVICE_LTE_ANT_SHARE_SUPPORT);
 }
 
 static inline void wma_update_target_ht_cap(tp_wma_handle wh,
@@ -11673,6 +11995,17 @@
 		return VOS_STATUS_E_FAILURE;
 	}
 
+	if ((frmType == HAL_TXRX_FRM_802_11_MGMT) &&
+	    (pFc->subType == SIR_MAC_MGMT_PROBE_RSP)) {
+		u_int64_t adjusted_tsf_le;
+		struct ieee80211_frame *wh =
+			(struct ieee80211_frame *)adf_nbuf_data(tx_frame);
+
+		/* Make the TSF offset negative to match TSF in beacons */
+		adjusted_tsf_le = cpu_to_le64(0ULL -
+				wma_handle->interfaces[vdev_id].tsfadjust);
+		A_MEMCPY(&wh[1], &adjusted_tsf_le, sizeof(adjusted_tsf_le));
+	}
 	if (frmType == HAL_TXRX_FRM_802_11_DATA) {
 		adf_nbuf_t ret;
 		adf_nbuf_t skb = (adf_nbuf_t)tx_frame;
@@ -12407,9 +12740,10 @@
 	return (ret)? eHAL_STATUS_FAILURE : eHAL_STATUS_SUCCESS;
 }
 
-eHalStatus WMA_SetRegDomain(void * clientCtxt, v_REGDOMAIN_t regId)
+eHalStatus WMA_SetRegDomain(void * clientCtxt, v_REGDOMAIN_t regId,
+		tAniBool sendRegHint)
 {
-	if(VOS_STATUS_SUCCESS != vos_nv_setRegDomain(clientCtxt, regId))
+	if(VOS_STATUS_SUCCESS != vos_nv_setRegDomain(clientCtxt, regId, sendRegHint))
 		return eHAL_STATUS_INVALID_PARAMETER;
 
 	return eHAL_STATUS_SUCCESS;
@@ -12468,3 +12802,114 @@
 {
 	return mapChannel;
 }
+
+static eHalStatus wma_set_mimops(tp_wma_handle wma, tANI_U8 vdev_id, int value)
+{
+        int ret = eHAL_STATUS_SUCCESS;
+        wmi_sta_smps_force_mode_cmd_fixed_param *cmd;
+        wmi_buf_t buf;
+        u_int16_t len = sizeof(*cmd);
+
+        buf = wmi_buf_alloc(wma->wmi_handle, len);
+        if (!buf) {
+                WMA_LOGE("%s:wmi_buf_alloc failed", __func__);
+                return -ENOMEM;
+        }
+        cmd = (wmi_sta_smps_force_mode_cmd_fixed_param *) wmi_buf_data(buf);
+        WMITLV_SET_HDR(&cmd->tlv_header,
+                WMITLV_TAG_STRUC_wmi_sta_smps_force_mode_cmd_fixed_param,
+                WMITLV_GET_STRUCT_TLVLEN(
+                wmi_sta_smps_force_mode_cmd_fixed_param));
+
+        cmd->vdev_id = vdev_id;
+
+        switch(value)
+        {
+            case 0:
+                   cmd->forced_mode = WMI_SMPS_FORCED_MODE_STATIC;
+                   break;
+            case 1:
+                   cmd->forced_mode = WMI_SMPS_FORCED_MODE_DYNAMIC;
+                   break;
+            case 3:
+                   cmd->forced_mode = WMI_SMPS_FORCED_MODE_DISABLED;
+                   break;
+            default:
+                   WMA_LOGE("%s:INVALID Mimo PS CONFIG", __func__);
+                   return eHAL_STATUS_FAILURE;
+        }
+
+        WMA_LOGD("Setting vdev %d value = %u", vdev_id, value);
+
+        ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+                                WMI_STA_SMPS_FORCE_MODE_CMDID);
+        if (ret < 0) {
+                WMA_LOGE("Failed to send set Mimo PS ret = %d", ret);
+                wmi_buf_free(buf);
+        }
+
+        return ret;
+}
+
+static eHalStatus wma_set_ppsconfig(tANI_U8 vdev_id, tANI_U16 pps_param, int val)
+{
+        void *vos_context = vos_get_global_context(VOS_MODULE_ID_WDA, NULL);
+        tp_wma_handle wma = vos_get_context(VOS_MODULE_ID_WDA, vos_context);
+        int ret = -EIO;
+        u_int32_t pps_val;
+
+        switch (pps_param) {
+        case WMA_VHT_PPS_PAID_MATCH:
+            pps_val = ((val << 31) & 0xffff0000) |
+                (PKT_PWR_SAVE_PAID_MATCH & 0xffff);
+            goto pkt_pwr_save_config;
+        case WMA_VHT_PPS_GID_MATCH:
+            pps_val = ((val << 31) & 0xffff0000) |
+                (PKT_PWR_SAVE_GID_MATCH & 0xffff);
+            goto pkt_pwr_save_config;
+        case WMA_VHT_PPS_DELIM_CRC_FAIL:
+            pps_val = ((val << 31) & 0xffff0000) |
+                (PKT_PWR_SAVE_DELIM_CRC_FAIL & 0xffff);
+            goto pkt_pwr_save_config;
+
+        /* Enable the code below as and when the functionality
+         * is supported/added in host.
+         */
+#ifdef NOT_YET
+        case WMA_VHT_PPS_EARLY_TIM_CLEAR:
+            pps_val = ((val << 31) & 0xffff0000) |
+                (PKT_PWR_SAVE_EARLY_TIM_CLEAR & 0xffff);
+            goto pkt_pwr_save_config;
+        case WMA_VHT_PPS_EARLY_DTIM_CLEAR:
+            pps_val = ((val << 31) & 0xffff0000) |
+                (PKT_PWR_SAVE_EARLY_DTIM_CLEAR & 0xffff);
+            goto pkt_pwr_save_config;
+        case WMA_VHT_PPS_EOF_PAD_DELIM:
+            pps_val = ((val << 31) & 0xffff0000) |
+                (PKT_PWR_SAVE_EOF_PAD_DELIM & 0xffff);
+            goto pkt_pwr_save_config;
+        case WMA_VHT_PPS_MACADDR_MISMATCH:
+            pps_val = ((val << 31) & 0xffff0000) |
+                (PKT_PWR_SAVE_MACADDR_MISMATCH & 0xffff);
+            goto pkt_pwr_save_config;
+        case WMA_VHT_PPS_GID_NSTS_ZERO:
+            pps_val = ((val << 31) & 0xffff0000) |
+                (PKT_PWR_SAVE_GID_NSTS_ZERO & 0xffff);
+            goto pkt_pwr_save_config;
+        case WMA_VHT_PPS_RSSI_CHECK:
+            pps_val = ((val << 31) & 0xffff0000) |
+                (PKT_PWR_SAVE_RSSI_CHECK & 0xffff);
+            goto pkt_pwr_save_config;
+#endif
+pkt_pwr_save_config:
+            WMA_LOGD("vdev_id:%d val:0x%x pps_val:0x%x\n", vdev_id,
+                     val, pps_val);
+            ret = wmi_unified_vdev_set_param_send(wma->wmi_handle, vdev_id,
+                    WMI_VDEV_PARAM_PACKET_POWERSAVE, pps_val);
+            break;
+        default:
+            WMA_LOGE("%s:INVALID PPS CONFIG", __func__);
+        }
+
+        return (ret)? eHAL_STATUS_FAILURE : eHAL_STATUS_SUCCESS;
+}
diff --git a/CORE/SERVICES/WMA/wma.h b/CORE/SERVICES/WMA/wma.h
index 312c389..e234aae 100644
--- a/CORE/SERVICES/WMA/wma.h
+++ b/CORE/SERVICES/WMA/wma.h
@@ -421,6 +421,7 @@
 	struct wma_tx_ack_work_ctx *ack_work_ctx;
 	u_int8_t powersave_mode;
 	v_BOOL_t ptrn_match_enable_all_vdev;
+	void* pGetRssiReq;
 }t_wma_handle, *tp_wma_handle;
 
 struct wma_target_cap {
@@ -1044,6 +1045,9 @@
 VOS_STATUS wma_trigger_uapsd_params(tp_wma_handle wma_handle, u_int32_t vdev_id,
 			tp_wma_trigger_uapsd_params trigger_uapsd_params);
 
+/* added to get average snr for both data and beacon */
+VOS_STATUS wma_send_snr_request(tp_wma_handle wma_handle, void *pGetRssiReq);
+
 #ifdef FEATURE_WLAN_SCAN_PNO
 
 #define WMA_NLO_FREQ_THRESH          1000         /* in MHz */
@@ -1162,6 +1166,11 @@
 	PS_LEGACY_DEEPSLEEP = 3,
 	PS_QPOWER_DEEPSLEEP = 4
 };
-#define WMA_DEFAULT_QPOWER_MAX_PSPOLL_BEFORE_WAKE 1
+#define WMA_DEFAULT_MAX_PSPOLL_BEFORE_WAKE 1
 #define WMA_DEFAULT_QPOWER_TX_WAKE_THRESHOLD 2
+
+#define WMA_VHT_PPS_PAID_MATCH 1
+#define WMA_VHT_PPS_GID_MATCH 2
+#define WMA_VHT_PPS_DELIM_CRC_FAIL 3
+
 #endif
diff --git a/CORE/SME/inc/btcApi.h b/CORE/SME/inc/btcApi.h
index 86933b5..c2cfb22 100644
--- a/CORE/SME/inc/btcApi.h
+++ b/CORE/SME/inc/btcApi.h
@@ -41,6 +41,7 @@
 
 #include "vos_types.h"
 #include "vos_timer.h"
+#include "vos_nvitem.h"
 
 #define BT_INVALID_CONN_HANDLE (0xFFFF)  /**< Invalid connection handle */
 
@@ -132,6 +133,12 @@
 #define BTC_DHCP_ON_A2DP_DEF               (1)  // ON
 #define BTC_DHCP_ON_SCO_DEF                (0)  // OFF
 
+/*
+ * Number of victim tables and mws coex configurations
+ */
+#define MWS_COEX_MAX_VICTIM_TABLE             10
+#define MWS_COEX_MAX_CONFIG                   6
+
 /** Enumeration of all the different kinds of BT events
 */
 typedef enum eSmeBtEventType
@@ -277,6 +284,14 @@
    v_U32_t      btcMaxScoBlockPerc;
    v_U32_t      btcDhcpProtOnA2dp;
    v_U32_t      btcDhcpProtOnSco;
+
+   v_U32_t      mwsCoexVictimWANFreq[MWS_COEX_MAX_VICTIM_TABLE];
+   v_U32_t      mwsCoexVictimWLANFreq[MWS_COEX_MAX_VICTIM_TABLE];
+   v_U32_t      mwsCoexVictimConfig[MWS_COEX_MAX_VICTIM_TABLE];
+   v_U32_t      mwsCoexVictimConfig2[MWS_COEX_MAX_VICTIM_TABLE];
+   v_U32_t      mwsCoexModemBackoff;
+   v_U32_t      mwsCoexConfig[MWS_COEX_MAX_CONFIG];
+   v_U32_t      SARPowerBackoff;
 } tSmeBtcConfig, *tpSmeBtcConfig;
 
 
@@ -355,6 +370,7 @@
    v_U16_t       btcScoHandles[BT_MAX_SCO_SUPPORT];  /* Handles for SCO, if any*/
    v_BOOL_t      fA2DPUp;        /*remember whether A2DP is in session*/
    v_BOOL_t      btcScanCompromise;
+   v_U8_t        btcBssfordisableaggr[VOS_MAC_ADDRESS_LEN];
 } tSmeBtcInfo, *tpSmeBtcInfo;
 
 
diff --git a/CORE/SME/inc/csrApi.h b/CORE/SME/inc/csrApi.h
index ee1245b..b605642 100644
--- a/CORE/SME/inc/csrApi.h
+++ b/CORE/SME/inc/csrApi.h
@@ -25,6 +25,7 @@
  * to the Linux Foundation.
  */
 
+
 /** ------------------------------------------------------------------------- *
     ------------------------------------------------------------------------- *
     \file csrApi.h
@@ -218,14 +219,6 @@
     tANI_U8 *ChannelList;   //it will be an array of channels
 }tCsrChannelInfo, *tpCsrChannelInfo;
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
-typedef struct tagCsrCountryChannelInfo
-{
-    tCsrChannelInfo countryValidChannelList;
-    tANI_U8         revision; /* KR 25, 25 is the country revision index
-                                 to the list of valid channels */
-}tCsrCountryChannelInfo, *tpCsrCountryChannelInfo;
-#endif
 typedef struct tagCsrSSIDInfo
 {
    tSirMacSSid     SSID;
@@ -276,6 +269,7 @@
     eCsrRequestType requestType;    //11d scan or full scan
     tANI_BOOLEAN p2pSearch;
     tANI_BOOLEAN skipDfsChnlInP2pSearch;
+    tANI_BOOLEAN bcnRptReqScan;     //is Scan issued by Beacon Report Request
 }tCsrScanRequest;
 
 typedef struct tagCsrBGScanRequest
@@ -336,6 +330,14 @@
 } tCsrCcxCckmInfo;
 #endif
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+#define CSR_DOT11F_IE_RSN_MAX_LEN   (114)  /*TODO: duplicate one in dot11f.h */
+typedef struct tagCsrCcxCckmIe
+{
+    tANI_U8 cckmIe[CSR_DOT11F_IE_RSN_MAX_LEN];
+    tANI_U8 cckmIeLen;
+} tCsrCcxCckmIe;
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
 
 typedef struct tagCsrScanResultFilter
 {
@@ -444,6 +446,12 @@
 #ifdef FEATURE_WLAN_LFR
     eCSR_ROAM_PMK_NOTIFY,
 #endif
+#ifdef FEATURE_WLAN_LFR_METRICS
+    eCSR_ROAM_PREAUTH_INIT_NOTIFY,
+    eCSR_ROAM_PREAUTH_STATUS_SUCCESS,
+    eCSR_ROAM_PREAUTH_STATUS_FAILURE,
+    eCSR_ROAM_HANDOVER_SUCCESS,
+#endif
 #ifdef FEATURE_WLAN_TDLS
     eCSR_ROAM_TDLS_STATUS_UPDATE,
     eCSR_ROAM_RESULT_MGMT_TX_COMPLETE_IND,
@@ -455,6 +463,16 @@
     eCSR_ROAM_UNPROT_MGMT_FRAME_IND,
 #endif
 
+#ifdef FEATURE_CESIUM_PROPRIETARY
+    eCSR_ROAM_IBSS_PEER_INFO_COMPLETE,
+#endif
+
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+    eCSR_ROAM_TSM_IE_IND,
+    eCSR_ROAM_CCKM_PREAUTH_NOTIFY,
+    eCSR_ROAM_CCX_ADJ_AP_REPORT_IND,
+    eCSR_ROAM_CCX_BCN_REPORT_IND,
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
 }eRoamCmdStatus;
 
 
@@ -541,8 +559,13 @@
     eCSR_ROAM_RESULT_DELETE_TDLS_PEER,
     eCSR_ROAM_RESULT_TEARDOWN_TDLS_PEER_IND,
     eCSR_ROAM_RESULT_DELETE_ALL_TDLS_PEER_IND,
+    eCSR_ROAM_RESULT_LINK_ESTABLISH_REQ_RSP,
 #endif
 
+#ifdef FEATURE_CESIUM_PROPRIETARY
+    eCSR_ROAM_RESULT_IBSS_PEER_INFO_SUCCESS,
+    eCSR_ROAM_RESULT_IBSS_PEER_INFO_FAILED,
+#endif
 }eCsrRoamResult;
 
 
@@ -1002,14 +1025,17 @@
 
     tANI_U32  nActiveMinChnTimeBtc;     //in units of milliseconds
     tANI_U32  nActiveMaxChnTimeBtc;     //in units of milliseconds
+    tANI_U32  disableAggWithBtc;
 #ifdef WLAN_AP_STA_CONCURRENCY
     tANI_U32  nPassiveMinChnTimeConc;    //in units of milliseconds
     tANI_U32  nPassiveMaxChnTimeConc;    //in units of milliseconds
     tANI_U32  nActiveMinChnTimeConc;     //in units of milliseconds
     tANI_U32  nActiveMaxChnTimeConc;     //in units of milliseconds
     tANI_U32  nRestTimeConc;             //in units of milliseconds
-    tANI_U8   nNumChanCombinedConc;      //number of channels combined
-                                         //in each split scan operation
+    tANI_U8   nNumStaChanCombinedConc;   //number of channels combined for
+                                         //STA in each split scan operation
+    tANI_U8   nNumP2PChanCombinedConc;   //number of channels combined for
+                                         //P2P in each split scan operation
 #endif
 
     tANI_BOOLEAN IsIdleScanEnabled;
@@ -1027,6 +1053,7 @@
 #endif
 #ifdef FEATURE_WLAN_LFR
     tANI_U8   isFastRoamIniFeatureEnabled;
+    tANI_U8   MAWCEnabled;
 #endif
 
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
@@ -1064,18 +1091,18 @@
     //To enable/disable scanning 2.4Ghz channels twice on a single scan request from HDD
     tANI_BOOLEAN fScanTwice;
 #ifdef WLAN_FEATURE_11AC
-    tANI_U32  nVhtChannelWidth;
-    tANI_U8   enableTxBF;
-    tANI_U8   txBFCsnValue;
-    tANI_U8   enable2x2;
+    tANI_U32        nVhtChannelWidth;
+    tANI_U8         enableTxBF;
+    tANI_U8         txBFCsnValue;
+    tANI_U8         enable2x2;
     tANI_BOOLEAN    enableVhtFor24GHz;
-    tANI_U8   enableMuBformee;
-    tANI_U8    enableVhtpAid;
-    tANI_U8    enableVhtGid;
+    tANI_U8         enableMuBformee;
+    tANI_U8         enableVhtpAid;
+    tANI_U8         enableVhtGid;
 #endif
-    tANI_U8    enableAmpduPs;
-    tANI_U8    enableHtSmps;
-    tANI_U8    htSmps;
+    tANI_U8         enableAmpduPs;
+    tANI_U8         enableHtSmps;
+    tANI_U8         htSmps;
 
     /*
     * To enable/disable scanning only 2.4Ghz channels on first scan
@@ -1085,18 +1112,26 @@
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
     tANI_BOOLEAN nRoamPrefer5GHz;
     tANI_BOOLEAN nRoamIntraBand;
-#endif
+    tANI_U8      nProbes;
+    tANI_U16     nRoamScanHomeAwayTime;
 
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
     tANI_BOOLEAN isRoamOffloadScanEnabled;
+    tANI_BOOLEAN bFastRoamInConIniFeatureEnabled;
 #endif
+#endif
+
 
     tANI_U8 scanCfgAgingTime;
 
     tANI_U8   enableTxLdpc;
 
+    tANI_U8 isAmsduSupportInAMPDU;
+    tANI_U8 nSelect5GHzMargin;
+
     tANI_U8 isCoalesingInIBSSAllowed;
 
+
 }tCsrConfigParam;
 
 //Tush
@@ -1154,6 +1189,12 @@
 
 #ifdef FEATURE_WLAN_CCX
     tANI_BOOLEAN isCCXAssoc;
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+    tSirTsmIE tsmIe;
+    tANI_U32 timestamp[2];
+    tANI_U16 tsmRoamDelay;
+    tSirCcxBcnReportRsp *pCcxBcnReportRsp;
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
 #endif
     void* pRemainCtx;
     tANI_U32 rxChan;
@@ -1319,6 +1360,16 @@
 } tCsrRoamRemoveKey;
 
 #ifdef FEATURE_WLAN_TDLS
+
+typedef struct tagCsrLinkEstablishParams
+{
+    tSirMacAddr peerMac;
+    tANI_U8 uapsdQueues;
+    tANI_U8 maxSp;
+    tANI_U8 isBufSta;
+    tANI_U8 isResponder;
+}tCsrTdlsLinkEstablishParams;
+
 typedef struct tagCsrTdlsSendMgmt
 {
         tSirMacAddr peerMac;
@@ -1356,7 +1407,29 @@
 
 #define CSR_INVALID_SCANRESULT_HANDLE       (NULL)
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+typedef struct tagCsrHandoffRequest
+{
+    tCsrBssid bssid;
+    tANI_U8 channel;
+}tCsrHandoffRequest;
+#endif
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+typedef struct tagCsrCcxBeaconReqParams
+{
+    tANI_U16   measurementToken;
+    tANI_U8    channel;
+    tANI_U8    scanMode;
+    tANI_U16   measurementDuration;
+} tCsrCcxBeaconReqParams, *tpCsrCcxBeaconReqParams;
+
+typedef struct tagCsrCcxBeaconReq
+{
+    tANI_U8                numBcnReqIe;
+    tCsrCcxBeaconReqParams bcnReq[SIR_CCX_MAX_MEAS_IE_REQS];
+} tCsrCcxBeaconReq, *tpCsrCcxBeaconReq;
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
 
 ////////////////////////////////////////////Common SCAN starts
 
@@ -1499,6 +1572,30 @@
 
 typedef void ( *tCsrRssiCallback) (v_S7_t rssi, tANI_U32 staId, void *pContext);
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+/*---------------------------------------------------------------------------
+  This is the type for a tsm stats callback to be registered with SME
+  for getting tsm stats
+  \param tsmMetrics - tsmMetrics
+  \param pContext - any user data given at callback registration.
+  \return None
+---------------------------------------------------------------------------*/
+typedef void ( *tCsrTsmStatsCallback) (tAniTrafStrmMetrics tsmMetrics,
+                                       tANI_U32 staId,
+                                       void *pContext);
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
+
+/*---------------------------------------------------------------------------
+  This is the type for a snr callback to be registered with SME
+  for getting snr
+
+  \param snr
+  \param pContext - any user data given at callback registration.
+  \return None
+
+---------------------------------------------------------------------------*/
+typedef void (*tCsrSnrCallback) (v_S7_t snr, tANI_U32 staId, void *pContext);
+
 #ifdef WLAN_FEATURE_VOWIFI_11R
 eHalStatus csrRoamIssueFTPreauthReq(tHalHandle hHal, tANI_U32 sessionId, tpSirBssDescription pBssDescription);
 #endif
@@ -1522,6 +1619,5 @@
 eCsrBand csrGetCurrentBand (tHalHandle hHal);
 
 typedef void (*csrReadyToSuspendCallback)(void *pContext);
-
 #endif
 
diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index 190bb6d..53dfe1a 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -70,6 +70,7 @@
 #define CSR_SESSION_ID_INVALID    0xFF   // session ID invalid
 #define CSR_ROAM_SESSION_MAX      5   // No of sessions to be supported, and a
                                       // session is for Infra, IBSS or BT-AMP
+#define CSR_SESSION_ID_ANY        50
 
 #define CSR_IS_SESSION_VALID( pMac, sessionId ) ( ( (sessionId) < CSR_ROAM_SESSION_MAX ) \
                                                   && ( (pMac)->roam.roamSession[(sessionId)].sessionActive ) )
@@ -80,6 +81,12 @@
      NULL \
 )
 
+#define CSR_IS_SESSION_ANY(sessionId) (sessionId == CSR_SESSION_ID_ANY)
+#define CSR_IS_SELECT_5GHZ_MARGIN( pMac ) \
+( \
+   (((pMac)->roam.configParam.nSelect5GHzMargin)?eANI_BOOLEAN_TRUE:eANI_BOOLEAN_FALSE) \
+)
+
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
 #define CSR_IS_ROAM_PREFER_5GHZ( pMac ) \
 ( \
@@ -96,6 +103,11 @@
 ( \
    (((pMac)->roam.configParam.isRoamOffloadScanEnabled)?eANI_BOOLEAN_TRUE:eANI_BOOLEAN_FALSE) \
 )
+
+#define CSR_IS_FASTROAM_IN_CONCURRENCY_INI_FEATURE_ENABLED( pMac ) \
+( \
+   (((pMac)->roam.configParam.bFastRoamInConIniFeatureEnabled)?eANI_BOOLEAN_TRUE:eANI_BOOLEAN_FALSE) \
+)
 #endif
 
 //Support for "Fast roaming" (i.e., CCX, LFR, or 802.11r.)
@@ -443,10 +455,12 @@
 
 }tWmStatusChangeCmd;
 
+
 typedef struct tagAddStaForSessionCmd
 {
    //Session self mac addr
    tSirMacAddr selfMacAddr;
+   tVOS_CON_MODE currDeviceMode;
    tANI_U32        type;
    tANI_U32        subType;
    tANI_U8         sessionId;
@@ -563,14 +577,17 @@
 
     tANI_U32  nActiveMinChnTimeBtc;     //in units of milliseconds
     tANI_U32  nActiveMaxChnTimeBtc;     //in units of milliseconds
+    tANI_U8   disableAggWithBtc;
 #ifdef WLAN_AP_STA_CONCURRENCY
     tANI_U32  nPassiveMinChnTimeConc;    //in units of milliseconds
     tANI_U32  nPassiveMaxChnTimeConc;    //in units of milliseconds
     tANI_U32  nActiveMinChnTimeConc;     //in units of milliseconds
     tANI_U32  nActiveMaxChnTimeConc;     //in units of milliseconds
     tANI_U32  nRestTimeConc;             //in units of milliseconds
-    tANI_U8   nNumChanCombinedConc;      //number of channels combined
-                                         //in each split scan operation
+    tANI_U8   nNumStaChanCombinedConc;   //number of channels combined for
+                                         //Sta in each split scan operation
+    tANI_U8   nNumP2PChanCombinedConc;   //number of channels combined for
+                                         //P2P in each split scan operation
 #endif
 
     tANI_BOOLEAN IsIdleScanEnabled;
@@ -588,9 +605,11 @@
 #endif
 
 #ifdef FEATURE_WLAN_LFR
-    tANI_U8   isFastRoamIniFeatureEnabled;
+    tANI_U8      isFastRoamIniFeatureEnabled;
+    tANI_U8      MAWCEnabled;
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-    tANI_U8   isRoamOffloadScanEnabled;
+    tANI_U8      isRoamOffloadScanEnabled;
+    tANI_BOOLEAN bFastRoamInConIniFeatureEnabled;
 #endif
 #endif
 
@@ -606,6 +625,8 @@
     tANI_BOOLEAN  nRoamIntraBand;
     tANI_BOOLEAN  isWESModeEnabled;
     tANI_BOOLEAN  nRoamScanControl;
+    tANI_U8       nProbes;
+    tANI_U16      nRoamScanHomeAwayTime;
 #endif
 
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
@@ -638,8 +659,13 @@
     tANI_U8   htSmps;
     tANI_U8   txLdpcEnable;
 
+    /*
+     * Enable/Disable heartbeat offload
+     */
+    tANI_BOOLEAN enableHeartBeatOffload;
+    tANI_U8 isAmsduSupportInAMPDU;
+    tANI_U8 nSelect5GHzMargin;
     tANI_U8 isCoalesingInIBSSAllowed;
-
 }tCsrConfig;
 
 typedef struct tagCsrChannelPowerInfo
@@ -675,13 +701,13 @@
     tDblLinkList tempScanResults;
     tANI_BOOLEAN fScanEnable;
     tANI_BOOLEAN fFullScanIssued;
-    tPalTimerHandle hTimerGetResult;
+    vos_timer_t hTimerGetResult;
 #ifdef WLAN_AP_STA_CONCURRENCY
-    tPalTimerHandle hTimerStaApConcTimer;
+    vos_timer_t hTimerStaApConcTimer;
 #endif
-    tPalTimerHandle hTimerIdleScan;
-    tPalTimerHandle hTimerResultAging;
-    tPalTimerHandle hTimerResultCfgAging;
+    vos_timer_t hTimerIdleScan;
+    vos_timer_t hTimerResultAging;
+    vos_timer_t hTimerResultCfgAging;
     tPalTimerHandle hTimerBgScan;
     //changes on every scan, it is used as a flag for whether 11d info is found on every scan
     tANI_U8 channelOf11dInfo;
@@ -708,6 +734,7 @@
     tANI_U8 countryCode11d[WNI_CFG_COUNTRY_CODE_LEN];
     v_REGDOMAIN_t domainIdDefault;  //default regulatory domain
     v_REGDOMAIN_t domainIdCurrent;  //current regulatory domain
+    tCsrBssid currentCountryBssid;  // Bssid for current country code
     tANI_BOOLEAN f11dInfoApplied;
     tANI_BOOLEAN fCancelIdleScan;
 #ifdef FEATURE_WLAN_WAPI
@@ -749,6 +776,7 @@
     tDblLinkList scanCmdPendingList;
 #endif
     tCsrChannel occupiedChannels;   //This includes all channels on which candidate APs are found
+    tANI_S8     inScanResultBestAPRssi;
 }tCsrScanStruct;
 
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
@@ -834,7 +862,7 @@
 {
    tANI_U32               periodicity;
    tANI_BOOLEAN           timerRunning;
-   tPalTimerHandle        hTlStatsTimer;
+   vos_timer_t            hTlStatsTimer;
    tANI_U8                numClient;
 }tCsrTlStatsReqInfo;
 
@@ -884,10 +912,7 @@
     tCsrTimerInfo roamingTimerInfo;
     eCsrRoamingReason roamingReason;
     tANI_BOOLEAN fCancelRoaming;
-    tPalTimerHandle hTimerRoaming;
-    tPalTimerHandle hTimerIbssJoining;
-    tCsrTimerInfo ibssJoinTimerInfo;
-    tANI_BOOLEAN ibss_join_pending;
+    vos_timer_t hTimerRoaming;
     eCsrRoamResult roamResult;  //the roamResult that is used when the roaming timer fires
     tCsrRoamJoinStatus joinFailStatusCode;    //This is the reason code for join(assoc) failure
     //The status code returned from PE for deauth or disassoc (in case of lostlink), or our own dynamic roaming
@@ -901,7 +926,7 @@
     tANI_BOOLEAN fWMMConnection;
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
     //To retry a join later when it fails if so desired
-    tPalTimerHandle hTimerJoinRetry;
+    vos_timer_t hTimerJoinRetry;
     tCsrTimerInfo joinRetryTimerInfo;
     tANI_U32 maxRetryCount;
 #endif
@@ -913,6 +938,9 @@
     tANI_U8 prevOpChannel;
     tANI_U16 clientDissSecs;
     tANI_U32 roamTS1;
+#if defined(FEATURE_WLAN_CCX_UPLOAD)
+    tCsrCcxCckmIe suppCckmIeInfo;
+#endif
 #endif
     tANI_U8 bRefAssocStartCnt;   //Tracking assoc start indication
    /* to force the AP initiate fresh 802.1x authentication after re-association need to clear
@@ -944,7 +972,7 @@
     tANI_U32 numValidChannels; //total number of channels in CFG
 
     tANI_S32 sPendingCommands;
-    tPalTimerHandle hTimerWaitForKey;  //To support timeout for WaitForKey state
+    vos_timer_t hTimerWaitForKey;  //To support timeout for WaitForKey state
     tCsrSummaryStatsInfo       summaryStatsInfo;
     tCsrGlobalClassAStatsInfo  classAStatsInfo;
     tCsrGlobalClassBStatsInfo  classBStatsInfo;
@@ -1106,10 +1134,6 @@
 void csrScanResumeIMPS( tpAniSirGlobal pMac );
 
 eHalStatus csrInitGetChannels(tpAniSirGlobal pMac);
-// Getting the 5GHz Channel list
-eHalStatus csrGet5GChannels(tpAniSirGlobal pMac);
-// Getting the 2.4GHz Channel list
-eHalStatus csrGet24GChannels(tpAniSirGlobal pMac);
 
 eHalStatus csrSetModifyProfileFields(tpAniSirGlobal pMac, tANI_U32 sessionId,
                                      tCsrRoamModifyProfileFields *pModifyProfileFields);
@@ -1199,8 +1223,33 @@
                             tANI_U32 periodicity, tANI_BOOLEAN cache,
                             tANI_U8 staId, void *pContext);
 
+/* ---------------------------------------------------------------------------
+    \fn csrGetTLSTAState
+    \helper function to get the TL STA State whenever the function is called.
+
+    \param staId - The staID to be passed to the TL
+            to get the relevant TL STA State
+    \return the state as tANI_U16
+  ---------------------------------------------------------------------------*/
+tANI_U16 csrGetTLSTAState(tpAniSirGlobal pMac, tANI_U8 staId);
 
 eHalStatus csrGetRssi(tpAniSirGlobal pMac,tCsrRssiCallback callback,tANI_U8 staId,tCsrBssid bssId,void * pContext,void * pVosContext);
+
+/* ---------------------------------------------------------------------------
+    \fn csrGetSnr
+    \brief csr function that client calls to register a callback to get
+     SNR stored in TL
+
+    \param callback - SME sends back the requested stats using the callback
+    \param staId - The station ID for which the stats is requested for
+    \param bssid - The bssid for the connected session
+    \param pContext - user context to be passed back along with the callback
+
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus csrGetSnr(tpAniSirGlobal pMac, tCsrSnrCallback callback,
+                     tANI_U8 staId, tCsrBssid bssId, void *pContext);
+
 #if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
 eHalStatus csrGetRoamRssi(tpAniSirGlobal pMac,
                           tCsrRssiCallback callback,
@@ -1209,7 +1258,20 @@
                           void * pContext,
                           void * pVosContext);
 #endif
-eHalStatus csrRoamRegisterCallback(tpAniSirGlobal pMac, csrRoamCompleteCallback callback, void *pContext);
+
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+eHalStatus csrGetTsmStats(tpAniSirGlobal pMac,
+                          tCsrTsmStatsCallback callback,
+                          tANI_U8 staId,
+                          tCsrBssid bssId,
+                          void *pContext,
+                          void* pVosContext,
+                          tANI_U8 tid);
+#endif  /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
+
+eHalStatus csrRoamRegisterCallback(tpAniSirGlobal pMac,
+                                   csrRoamCompleteCallback callback,
+                                   void *pContext);
 /* ---------------------------------------------------------------------------
     \fn csrGetConfigParam
     \brief HDD calls this function to get the global settings currently maintained by CSR.
@@ -1268,7 +1330,7 @@
     \brief To stop CSR. CSR still keeps its current setting.
     \return eHalStatus
   -------------------------------------------------------------------------------*/
-eHalStatus csrStop(tpAniSirGlobal pMac);
+eHalStatus csrStop(tpAniSirGlobal pMac, tHalStopType stopType);
 /* ---------------------------------------------------------------------------
     \fn csrReady
     \brief To let CSR is ready to operate
@@ -1337,6 +1399,8 @@
 #ifdef FEATURE_WLAN_CCX
 //Returns whether the current association is a CCX assoc or not
 tANI_BOOLEAN csrRoamIsCCXAssoc(tpAniSirGlobal pMac);
+tANI_BOOLEAN csrRoamIsCcxIniFeatureEnabled(tpAniSirGlobal pMac);
+tANI_BOOLEAN csrNeighborRoamIsCCXAssoc(tpAniSirGlobal pMac);
 #endif
 
 //Remove this code once SLM_Sessionization is supported
@@ -1354,7 +1418,15 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 eHalStatus csrScanRequestLfrResult(tpAniSirGlobal pMac, tANI_U32 sessionId,
                                    csrScanCompleteCallback callback, void *pContext);
+eHalStatus csrRoamOffloadScanRspHdlr(tpAniSirGlobal pMac, tANI_U8 reason);
+eHalStatus csrHandoffRequest(tpAniSirGlobal pMac, tCsrHandoffRequest *pHandoffInfo);
 #endif
 tANI_BOOLEAN csrRoamIsStaMode(tpAniSirGlobal pMac, tANI_U32 sessionId);
 #endif
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+eHalStatus csrEnableRMC(tpAniSirGlobal pMac, tANI_U32 sessionId);
+eHalStatus csrDisableRMC(tpAniSirGlobal pMac, tANI_U32 sessionId);
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
 #endif
diff --git a/CORE/SME/inc/csrLinkList.h b/CORE/SME/inc/csrLinkList.h
index 83ef3f6..1531ed4 100644
--- a/CORE/SME/inc/csrLinkList.h
+++ b/CORE/SME/inc/csrLinkList.h
@@ -63,6 +63,10 @@
   tANI_U32  Count;
   tHddHandle hHdd;
   tListFlag Flag;
+
+  /*command debugging */
+  tANI_U32  cmdTimeoutDuration;  /* command timeout duration */
+  vos_timer_t *cmdTimeoutTimer;  /*command timeout Timer */
 }tDblLinkList;
 
 //To get the address of an object of (type) base on the (address) of one of its (field)
diff --git a/CORE/SME/inc/csrNeighborRoam.h b/CORE/SME/inc/csrNeighborRoam.h
index 7c8b9f1..4805f13 100644
--- a/CORE/SME/inc/csrNeighborRoam.h
+++ b/CORE/SME/inc/csrNeighborRoam.h
@@ -41,6 +41,7 @@
 #define CSR_NEIGHBOR_ROAM_H
 
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
+#include "sme_Api.h"
 
 /* Enumeration of various states in neighbor roam algorithm */
 typedef enum
@@ -70,9 +71,6 @@
     tANI_U32        minChannelScanTime;
     tANI_U32        maxChannelScanTime;
     tANI_U16        neighborResultsRefreshPeriod;
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
-    tCsrCountryChannelInfo countryChannelInfo;
-#endif
     tANI_U16        emptyScanRefreshPeriod;
 } tCsrNeighborRoamCfgParams, *tpCsrNeighborRoamCfgParams;
 
@@ -168,9 +166,9 @@
     tCsrNeighborRoamCfgParams   cfgParams;
     tCsrBssid                   currAPbssid; // current assoc AP
     tANI_U8                     currAPoperationChannel; // current assoc AP
-    tPalTimerHandle             neighborScanTimer;
-    tPalTimerHandle             neighborResultsRefreshTimer;
-    tPalTimerHandle             emptyScanRefreshTimer;
+    vos_timer_t                 neighborScanTimer;
+    vos_timer_t                 neighborResultsRefreshTimer;
+    vos_timer_t                 emptyScanRefreshTimer;
     tCsrTimerInfo               neighborScanTimerInfo;
     tCsrNeighborRoamChannelInfo roamChannelInfo;
     tANI_U8                     currentNeighborLookupThreshold;
@@ -196,7 +194,16 @@
                                                     we re-initialize occupied channel list */
     tANI_S8                     lookupDOWNRssi;
     tANI_U8                     uScanMode;
+    tANI_U8                     uOsRequestedHandoff; /* upper layer requested
+                                                        a reassoc */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    tCsrHandoffRequest          handoffReqInfo; /* handoff related info came
+                                                   with upper layer's req for
+                                                   reassoc */
 #endif
+#endif
+    tSmeFastRoamTrigger         cfgRoamEn;
+    tSirMacAddr                 cfgRoambssId;
 } tCsrNeighborRoamControlInfo, *tpCsrNeighborRoamControlInfo;
 
 
@@ -227,10 +234,20 @@
 VOS_STATUS csrNeighborRoamChannelsFilterByCurrentBand(
                       tpAniSirGlobal pMac,
                       tANI_U8*  pInputChannelList,
-                      int       inputNumOfChannels,
+                      tANI_U8   inputNumOfChannels,
                       tANI_U8*  pOutputChannelList,
-                      int*      pMergedOutputNumOfChannels
+                      tANI_U8*  pMergedOutputNumOfChannels
                       );
+VOS_STATUS csrNeighborRoamReassocIndCallback(v_PVOID_t pAdapter,
+                                             v_U8_t trafficStatus,
+                                             v_PVOID_t pUserCtxt,
+                                             v_S7_t   avgRssi);
+VOS_STATUS csrNeighborRoamMergeChannelLists(tpAniSirGlobal pMac,
+                                    tANI_U8  *pInputChannelList,
+                                    tANI_U8  inputNumOfChannels,
+                                    tANI_U8  *pOutputChannelList,
+                                    tANI_U8  outputNumOfChannels,
+                                    tANI_U8  *pMergedOutputNumOfChannels);
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 #define ROAM_SCAN_OFFLOAD_START                     1
 #define ROAM_SCAN_OFFLOAD_STOP                      2
@@ -249,12 +266,27 @@
 #define REASON_EMPTY_SCAN_REF_PERIOD_CHANGED        10
 #define REASON_PREAUTH_FAILED_FOR_ALL               11
 #define REASON_NO_CAND_FOUND_OR_NOT_ROAMING_NOW     12
-
+#define REASON_NPROBES_CHANGED                      13
+#define REASON_HOME_AWAY_TIME_CHANGED               14
+#define REASON_OS_REQUESTED_ROAMING_NOW             15
+#define REASON_SCAN_CH_TIME_CHANGED                 16
+#define REASON_SCAN_HOME_TIME_CHANGED               17
 eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 command, tANI_U8 reason);
 eHalStatus csrNeighborRoamCandidateFoundIndHdlr(tpAniSirGlobal pMac, void* pMsg);
+eHalStatus csrNeighborRoamHandoffReqHdlr(tpAniSirGlobal pMac, void* pMsg);
+eHalStatus csrNeighborRoamProceedWithHandoffReq(tpAniSirGlobal pMac);
+eHalStatus csrNeighborRoamSssidScanDone(tpAniSirGlobal pMac, eHalStatus status);
+eHalStatus csrNeighborRoamStartLfrScan(tpAniSirGlobal pMac);
 #endif
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+VOS_STATUS csrSetCCKMIe(tpAniSirGlobal pMac, const tANI_U8 sessionId,
+                            const tANI_U8 *pCckmIe,
+                            const tANI_U8 ccKmIeLen);
+VOS_STATUS csrRoamReadTSF(tpAniSirGlobal pMac, tANI_U8 *pTimestamp);
+#endif /*FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
 
 #endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
 
 #endif /* CSR_NEIGHBOR_ROAM_H */
+
diff --git a/CORE/SME/inc/p2p_Api.h b/CORE/SME/inc/p2p_Api.h
index 992b6e1..da9368b 100644
--- a/CORE/SME/inc/p2p_Api.h
+++ b/CORE/SME/inc/p2p_Api.h
@@ -416,14 +416,14 @@
    tANI_U32 ActionFrameLen;
    tANI_U32 ActionFrameSendTimeout;
    eListenDiscoverableState listenDiscoverableState;
-   tPalTimerHandle listenTimerHandler;
-   tPalTimerHandle WPSRegistrarCheckTimerHandler;
+   vos_timer_t listenTimerHandler;
+   vos_timer_t WPSRegistrarCheckTimerHandler;
    tANI_U32 WPSRegistrarSet;
    tANI_U8 bWaitForWPSReady;
    tANI_U8 bInGroupFormation;
-   tPalTimerHandle discoverTimer;
-   tPalTimerHandle retryActionFrameTimer;
-   tPalTimerHandle actionFrameTimer;
+   vos_timer_t discoverTimer;
+   vos_timer_t retryActionFrameTimer;
+   vos_timer_t actionFrameTimer;
    tPalTimerHandle nextActionFrameTimer;
    tANI_U8 peerMacAddress[P2P_MAC_ADDRESS_LEN];
    tANI_U8 selfMacAddress[P2P_MAC_ADDRESS_LEN];
@@ -475,11 +475,11 @@
 #endif
 } tp2pContext, *tPp2pContext;
 
-
 eHalStatus sme_RemainOnChannel( tHalHandle hHal, tANI_U8 sessionId,
                                 tANI_U8 channel, tANI_U32 duration,
-                                remainOnChanCallback callback, 
-                                void *pContext );
+                                remainOnChanCallback callback,
+                                void *pContext,
+                                tANI_U8 isP2PProbeReqAllowed);
 eHalStatus sme_ReportProbeReq( tHalHandle hHal, tANI_U8 flag );
 eHalStatus sme_updateP2pIe( tHalHandle hHal, void *p2pIe, 
                             tANI_U32 p2pIeLength );
@@ -495,11 +495,14 @@
 eHalStatus p2pRemainOnChannel( tHalHandle hHal, tANI_U8 sessionId,
                                tANI_U8 channel, tANI_U32 duration,
                                remainOnChanCallback callback, void *pContext,
+                               tANI_U8 isP2PProbeReqAllowed,
                                eP2PRemainOnChnReason reason);
 #else
 eHalStatus p2pRemainOnChannel( tHalHandle hHal, tANI_U8 sessionId,
                                tANI_U8 channel, tANI_U32 duration,
-                               remainOnChanCallback callback, void *pContext);
+                               remainOnChanCallback callback,
+                               void *pContext,
+                               tANI_U8 isP2PProbeReqAllowed);
 #endif
 eHalStatus p2pSendAction( tHalHandle hHal, tANI_U8 sessionId,
                           const tANI_U8 *pBuf, tANI_U32 len,
diff --git a/CORE/SME/inc/pmc.h b/CORE/SME/inc/pmc.h
index e3dde96..3c82a54 100644
--- a/CORE/SME/inc/pmc.h
+++ b/CORE/SME/inc/pmc.h
@@ -159,12 +159,12 @@
     void (*impsCallbackRoutine) (void *callbackContext, eHalStatus status);  /* routine to call when IMPS period
                                                                                 has finished */ 
     void *impsCallbackContext;  /* value to be passed as parameter to routine specified above */
-    tPalTimerHandle hImpsTimer;  /* timer to use with IMPS */
+    vos_timer_t hImpsTimer;  /* timer to use with IMPS */
     vos_timer_t hTrafficTimer;  /* timer to measure traffic for BMPS */
 #ifdef FEATURE_WLAN_DIAG_SUPPORT    
-    tPalTimerHandle hDiagEvtTimer;  /* timer to report PMC state through DIAG event */
+    vos_timer_t hDiagEvtTimer;  /* timer to report PMC state through DIAG event */
 #endif
-    tPalTimerHandle hExitPowerSaveTimer;  /* timer for deferred exiting of power save mode */
+    vos_timer_t hExitPowerSaveTimer;  /* timer for deferred exiting of power save mode */
     tDblLinkList powerSaveCheckList; /* power save check routine list */
     tDblLinkList requestFullPowerList; /* request full power callback routine list */
     tANI_U32 cLastTxUnicastFrames;  /* transmit unicast frame count at last BMPS traffic timer expiration */
@@ -212,6 +212,17 @@
     v_BOOL_t    ImpsReqTimerFailed;
     tANI_U8     ImpsReqFailCnt;
     tANI_U8     ImpsReqTimerfailCnt;
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+   /*HDD callback to be called after receiving SET BATCH SCAN RSP from FW*/
+   hddSetBatchScanReqCallback setBatchScanReqCallback;
+   void * setBatchScanReqCallbackContext;
+   /*HDD callback to be called after receiving BATCH SCAN iRESULT IND from FW*/
+   hddTriggerBatchScanResultIndCallback batchScanResultCallback;
+   void * batchScanResultCallbackContext;
+#endif
+
+
 } tPmcInfo, *tpPmcInfo;
 
 
diff --git a/CORE/SME/inc/pmcApi.h b/CORE/SME/inc/pmcApi.h
index 128d9ab..17b782b 100644
--- a/CORE/SME/inc/pmcApi.h
+++ b/CORE/SME/inc/pmcApi.h
@@ -34,6 +34,7 @@
 *
 
 * Description: Power Management Control (PMC) API definitions.
+
 * Copyright 2008 (c) Qualcomm Technologies, Inc.  
 
 * All Rights Reserved.
@@ -488,6 +489,68 @@
                                    void *callbackContext, tANI_U8 sessionId);
 #endif // WLAN_FEATURE_GTK_OFFLOAD
 
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/*Set batch scan request Cb declaration*/
+typedef void(*hddSetBatchScanReqCallback)(void *callbackContext,
+     tSirSetBatchScanRsp *pRsp);
+
+/*Trigger batch scan result indication Cb declaration*/
+typedef void(*hddTriggerBatchScanResultIndCallback)(void *callbackContext,
+     void *pRsp);
+
+/* -----------------------------------------------------------------------------
+    \fn pmcSetBatchScanReq
+    \brief  Setting batch scan request in FW
+    \param  hHal - The handle returned by macOpen.
+    \param  sessionId - session id
+    \param  callbackRoutine - Pointer to set batch scan request callback routine
+    \param  calbackContext - callback context
+    \return eHalStatus
+             eHAL_STATUS_FAILURE  Cannot set batch scan request
+             eHAL_STATUS_SUCCESS  Request accepted.
+ -----------------------------------------------------------------------------*/
+extern eHalStatus pmcSetBatchScanReq(tHalHandle hHal, tSirSetBatchScanReq
+       *pRequest, tANI_U8 sessionId, hddSetBatchScanReqCallback callbackRoutine,
+       void *callbackContext);
+
+/* -----------------------------------------------------------------------------
+    \fn pmcTriggerBatchScanResultInd
+    \brief  API to pull batch scan result from FW
+    \param  hHal - The handle returned by macOpen.
+    \param  sessionId - session id
+    \param  callbackRoutine - Pointer to get batch scan request callback routine
+    \param  calbackContext - callback context
+    \return eHalStatus
+             eHAL_STATUS_FAILURE  Cannot set batch scan request
+             eHAL_STATUS_SUCCESS  Request accepted.
+ -----------------------------------------------------------------------------*/
+extern eHalStatus pmcTriggerBatchScanResultInd
+(
+    tHalHandle hHal, tSirTriggerBatchScanResultInd *pRequest, tANI_U8 sessionId,
+    hddTriggerBatchScanResultIndCallback callbackRoutine, void *callbackContext
+);
+
+
+/* -----------------------------------------------------------------------------
+    \fn pmcStopBatchScanInd
+    \brief  Stoping batch scan request in FW
+    \param  hHal - The handle returned by macOpen.
+    \param  pInd - Pointer to stop batch scan indication
+    \return eHalStatus
+             eHAL_STATUS_FAILURE  Cannot set batch scan request
+             eHAL_STATUS_SUCCESS  Request accepted.
+ -----------------------------------------------------------------------------*/
+
+extern eHalStatus pmcStopBatchScanInd
+(
+    tHalHandle hHal,
+    tSirStopBatchScanInd *pInd,
+    tANI_U8 sessionId
+);
+
+#endif // FEATURE_WLAN_BATCH_SCAN
+
+
 /* Power Save Offload Changes */
 typedef enum eUapsdStatus
 {
diff --git a/CORE/SME/inc/smeInside.h b/CORE/SME/inc/smeInside.h
index 500fc72..f95e0ad 100644
--- a/CORE/SME/inc/smeInside.h
+++ b/CORE/SME/inc/smeInside.h
@@ -25,6 +25,7 @@
  * to the Linux Foundation.
  */
 
+
 #if !defined( __SMEINSIDE_H )
 #define __SMEINSIDE_H
 
@@ -64,7 +65,7 @@
 #if defined WLAN_FEATURE_VOWIFI
 #include "sme_RrmApi.h"
 #endif
-
+ePhyChanBondState csrConvertCBIniValueToPhyCBState(v_U32_t cbIniValue);
 
 /*-------------------------------------------------------------------------- 
   Type declarations
@@ -100,6 +101,7 @@
     tANI_U8 chn;
     tANI_U8 phyMode;
     tANI_U32 duration;
+    tANI_U8 isP2PProbeReqAllowed;
     void* callback;
     void* callbackCtx;
 }tRemainChlCmd;
@@ -120,6 +122,15 @@
   tANI_U8 len;
 } tTdlsSendMgmtCmdInfo;
 
+typedef struct TdlsLinkEstablishInfo
+{
+  tSirMacAddr peerMac;
+  tANI_U8 uapsdQueues;
+  tANI_U8 maxSp;
+  tANI_U8 isBufSta;
+  tANI_U8 isResponder;
+} tTdlsLinkEstablishCmdInfo;
+
 typedef struct TdlsAddStaInfo
 {
   eTdlsAddOper tdlsAddOper;
@@ -172,6 +183,7 @@
     //tEnterPeerUAPSDInfo enterUapsdInfo ;
     //tExitPeerUAPSDinfo  exitUapsdInfo ;
 #endif
+    tTdlsLinkEstablishCmdInfo tdlsLinkEstablishCmdInfo;
     tTdlsSendMgmtCmdInfo tdlsSendMgmtCmdInfo;
     tTdlsAddStaCmdInfo   tdlsAddStaCmdInfo;
     tTdlsDelStaCmdInfo   tdlsDelStaCmdInfo;
@@ -287,10 +299,15 @@
 tANI_BOOLEAN csrRoamGetConcurrencyConnectStatusForBmps(tpAniSirGlobal pMac);
 #ifdef FEATURE_WLAN_TDLS
 eHalStatus csrTdlsSendMgmtReq(tHalHandle hHal, tANI_U8 sessionId, tCsrTdlsSendMgmt *tdlsSendMgmt);
+VOS_STATUS csrTdlsSendLinkEstablishParams(tHalHandle hHal,
+                                          tANI_U8 sessionId,
+                                          tSirMacAddr peerMac,
+                                          tCsrTdlsLinkEstablishParams *tdlsLinkEstablishParams);
 eHalStatus csrTdlsAddPeerSta(tHalHandle hHal, tANI_U8 sessionId, tSirMacAddr peerMac);
 eHalStatus csrTdlsChangePeerSta(tHalHandle hHal, tANI_U8 sessionId, tSirMacAddr peerMac, tCsrStaParams *pstaParams);
 eHalStatus csrTdlsDelPeerSta(tHalHandle hHal, tANI_U8 sessionId, tSirMacAddr peerMac);
 eHalStatus csrTdlsProcessCmd(tpAniSirGlobal pMac,tSmeCmd *pCommand );
+eHalStatus csrTdlsProcessLinkEstablish( tpAniSirGlobal pMac, tSmeCmd *cmd );
 eHalStatus tdlsMsgProcessor(tpAniSirGlobal pMac,v_U16_t msg_type,
                                                            void *pMsgBuf);
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
@@ -304,14 +321,20 @@
 #endif /* FEATURE_WLAN_TDLS */
 
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
-eHalStatus csrFlushBgScanRoamChannelList(tpAniSirGlobal pMac);
+eHalStatus csrFlushCfgBgScanRoamChannelList(tpAniSirGlobal pMac);
 eHalStatus csrCreateBgScanRoamChannelList(tpAniSirGlobal pMac,
                                             const tANI_U8 *pChannelList,
                                             const tANI_U8 numChannels);
 eHalStatus csrUpdateBgScanConfigIniChannelList(tpAniSirGlobal pMac, eCsrBand eBand);
-eHalStatus csrInitCountryValidChannelList(tpAniSirGlobal pMac, tANI_U8 revision);
-void csr_SetRevision(tpAniSirGlobal pMac, tANI_U8 revision);
 #endif
+
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+eHalStatus csrCreateRoamScanChannelList(tpAniSirGlobal pMac,
+                                                tANI_U8 *pChannelList,
+                                                tANI_U8 numChannels,
+                                                const eCsrBand eBand);
+#endif
+
 ePhyChanBondState csrConvertCBIniValueToPhyCBState(v_U32_t cbIniValue);
 
 eHalStatus csrPsOffloadIsFullPowerNeeded(tpAniSirGlobal pMac,
@@ -319,4 +342,12 @@
                                          tRequestFullPowerReason *pReason,
                                          tANI_BOOLEAN *pfNeedPower);
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+eHalStatus csrCreateRoamScanChannelList(tpAniSirGlobal pMac,
+                                                tANI_U8 *pChannelList,
+                                                tANI_U8 numChannels,
+                                                const eCsrBand eBand);
+#endif
+void activeListCmdTimeoutHandle(void *userData);
+
 #endif //#if !defined( __SMEINSIDE_H )
diff --git a/CORE/SME/inc/smeInternal.h b/CORE/SME/inc/smeInternal.h
index daa972d..1563348 100644
--- a/CORE/SME/inc/smeInternal.h
+++ b/CORE/SME/inc/smeInternal.h
@@ -51,6 +51,7 @@
 #include "vos_trace.h"
 #include "vos_memory.h"
 #include "vos_types.h"
+#include "vos_diag_core_event.h"
 #include "csrLinkList.h"
 
 /*-------------------------------------------------------------------------- 
@@ -77,6 +78,7 @@
     eSmeCommandTdlsSendMgmt, 
     eSmeCommandTdlsAddPeer, 
     eSmeCommandTdlsDelPeer, 
+    eSmeCommandTdlsLinkEstablish,
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
     eSmeCommandTdlsDiscovery,
     eSmeCommandTdlsLinkSetup,
@@ -115,20 +117,22 @@
     SME_STATE_READY,
 } eSmeState;
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
-/* enumeration for Korea country revision index,
-   index to the list of valid channels */
-typedef enum eSmeKRRevision
-{
-    SME_KR_3         = 3,
-    SME_KR_24        = 24,
-    SME_KR_25        = 25,
-} eSmeKRRevision;
-#endif
-
 #define SME_IS_START(pMac)  (SME_STATE_STOP != (pMac)->sme.state)
 #define SME_IS_READY(pMac)  (SME_STATE_READY == (pMac)->sme.state)
 
+#ifdef FEATURE_CESIUM_PROPRIETARY
+
+/* HDD Callback function */
+typedef void(*pIbssPeerInfoCb)(void *pUserData, void *infoParam);
+
+/* Peer info */
+typedef struct tagSmePeerInfoHddCbkInfo
+{
+   void *pUserData;
+   pIbssPeerInfoCb peerInfoCbk;
+}tSmePeerInfoHddCbkInfo;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
 
 typedef struct tagSmeStruct
 {
@@ -141,8 +145,20 @@
     tDblLinkList smeCmdFreeList;   //preallocated roam cmd list
     void (*pTxPerHitCallback) (void *pCallbackContext); /* callback for Tx PER hit to HDD */ 
     void *pTxPerHitCbContext;
+    tVOS_CON_MODE currDeviceMode;
+#ifdef FEATURE_WLAN_LPHB
+    void (*pLphbIndCb) (void *pAdapter, void *indParam);
+#endif /* FEATURE_WLAN_LPHB */
+    //pending scan command list
     tDblLinkList smeScanCmdPendingList;
+    //active scan command list
     tDblLinkList smeScanCmdActiveList;
+#ifdef FEATURE_CESIUM_PROPRIETARY
+    tSmePeerInfoHddCbkInfo peerInfoParams;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
+    vos_event_wlan_status_payload_type eventPayload;
+#endif
 } tSmeStruct, *tpSmeStruct;
 
 
diff --git a/CORE/SME/inc/smeRrmInternal.h b/CORE/SME/inc/smeRrmInternal.h
index 336b6f0..7ea2291 100644
--- a/CORE/SME/inc/smeRrmInternal.h
+++ b/CORE/SME/inc/smeRrmInternal.h
@@ -96,12 +96,16 @@
    tAniSSID ssId;  //SSID used in the measuring beacon report.
    tSirMacAddr bssId; //bssid used for beacon report measurement.
    tANI_U16 randnIntvl; //Randomization interval to be used in subsequent measurements.
-   tANI_U16 duration;
-   tANI_U16 measMode;
+   tANI_U16 duration[SIR_CCX_MAX_MEAS_IE_REQS];
+   tANI_U8 measMode[SIR_CCX_MAX_MEAS_IE_REQS];
    tRrmConfigParam rrmConfig;
    vos_timer_t IterMeasTimer;
    tDblLinkList neighborReportCache;
    tRrmNeighborRequestControlInfo neighborReqControlInfo;
+
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+   tCsrCcxBeaconReq  ccxBcnReqInfo;
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
 }tRrmSMEContext, *tpRrmSMEContext; 
 
 typedef struct sRrmNeighborReq
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index c44a18e..50f62c2 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -56,6 +56,9 @@
 #include "btcApi.h"
 #include "vos_nvitem.h"
 #include "p2p_Api.h"
+#ifdef FEATURE_CESIUM_PROPRIETARY
+#include "smeInternal.h"
+#endif
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
 #include "oemDataApi.h"
@@ -78,6 +81,10 @@
 
 #define SME_INVALID_COUNTRY_CODE "XX"
 
+//Macro to disable split scan
+#define SME_DISABLE_SPLIT_SCAN   255
+
+#ifdef QCA_WIFI_2_0
 #define SME_2_4_GHZ_MAX_FREQ    3000
 #define SME_MODE_11A            0    /* 11a mode */
 #define SME_MODE_11G            1    /* 11b/g mode */
@@ -97,6 +104,7 @@
     (psme_channel)->reg_info_1 &= 0xff00ffff;             \
     (psme_channel)->reg_info_1 |= ((val & 0xff) << 16);   \
 } while(0)
+#endif
 
 /*-------------------------------------------------------------------------- 
   Type declarations
@@ -109,6 +117,7 @@
 #endif
 #if defined FEATURE_WLAN_LFR
     tANI_U8   isFastRoamIniFeatureEnabled;
+    tANI_U8   MAWCEnabled;
 #endif
 #if defined FEATURE_WLAN_CCX
     tANI_U8   isCcxIniFeatureEnabled;
@@ -122,10 +131,19 @@
     tANI_BOOLEAN  isWESModeEnabled;
 #endif
     tANI_BOOLEAN  fScanOffload;
+    tANI_U8  isAmsduSupportInAMPDU;
     tANI_BOOLEAN  fP2pListenOffload;
     tANI_BOOLEAN  pnoOffload;
 } tSmeConfigParams, *tpSmeConfigParams;
 
+typedef enum
+{
+    eSME_ROAM_TRIGGER_NONE = 0,
+    eSME_ROAM_TRIGGER_SCAN = 1,
+    eSME_ROAM_TRIGGER_FAST_ROAM = 2,
+    eSME_ROAM_TRIGGER_MAX
+} tSmeFastRoamTrigger;
+
 #ifdef QCA_WIFI_2_0
 typedef struct _smeChannelInfo
 {
@@ -243,7 +261,7 @@
   
   \param hHal - The handle returned by macOpen.
 
-  \param pmcFlag - The flag tells SME if we want to stop PMC or not
+  \param tHalStopType - reason for stopping
   
   \return eHAL_STATUS_SUCCESS - SME is stopped.
   
@@ -252,7 +270,7 @@
   \sa
   
   --------------------------------------------------------------------------*/
-eHalStatus sme_Stop(tHalHandle hHal, tANI_BOOLEAN pmcFlag);
+eHalStatus sme_Stop(tHalHandle hHal, tHalStopType stopType);
 
 
 /*--------------------------------------------------------------------------
@@ -275,10 +293,19 @@
   \sa
   
   --------------------------------------------------------------------------*/
-eHalStatus sme_OpenSession(tHalHandle hHal, csrRoamCompleteCallback callback, void *pContext,
-                           tANI_U8 *pSelfMacAddr, tANI_U8 *pbSessionId,
-                           tANI_U32 type, tANI_U32 subType);
+eHalStatus sme_OpenSession(tHalHandle hHal, csrRoamCompleteCallback callback,
+                           void *pContext, tANI_U8 *pSelfMacAddr,
+                           tANI_U8 *pbSessionId, tANI_U32 type,
+                           tANI_U32 subType);
 
+/*--------------------------------------------------------------------------
+
+  \brief sme_SetCurrDeviceMode() - Sets the current operating device mode.
+  \param hHal - The handle returned by macOpen.
+  \param currDeviceMode - Current operating device mode.
+  --------------------------------------------------------------------------*/
+
+void sme_SetCurrDeviceMode (tHalHandle hHal, tVOS_CON_MODE currDeviceMode);
 
 /*--------------------------------------------------------------------------
   
@@ -823,9 +850,34 @@
                              tANI_U32 periodicity, tANI_BOOLEAN cache, 
                              tANI_U8 staId, void *pContext);
 
+/* ---------------------------------------------------------------------------
+    \fn smeGetTLSTAState
+    \helper function to get teh TL STA State whenever the function is called.
+
+    \param staId - The staID to be passed to the TL
+            to get the relevant TL STA State
+    \return the state as tANI_U16
+  ---------------------------------------------------------------------------*/
+tANI_U16 smeGetTLSTAState(tHalHandle hHal, tANI_U8 staId);
+
 eHalStatus sme_GetRssi(tHalHandle hHal, 
                              tCsrRssiCallback callback, 
                              tANI_U8 staId, tCsrBssid bssId, void *pContext, void* pVosContext);
+
+/* ---------------------------------------------------------------------------
+    \fn sme_GetSnr
+    \brief a wrapper function that client calls to register a callback to get
+    SNR from FW
+
+    \param callback - SME sends back the requested stats using the callback
+    \param staId - The station ID for which the stats is requested for
+    \param bssid - The bssid of the connected session
+    \param pContext - user context to be passed back along with the callback
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_GetSnr(tHalHandle hHal,
+                       tCsrSnrCallback callback,
+                       tANI_U8 staId, tCsrBssid bssId,
+                       void *pContext);
 #if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
 eHalStatus sme_GetRoamRssi(tHalHandle hHal,
                            tCsrRssiCallback callback,
@@ -834,6 +886,47 @@
                            void *pContext,
                            void* pVosContext);
 #endif
+
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+/* ---------------------------------------------------------------------------
+    \fn sme_GetTsmStats
+    \brief a wrapper function that client calls to register a callback to get
+           TSM Stats
+    \param callback - SME sends back the requested stats using the callback
+    \param staId - The station ID for which the stats is requested for
+    \param pContext - user context to be passed back along with the callback
+    \param pVosContext - vos context
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_GetTsmStats(tHalHandle hHal,
+                             tCsrTsmStatsCallback callback,
+                             tANI_U8 staId, tCsrBssid bssId,
+                             void *pContext, void* pVosContext, tANI_U8 tid);
+/* ---------------------------------------------------------------------------
+    \fn sme_SetCCKMIe
+    \brief function to store the CCKM IE passed from supplicant and use it
+          while packing reassociation request
+    \param  hHal - HAL handle for device
+    \param  pCckmIe - pointer to CCKM IE data
+    \param  pCckmIeLen - length of the CCKM IE
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_SetCCKMIe(tHalHandle hHal,
+                         tANI_U8 sessionId,
+                         tANI_U8 *pCckmIe,
+                         tANI_U8 cckmIeLen);
+/* ---------------------------------------------------------------------------
+    \fn sme_SetCcxBeaconRequest
+    \brief  function to set CCX beacon request parameters
+    \param  hHal - HAL handle for device
+    \param  pCcxBcnReq - pointer to CCX beacon request
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_SetCcxBeaconRequest(tHalHandle hHal, const tANI_U8 sessionId,
+                                   const tCsrCcxBeaconReq* pCcxBcnReq);
+
+#endif /*FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
+
 /* ---------------------------------------------------------------------------
     \fn sme_CfgSetInt
     \brief a wrapper function that HDD calls to set parameters in CFG. 
@@ -1454,6 +1547,8 @@
 
     \param pCountry New Country Code String
 
+    \param sendRegHint If we want to send reg hint to nl80211
+
     \return eHalStatus  SUCCESS.
 
                          FAILURE or RESOURCES  The API finished and failed.
@@ -1463,7 +1558,97 @@
                                   tSmeChangeCountryCallback callback,
                                   tANI_U8 *pCountry,
                                   void *pContext,
-                                  void* pVosContext );
+                                  void* pVosContext,
+                                  tAniBool countryFromUserSpace,
+                                  tAniBool sendRegHint);
+
+/* ---------------------------------------------------------------------------
+
+    \fn sme_GenericChangeCountryCode
+
+    \brief Generic API to change country code
+
+    \param hHal - The handle returned by macOpen.
+
+    \param pCountry New Country Code String
+
+    \param reg_domain Regulatory domain for the new country code
+
+    \return eHalStatus  SUCCESS.
+
+                        FAILURE or RESOURCES  The API finished and failed.
+
+  -------------------------------------------------------------------------------*/
+eHalStatus sme_GenericChangeCountryCode( tHalHandle hHal,
+                                         tANI_U8 *pCountry,
+                                         v_REGDOMAIN_t reg_domain);
+
+/* ---------------------------------------------------------------------------
+
+    \fn sme_DHCPStartInd
+
+    \brief Indicate FW about DHCP start event.
+
+    \param hHal - The handle returned by macOpen.
+
+    \param device_mode the mode of the device
+
+    \param macAddr the macAddress of the devices
+
+    \return eHalStatus  SUCCESS.
+
+                         FAILURE or RESOURCES  The API finished and failed.
+
+  -------------------------------------------------------------------------------*/
+
+eHalStatus sme_DHCPStartInd( tHalHandle hHal,
+                             tANI_U8 device_mode,
+                             tANI_U8 *macAddr );
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/* ---------------------------------------------------------------------------
+
+    \fn sme_TXFailMonitorStartStopInd
+
+    \brief Indicate FW about TX Fail Monitor Indication`
+
+    \param hHal - The handle returned by macOpen.
+
+    \param tx_fail_count number of failures after which the firmware sends
+                         an indication to host
+
+    \param txFailIndCallback function to be called after receiving TX Fail
+                             indication
+    \return eHalStatus  SUCCESS.
+
+                         FAILURE or RESOURCES  The API finished and failed.
+
+  -------------------------------------------------------------------------------*/
+eHalStatus sme_TXFailMonitorStartStopInd(tHalHandle hHal,
+                                         tANI_U8 tx_fail_count,
+                                         void * txFailIndCallback);
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+/* ---------------------------------------------------------------------------
+
+    \fn sme_DHCPStopInd
+
+    \brief Indicate FW about DHCP stop event.
+
+    \param hHal - The handle returned by macOpen.
+
+    \param device_mode the mode of the device
+
+    \param macAddr the macAddress of the devices
+
+    \return eHalStatus  SUCCESS.
+
+                         FAILURE or RESOURCES  The API finished and failed.
+
+ -------------------------------------------------------------------------------*/
+eHalStatus sme_DHCPStopInd( tHalHandle hHal,
+                            tANI_U8 device_mode,
+                            tANI_U8 *macAddr );
 
 
 /* ---------------------------------------------------------------------------
@@ -1849,15 +2034,18 @@
  
     wlanSuspendParam- Depicts the wlan suspend params
 
+    csrReadyToSuspendCallback - Callback to be called when ready to suspend
+                                event is received.
+    callbackContext  - Context associated with csrReadyToSuspendCallback.
    
   \return eHalStatus    
   
   
 --------------------------------------------------------------------------- */
-eHalStatus sme_ConfigureSuspendInd( tHalHandle hHal,
-                          tpSirWlanSuspendParam  wlanSuspendParam,
-                          csrReadyToSuspendCallback,
-                          void *callbackContext);
+eHalStatus sme_ConfigureSuspendInd( tHalHandle hHal, 
+                             tpSirWlanSuspendParam  wlanSuspendParam,
+                             csrReadyToSuspendCallback,
+                             void *callbackContext);
 
 /* ---------------------------------------------------------------------------
 
@@ -2174,6 +2362,16 @@
                              tSirMacAddr pSelfMacAddress, v_S7_t dB);
 
 /* ---------------------------------------------------------------------------
+    \fn sme_SetMaxTxPowerPerBand
+    \brief  Used to set the Maximum Transmit Power for
+    specific band dynamically. Note: this setting will not persist over reboots
+    \param band
+    \param power to set in dB
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_SetMaxTxPowerPerBand(eCsrBand band, v_S7_t db);
+
+/* ---------------------------------------------------------------------------
 
     \fn sme_SetTxPower
 
@@ -2210,7 +2408,7 @@
     \param  hHal - The handle returned by macOpen.
     \param  newTMLevel - new Thermal Mitigation Level
     \param  tmMode - Thermal Mitigation handle mode, default 0
-    \return eHalStatus     
+    \return eHalStatus
   ---------------------------------------------------------------------------*/
 eHalStatus sme_SetTmLevel(tHalHandle hHal, v_U16_t newTMLevel, v_U16_t tmMode);
 
@@ -2310,6 +2508,30 @@
 eHalStatus sme_setRoamIntraBand(tHalHandle hHal, const v_BOOL_t nRoamIntraBand);
 
 /* ---------------------------------------------------------------------------
+    \fn sme_UpdateRoamScanNProbes
+    \brief  function to update roam scan N probes
+            This function is called through dynamic setConfig callback function
+            to update roam scan N probes
+    \param  hHal - HAL handle for device
+    \param  nProbes number of probe requests to be sent out
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_UpdateRoamScanNProbes(tHalHandle hHal, const v_U8_t nProbes);
+
+/* ---------------------------------------------------------------------------
+    \fn sme_UpdateRoamScanHomeAwayTime
+    \brief  function to update roam scan Home away time
+            This function is called through dynamic setConfig callback function
+            to update roam scan home away time
+    \param  hHal - HAL handle for device
+    \param  nRoamScanAwayTime Scan home away time
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_UpdateRoamScanHomeAwayTime(tHalHandle hHal,
+                                          const v_U16_t nRoamScanHomeAwayTime,
+                                          const eAniBoolean bSendOffloadCmd);
+
+/* ---------------------------------------------------------------------------
     \fn sme_getRoamIntraBand
     \brief  get Intra band roaming
     \param  hHal - HAL handle for device
@@ -2318,6 +2540,22 @@
 v_BOOL_t sme_getRoamIntraBand(tHalHandle hHal);
 
 /* ---------------------------------------------------------------------------
+    \fn sme_getRoamScanNProbes
+    \brief  get N Probes
+    \param  hHal - HAL handle for device
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+v_U8_t sme_getRoamScanNProbes(tHalHandle hHal);
+
+/* ---------------------------------------------------------------------------
+    \fn sme_getRoamScanHomeAwayTime
+    \brief  get Roam scan home away time
+    \param  hHal - HAL handle for device
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+v_U16_t sme_getRoamScanHomeAwayTime(tHalHandle hHal);
+
+/* ---------------------------------------------------------------------------
     \fn sme_UpdateImmediateRoamRssiDiff
     \brief  Update nImmediateRoamRssiDiff
             This function is called through dynamic setConfig callback function
@@ -2397,6 +2635,34 @@
 
 eHalStatus sme_UpdateIsFastRoamIniFeatureEnabled(tHalHandle hHal,
         const v_BOOL_t isFastRoamIniFeatureEnabled);
+
+/*--------------------------------------------------------------------------
+  \brief sme_UpdateIsMAWCIniFeatureEnabled() -
+  Enable/disable LFR MAWC support at runtime
+  It is used at in the REG_DYNAMIC_VARIABLE macro definition of
+  isMAWCIniFeatureEnabled.
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update MAWCEnabled config successfully.
+          Other status means SME is failed to update MAWCEnabled.
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_UpdateIsMAWCIniFeatureEnabled(tHalHandle hHal,
+        const v_BOOL_t MAWCEnabled);
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+/*--------------------------------------------------------------------------
+  \brief sme_UpdateEnableFastRoamInConcurrency() - enable/disable LFR if Concurrent session exists
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS
+          Other status means SME is failed
+  \sa
+  --------------------------------------------------------------------------*/
+
+eHalStatus sme_UpdateEnableFastRoamInConcurrency(tHalHandle hHal,
+         v_BOOL_t bFastRoamInConIniFeatureEnabled);
+#endif
 #endif /* FEATURE_WLAN_LFR */
 
 #ifdef FEATURE_WLAN_CCX
@@ -2590,17 +2856,19 @@
 eHalStatus sme_ChangeRoamScanChannelList(tHalHandle hHal, tANI_U8 *pChannelList,
                                          tANI_U8 numChannels);
 
+#ifdef FEATURE_WLAN_CCX_UPLOAD
 /*--------------------------------------------------------------------------
-  \brief sme_ChangeCountryValidChannelListByRevision() - Change Korea valid channel list
-  based on country revision number
+  \brief sme_SetCcxRoamScanChannelList() - set ccx roam scan channel list
   This is a synchronuous call
   \param hHal - The handle returned by macOpen.
   \return eHAL_STATUS_SUCCESS - SME update config successful.
           Other status means SME is failed to update
   \sa
   --------------------------------------------------------------------------*/
-eHalStatus sme_ChangeCountryValidChannelListByRevision(tHalHandle hHal,
-                                         tANI_U8 Revision);
+eHalStatus sme_SetCcxRoamScanChannelList(tHalHandle hHal,
+                                                   tANI_U8 *pChannelList,
+                                                   tANI_U8 numChannels);
+#endif
 
 /*--------------------------------------------------------------------------
   \brief csrUpdateBgScanConfigIniChannelList() - Update bgscan roam cache
@@ -2626,16 +2894,6 @@
                                          tANI_U8 *pNumChannels);
 
 /*--------------------------------------------------------------------------
-  \brief sme_GetCountryRevision() - get Country revision index
-  This is a synchronuous call
-  \param hHal - The handle returned by macOpen.
-  \return eHAL_STATUS_SUCCESS - SME update config successful.
-          Other status means SME is failed to update
-  \sa
-  --------------------------------------------------------------------------*/
-eHalStatus sme_GetCountryRevision(tHalHandle hHal, tANI_U8 *pRevision);
-
-/*--------------------------------------------------------------------------
   \brief sme_getIsCcxFeatureEnabled() - get CCX feature enabled or not
   This is a synchronuous call
   \param hHal - The handle returned by macOpen.
@@ -2723,6 +2981,21 @@
     -------------------------------------------------------------------------*/
 tANI_U8 sme_IsFeatureSupportedByFW(tANI_U8 featEnumValue);
 #ifdef FEATURE_WLAN_TDLS
+
+/* ---------------------------------------------------------------------------
+    \fn sme_SendTdlsLinkEstablishParams
+    \brief  API to send TDLS Link Establishment Parameters.
+
+    \param  peerMac - peer's Mac Adress.
+    \param  tdlsLinkEstablishParams - TDLS Peer Link Establishment Parameters
+    \- return VOS_STATUS_SUCCES
+    -------------------------------------------------------------------------*/
+
+VOS_STATUS sme_SendTdlsLinkEstablishParams(tHalHandle hHal,
+                                                   tANI_U8 sessionId,
+                                                   tSirMacAddr peerMac,
+                                                   tCsrTdlsLinkEstablishParams *tdlsLinkEstablishParams);
+
 /* ---------------------------------------------------------------------------
     \fn sme_SendTdlsMgmtFrame
     \brief  API to send TDLS management frames.
@@ -2765,13 +3038,6 @@
     -------------------------------------------------------------------------*/
 VOS_STATUS sme_DeleteTdlsPeerSta(tHalHandle hHal, tANI_U8 sessionId, tSirMacAddr peerMac);
 /* ---------------------------------------------------------------------------
-    \fn sme_IsPmcBmps
-    \brief  API to Check if PMC state is BMPS.
-
-    \- return v_BOOL_t
-    -------------------------------------------------------------------------*/
-v_BOOL_t sme_IsPmcBmps(tHalHandle hHal);
-/* ---------------------------------------------------------------------------
     \fn sme_SetTdlsPowerSaveProhibited
     \API to set/reset the isTdlsPowerSaveProhibited.
 
@@ -2781,6 +3047,14 @@
                                             v_BOOL_t val);
 
 #endif
+/* ---------------------------------------------------------------------------
+    \fn sme_IsPmcBmps
+    \brief  API to Check if PMC state is BMPS.
+
+    \- return v_BOOL_t
+    -------------------------------------------------------------------------*/
+v_BOOL_t sme_IsPmcBmps(tHalHandle hHal);
+
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
 typedef struct smeTdlsDisResult
 {
@@ -2834,8 +3108,200 @@
  */
 VOS_STATUS sme_SelectCBMode(tHalHandle hHal, eCsrPhyMode eCsrPhyMode, tANI_U8 channel);
 
-/*SME API to convert convert the ini value to the ENUM used in csr and MAC*/
-ePhyChanBondState sme_GetCBPhyStateFromCBIniValue(tANI_U32 cb_ini_value);
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+/*--------------------------------------------------------------------------
+  \brief sme_HandoffRequest() - a wrapper function to Request a handoff
+  from CSR.
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen
+  \param pHandoffInfo - info provided by HDD with the handoff request (namely:
+  BSSID, channel etc.)
+  \return eHAL_STATUS_SUCCESS - SME passed the request to CSR successfully.
+          Other status means SME is failed to send the request.
+  \sa
+  --------------------------------------------------------------------------*/
+
+eHalStatus sme_HandoffRequest(tHalHandle hHal, tCsrHandoffRequest *pHandoffInfo);
+#endif
+/*--------------------------------------------------------------------------
+  \brief sme_isSta_p2p_clientConnected() - a wrapper function to check if there
+                                           is any connected session .
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen
+  \return VOS_STATUS - SME passed the request to CSR successfully.
+          Other status means SME is failed to send the request.
+  \sa
+  --------------------------------------------------------------------------*/
+VOS_STATUS sme_isSta_p2p_clientConnected(tHalHandle hHal);
+
+#ifdef FEATURE_WLAN_LPHB
+/* ---------------------------------------------------------------------------
+    \fn sme_LPHBConfigReq
+    \API to make configuration LPHB within FW.
+    \param hHal - The handle returned by macOpen
+    \param lphdReq - LPHB request argument by client
+    \param pCallbackfn - LPHB timeout notification callback function pointer
+    \- return Configuration message posting status, SUCCESS or Fail
+    -------------------------------------------------------------------------*/
+eHalStatus sme_LPHBConfigReq(
+                      tHalHandle hHal,
+                      tSirLPHBReq *lphdReq,
+                      void (*pCallbackfn)(void *pAdapter, void *indParam));
+#endif /* FEATURE_WLAN_LPHB */
+
+/* ---------------------------------------------------------------------------
+    \fn sme_AddPeriodicTxPtrn
+    \brief  API to Periodic TX Pattern Offload feature
+    \param  hHal - The handle returned by macOpen
+    \param  addPeriodicTxPtrnParams -  Pointer to the add pattern structure
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_AddPeriodicTxPtrn(tHalHandle hHal, tSirAddPeriodicTxPtrn
+                                 *addPeriodicTxPtrnParams);
+
+/* ---------------------------------------------------------------------------
+    \fn sme_DelPeriodicTxPtrn
+    \brief  API to Periodic TX Pattern Offload feature
+    \param  hHal - The handle returned by macOpen
+    \param  delPeriodicTxPtrnParams -  Pointer to the deleting pattern structure
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_DelPeriodicTxPtrn(tHalHandle hHal, tSirDelPeriodicTxPtrn
+                                 *delPeriodicTxPtrnParams);
+/*--------------------------------------------------------------------------
+  \brief sme_enable_disable_split_scan() - a wrapper function to set the split
+                                          scan parameter.
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen
+  \return None.
+  \sa
+  --------------------------------------------------------------------------*/
+void sme_enable_disable_split_scan (tHalHandle hHal, tANI_U8 nNumStaChan,
+                                    tANI_U8 nNumP2PChan);
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+/* ---------------------------------------------------------------------------
+    \fn sme_EnableReliableMcast
+    \brief  Used to enable Reliable Multicast using Leader Based Protocol
+    setting will not persist over reboots
+    \param  hHal
+    \param  sessionId
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_EnableReliableMcast(tHalHandle hHal, tANI_U32 sessionId);
+
+/* ---------------------------------------------------------------------------
+    \fn sme_DisableReliableMcast
+    \brief  Used to disable Reliable Multicast using Leader Based Protocol
+    setting will not persist over reboots
+    \param  hHal
+    \param  sessionId
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_DisableReliableMcast(tHalHandle hHal, tANI_U32 sessionId);
+#endif //#if defined WLAN_FEATURE_RELIABLE_MCAST
+
+/* ---------------------------------------------------------------------------
+    \fn sme_SendRateUpdateInd
+    \brief  API to Update rate
+    \param  hHal - The handle returned by macOpen
+    \param  rateUpdateParams - Pointer to rate update params
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateParams);
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/* ---------------------------------------------------------------------------
+    \fn sme_GetIBSSPeerInfo
+    \brief  Used to disable Reliable Multicast using Leader Based Protocol
+    setting will not persist over reboots
+    \param  hHal
+    \param  ibssPeerInfoReq  multicast Group IP address
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_RequestIBSSPeerInfo(tHalHandle hHal, void *pUserData,
+                                            pIbssPeerInfoCb peerInfoCbk,
+                                            tANI_BOOLEAN allPeerInfoReqd,
+                                            tANI_U8 staIdx);
+
+/* ---------------------------------------------------------------------------
+    \fn sme_IBSSRouteTableUpdate
+    \API to update IBSS Route table in FW.
+    \param hHal - The handle returned by macOpen
+    \param pIbssTable - ptr to IBSS table struct
+    \- return Success or Failiure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_IBSSRouteTableUpdateInd(tHalHandle hHal,
+                                       tAniIbssRouteTable *pIbssTable);
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+/*
+ * sme API to trigger fast BSS roam to a given BSSID independent of RSSI
+ * triggers
+ * return status
+*/
+eHalStatus smeIssueFastRoamNeighborAPEvent (tHalHandle hHal,
+                                            tANI_U8 *bssid,
+                                            tSmeFastRoamTrigger fastRoamTrig);
+
+eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId, tANI_U8 *pBSSId );
+
+void smeGetCommandQStatus( tHalHandle hHal );
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/* ---------------------------------------------------------------------------
+    \fn sme_SetBatchScanReq
+    \brief  API to set batch scan request in FW
+    \param  hHal - The handle returned by macOpen.
+    \param  pRequest -  Pointer to the batch request.
+    \param  sessionId - session ID
+    \param  callbackRoutine - HDD callback which needs to be invoked after
+            getting set batch scan response from FW
+    \param  callbackContext - pAdapter context
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus
+sme_SetBatchScanReq
+(
+    tHalHandle hHal, tSirSetBatchScanReq *pRequest, tANI_U8 sessionId,
+    void (*callbackRoutine) (void *callbackCtx, tSirSetBatchScanRsp *pRsp),
+    void *callbackContext
+);
+
+/* ---------------------------------------------------------------------------
+    \fn sme_TriggerBatchScanResultInd
+    \brief  API to trigger batch scan result indications from from FW
+    \param  hHal - The handle returned by macOpen.
+    \param  pRequest -  Pointer to get batch request.
+    \param  sessionId - session ID
+    \param  callbackRoutine - HDD callback which needs to be invoked after
+            getting get batch scan response from FW
+    \param  callbackContext - pAdapter context
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus
+sme_TriggerBatchScanResultInd
+(
+    tHalHandle hHal, tSirTriggerBatchScanResultInd *pRequest, tANI_U8 sessionId,
+    void (*callbackRoutine) (void *callbackCtx, void *pRsp),
+    void *callbackContext
+);
+
+/* ---------------------------------------------------------------------------
+    \fn sme_StopBatchScanInd
+    \brief  API to stop batch scan request in FW
+    \param  hHal - The handle returned by macOpen.
+    \param  pRequest -  Pointer to stop batch indication
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus
+sme_StopBatchScanInd
+(
+    tHalHandle hHal, tSirStopBatchScanInd *pInd, tANI_U8 sessionId
+);
+
+#endif
+
 
 /*
  * SME API to enable/disable idle mode powersave
@@ -2849,6 +3315,9 @@
 eHalStatus sme_PsOffloadEnablePowerSave (tHalHandle hHal, tANI_U32 sessionId);
 eHalStatus sme_PsOffloadDisablePowerSave (tHalHandle hHal, tANI_U32 sessionId);
 
+/*SME API to convert convert the ini value to the ENUM used in csr and MAC*/
+ePhyChanBondState sme_GetCBPhyStateFromCBIniValue(tANI_U32 cb_ini_value);
+
 int sme_UpdateHTConfig(tHalHandle hHal, tANI_U8 sessionId, tANI_U16 htCapab,
                          int value);
 tANI_S16 sme_GetHTConfig(tHalHandle hHal, tANI_U8 session_id, tANI_U16 ht_capab);
@@ -2861,13 +3330,4 @@
 eHalStatus sme_getChannelInfo(tHalHandle hHal, tANI_U8 chanId,
                               tSmeChannelInfo *chanInfo);
 #endif
-/* ---------------------------------------------------------------------------
-    \fn sme_SendRateUpdateInd
-    \brief  API to Update rate
-    \param  hHal - The handle returned by macOpen
-    \param  rateUpdateParams - Pointer to rate update params
-    \return eHalStatus
-  ---------------------------------------------------------------------------*/
-eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateParams);
-eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId, tANI_U8 *pBSSId );
 #endif //#if !defined( __SME_API_H )
diff --git a/CORE/SME/inc/sme_FTApi.h b/CORE/SME/inc/sme_FTApi.h
index ca29765..1f0bf2c 100644
--- a/CORE/SME/inc/sme_FTApi.h
+++ b/CORE/SME/inc/sme_FTApi.h
@@ -25,6 +25,7 @@
  * to the Linux Foundation.
  */
 
+
 #if !defined( __SME_FTAPI_H )
 #define __SME_FTAPI_H
 
@@ -72,7 +73,7 @@
     v_BOOL_t          setFTPTKState;
 
     // Time to trigger reassoc once pre-auth is successful
-    tPalTimerHandle   preAuthReassocIntvlTimer;
+    vos_timer_t       preAuthReassocIntvlTimer;
     tCsrRoamSetKey    *pCsrFTKeyInfo;
 
 } tftSMEContext, *tpftSMEContext;
diff --git a/CORE/SME/inc/sme_QosApi.h b/CORE/SME/inc/sme_QosApi.h
index ef0a99d..6f4ea84 100644
--- a/CORE/SME/inc/sme_QosApi.h
+++ b/CORE/SME/inc/sme_QosApi.h
@@ -54,6 +54,14 @@
 #include "aniGlobal.h"
 #include "sirApi.h"
 
+/*--------------------------------------------------------------------------
+  Pre-processor Definitions
+  ------------------------------------------------------------------------*/
+#define SME_QOS_UAPSD_VO      0x01
+#define SME_QOS_UAPSD_VI      0x02
+#define SME_QOS_UAPSD_BE      0x08
+#define SME_QOS_UAPSD_BK      0x04
+
 /*-------------------------------------------------------------------------- 
   Type declarations
   ------------------------------------------------------------------------*/
diff --git a/CORE/SME/inc/sme_RrmApi.h b/CORE/SME/inc/sme_RrmApi.h
index b9696dc..81dee62 100644
--- a/CORE/SME/inc/sme_RrmApi.h
+++ b/CORE/SME/inc/sme_RrmApi.h
@@ -25,7 +25,6 @@
  * to the Linux Foundation.
  */
 
-
 #if !defined( __SMERRMAPI_H )
 #define __SMERRMAPI_H
 
@@ -69,6 +68,7 @@
 
 tRrmNeighborReportDesc* smeRrmGetFirstBssEntryFromNeighborCache( tpAniSirGlobal pMac);
 tRrmNeighborReportDesc* smeRrmGetNextBssEntryFromNeighborCache( tpAniSirGlobal pMac, tpRrmNeighborReportDesc pBssEntry);
+void sme_RrmProcessBeaconReportReqInd(tpAniSirGlobal pMac, void *pMsgBuf);
 
 
 #endif
diff --git a/CORE/SME/inc/smsDebug.h b/CORE/SME/inc/smsDebug.h
index a498787..a9a6226 100644
--- a/CORE/SME/inc/smsDebug.h
+++ b/CORE/SME/inc/smsDebug.h
@@ -47,5 +47,6 @@
 #include "sirDebug.h"
 
 void smsLog(tpAniSirGlobal pMac, tANI_U32 loglevel, const char *pString,...); 
+void pmcLog(tpAniSirGlobal pMac, tANI_U32 loglevel, const char *pString,...);
 
 #endif // __HAL_DEBUG_H__
diff --git a/CORE/SME/src/QoS/sme_Qos.c b/CORE/SME/src/QoS/sme_Qos.c
index 2ff0cdf..7a010fd 100644
--- a/CORE/SME/src/QoS/sme_Qos.c
+++ b/CORE/SME/src/QoS/sme_Qos.c
@@ -52,7 +52,7 @@
 #include "smsDebug.h"
 #include "utilsParser.h"
 #endif
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include <csrCcx.h>
 #endif
 
@@ -123,6 +123,14 @@
    
 }sme_QosStates;
 /*---------------------------------------------------------------------------
+   Enumeration of the various Release QoS trigger
+---------------------------------------------------------------------------*/
+typedef enum
+{
+   SME_QOS_RELEASE_DEFAULT = 0,
+   SME_QOS_RELEASE_BY_AP,
+}sme_QosRelTriggers;
+/*---------------------------------------------------------------------------
    Enumeration of the various QoS cmds 
 ---------------------------------------------------------------------------*/
 typedef enum
@@ -150,7 +158,7 @@
   Table to map user priority passed in as an argument to appropriate Access 
   Category as specified in 802.11e/WMM
 ---------------------------------------------------------------------------*/
-sme_QosEdcaAcType sme_QosUPtoACMap[SME_QOS_WMM_UP_MAX] = 
+sme_QosEdcaAcType sme_QosUPtoACMap[SME_QOS_WMM_UP_MAX] =
 {
    SME_QOS_EDCA_AC_BE, /* User Priority 0 */
    SME_QOS_EDCA_AC_BK, /* User Priority 1 */
@@ -294,6 +302,7 @@
    parsing the RIC received in the the reassoc response */
    tSirAddtsRsp           addTsRsp[SME_QOS_TSPEC_INDEX_MAX];
 #endif
+   sme_QosRelTriggers     relTrig;
 
 } sme_QosACInfo;
 /*---------------------------------------------------------------------------
@@ -2574,7 +2583,7 @@
       {
          // this is the only flow aggregated in this TSPEC
          status = SME_QOS_STATUS_RELEASE_SUCCESS_RSP;
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
          if (ac == SME_QOS_EDCA_AC_VO)
          {
             // Indicate to neighbor roam logic of the new required VO
@@ -2615,24 +2624,34 @@
                   }
                }
             }
-            //send delts
-            hstatus = qosIssueCommand(pMac, sessionId, eSmeCommandDelTs,
-                                      NULL, ac, flow_info->tspec_mask);
-            if(!HAL_STATUS_SUCCESS(hstatus))
+            if (SME_QOS_RELEASE_DEFAULT == pACInfo->relTrig)
             {
-               //err msg
-               VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, 
-                         "%s: %d: sme_QosDelTsReq() failed",
-                         __func__, __LINE__);
-               status = SME_QOS_STATUS_RELEASE_FAILURE_RSP;
-               // we won't be waiting for a response from the AP
-               // so vote powersave back on
-               pSession->readyForPowerSave = VOS_TRUE;
+               //send delts
+               hstatus = qosIssueCommand(pMac, sessionId, eSmeCommandDelTs,
+                                         NULL, ac, flow_info->tspec_mask);
+               if(!HAL_STATUS_SUCCESS(hstatus))
+               {
+                  //err msg
+                  VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                            "%s: %d: sme_QosDelTsReq() failed",
+                            __func__, __LINE__);
+                  status = SME_QOS_STATUS_RELEASE_FAILURE_RSP;
+                  // we won't be waiting for a response from the AP
+                  // so vote powersave back on
+                  pSession->readyForPowerSave = VOS_TRUE;
+               }
+               else
+               {
+                  pACInfo->tspec_mask_status &= SME_QOS_TSPEC_MASK_BIT_1_2_SET &
+                                                (~flow_info->tspec_mask);
+                  deltsIssued = VOS_TRUE;
+               }
             }
             else
             {
-               pACInfo->tspec_mask_status &= SME_QOS_TSPEC_MASK_BIT_1_2_SET & 
-                  (~flow_info->tspec_mask);
+               pSession->readyForPowerSave = VOS_TRUE;
+               pACInfo->tspec_mask_status &= SME_QOS_TSPEC_MASK_BIT_1_2_SET &
+                                              (~flow_info->tspec_mask);
                deltsIssued = VOS_TRUE;
             }
          }
@@ -2690,13 +2709,27 @@
             // so vote powersave back on
             pSession->readyForPowerSave = VOS_TRUE;
          }
-         if(buffered_cmd)
+
+         if (SME_QOS_RELEASE_BY_AP == pACInfo->relTrig)
          {
-            flow_info->QoSCallback(pMac, flow_info->HDDcontext, 
+            flow_info->QoSCallback(pMac, flow_info->HDDcontext,
+                          &pACInfo->curr_QoSInfo[flow_info->tspec_mask - 1],
+                          SME_QOS_STATUS_RELEASE_QOS_LOST_IND,
+                          flow_info->QosFlowID);
+
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
+                      "%s: %d: Deleting entry at %p with flowID %d",
+                      __func__, __LINE__,
+                      flow_info, flow_info->QosFlowID);
+         }
+         else if(buffered_cmd)
+         {
+            flow_info->QoSCallback(pMac, flow_info->HDDcontext,
                                    NULL,
                                    status,
                                    flow_info->QosFlowID);
          }
+
          if(SME_QOS_STATUS_RELEASE_FAILURE_RSP == status)
          {
             break;
@@ -2740,6 +2773,7 @@
                    sessionId, flow_info, QosFlowID);
          csrLLRemoveEntry(&sme_QosCb.flow_list, pEntry, VOS_TRUE );
          pDeletedFlow = flow_info;
+         pACInfo->relTrig = SME_QOS_RELEASE_DEFAULT;
       }
       /* if we are doing reassoc & we are already in handoff state, no need
          to move to requested state. But make sure to set the previous state
@@ -2897,14 +2931,10 @@
       //notify HDD through the synchronous status msg
       return SME_QOS_STATUS_SETUP_NOT_QOS_AP_RSP;
    }
-   if(pTspec_Info->max_service_interval || pTspec_Info->min_service_interval)
-   {
-      pTspec_Info->ts_info.psb = 1;
-   }
-   else
-   {
-      pTspec_Info->ts_info.psb = 0;
-   }
+
+   VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+             "%s: %d: UAPSD/PSB set %d: ", __func__, __LINE__,
+             pTspec_Info->ts_info.psb);
 
    pACInfo = &pSession->ac_info[ac];
    do
@@ -2923,6 +2953,19 @@
                       __func__, __LINE__);
             break;
          }
+
+         if (pTspec_Info->ts_info.psb &&
+             !(pIes->WMMParams.qosInfo & SME_QOS_AP_SUPPORTS_APSD) &&
+             !(pIes->WMMInfoAp.uapsd))
+         {
+            // application is looking for APSD but AP doesn't support it
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                      "%s: %d: On session %d AP doesn't support APSD",
+                      __func__, __LINE__,
+                      sessionId);
+            break;
+         }
+
          if(SME_QOS_MAX_TID == pTspec_Info->ts_info.tid)
          {
             //App didn't set TID, generate one
@@ -3086,6 +3129,7 @@
 {
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_WARN, 
             "########### Set Key Complete #############");
+    (void)sme_QosProcessBufferedCmd(sessionId);
     return eHAL_STATUS_SUCCESS;
 }
 #endif
@@ -3347,7 +3391,7 @@
     ricIE.TSPEC.max_msdu_size = pTspec_Info->maximum_msdu_size;
     ricIE.TSPEC.max_service_int = pTspec_Info->max_service_interval;
     ricIE.TSPEC.mean_data_rate = pTspec_Info->mean_data_rate;
-    ricIE.TSPEC.medium_time = pTspec_Info->medium_time;
+    ricIE.TSPEC.medium_time = 0;
     ricIE.TSPEC.min_data_rate = pTspec_Info->min_data_rate;
     ricIE.TSPEC.min_phy_rate = pTspec_Info->min_phy_rate;
     ricIE.TSPEC.min_service_int = pTspec_Info->min_service_interval;
@@ -3391,7 +3435,7 @@
     ricIE.WMMTSPEC.max_msdu_size = pTspec_Info->maximum_msdu_size;
     ricIE.WMMTSPEC.max_service_int = pTspec_Info->max_service_interval;
     ricIE.WMMTSPEC.mean_data_rate = pTspec_Info->mean_data_rate;
-    ricIE.WMMTSPEC.medium_time = pTspec_Info->medium_time;
+    ricIE.WMMTSPEC.medium_time = 0;
     ricIE.WMMTSPEC.min_data_rate = pTspec_Info->min_data_rate;
     ricIE.WMMTSPEC.min_phy_rate = pTspec_Info->min_phy_rate;
     ricIE.WMMTSPEC.min_service_int = pTspec_Info->min_service_interval;
@@ -3850,6 +3894,15 @@
              "%s: %d: invoked on session %d for AC %d",
              __func__, __LINE__,
              sessionId, ac);
+   if (sessionId >= CSR_ROAM_SESSION_MAX)
+   {
+      //err msg
+      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                "%s: %d: sessionId(%d) is invalid",
+                __func__, __LINE__, sessionId);
+      return eHAL_STATUS_FAILURE;
+   }
+
    pSession = &sme_QosCb.sessionInfo[sessionId];
    pMsg = (tSirAddtsReq *)vos_mem_malloc(sizeof(tSirAddtsReq));
    if (!pMsg)
@@ -4079,10 +4132,10 @@
     sme_QosACInfo *pACInfo;
     sme_QosEdcaAcType ac;
 #endif
-
 #ifdef FEATURE_WLAN_DIAG_SUPPORT
-   WLAN_VOS_DIAG_EVENT_DEF(qos, vos_event_wlan_qos_payload_type);
+    WLAN_VOS_DIAG_EVENT_DEF(qos, vos_event_wlan_qos_payload_type);
 #endif
+
     pSession = &sme_QosCb.sessionInfo[sessionId];
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -4110,6 +4163,7 @@
     }
 #endif
 
+
    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH, 
              "%s: %d: Invoked on session %d with return code %d",
              __func__, __LINE__,
@@ -4222,26 +4276,14 @@
       VOS_ASSERT(0);
       return eHAL_STATUS_FAILURE;
    }
-   //clean up the CB
-   vos_mem_zero(&pACInfo->curr_QoSInfo[SME_QOS_TSPEC_INDEX_0], 
-                sizeof(sme_QosWmmTspecInfo));
-   vos_mem_zero(&pACInfo->requested_QoSInfo[SME_QOS_TSPEC_INDEX_0], 
-                sizeof(sme_QosWmmTspecInfo));
-   vos_mem_zero(&pACInfo->curr_QoSInfo[SME_QOS_TSPEC_INDEX_1], 
-                sizeof(sme_QosWmmTspecInfo));
-   vos_mem_zero(&pACInfo->requested_QoSInfo[SME_QOS_TSPEC_INDEX_1], 
-                sizeof(sme_QosWmmTspecInfo));
-   pACInfo->tspec_mask_status = SME_QOS_TSPEC_MASK_CLEAR;
-   pACInfo->tspec_pending = 0;
-   //event: EVENT_WLAN_QOS
-#ifdef FEATURE_WLAN_DIAG_SUPPORT          
+
+//event: EVENT_WLAN_QOS
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
    qos.eventId = SME_QOS_DIAG_DELTS;
    qos.reasonCode = SME_QOS_DIAG_DELTS_IND_FROM_AP;
    WLAN_VOS_DIAG_EVENT_REPORT(&qos, EVENT_WLAN_QOS);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
 
-   sme_QosStateTransition(sessionId, ac, SME_QOS_LINK_UP);
-   (void)sme_QosProcessBufferedCmd(sessionId);
    return eHAL_STATUS_SUCCESS;
 }
 /*--------------------------------------------------------------------------
@@ -4463,7 +4505,7 @@
 eHalStatus sme_QosProcessReassocSuccessEv(tpAniSirGlobal pMac, v_U8_t sessionId, void * pEvent_info)
 {
 
-   tCsrRoamSession *pCsrRoamSession = CSR_GET_SESSION( pMac, sessionId );
+   tCsrRoamSession *pCsrRoamSession = NULL;
    sme_QosSessionInfo *pSession;
    sme_QosACInfo *pACInfo;
    sme_QosEdcaAcType ac, ac_index;
@@ -4477,6 +4519,17 @@
              "%s: %d: invoked on session %d",
              __func__, __LINE__,
              sessionId);
+
+   if (CSR_ROAM_SESSION_MAX <= sessionId) {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                "%s: %d: invoked on session %d",
+                __func__, __LINE__,
+                sessionId);
+       return status;
+   }
+
+   pCsrRoamSession = CSR_GET_SESSION( pMac, sessionId );
+
    pSession = &sme_QosCb.sessionInfo[sessionId];
    // our pending reassociation has completed
    // we can allow powersave
@@ -5387,8 +5440,6 @@
                 "%s: %d: On session %d an AddTS is not pending on AC %d",
                 __func__, __LINE__,
                 sessionId, ac);
-      //ASSERT
-      VOS_ASSERT(0);
       return eHAL_STATUS_FAILURE;
    }
    //App is looking for APSD or the App which was looking for APSD has been 
@@ -5420,8 +5471,56 @@
          return eHAL_STATUS_FAILURE;
       }
    }
-   pACInfo->curr_QoSInfo[tspec_pending - 1] = 
-      pACInfo->requested_QoSInfo[tspec_pending - 1];
+
+   pACInfo->curr_QoSInfo[tspec_pending - 1].ts_info.burst_size_defn =
+                              pRsp->tspec.tsinfo.traffic.burstSizeDefn;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].ts_info.ack_policy =
+                              pRsp->tspec.tsinfo.traffic.ackPolicy;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].ts_info.up =
+                              pRsp->tspec.tsinfo.traffic.userPrio;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].ts_info.psb =
+                                        pRsp->tspec.tsinfo.traffic.psb;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].ts_info.direction =
+                                  pRsp->tspec.tsinfo.traffic.direction;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].ts_info.tid =
+                                       pRsp->tspec.tsinfo.traffic.tsid;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].nominal_msdu_size =
+                                       pRsp->tspec.nomMsduSz;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].maximum_msdu_size =
+                                                 pRsp->tspec.maxMsduSz;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].min_service_interval =
+                                            pRsp->tspec.minSvcInterval;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].max_service_interval =
+                                            pRsp->tspec.maxSvcInterval;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].inactivity_interval =
+                                             pRsp->tspec.inactInterval;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].suspension_interval =
+                                           pRsp->tspec.suspendInterval;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].svc_start_time =
+                                              pRsp->tspec.svcStartTime;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].min_data_rate =
+                                              pRsp->tspec.minDataRate;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].mean_data_rate =
+                                             pRsp->tspec.meanDataRate;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].peak_data_rate =
+                                             pRsp->tspec.peakDataRate;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].max_burst_size =
+                                               pRsp->tspec.maxBurstSz;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].delay_bound =
+                                               pRsp->tspec.delayBound;
+
+   pACInfo->curr_QoSInfo[tspec_pending - 1].min_phy_rate =
+                                               pRsp->tspec.minPhyRate;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].surplus_bw_allowance =
+                                                pRsp->tspec.surplusBw;
+   pACInfo->curr_QoSInfo[tspec_pending - 1].medium_time =
+                                               pRsp->tspec.mediumTime;
+
+   VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+             "%s: %d: On session %d AddTspec Medium Time %d",
+             __func__, __LINE__,
+             sessionId, pRsp->tspec.mediumTime);
+
    /* Check if the current flow is for bi-directional. If so, update the number of flows
     * to reflect that all flows are aggregated into tspec index 0. */
    if((pACInfo->curr_QoSInfo[pACInfo->tspec_pending - 1].ts_info.direction == SME_QOS_WMM_TS_DIR_BOTH) &&
@@ -5506,7 +5605,7 @@
    }
    WLAN_VOS_DIAG_LOG_REPORT(log_ptr);
 #endif //FEATURE_WLAN_DIAG_SUPPORT
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
    if (ac == SME_QOS_EDCA_AC_VO)
    {
       // Indicate to neighbor roam logic of the new required VO
@@ -5562,10 +5661,14 @@
    }
    vos_mem_copy(&TspecInfo, pCurrent_Tspec_Info, 
                 sizeof(sme_QosWmmTspecInfo));
+   TspecInfo.ts_info.psb = pInput_Tspec_Info->ts_info.psb;
    /*-------------------------------------------------------------------------
      APSD preference is only meaningful if service interval was set by app
    -------------------------------------------------------------------------*/
-   if(pCurrent_Tspec_Info->min_service_interval && pInput_Tspec_Info->min_service_interval)
+   if(pCurrent_Tspec_Info->min_service_interval &&
+      pInput_Tspec_Info->min_service_interval &&
+      (pCurrent_Tspec_Info->ts_info.direction !=
+      pInput_Tspec_Info->ts_info.direction))
    {
       TspecInfo.min_service_interval = VOS_MIN(
          pCurrent_Tspec_Info->min_service_interval,
@@ -5575,7 +5678,10 @@
    {
       TspecInfo.min_service_interval = pInput_Tspec_Info->min_service_interval;
    }
-   if(pCurrent_Tspec_Info->max_service_interval)
+   if(pCurrent_Tspec_Info->max_service_interval &&
+      pInput_Tspec_Info->max_service_interval &&
+      (pCurrent_Tspec_Info->ts_info.direction !=
+      pInput_Tspec_Info->ts_info.direction))
    {
       TspecInfo.max_service_interval = VOS_MIN(
          pCurrent_Tspec_Info->max_service_interval,
@@ -6687,6 +6793,9 @@
    sme_QosACInfo *pACInfo;
    sme_QosFlowInfoEntry *flow_info = NULL;
    sme_QosEdcaAcType ac;
+   eHalStatus lock_status = eHAL_STATUS_FAILURE;
+   sme_QosStatusType status;
+
    if(!pEntry)
    {
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, 
@@ -6701,18 +6810,24 @@
    ac = flow_info->ac_type;
    pSession = &sme_QosCb.sessionInfo[flow_info->sessionId];
    pACInfo = &pSession->ac_info[ac];
-   flow_info->QoSCallback(pMac, flow_info->HDDcontext, 
-                          &pACInfo->curr_QoSInfo[flow_info->tspec_mask - 1],
-                          SME_QOS_STATUS_RELEASE_QOS_LOST_IND,
-                          flow_info->QosFlowID);
-   pACInfo->num_flows[flow_info->tspec_mask - 1]--;
+   pACInfo->relTrig = SME_QOS_RELEASE_BY_AP;
+
+   lock_status = sme_AcquireGlobalLock( &pMac->sme );
+   if ( !HAL_STATUS_SUCCESS( lock_status ) )
+   {
+      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                "%s: %d: Unable to obtain lock",
+                __func__, __LINE__);
+      return SME_QOS_STATUS_RELEASE_FAILURE_RSP;
+   }
+   //Call the internal function for QoS release, adding a layer of abstraction
+   status = sme_QosInternalReleaseReq(pMac, flow_info->QosFlowID, VOS_FALSE);
+   sme_ReleaseGlobalLock( &pMac->sme );
    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH, 
-             "%s: %d: Deleting entry at %p with flowID %d",
+             "%s: %d: QoS Release return status on Flow %d is %d",
              __func__, __LINE__,
-             flow_info, flow_info->QosFlowID);
-   csrLLRemoveEntry(&sme_QosCb.flow_list, pEntry, VOS_TRUE );
-   // reclaim the memory
-   vos_mem_free(flow_info);
+             flow_info->QosFlowID, status);
+
    return eHAL_STATUS_SUCCESS;
 }
 /*--------------------------------------------------------------------------
@@ -7587,9 +7702,8 @@
       flow_info = GET_BASE_ADDR( pEntry, sme_QosFlowInfoEntry, link );
       pSession = &sme_QosCb.sessionInfo[flow_info->sessionId];
       //only notify the flows which already successfully setup UAPSD
-      if((flow_info->QoSInfo.max_service_interval ||
-          flow_info->QoSInfo.min_service_interval) &&
-         (SME_QOS_REASON_REQ_SUCCESS == flow_info->reason))
+      if( (flow_info->QoSInfo.ts_info.psb) &&
+         (SME_QOS_REASON_REQ_SUCCESS == flow_info->reason) )
       {
          flow_info->QoSCallback(pMac, flow_info->HDDcontext, 
                                 &pSession->ac_info[flow_info->ac_type].curr_QoSInfo[flow_info->tspec_mask - 1],
@@ -7924,8 +8038,7 @@
                         tspec1 = SME_QOS_TSPEC_MASK_BIT_1_2_SET & pACInfo->tspec_mask_status;
                      }
                      // Does TSPEC 1 really require UAPSD?
-                     fIsUapsdNeeded = (v_BOOL_t)(pACInfo->curr_QoSInfo[tspec1 - 1].max_service_interval || 
-                                                 pACInfo->curr_QoSInfo[tspec1 - 1].min_service_interval);
+                     fIsUapsdNeeded = (v_BOOL_t)(pACInfo->curr_QoSInfo[tspec1 - 1].ts_info.psb);
                      //double check whether we need to do anything
                      if( fIsUapsdNeeded )
                      {
@@ -7940,8 +8053,7 @@
                      if( tspec2 )
                      {
                         // Does TSPEC 2 really require UAPSD?
-                        fIsUapsdNeeded = (v_BOOL_t)(pACInfo->curr_QoSInfo[tspec2 - 1].max_service_interval || 
-                                                    pACInfo->curr_QoSInfo[tspec2 - 1].min_service_interval);
+                        fIsUapsdNeeded = (v_BOOL_t)(pACInfo->curr_QoSInfo[tspec2 - 1].ts_info.psb);
                         if( fIsUapsdNeeded )
                         {
                            //No need to inform HDD
@@ -7968,8 +8080,7 @@
                else
                {
                   //Since ACM bit is not set, there should be only one QoS information for both directions.
-                  fIsUapsdNeeded = (v_BOOL_t)(pACInfo->curr_QoSInfo[0].max_service_interval || 
-                                              pACInfo->curr_QoSInfo[0].min_service_interval);
+                  fIsUapsdNeeded = (v_BOOL_t)(pACInfo->curr_QoSInfo[0].ts_info.psb);
                   if(fIsUapsdNeeded)
                   {
                      // we need UAPSD on this AC (and we may not currently have it)
diff --git a/CORE/SME/src/btc/btcApi.c b/CORE/SME/src/btc/btcApi.c
index 805dbf3..fbdea58 100644
--- a/CORE/SME/src/btc/btcApi.c
+++ b/CORE/SME/src/btc/btcApi.c
@@ -71,6 +71,8 @@
 {
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
    VOS_STATUS vosStatus;
+   int i;
+
    /* Initialize BTC configuartion. */
    pMac->btc.btcConfig.btcExecutionMode = BTC_SMART_COEXISTENCE;
    pMac->btc.btcConfig.btcConsBtSlotsToBlockDuringDhcp = 0;
@@ -98,6 +100,22 @@
    pMac->btc.btcHBActive = VOS_TRUE;
    pMac->btc.btcScanCompromise = VOS_FALSE;
 
+   for (i = 0; i < MWS_COEX_MAX_VICTIM_TABLE; i++)
+   {
+      pMac->btc.btcConfig.mwsCoexVictimWANFreq[i] = 0;
+      pMac->btc.btcConfig.mwsCoexVictimWLANFreq[i] = 0;
+      pMac->btc.btcConfig.mwsCoexVictimConfig[i] = 0;
+      pMac->btc.btcConfig.mwsCoexVictimConfig2[i] = 0;
+   }
+
+   for (i = 0; i < MWS_COEX_MAX_CONFIG; i++)
+   {
+      pMac->btc.btcConfig.mwsCoexConfig[i] = 0;
+   }
+
+   pMac->btc.btcConfig.mwsCoexModemBackoff = 0;
+   pMac->btc.btcConfig.SARPowerBackoff = 0;
+
    vosStatus = vos_timer_init( &pMac->btc.restoreHBTimer,
                       VOS_TIMER_TYPE_SW,
                       btcRestoreHeartBeatMonitoringHandle,
@@ -1797,15 +1815,15 @@
            if( !fMoreSCO && !pMac->btc.fA2DPUp )
            {
                //All SCO is disconnected
-               pMac->btc.btcUapsdOk = VOS_TRUE;
                smsLog( pMac, LOGE, "BT event (DISCONNECTION) happens, UAPSD-allowed flag (%d) change to TRUE",
-                        pBtEvent->btEventType, pMac->btc.btcUapsdOk );
+                        pMac->btc.btcUapsdOk );
+               pMac->btc.btcUapsdOk = VOS_TRUE;
            }
        }
        break;
    case BT_EVENT_DEVICE_SWITCHED_OFF:
        smsLog( pMac, LOGE, "BT event (DEVICE_OFF) happens, UAPSD-allowed flag (%d) change to TRUE",
-                        pBtEvent->btEventType, pMac->btc.btcUapsdOk );
+                        pMac->btc.btcUapsdOk );
        //Clean up SCO
        for(i=0; i < BT_MAX_SCO_SUPPORT; i++)
        {
@@ -1978,6 +1996,38 @@
          smsLog(pMac, LOGW, "Coex indication in %s(), type - SIR_COEX_IND_TYPE_SCAN_NOT_COMPROMISED",
              __func__);
      }
+     else if (pSmeCoexInd->coexIndType == SIR_COEX_IND_TYPE_DISABLE_AGGREGATION_IN_2p4)
+     {
+         if (pMac->roam.configParam.disableAggWithBtc)
+         {
+             ccmCfgSetInt(pMac, WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC, 1,
+                             NULL, eANI_BOOLEAN_FALSE);
+             pMac->btc.btcBssfordisableaggr[0] = pSmeCoexInd->coexIndData[0] & 0xFF;
+             pMac->btc.btcBssfordisableaggr[1] = pSmeCoexInd->coexIndData[0] >> 8;
+             pMac->btc.btcBssfordisableaggr[2] = pSmeCoexInd->coexIndData[1] & 0xFF;
+             pMac->btc.btcBssfordisableaggr[3] = pSmeCoexInd->coexIndData[1]  >> 8;
+             pMac->btc.btcBssfordisableaggr[4] = pSmeCoexInd->coexIndData[2] & 0xFF;
+             pMac->btc.btcBssfordisableaggr[5] = pSmeCoexInd->coexIndData[2] >> 8;
+             smsLog(pMac, LOGW,
+             "Coex indication in %s(), \
+              type - SIR_COEX_IND_TYPE_DISABLE_AGGREGATION_IN_2p4 \
+              for BSSID %02x:%02x:%02x:%02x:%02x:%02x",__func__,
+              pMac->btc.btcBssfordisableaggr[0],pMac->btc.btcBssfordisableaggr[1],
+              pMac->btc.btcBssfordisableaggr[2],pMac->btc.btcBssfordisableaggr[3],
+              pMac->btc.btcBssfordisableaggr[4],pMac->btc.btcBssfordisableaggr[5]);
+         }
+     }
+     else if (pSmeCoexInd->coexIndType == SIR_COEX_IND_TYPE_ENABLE_AGGREGATION_IN_2p4)
+     {
+         if (pMac->roam.configParam.disableAggWithBtc)
+         {
+             ccmCfgSetInt(pMac, WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC, 0,
+                             NULL, eANI_BOOLEAN_FALSE);
+             smsLog(pMac, LOGW,
+             "Coex indication in %s(), type - SIR_COEX_IND_TYPE_ENABLE_AGGREGATION_IN_2p4",
+                 __func__);
+         }
+     }
      // unknown indication type
      else
      {
diff --git a/CORE/SME/src/ccm/ccmApi.c b/CORE/SME/src/ccm/ccmApi.c
index a6d33ee..a277255 100644
--- a/CORE/SME/src/ccm/ccmApi.c
+++ b/CORE/SME/src/ccm/ccmApi.c
@@ -76,7 +76,7 @@
     }
     else
     {
-        palCopyMemory(hHdd, (void *)pl, (void *)pBuf, length);
+        vos_mem_copy((void *)pl, (void *)pBuf, length);
         pl += (CFGOBJ_ALIGN(length) / CFGOBJ_ALIGNTO);
     }
     return pl ;
@@ -110,8 +110,8 @@
                                  CFGOBJ_LEN_SIZE +
                                  CFGOBJ_ALIGN(req->length)) ;
 
-    status = palAllocateMemory(hHdd, (void **)&msg, msgLen);
-    if (status == eHAL_STATUS_SUCCESS)
+    msg = vos_mem_malloc(msgLen);
+    if ( NULL != msg )
     {
         if( fRsp )
         {
@@ -134,7 +134,8 @@
     }
     else
     {
-        smsLog( pMac, LOGW, FL("palAllocateMemory(len=%d)"), msgLen );
+        smsLog( pMac, LOGW, FL("failed to allocate memory(len=%d)"), msgLen );
+        status = eHAL_STATUS_FAILURE;
     }
 
     return status ;
@@ -150,7 +151,8 @@
         alloc_len += length ;
     }
 
-    if (palAllocateMemory(hHdd, (void **)&req, alloc_len) != eHAL_STATUS_SUCCESS)
+    req = vos_mem_malloc(alloc_len);
+    if ( NULL == req )
     {
         return NULL ;
     }
@@ -162,7 +164,7 @@
 
 static void freeCfgReq(tHddHandle hHdd, tCfgReq *req)
 {
-    palFreeMemory(hHdd, (void*)req) ;
+    vos_mem_free(req);
 }
 
 static void add_req_tail(tCfgReq *req, struct ccmlink *q)
@@ -291,7 +293,7 @@
         }
         else
         {
-            palCopyMemory(hHdd, (void*)req->ccmPtr, (void*)ccmPtr, length); 
+            vos_mem_copy((void *)req->ccmPtr, (void *)ccmPtr, length);
         }
 
         palSpinLockTake(hHdd, pMac->ccm.lock);
@@ -399,7 +401,7 @@
     tHddHandle hHdd = halHandle2HddHandle(hHal);
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
-    (void)palZeroMemory(hHdd, &pMac->ccm, sizeof(tCcm)) ;
+    vos_mem_set(&pMac->ccm, sizeof(tCcm), 0);
     return palSpinLockAlloc(hHdd, &pMac->ccm.lock);
 }
 
@@ -667,8 +669,8 @@
 
     if (req && req->state == eCCM_REQ_DONE && (tANI_U32)req->length <= *pLength)
     {
-        *pLength = req->length ; 
-        palCopyMemory(hHdd, (void*)pBuf, (void*)req->ccmPtr, req->length); 
+        *pLength = req->length ;
+        vos_mem_copy((void *)pBuf, (void *)req->ccmPtr, req->length);
     }
     else
     {
@@ -737,11 +739,12 @@
     pMac->ccm.replay.callback    = callback ;
     pMac->ccm.replay.done        = NULL ;
 
-    status = palAllocateMemory(hHdd, (void **)&msg, msgLen) ;
-    if (status != eHAL_STATUS_SUCCESS)
+    msg = vos_mem_malloc(msgLen);
+    if ( NULL == msg )
     {
         pMac->ccm.replay.started = 0 ;
-        goto end ; 
+        status = eHAL_STATUS_FAILURE;
+        goto end;
     }
 
     msg->type   = pal_cpu_to_be16(WNI_CFG_SET_REQ);
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index 1ba97dc..8d8f9cb 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -24,7 +24,6 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
-
 /** ------------------------------------------------------------------------- * 
     ------------------------------------------------------------------------- *  
   
@@ -45,7 +44,7 @@
 
   when            who                 what, where, why
 ----------       ---                --------------------------------------------------------
-06/03/10     js                     Added support to hostapd driven
+06/03/10     js                     Added support to hostapd driven 
  *                                  deauth/disassoc/mic failure
 ===========================================================================*/
 #include "aniGlobal.h" //for tpAniSirGlobal
@@ -67,22 +66,21 @@
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 #include "csrNeighborRoam.h"
 #endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include "csrCcx.h"
-#endif /* FEATURE_WLAN_CCX */
+#endif /* FEATURE_WLAN_CCX && !FEATURE_WLAN_CCX_UPLOAD */
 #define CSR_NUM_IBSS_START_CHANNELS_50      4
 #define CSR_NUM_IBSS_START_CHANNELS_24      3
 #define CSR_DEF_IBSS_START_CHANNEL_50       36
 #define CSR_DEF_IBSS_START_CHANNEL_24       1
-#define CSR_IBSS_JOIN_TIMEOUT_PERIOD        ( 1 *  PAL_TIMER_TO_SEC_UNIT )  // 1 second
 #define CSR_WAIT_FOR_KEY_TIMEOUT_PERIOD         ( 5 * PAL_TIMER_TO_SEC_UNIT )  // 5 seconds, for WPA, WPA2, CCKM
 #define CSR_WAIT_FOR_WPS_KEY_TIMEOUT_PERIOD         ( 120 * PAL_TIMER_TO_SEC_UNIT )  // 120 seconds, for WPS
 /*---------------------------------------------------------------------------
-  OBIWAN recommends [8 10]% : pick 9%
+  OBIWAN recommends [8 10]% : pick 9% 
 ---------------------------------------------------------------------------*/
 #define CSR_VCC_UL_MAC_LOSS_THRESHOLD 9
 /*---------------------------------------------------------------------------
-  OBIWAN recommends -85dBm
+  OBIWAN recommends -85dBm 
 ---------------------------------------------------------------------------*/
 #define CSR_VCC_RSSI_THRESHOLD 80
 #define CSR_MIN_GLOBAL_STAT_QUERY_PERIOD   500 //ms
@@ -99,22 +97,16 @@
 #define RSSI_HACK_BMPS (-40)
 #define MAX_CB_VALUE_IN_INI (2)
 
-/*--------------------------------------------------------------------------
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+static tANI_BOOLEAN bRoamScanOffloadStarted = VOS_FALSE;
+#endif
+
+/*-------------------------------------------------------------------------- 
   Static Type declarations
   ------------------------------------------------------------------------*/
 static tCsrRoamSession csrRoamRoamSession[CSR_ROAM_SESSION_MAX];
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
-static const char KR_3[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
-                            36, 40, 44, 48, 52, 56, 60, 64, 100, 104,
-                            108, 112, 116, 120, 124, 149, 153, 157, 161};
-static const char KR_24[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
-                            36, 40, 44, 48, 52, 56, 60, 64, 100, 104,
-                            108, 112, 116, 120, 124, 149, 153, 157, 161};
-static const char KR_25[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
-                            36, 40, 44, 48, 149, 153, 157, 161};
-#endif
 
-/*--------------------------------------------------------------------------
+/*-------------------------------------------------------------------------- 
   Type declarations
   ------------------------------------------------------------------------*/
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
@@ -184,16 +176,16 @@
     return (n);
 }
 #endif //#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
-static const tANI_U8 csrStartIbssChannels50[ CSR_NUM_IBSS_START_CHANNELS_50 ] = { 36, 40,  44,  48};
+static const tANI_U8 csrStartIbssChannels50[ CSR_NUM_IBSS_START_CHANNELS_50 ] = { 36, 40,  44,  48}; 
 static const tANI_U8 csrStartIbssChannels24[ CSR_NUM_IBSS_START_CHANNELS_24 ] = { 1, 6, 11 };
 static void initConfigParam(tpAniSirGlobal pMac);
 static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pCommand,
                                        eCsrRoamCompleteResult Result, void *Context );
-static eHalStatus csrRoamStartIbss( tpAniSirGlobal pMac, tANI_U32 sessionId,
-                                    tCsrRoamProfile *pProfile,
+static eHalStatus csrRoamStartIbss( tpAniSirGlobal pMac, tANI_U32 sessionId, 
+                                    tCsrRoamProfile *pProfile, 
                                     tANI_BOOLEAN *pfSameIbss );
 static void csrRoamUpdateConnectedProfileFromNewBss( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirSmeNewBssInfo *pNewBss );
-static void csrRoamPrepareBssParams(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
+static void csrRoamPrepareBssParams(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, 
                                      tSirBssDescription *pBssDesc, tBssConfigParam *pBssConfig, tDot11fBeaconIEs *pIes);
 static ePhyChanBondState csrGetCBModeFromIes(tpAniSirGlobal pMac, tANI_U8 primaryChn, tDot11fBeaconIEs *pIes);
 eHalStatus csrInitGetChannels(tpAniSirGlobal pMac);
@@ -203,33 +195,29 @@
 void csrRoamMICErrorTimerHandler(void *pv);
 void csrRoamTKIPCounterMeasureTimerHandler(void *pv);
 tANI_BOOLEAN csrRoamIsSameProfileKeys(tpAniSirGlobal pMac, tCsrRoamConnectedProfile *pConnProfile, tCsrRoamProfile *pProfile2);
-
+ 
 static eHalStatus csrRoamStartRoamingTimer(tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U32 interval);
 static eHalStatus csrRoamStopRoamingTimer(tpAniSirGlobal pMac, tANI_U32 sessionId);
 static void csrRoamRoamingTimerHandler(void *pv);
-eHalStatus csrRoamStartIbssJoinTimer(tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U32 interval);
-eHalStatus csrRoamStopIbssJoinTimer(tpAniSirGlobal pMac, tANI_U32 sessionId);
-static void csrRoamIbssJoinTimerHandler(void *pv);
 eHalStatus csrRoamStartWaitForKeyTimer(tpAniSirGlobal pMac, tANI_U32 interval);
 eHalStatus csrRoamStopWaitForKeyTimer(tpAniSirGlobal pMac);
 static void csrRoamWaitForKeyTimeOutHandler(void *pv);
-
 static eHalStatus CsrInit11dInfo(tpAniSirGlobal pMac, tCsr11dinfo *ps11dinfo);
 static eHalStatus csrInitChannelPowerList( tpAniSirGlobal pMac, tCsr11dinfo *ps11dinfo);
 static eHalStatus csrRoamFreeConnectedInfo( tpAniSirGlobal pMac, tCsrRoamConnectedInfo *pConnectedInfo );
-eHalStatus csrSendMBSetContextReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId,
-           tSirMacAddr peerMacAddr, tANI_U8 numKeys, tAniEdType edType,
+eHalStatus csrSendMBSetContextReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, 
+           tSirMacAddr peerMacAddr, tANI_U8 numKeys, tAniEdType edType, 
            tANI_BOOLEAN fUnicast, tAniKeyDirection aniKeyDirection,
-           tANI_U8 keyId, tANI_U8 keyLength, tANI_U8 *pKey, tANI_U8 paeRole,
+           tANI_U8 keyId, tANI_U8 keyLength, tANI_U8 *pKey, tANI_U8 paeRole, 
            tANI_U8 *pKeyRsc );
-static eHalStatus csrRoamIssueReassociate( tpAniSirGlobal pMac, tANI_U32 sessionId,
-                                    tSirBssDescription *pSirBssDesc, tDot11fBeaconIEs *pIes,
+static eHalStatus csrRoamIssueReassociate( tpAniSirGlobal pMac, tANI_U32 sessionId, 
+                                    tSirBssDescription *pSirBssDesc, tDot11fBeaconIEs *pIes, 
                                     tCsrRoamProfile *pProfile );
 void csrRoamStatisticsTimerHandler(void *pv);
 void csrRoamStatsGlobalClassDTimerHandler(void *pv);
 static void csrRoamLinkUp(tpAniSirGlobal pMac, tCsrBssid bssid);
-VOS_STATUS csrRoamVccTriggerRssiIndCallback(tHalHandle hHal,
-                                            v_U8_t  rssiNotification,
+VOS_STATUS csrRoamVccTriggerRssiIndCallback(tHalHandle hHal, 
+                                            v_U8_t  rssiNotification, 
                                             void * context);
 static void csrRoamLinkDown(tpAniSirGlobal pMac, tANI_U32 sessionId);
 void csrRoamVccTrigger(tpAniSirGlobal pMac);
@@ -244,9 +232,9 @@
                                                      tDblLinkList *pStaList,
                                                      tCsrStatsClientReqInfo *pStaEntry);
 void csrRoamStatsClientTimerHandler(void *pv);
-tCsrPeStatsReqInfo *  csrRoamCheckPeStatsReqList(tpAniSirGlobal pMac, tANI_U32  statsMask,
+tCsrPeStatsReqInfo *  csrRoamCheckPeStatsReqList(tpAniSirGlobal pMac, tANI_U32  statsMask, 
                                                  tANI_U32 periodicity, tANI_BOOLEAN *pFound, tANI_U8 staId);
-void csrRoamReportStatistics(tpAniSirGlobal pMac, tANI_U32 statsMask,
+void csrRoamReportStatistics(tpAniSirGlobal pMac, tANI_U32 statsMask, 
                              tCsrStatsCallback callback, tANI_U8 staId, void *pContext);
 void csrRoamSaveStatsFromTl(tpAniSirGlobal pMac, WLANTL_TRANSFER_STA_TYPE *pTlStats);
 void csrRoamTlStatsTimerHandler(void *pv);
@@ -258,7 +246,7 @@
 static tANI_U32 csrFindIbssSession( tpAniSirGlobal pMac );
 static eHalStatus csrRoamStartWds( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, tSirBssDescription *pBssDesc );
 static void csrInitSession( tpAniSirGlobal pMac, tANI_U32 sessionId );
-static eHalStatus csrRoamIssueSetKeyCommand( tpAniSirGlobal pMac, tANI_U32 sessionId,
+static eHalStatus csrRoamIssueSetKeyCommand( tpAniSirGlobal pMac, tANI_U32 sessionId, 
                                              tCsrRoamSetKey *pSetKey, tANI_U32 roamId );
 //static eHalStatus csrRoamProcessStopBss( tpAniSirGlobal pMac, tSmeCmd *pCommand );
 static eHalStatus csrRoamGetQosInfoFromBss(tpAniSirGlobal pMac, tSirBssDescription *pBssDesc);
@@ -297,7 +285,7 @@
     VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
     v_REGDOMAIN_t regId;
     tANI_U32 i;
-
+    
     do
     {
         /* Initialize CSR Roam Globals */
@@ -320,9 +308,9 @@
         vosStatus = vos_nv_readDefaultCountryTable( &nvTables );
         if ( VOS_IS_STATUS_SUCCESS(vosStatus) )
         {
-            palCopyMemory( pMac->hHdd, pMac->scan.countryCodeDefault,
-                    nvTables.defaultCountryTable.countryCode, WNI_CFG_COUNTRY_CODE_LEN );
-            status = eHAL_STATUS_SUCCESS;
+           vos_mem_copy(pMac->scan.countryCodeDefault, nvTables.defaultCountryTable.countryCode,
+                        WNI_CFG_COUNTRY_CODE_LEN);
+           status = eHAL_STATUS_SUCCESS;
         }
         else
         {
@@ -334,15 +322,25 @@
             //status = eHAL_STATUS_SUCCESS;
         }
         smsLog( pMac, LOG1, FL(" country Code from nvRam %.2s"), pMac->scan.countryCodeDefault );
-        csrGetRegulatoryDomainForCountry(pMac, pMac->scan.countryCodeDefault, &regId);
-        WDA_SetRegDomain(pMac, regId);
+
+        if (!('0' == pMac->scan.countryCodeDefault[0] &&
+            '0' == pMac->scan.countryCodeDefault[1]))
+        {
+            csrGetRegulatoryDomainForCountry(pMac, pMac->scan.countryCodeDefault,
+                                             &regId, COUNTRY_NV);
+        }
+        else
+        {
+            regId = REGDOMAIN_WORLD;
+        }
+        WDA_SetRegDomain(pMac, regId, eSIR_TRUE);
         pMac->scan.domainIdDefault = regId;
         pMac->scan.domainIdCurrent = pMac->scan.domainIdDefault;
-        status = palCopyMemory(pMac->hHdd, pMac->scan.countryCodeCurrent,
-                         pMac->scan.countryCodeDefault, WNI_CFG_COUNTRY_CODE_LEN);
+        vos_mem_copy(pMac->scan.countryCodeCurrent, pMac->scan.countryCodeDefault,
+                     WNI_CFG_COUNTRY_CODE_LEN);
         status = csrInitGetChannels( pMac );
     }while(0);
-
+    
     return (status);
 }
 
@@ -353,11 +351,9 @@
     v_REGDOMAIN_t reg_id;
 
     if (vos_nv_readDefaultCountryTable(&nv_tbl) == VOS_STATUS_SUCCESS) {
-       status = palCopyMemory(mac->hHdd, mac->scan.countryCodeDefault,
-                              nv_tbl.defaultCountryTable.countryCode,
-                              WNI_CFG_COUNTRY_CODE_LEN);
-       if (status != eHAL_STATUS_SUCCESS)
-          return status;
+       vos_mem_copy(mac->scan.countryCodeDefault,
+                    nv_tbl.defaultCountryTable.countryCode,
+                    WNI_CFG_COUNTRY_CODE_LEN);
     } else {
        smsLog(mac, LOGE, FL("fail to get NV_FIELD_IMAGE"));
        /* hardcoded for now */
@@ -369,19 +365,17 @@
            mac->scan.countryCodeDefault);
     status = csrGetRegulatoryDomainForCountry(mac,
                                               mac->scan.countryCodeDefault,
-                                              &reg_id);
+                                              &reg_id, COUNTRY_IE);
     if (status != eHAL_STATUS_SUCCESS)
        return status;
 
-    if (vos_nv_setRegDomain(mac, reg_id) != VOS_STATUS_SUCCESS)
+    if (vos_nv_setRegDomain(mac, reg_id, FALSE) != VOS_STATUS_SUCCESS)
        return eHAL_STATUS_FAILURE;
     mac->scan.domainIdDefault = reg_id;
     mac->scan.domainIdCurrent = mac->scan.domainIdDefault;
-    status = palCopyMemory(mac->hHdd, mac->scan.countryCodeCurrent,
-                           mac->scan.countryCodeDefault,
-                           WNI_CFG_COUNTRY_CODE_LEN);
-    if (status != eHAL_STATUS_SUCCESS)
-       return status;
+    vos_mem_copy(mac->scan.countryCodeCurrent,
+                 mac->scan.countryCodeDefault,
+                 WNI_CFG_COUNTRY_CODE_LEN);
 
     status = csrInitGetChannels(mac);
     return status;
@@ -399,7 +393,7 @@
        return eHAL_STATUS_FAILURE;
     }
     smsLog( pMac, LOGW, FL(" country Code %.2s"), apCntryCode );
-    /* To get correct Regulatory domain from NV table
+    /* To get correct Regulatory domain from NV table 
      * 2 character Country code should be used
      * 3rd charater is optional for indoor/outdoor setting */
     cntryCodeLength = WNI_CFG_COUNTRY_CODE_LEN;
@@ -412,13 +406,14 @@
        return eHAL_STATUS_FAILURE;
     }
 */
-    status = csrGetRegulatoryDomainForCountry(pMac, apCntryCode, &regId);
+    status = csrGetRegulatoryDomainForCountry(pMac, apCntryCode, &regId,
+                                              COUNTRY_USER);
     if (status != eHAL_STATUS_SUCCESS)
     {
         smsLog( pMac, LOGE, FL("  fail to get regId for country Code %.2s"), apCntryCode );
         return status;
     }
-    status = WDA_SetRegDomain(hHal, regId);
+    status = WDA_SetRegDomain(hHal, regId, eSIR_TRUE);
     if (status != eHAL_STATUS_SUCCESS)
     {
         smsLog( pMac, LOGE, FL("  fail to get regId for country Code %.2s"), apCntryCode );
@@ -427,23 +422,18 @@
     pMac->scan.domainIdDefault = regId;
     pMac->scan.domainIdCurrent = pMac->scan.domainIdDefault;
     /* Clear CC field */
-    palFillMemory( pMac->hHdd,
-                   pMac->scan.countryCodeDefault,
-                   WNI_CFG_COUNTRY_CODE_LEN,
-                   0 );
+    vos_mem_set(pMac->scan.countryCodeDefault, WNI_CFG_COUNTRY_CODE_LEN, 0);
+
     /* Copy 2 or 3 bytes country code */
-    palCopyMemory( pMac->hHdd, pMac->scan.countryCodeDefault,
-                apCntryCode, cntryCodeLength );
+    vos_mem_copy(pMac->scan.countryCodeDefault, apCntryCode, cntryCodeLength);
+
     /* If 2 bytes country code, 3rd byte must be filled with space */
     if((WNI_CFG_COUNTRY_CODE_LEN - 1) == cntryCodeLength)
     {
-       palFillMemory( pMac->hHdd,
-                      pMac->scan.countryCodeDefault + 2,
-                      1,
-                      0x20 );
+        vos_mem_set(pMac->scan.countryCodeDefault + 2, 1, 0x20);
     }
-    status = palCopyMemory(pMac->hHdd, pMac->scan.countryCodeCurrent,
-                               pMac->scan.countryCodeDefault, WNI_CFG_COUNTRY_CODE_LEN);
+    vos_mem_copy(pMac->scan.countryCodeCurrent, pMac->scan.countryCodeDefault,
+                 WNI_CFG_COUNTRY_CODE_LEN);
     status = csrInitGetChannels( pMac );
     return status;
 }
@@ -452,8 +442,8 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     tANI_U8   index = 0;
-    palCopyMemory( pMac->hHdd, pParam->Csr11dinfo.countryCode,
-                   pMac->scan.countryCodeCurrent, WNI_CFG_COUNTRY_CODE_LEN );
+    vos_mem_copy(pParam->Csr11dinfo.countryCode, pMac->scan.countryCodeCurrent,
+                 WNI_CFG_COUNTRY_CODE_LEN);
     for ( index = 0; index < pMac->scan.base20MHzChannels.numChannels ; index++)
     {
         pParam->Csr11dinfo.Channels.channelList[index] = pMac->scan.base20MHzChannels.channelList[ index ];
@@ -462,14 +452,13 @@
         pParam->Csr11dinfo.ChnPower[index].maxtxPower = pMac->scan.defaultPowerTable[index].pwr;
     }
     pParam->Csr11dinfo.Channels.numChannels = pMac->scan.base20MHzChannels.numChannels;
-
+    
     return status;
 }
 eHalStatus csrClose(tpAniSirGlobal pMac)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
 
-    csrStop(pMac);
     csrRoamClose(pMac);
     csrScanClose(pMac);
     csrLLClose(&pMac->roam.statsClientReqList);
@@ -478,7 +467,7 @@
     /* DeInit Globals */
     csrRoamDeInitGlobals(pMac);
     return (status);
-}
+} 
 
 eHalStatus csrUpdateChannelList(tCsrScanStruct *pScan)
 {
@@ -528,7 +517,7 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tANI_U32 i;
-
+ 
     do
     {
        //save the global vos context
@@ -569,7 +558,7 @@
         pMac->roam.tlStatsReqInfo.timerRunning = FALSE;
         //init the link quality indication also
         pMac->roam.vccLinkQuality = eCSR_ROAM_LINK_QUAL_MIN_IND;
-        if(!HAL_STATUS_SUCCESS(status))
+        if(!HAL_STATUS_SUCCESS(status)) 
         {
            smsLog(pMac, LOGW, " csrStart: Couldn't Init HO control blk ");
            break;
@@ -589,7 +578,7 @@
     return (status);
 }
 
-eHalStatus csrStop(tpAniSirGlobal pMac)
+eHalStatus csrStop(tpAniSirGlobal pMac, tHalStopType stopType)
 {
     tANI_U32 sessionId;
     tANI_U32 i;
@@ -602,7 +591,7 @@
     pMac->scan.fCancelIdleScan = eANI_BOOLEAN_FALSE;
     pMac->scan.fRestartIdleScan = eANI_BOOLEAN_FALSE;
     csrLLPurge( &pMac->roam.roamCmdPendingList, eANI_BOOLEAN_TRUE );
-
+    
 #if   defined WLAN_FEATURE_NEIGHBOR_ROAMING
     csrNeighborRoamClose(pMac);
 #endif
@@ -628,10 +617,22 @@
 
     for( i = 0; i < CSR_ROAM_SESSION_MAX; i++ )
     {
-       csrRoamStateChange( pMac, eCSR_ROAMING_STATE_STOP ,i );
+       csrRoamStateChange( pMac, eCSR_ROAMING_STATE_STOP, i );
        pMac->roam.curSubState[i] = eCSR_ROAM_SUBSTATE_NONE;
     }
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    /* When HAL resets all the context information
+     * in HAL is lost, so we might need to send the
+     * scan offload request again when it comes
+     * out of reset for scan offload to be functional
+     */
+    if (HAL_STOP_TYPE_SYS_RESET == stopType)
+    {
+       bRoamScanOffloadStarted = VOS_FALSE;
+    }
+#endif
+
     return (eHAL_STATUS_SUCCESS);
 }
 
@@ -644,8 +645,8 @@
     csrInitBGScanChannelList(pMac);
     /* HDD issues the init scan */
     csrScanStartResultAgingTimer(pMac);
-    /* If the gScanAgingTime is set to '0' then scan results aging timeout
-         based  on timer feature is not enabled*/
+    /* If the gScanAgingTime is set to '0' then scan results aging timeout 
+         based  on timer feature is not enabled*/  
     if(0 != pMac->scan.scanResultCfgAgingTime )
     {
        csrScanStartResultCfgAgingTimer(pMac);
@@ -672,7 +673,7 @@
     ccmCfgSetInt(pMac, WNI_CFG_FRAGMENTATION_THRESHOLD, csrGetFragThresh(pMac), NULL, eANI_BOOLEAN_FALSE);
     ccmCfgSetInt(pMac, WNI_CFG_RTS_THRESHOLD, csrGetRTSThresh(pMac), NULL, eANI_BOOLEAN_FALSE);
     ccmCfgSetInt(pMac, WNI_CFG_11D_ENABLED,
-                        ((pMac->roam.configParam.Is11hSupportEnabled) ? pMac->roam.configParam.Is11dSupportEnabled : pMac->roam.configParam.Is11dSupportEnabled),
+                        ((pMac->roam.configParam.Is11hSupportEnabled) ? pMac->roam.configParam.Is11dSupportEnabled : pMac->roam.configParam.Is11dSupportEnabled), 
                         NULL, eANI_BOOLEAN_FALSE);
     ccmCfgSetInt(pMac, WNI_CFG_11H_ENABLED, pMac->roam.configParam.Is11hSupportEnabled, NULL, eANI_BOOLEAN_FALSE);
     /* For now we will just use the 5GHz CB mode ini parameter to decide whether CB supported or not in Probes when there is no session
@@ -680,10 +681,10 @@
      */
     ccmCfgSetInt(pMac, WNI_CFG_CHANNEL_BONDING_MODE, !!(pMac->roam.configParam.channelBondingMode5GHz), NULL, eANI_BOOLEAN_FALSE);
     ccmCfgSetInt(pMac, WNI_CFG_HEART_BEAT_THRESHOLD, pMac->roam.configParam.HeartbeatThresh24, NULL, eANI_BOOLEAN_FALSE);
-
+    
     //Update the operating mode to configured value during initialization,
     //So that client can advertise full capabilities in Probe request frame.
-    csrSetDefaultDot11Mode( pMac );
+    csrSetDefaultDot11Mode( pMac );    
 }
 
 eHalStatus csrRoamOpen(tpAniSirGlobal pMac)
@@ -701,15 +702,17 @@
         }
         pMac->roam.WaitForKeyTimerInfo.pMac = pMac;
         pMac->roam.WaitForKeyTimerInfo.sessionId = CSR_SESSION_ID_INVALID;
-        status = palTimerAlloc(pMac->hHdd, &pMac->roam.hTimerWaitForKey, csrRoamWaitForKeyTimeOutHandler,
+        status = vos_timer_init(&pMac->roam.hTimerWaitForKey, VOS_TIMER_TYPE_SW,
+                                csrRoamWaitForKeyTimeOutHandler,
                                 &pMac->roam.WaitForKeyTimerInfo);
-      if(!HAL_STATUS_SUCCESS(status))
+      if (!HAL_STATUS_SUCCESS(status))
       {
         smsLog(pMac, LOGE, FL("cannot allocate memory for WaitForKey time out timer"));
         break;
       }
-      status = palTimerAlloc(pMac->hHdd, &pMac->roam.tlStatsReqInfo.hTlStatsTimer, csrRoamTlStatsTimerHandler, pMac);
-      if(!HAL_STATUS_SUCCESS(status))
+      status = vos_timer_init(&pMac->roam.tlStatsReqInfo.hTlStatsTimer,
+                              VOS_TIMER_TYPE_SW, csrRoamTlStatsTimerHandler, pMac);
+      if (!HAL_STATUS_SUCCESS(status))
       {
          smsLog(pMac, LOGE, FL("cannot allocate memory for summary Statistics timer"));
          return eHAL_STATUS_FAILURE;
@@ -725,10 +728,10 @@
     {
         csrRoamCloseSession(pMac, sessionId, TRUE, NULL, NULL);
     }
-    palTimerStop(pMac->hHdd, pMac->roam.hTimerWaitForKey);
-    palTimerFree(pMac->hHdd, pMac->roam.hTimerWaitForKey);
-    palTimerStop(pMac->hHdd, pMac->roam.tlStatsReqInfo.hTlStatsTimer);
-    palTimerFree(pMac->hHdd, pMac->roam.tlStatsReqInfo.hTlStatsTimer);
+    vos_timer_stop(&pMac->roam.hTimerWaitForKey);
+    vos_timer_destroy(&pMac->roam.hTimerWaitForKey);
+    vos_timer_stop(&pMac->roam.tlStatsReqInfo.hTlStatsTimer);
+    vos_timer_destroy(&pMac->roam.tlStatsReqInfo.hTlStatsTimer);
     return (eHAL_STATUS_SUCCESS);
 }
 
@@ -751,7 +754,7 @@
     {
         status = eHAL_STATUS_SUCCESS;
         *pState = pMac->roam.roamSession[sessionId].connectState;
-    }
+    }    
     return (status);
 }
 
@@ -766,7 +769,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     if(pProfile)
     {
         if(pSession->pConnectBssDesc)
@@ -776,10 +779,12 @@
                 size = pSession->pConnectBssDesc->length + sizeof(pSession->pConnectBssDesc->length);
                 if(size)
                 {
-                    status = palAllocateMemory(pMac->hHdd, (void **)&pProfile->pBssDesc, size);
-                    if(HAL_STATUS_SUCCESS(status))
+                    pProfile->pBssDesc = vos_mem_malloc(size);
+                    if ( NULL != pProfile->pBssDesc )
                     {
-                        palCopyMemory(pMac->hHdd, pProfile->pBssDesc, pSession->pConnectBssDesc, size);
+                        vos_mem_copy(pProfile->pBssDesc,
+                                     pSession->pConnectBssDesc, size);
+                        status = eHAL_STATUS_SUCCESS;
                     }
                     else
                         break;
@@ -794,8 +799,10 @@
                 pProfile->BSSType = pSession->connectedProfile.BSSType;
                 pProfile->operationChannel = pSession->connectedProfile.operationChannel;
                 pProfile->CBMode = pSession->connectedProfile.CBMode;
-                palCopyMemory(pMac->hHdd, &pProfile->bssid, &pSession->connectedProfile.bssid, sizeof(tCsrBssid));
-                palCopyMemory(pMac->hHdd, &pProfile->SSID, &pSession->connectedProfile.SSID, sizeof(tSirMacSSid));
+                vos_mem_copy(&pProfile->bssid, &pSession->connectedProfile.bssid,
+                             sizeof(tCsrBssid));
+                vos_mem_copy(&pProfile->SSID, &pSession->connectedProfile.SSID,
+                             sizeof(tSirMacSSid));
 #ifdef WLAN_FEATURE_VOWIFI_11R
                 if (pSession->connectedProfile.MDID.mdiePresent)
                 {
@@ -812,18 +819,19 @@
                 pProfile->isCCXAssoc = pSession->connectedProfile.isCCXAssoc;
                 if (csrIsAuthTypeCCX(pSession->connectedProfile.AuthType))
                 {
-                    palCopyMemory( pMac->hHdd, pProfile->ccxCckmInfo.krk,
-                        pSession->connectedProfile.ccxCckmInfo.krk, CSR_KRK_KEY_LEN );
+                    vos_mem_copy (pProfile->ccxCckmInfo.krk,
+                                  pSession->connectedProfile.ccxCckmInfo.krk,
+                                  CSR_KRK_KEY_LEN);
                     pProfile->ccxCckmInfo.reassoc_req_num=
                         pSession->connectedProfile.ccxCckmInfo.reassoc_req_num;
-                    pProfile->ccxCckmInfo.krk_plumbed =
+                    pProfile->ccxCckmInfo.krk_plumbed = 
                         pSession->connectedProfile.ccxCckmInfo.krk_plumbed;
                 }
 #endif
             }while(0);
         }
     }
-
+    
     return (status);
 }
 
@@ -845,16 +853,17 @@
 eHalStatus csrRoamFreeConnectProfile(tpAniSirGlobal pMac, tCsrRoamConnectedProfile *pProfile)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
+    
+    if (pProfile->pBssDesc)
+    {
+        vos_mem_free(pProfile->pBssDesc);
+    }
+    if (pProfile->pAddIEAssoc)
+    {
+        vos_mem_free(pProfile->pAddIEAssoc);
+    }
+    vos_mem_set(pProfile, sizeof(tCsrRoamConnectedProfile), 0);
 
-    if(pProfile->pBssDesc)
-    {
-        palFreeMemory(pMac->hHdd, pProfile->pBssDesc);
-    }
-    if(pProfile->pAddIEAssoc)
-    {
-        palFreeMemory(pMac->hHdd, pProfile->pAddIEAssoc);
-    }
-    palZeroMemory(pMac->hHdd, pProfile, sizeof(tCsrRoamConnectedProfile));
     pProfile->AuthType = eCSR_AUTH_TYPE_UNKNOWN;
     return (status);
 }
@@ -864,7 +873,7 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     if( pConnectedInfo->pbFrames )
     {
-        palFreeMemory( pMac->hHdd, pConnectedInfo->pbFrames );
+        vos_mem_free(pConnectedInfo->pbFrames);
         pConnectedInfo->pbFrames = NULL;
     }
     pConnectedInfo->nBeaconLength = 0;
@@ -873,22 +882,22 @@
     pConnectedInfo->staId = 0;
 #ifdef WLAN_FEATURE_VOWIFI_11R
     pConnectedInfo->nRICRspLength = 0;
-#endif
+#endif    
 #ifdef FEATURE_WLAN_CCX
     pConnectedInfo->nTspecIeLength = 0;
-#endif
+#endif    
     return ( status );
 }
 
-
-
-
+    
+                
+                
 void csrReleaseCommandPreauth(tpAniSirGlobal pMac, tSmeCmd *pCommand)
 {
     csrReinitPreauthCmd(pMac, pCommand);
     csrReleaseCommand( pMac, pCommand );
 }
-
+                
 void csrReleaseCommandRoam(tpAniSirGlobal pMac, tSmeCmd *pCommand)
 {
     csrReinitRoamCmd(pMac, pCommand);
@@ -909,12 +918,12 @@
 
 void csrReinitSetKeyCmd(tpAniSirGlobal pMac, tSmeCmd *pCommand)
 {
-    palZeroMemory(pMac->hHdd, &pCommand->u.setKeyCmd, sizeof(tSetKeyCmd));
+    vos_mem_set(&pCommand->u.setKeyCmd, sizeof(tSetKeyCmd), 0);
 }
 
 void csrReinitRemoveKeyCmd(tpAniSirGlobal pMac, tSmeCmd *pCommand)
 {
-    palZeroMemory(pMac->hHdd, &pCommand->u.removeKeyCmd, sizeof(tRemoveKeyCmd));
+    vos_mem_set(&pCommand->u.removeKeyCmd, sizeof(tRemoveKeyCmd), 0);
 }
 
 void csrReleaseCommandSetKey(tpAniSirGlobal pMac, tSmeCmd *pCommand)
@@ -936,8 +945,9 @@
         {
         case eSmeCommandScan:
             // We need to inform the requester before dropping the scan command
-            smsLog( pMac, LOGW, "%s: Drop scan reason %d callback 0x%X",
-                __func__, pCommand->u.scanCmd.reason, (unsigned int)pCommand->u.scanCmd.callback);
+            smsLog( pMac, LOGW, "%s: Drop scan reason %d callback %p",
+                    __func__, pCommand->u.scanCmd.reason,
+                    pCommand->u.scanCmd.callback);
             if (NULL != pCommand->u.scanCmd.callback)
             {
                 smsLog( pMac, LOGW, "%s callback scan requester", __func__);
@@ -983,16 +993,16 @@
 eCsrRoamState csrRoamStateChange( tpAniSirGlobal pMac, eCsrRoamState NewRoamState, tANI_U8 sessionId)
 {
     eCsrRoamState PreviousState;
-
+          
     smsLog( pMac, LOG1, "CSR RoamState[%hu]: [ %d <== %d ]", sessionId,
             NewRoamState, pMac->roam.curState[sessionId]);
 
     PreviousState = pMac->roam.curState[sessionId];
-
-    if ( NewRoamState != pMac->roam.curState[sessionId] )
+    
+    if ( NewRoamState != pMac->roam.curState[sessionId] ) 
     {
         // Whenever we transition OUT of the Roaming state, clear the Roaming substate...
-        if ( CSR_IS_ROAM_JOINING(pMac, sessionId) )
+        if ( CSR_IS_ROAM_JOINING(pMac, sessionId) ) 
         {
             csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_NONE, sessionId );
         }
@@ -1002,7 +1012,7 @@
     return( PreviousState );
 }
 
-void csrAssignRssiForCategory(tpAniSirGlobal pMac, tANI_U8 catOffset)
+void csrAssignRssiForCategory(tpAniSirGlobal pMac, tANI_S8 bestApRssi, tANI_U8 catOffset)
 {
     int i;
     if(catOffset)
@@ -1010,7 +1020,7 @@
         pMac->roam.configParam.bCatRssiOffset = catOffset;
         for(i = 0; i < CSR_NUM_RSSI_CAT; i++)
         {
-            pMac->roam.configParam.RSSICat[CSR_NUM_RSSI_CAT - i - 1] = (int)CSR_BEST_RSSI_VALUE - (int)(i * catOffset);
+            pMac->roam.configParam.RSSICat[CSR_NUM_RSSI_CAT - i - 1] = (int)bestApRssi - pMac->roam.configParam.nSelect5GHzMargin - (int)(i * catOffset);
         }
     }
 }
@@ -1038,15 +1048,15 @@
     pMac->roam.configParam.ProprietaryRatesEnabled = eANI_BOOLEAN_TRUE;
     pMac->roam.configParam.TxRate = eCSR_TX_RATE_AUTO;
     pMac->roam.configParam.impsSleepTime = CSR_IDLE_SCAN_NO_PS_INTERVAL;
-    pMac->roam.configParam.scanAgeTimeNCNPS = CSR_SCAN_AGING_TIME_NOT_CONNECT_NO_PS;
-    pMac->roam.configParam.scanAgeTimeNCPS = CSR_SCAN_AGING_TIME_NOT_CONNECT_W_PS;
-    pMac->roam.configParam.scanAgeTimeCNPS = CSR_SCAN_AGING_TIME_CONNECT_NO_PS;
-    pMac->roam.configParam.scanAgeTimeCPS = CSR_SCAN_AGING_TIME_CONNECT_W_PS;
+    pMac->roam.configParam.scanAgeTimeNCNPS = CSR_SCAN_AGING_TIME_NOT_CONNECT_NO_PS;  
+    pMac->roam.configParam.scanAgeTimeNCPS = CSR_SCAN_AGING_TIME_NOT_CONNECT_W_PS;   
+    pMac->roam.configParam.scanAgeTimeCNPS = CSR_SCAN_AGING_TIME_CONNECT_NO_PS;   
+    pMac->roam.configParam.scanAgeTimeCPS = CSR_SCAN_AGING_TIME_CONNECT_W_PS;   
     for(i = 0; i < CSR_NUM_RSSI_CAT; i++)
     {
         pMac->roam.configParam.BssPreferValue[i] = i;
     }
-    csrAssignRssiForCategory(pMac, CSR_DEFAULT_RSSI_DB_GAP);
+    csrAssignRssiForCategory(pMac, CSR_BEST_RSSI_VALUE, CSR_DEFAULT_RSSI_DB_GAP);
     pMac->roam.configParam.nRoamingTime = CSR_DEFAULT_ROAMING_TIME;
     pMac->roam.configParam.fEnforce11dChannels = eANI_BOOLEAN_FALSE;
     pMac->roam.configParam.fSupplicantCountryCodeHasPriority = eANI_BOOLEAN_FALSE;
@@ -1058,13 +1068,15 @@
     pMac->roam.configParam.nPassiveMinChnTime = CSR_PASSIVE_MIN_CHANNEL_TIME;
     pMac->roam.configParam.nActiveMaxChnTimeBtc = CSR_ACTIVE_MAX_CHANNEL_TIME_BTC;
     pMac->roam.configParam.nActiveMinChnTimeBtc = CSR_ACTIVE_MIN_CHANNEL_TIME_BTC;
+    pMac->roam.configParam.disableAggWithBtc = eANI_BOOLEAN_TRUE;
 #ifdef WLAN_AP_STA_CONCURRENCY
     pMac->roam.configParam.nActiveMaxChnTimeConc = CSR_ACTIVE_MAX_CHANNEL_TIME_CONC;
     pMac->roam.configParam.nActiveMinChnTimeConc = CSR_ACTIVE_MIN_CHANNEL_TIME_CONC;
     pMac->roam.configParam.nPassiveMaxChnTimeConc = CSR_PASSIVE_MAX_CHANNEL_TIME_CONC;
     pMac->roam.configParam.nPassiveMinChnTimeConc = CSR_PASSIVE_MIN_CHANNEL_TIME_CONC;
     pMac->roam.configParam.nRestTimeConc = CSR_REST_TIME_CONC;
-    pMac->roam.configParam.nNumChanCombinedConc = CSR_NUM_CHAN_COMBINED_CONC;
+    pMac->roam.configParam.nNumStaChanCombinedConc = CSR_NUM_STA_CHAN_COMBINED_CONC;
+    pMac->roam.configParam.nNumP2PChanCombinedConc = CSR_NUM_P2P_CHAN_COMBINED_CONC;
 #endif
     pMac->roam.configParam.IsIdleScanEnabled = TRUE; //enable the idle scan by default
     pMac->roam.configParam.nTxPowerCap = CSR_MAX_TX_POWER;
@@ -1094,7 +1106,7 @@
     pMac->roam.configParam.addTSWhenACMIsOff = 0;
     pMac->roam.configParam.fScanTwice = eANI_BOOLEAN_FALSE;
 
-    //Remove this code once SLM_Sessionization is supported
+    //Remove this code once SLM_Sessionization is supported 
     //BMPS_WORKAROUND_NOT_NEEDED
     pMac->roam.configParam.doBMPSWorkaround = 0;
 
@@ -1105,47 +1117,36 @@
     return pMac->roam.configParam.bandCapability;
 }
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
-tANI_BOOLEAN csrIsChannelInCountryValidList(tpAniSirGlobal pMac, tANI_U8 channel)
-{
-    /* Get country code from CFG */
-    tANI_U8 *pCountryCode = pMac->scan.countryCodeCurrent;
-    tANI_U8 i = 0;
-    v_BOOL_t retVal = FALSE;
-    tANI_U8 *pCountryValidChannelList = pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.ChannelList;
-    tANI_U8 *pNumChannels = &pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.numOfChannels;
-
-    /* Compare against KR valid list */
-    if ((0 == strncmp(pCountryCode, "KR", 2)) &&
-        (NULL != pCountryValidChannelList))
-    {
-        for (i = 0; i <(*pNumChannels); i++)
-        {
-            if (channel == pCountryValidChannelList[i])
-            {
-                retVal = TRUE;
-                break;
-            }
-        }
-    }
-    else
-    {
-        retVal = csrRoamIsChannelValid(pMac, channel);
-    }
-
-    return retVal;
-}
-
-void csr_SetRevision(tpAniSirGlobal pMac, tANI_U8 revision)
-{
-    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
-    pNeighborRoamInfo->cfgParams.countryChannelInfo.revision = revision;
-}
-
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
 /*
  This function flushes the roam scan cache
 */
-eHalStatus csrFlushBgScanRoamChannelList(tpAniSirGlobal pMac)
+eHalStatus csrFlushRoamScanRoamChannelList(tpAniSirGlobal pMac)
+{
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo
+      = &pMac->roam.neighborRoamInfo;
+    /* Free up the memory first (if required) */
+    if (NULL !=
+      pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList)
+    {
+        vos_mem_free(
+          pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList
+          );
+        pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList
+          = NULL;
+        pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.numOfChannels
+          = 0;
+    }
+    return status;
+}
+#endif  /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
+
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+/*
+ This function flushes the roam scan cache
+*/
+eHalStatus csrFlushCfgBgScanRoamChannelList(tpAniSirGlobal pMac)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
@@ -1186,9 +1187,9 @@
     }
 
     /* Update the roam global structure */
-    palCopyMemory(pMac->hHdd, pNeighborRoamInfo->cfgParams.channelInfo.ChannelList,
-                        pChannelList,
-                        pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels);
+    vos_mem_copy(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList,
+                 pChannelList,
+                 pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels);
     return status;
 }
 
@@ -1225,12 +1226,12 @@
     {
         for (i = 0; i < inNumChannels; i++)
         {
-            if (CSR_IS_CHANNEL_24GHZ(inPtr[i]) && csrIsChannelInCountryValidList(pMac, inPtr[i]))
+            if (CSR_IS_CHANNEL_24GHZ(inPtr[i]) && csrRoamIsChannelValid(pMac, inPtr[i]))
             {
                 ChannelList[outNumChannels++] = inPtr[i];
             }
         }
-        csrFlushBgScanRoamChannelList(pMac);
+        csrFlushCfgBgScanRoamChannelList(pMac);
         csrCreateBgScanRoamChannelList(pMac, ChannelList, outNumChannels);
     }
     else if (eCSR_BAND_5G == eBand)
@@ -1239,26 +1240,26 @@
         {
             /* Add 5G Non-DFS channel */
             if (CSR_IS_CHANNEL_5GHZ(inPtr[i]) &&
-               csrIsChannelInCountryValidList(pMac, inPtr[i]) &&
+               csrRoamIsChannelValid(pMac, inPtr[i]) &&
                !CSR_IS_CHANNEL_DFS(inPtr[i]))
             {
                ChannelList[outNumChannels++] = inPtr[i];
             }
         }
-        csrFlushBgScanRoamChannelList(pMac);
+        csrFlushCfgBgScanRoamChannelList(pMac);
         csrCreateBgScanRoamChannelList(pMac, ChannelList, outNumChannels);
     }
     else if (eCSR_BAND_ALL == eBand)
     {
         for (i = 0; i < inNumChannels; i++)
         {
-            if (csrIsChannelInCountryValidList(pMac, inPtr[i]) &&
+            if (csrRoamIsChannelValid(pMac, inPtr[i]) &&
                !CSR_IS_CHANNEL_DFS(inPtr[i]))
             {
                ChannelList[outNumChannels++] = inPtr[i];
             }
         }
-        csrFlushBgScanRoamChannelList(pMac);
+        csrFlushCfgBgScanRoamChannelList(pMac);
         csrCreateBgScanRoamChannelList(pMac, ChannelList, outNumChannels);
     }
     else
@@ -1270,54 +1271,135 @@
 
     return status;
 }
+#endif
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
 /*
- This function initializes the valid channel list based on country code
-*/
-eHalStatus csrInitCountryValidChannelList(tpAniSirGlobal pMac,
-                                        tANI_U8 Revision)
+ * This function modifies the roam scan channel list as per AP neighbor
+ * report; AP neighbor report may be empty or may include only other AP
+ * channels; in any case, we merge the channel list with the learned occupied
+ * channels list.
+ * if the band is 2.4G, then make sure channel list contains only 2.4G
+ * valid channels if the band is 5G, then make sure channel list contains
+ * only 5G valid channels
+ */
+eHalStatus csrCreateRoamScanChannelList(tpAniSirGlobal pMac,
+                                        tANI_U8 *pChannelList,
+                                        tANI_U8 numChannels,
+                                        const eCsrBand eBand)
 {
-    eHalStatus status = eHAL_STATUS_SUCCESS;
-    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
-    tANI_U8 **pOutChannelList = &pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.ChannelList;
-    tANI_U8 *pNumChannels = &pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.numOfChannels;
-    const tANI_U8 *pChannelList = NULL;
-
-    if (SME_KR_3 == Revision)
+    eHalStatus   status = eHAL_STATUS_SUCCESS;
+    tpCsrNeighborRoamControlInfo pNeighborRoamInfo
+         = &pMac->roam.neighborRoamInfo;
+    tANI_U8      outNumChannels = 0;
+    tANI_U8      inNumChannels = numChannels;
+    tANI_U8      *inPtr = pChannelList;
+    tANI_U8      i = 0;
+    tANI_U8      ChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+    tANI_U8      tmpChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+    tANI_U8      mergedOutputNumOfChannels = 0;
+    tpCsrChannelInfo  currChannelListInfo
+         = &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo;
+    /*
+     * Create a Union of occupied channel list learnt by the DUT along
+     * with the Neighbor report Channels. This increases the chances of
+     * the DUT to get a candidate AP while roaming even if the Neighbor
+     * Report is not able to provide sufficient information.
+     */
+    if (pMac->scan.occupiedChannels.numChannels)
     {
-        pChannelList = KR_3;
-        *pNumChannels = sizeof(KR_3)/sizeof(KR_3[0]);
+       csrNeighborRoamMergeChannelLists(pMac,
+                  &pMac->scan.occupiedChannels.channelList[0],
+                  pMac->scan.occupiedChannels.numChannels,
+                  inPtr,
+                  inNumChannels,
+                  &mergedOutputNumOfChannels);
+       inNumChannels =  mergedOutputNumOfChannels;
     }
-    else if (SME_KR_24 == Revision)
+    if (eCSR_BAND_24 == eBand)
     {
-        pChannelList = KR_24;
-        *pNumChannels = sizeof(KR_24)/sizeof(KR_24[0]);
+        for (i = 0; i < inNumChannels; i++)
+        {
+            if (CSR_IS_CHANNEL_24GHZ(inPtr[i])
+                && csrRoamIsChannelValid(pMac, inPtr[i]))
+            {
+                ChannelList[outNumChannels++] = inPtr[i];
+            }
+        }
     }
-    else if (SME_KR_25 == Revision)
+    else if (eCSR_BAND_5G == eBand)
     {
-        pChannelList = KR_25;
-        *pNumChannels = sizeof(KR_25)/sizeof(KR_25[0]);
+        for (i = 0; i < inNumChannels; i++)
+        {
+            /* Add 5G Non-DFS channel */
+            if (CSR_IS_CHANNEL_5GHZ(inPtr[i]) &&
+               csrRoamIsChannelValid(pMac, inPtr[i]) &&
+               !CSR_IS_CHANNEL_DFS(inPtr[i]))
+            {
+               ChannelList[outNumChannels++] = inPtr[i];
+            }
+        }
+    }
+    else if (eCSR_BAND_ALL == eBand)
+    {
+        for (i = 0; i < inNumChannels; i++)
+        {
+            if (csrRoamIsChannelValid(pMac, inPtr[i]) &&
+               !CSR_IS_CHANNEL_DFS(inPtr[i]))
+            {
+               ChannelList[outNumChannels++] = inPtr[i];
+            }
+        }
     }
     else
-        return eHAL_STATUS_INVALID_PARAMETER;
-
-    /* Free any existing channel list */
-    vos_mem_free(*pOutChannelList);
-
-    *pOutChannelList = vos_mem_malloc(*pNumChannels);
-
-    if (NULL == *pOutChannelList)
     {
-        smsLog(pMac, LOGE, FL("Memory Allocation for CFG Channel List failed"));
-        *pNumChannels = 0;
-        return eHAL_STATUS_RESOURCES;
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_WARN,
+            "Invalid band, No operation carried out (Band %d)", eBand);
+        return eHAL_STATUS_INVALID_PARAMETER;
     }
-    /* Update the roam global structure */
-    palCopyMemory(pMac->hHdd, *pOutChannelList, pChannelList, *pNumChannels);
+    /*
+     * if roaming within band is enabled, then select only the
+     * in band channels .
+     * This is required only if the band capability is set to ALL,
+     * E.g., if band capability is only 2.4G then all the channels in the
+     * list are already filtered for 2.4G channels, hence ignore this check
+     */
+    if ((eCSR_BAND_ALL == eBand) && CSR_IS_ROAM_INTRA_BAND_ENABLED(pMac))
+    {
+        csrNeighborRoamChannelsFilterByCurrentBand(
+                             pMac,
+                             ChannelList,
+                             outNumChannels,
+                             tmpChannelList,
+                             &outNumChannels);
+        vos_mem_copy(ChannelList,
+                     tmpChannelList, outNumChannels);
+    }
+    /* Prepare final roam scan channel list */
+    if(outNumChannels)
+    {
+        /* Clear the channel list first */
+        if (NULL != currChannelListInfo->ChannelList)
+        {
+            vos_mem_free(currChannelListInfo->ChannelList);
+            currChannelListInfo->ChannelList = NULL;
+            currChannelListInfo->numOfChannels = 0;
+        }
+        currChannelListInfo->ChannelList
+          = vos_mem_malloc(outNumChannels * sizeof(tANI_U8));
+        if (NULL == currChannelListInfo->ChannelList)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL,
+                "Failed to allocate memory for roam scan channel list");
+            currChannelListInfo->numOfChannels = 0;
+            return VOS_STATUS_E_RESOURCES;
+        }
+        vos_mem_copy(currChannelListInfo->ChannelList,
+                     ChannelList, outNumChannels);
+    }
     return status;
 }
-
-#endif
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
 
 eHalStatus csrSetBand(tHalHandle hHal, eCsrBand eBand)
 {
@@ -1362,10 +1444,10 @@
 /* The funcns csrConvertCBIniValueToPhyCBState and csrConvertPhyCBStateToIniValue have been
  * introduced to convert the ini value to the ENUM used in csr and MAC for CB state
  * Ideally we should have kept the ini value and enum value same and representing the same
- * cb values as in 11n standard i.e.
- * Set to 1 (SCA) if the secondary channel is above the primary channel
- * Set to 3 (SCB) if the secondary channel is below the primary channel
- * Set to 0 (SCN) if no secondary channel is present
+ * cb values as in 11n standard i.e. 
+ * Set to 1 (SCA) if the secondary channel is above the primary channel 
+ * Set to 3 (SCB) if the secondary channel is below the primary channel 
+ * Set to 0 (SCN) if no secondary channel is present 
  * However, since our driver is already distributed we will keep the ini definition as it is which is:
  * 0 - secondary none
  * 1 - secondary LOW
@@ -1395,27 +1477,27 @@
         break;
 #ifdef WLAN_FEATURE_11AC
       case 3:
-        phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED;
+        phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED; 
         break;
       case 4:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED;
         break;
       case 5:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED;
-        break;
+        break; 
       case 6:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW;
         break;
       case 7:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW;
-        break;
+        break; 
       case 8:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH;
         break;
       case 9:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH;
-        break;
-#endif
+        break; 
+#endif 
       default:
         // If an invalid value is passed, disable CHANNEL BONDING
         phyCbState = PHY_SINGLE_CHANNEL_CENTERED;
@@ -1487,7 +1569,7 @@
 
         pMac->roam.configParam.fenableMCCMode = pParam->fEnableMCCMode;
         pMac->roam.configParam.fAllowMCCGODiffBI = pParam->fAllowMCCGODiffBI;
-
+        
         /* channelBondingMode5GHz plays a dual role right now
          * INFRA STA will use this non zero value as CB enabled and SOFTAP will use this non-zero value to determine the secondary channel offset
          * This is how channelBondingMode5GHz works now and this is kept intact to avoid any cfg.ini change
@@ -1514,6 +1596,7 @@
         pMac->roam.configParam.bandCapability = pParam->bandCapability;
         pMac->roam.configParam.cbChoice = pParam->cbChoice;
         pMac->roam.configParam.bgScanInterval = pParam->bgScanInterval;
+        pMac->roam.configParam.disableAggWithBtc = pParam->disableAggWithBtc;
         //if HDD passed down non zero values then only update,
         //otherwise keep using the defaults
         if (pParam->nActiveMaxChnTime)
@@ -1561,9 +1644,13 @@
         {
             pMac->roam.configParam.nRestTimeConc = pParam->nRestTimeConc;
         }
-        if (pParam->nNumChanCombinedConc)
+        if (pParam->nNumStaChanCombinedConc)
         {
-            pMac->roam.configParam.nNumChanCombinedConc = pParam->nNumChanCombinedConc;
+            pMac->roam.configParam.nNumStaChanCombinedConc = pParam->nNumStaChanCombinedConc;
+        }
+        if (pParam->nNumP2PChanCombinedConc)
+        {
+            pMac->roam.configParam.nNumP2PChanCombinedConc = pParam->nNumP2PChanCombinedConc;
         }
 #endif
         //if upper layer wants to disable idle scan altogether set it to 0
@@ -1585,7 +1672,7 @@
             pMac->roam.configParam.impsSleepTime = 0;
         }
         pMac->roam.configParam.eBand = pParam->eBand;
-        pMac->roam.configParam.uCfgDot11Mode = csrGetCfgDot11ModeFromCsrPhyMode(NULL, pMac->roam.configParam.phyMode,
+        pMac->roam.configParam.uCfgDot11Mode = csrGetCfgDot11ModeFromCsrPhyMode(NULL, pMac->roam.configParam.phyMode, 
                                                     pMac->roam.configParam.ProprietaryRatesEnabled);
         //if HDD passed down non zero values for age params, then only update,
         //otherwise keep using the defaults
@@ -1595,22 +1682,22 @@
         }
         if(pParam->scanAgeTimeNCNPS)
         {
-            pMac->roam.configParam.scanAgeTimeNCNPS = pParam->scanAgeTimeNCNPS;
+            pMac->roam.configParam.scanAgeTimeNCNPS = pParam->scanAgeTimeNCNPS;  
         }
         if(pParam->scanAgeTimeNCPS)
         {
-            pMac->roam.configParam.scanAgeTimeNCPS = pParam->scanAgeTimeNCPS;
+            pMac->roam.configParam.scanAgeTimeNCPS = pParam->scanAgeTimeNCPS;   
         }
         if(pParam->scanAgeTimeCNPS)
         {
-            pMac->roam.configParam.scanAgeTimeCNPS = pParam->scanAgeTimeCNPS;
+            pMac->roam.configParam.scanAgeTimeCNPS = pParam->scanAgeTimeCNPS;   
         }
         if(pParam->scanAgeTimeCPS)
         {
-            pMac->roam.configParam.scanAgeTimeCPS = pParam->scanAgeTimeCPS;
+            pMac->roam.configParam.scanAgeTimeCPS = pParam->scanAgeTimeCPS;   
         }
-
-        csrAssignRssiForCategory(pMac, pParam->bCatRssiOffset);
+        
+        csrAssignRssiForCategory(pMac, CSR_BEST_RSSI_VALUE, pParam->bCatRssiOffset);
         pMac->roam.configParam.nRoamingTime = pParam->nRoamingTime;
         pMac->roam.configParam.fEnforce11dChannels = pParam->fEnforce11dChannels;
         pMac->roam.configParam.fSupplicantCountryCodeHasPriority = pParam->fSupplicantCountryCodeHasPriority;
@@ -1641,7 +1728,8 @@
 
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
-        palCopyMemory( pMac->hHdd, &pMac->roam.configParam.csr11rConfig, &pParam->csr11rConfig, sizeof(tCsr11rConfigParams) );
+        vos_mem_copy(&pMac->roam.configParam.csr11rConfig,
+                     &pParam->csr11rConfig, sizeof(tCsr11rConfigParams));
         smsLog( pMac, LOG1, "IsFTResourceReqSupp = %d", pMac->roam.configParam.csr11rConfig.IsFTResourceReqSupported);
 #endif
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
@@ -1653,19 +1741,24 @@
         pMac->roam.configParam.nRoamPrefer5GHz = pParam->nRoamPrefer5GHz;
         pMac->roam.configParam.nRoamIntraBand = pParam->nRoamIntraBand;
         pMac->roam.configParam.isWESModeEnabled = pParam->isWESModeEnabled;
+        pMac->roam.configParam.nProbes = pParam->nProbes;
+        pMac->roam.configParam.nRoamScanHomeAwayTime = pParam->nRoamScanHomeAwayTime;
 #endif
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
         pMac->roam.configParam.isRoamOffloadScanEnabled = pParam->isRoamOffloadScanEnabled;
+        pMac->roam.configParam.bFastRoamInConIniFeatureEnabled = pParam->bFastRoamInConIniFeatureEnabled;
 #endif
 #ifdef FEATURE_WLAN_LFR
         pMac->roam.configParam.isFastRoamIniFeatureEnabled = pParam->isFastRoamIniFeatureEnabled;
+        pMac->roam.configParam.MAWCEnabled = pParam->MAWCEnabled;
 #endif
 
 #ifdef FEATURE_WLAN_CCX
         pMac->roam.configParam.isCcxIniFeatureEnabled = pParam->isCcxIniFeatureEnabled;
 #endif
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
-        palCopyMemory( pMac->hHdd, &pMac->roam.configParam.neighborRoamConfig, &pParam->neighborRoamConfig, sizeof(tCsrNeighborRoamConfigParams) );
+        vos_mem_copy(&pMac->roam.configParam.neighborRoamConfig,
+                     &pParam->neighborRoamConfig, sizeof(tCsrNeighborRoamConfigParams));
         smsLog( pMac, LOG1, "nNeighborScanTimerPerioid = %d", pMac->roam.configParam.neighborRoamConfig.nNeighborScanTimerPeriod);
         smsLog( pMac, LOG1, "nNeighborReassocRssiThreshold = %d", pMac->roam.configParam.neighborRoamConfig.nNeighborReassocRssiThreshold);
         smsLog( pMac, LOG1, "nNeighborLookupRssiThreshold = %d", pMac->roam.configParam.neighborRoamConfig.nNeighborLookupRssiThreshold);
@@ -1681,7 +1774,6 @@
            {
               smsLog( pMac, LOG1, "%d ", pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.channelList[i] );
            }
-           smsLog( pMac, LOG1, "");
         }
 #endif
         pMac->roam.configParam.addTSWhenACMIsOff = pParam->addTSWhenACMIsOff;
@@ -1697,7 +1789,7 @@
          * will automatically connect back and resume BMPS since resume BMPS is not working when moving from concurrent to
          * single session
          */
-        //Remove this code once SLM_Sessionization is supported
+        //Remove this code once SLM_Sessionization is supported 
         //BMPS_WORKAROUND_NOT_NEEDED
         pMac->roam.configParam.doBMPSWorkaround = 0;
 
@@ -1716,11 +1808,12 @@
         pMac->roam.configParam.htSmps= pParam->htSmps;
         pMac->roam.configParam.txLdpcEnable = pParam->enableTxLdpc;
 
+        pMac->roam.configParam.isAmsduSupportInAMPDU = pParam->isAmsduSupportInAMPDU;
+        pMac->roam.configParam.nSelect5GHzMargin = pParam->nSelect5GHzMargin;
         pMac->roam.configParam.isCoalesingInIBSSAllowed =
                                pParam->isCoalesingInIBSSAllowed;
-
     }
-
+    
     return status;
 }
 
@@ -1753,28 +1846,32 @@
         pParam->nActiveMinChnTime = pMac->roam.configParam.nActiveMinChnTime;
         pParam->nPassiveMaxChnTime = pMac->roam.configParam.nPassiveMaxChnTime;
         pParam->nPassiveMinChnTime = pMac->roam.configParam.nPassiveMinChnTime;
+        pParam->nActiveMaxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
+        pParam->nActiveMinChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
+        pParam->disableAggWithBtc = pMac->roam.configParam.disableAggWithBtc;
 #ifdef WLAN_AP_STA_CONCURRENCY
         pParam->nActiveMaxChnTimeConc = pMac->roam.configParam.nActiveMaxChnTimeConc;
         pParam->nActiveMinChnTimeConc = pMac->roam.configParam.nActiveMinChnTimeConc;
         pParam->nPassiveMaxChnTimeConc = pMac->roam.configParam.nPassiveMaxChnTimeConc;
         pParam->nPassiveMinChnTimeConc = pMac->roam.configParam.nPassiveMinChnTimeConc;
         pParam->nRestTimeConc = pMac->roam.configParam.nRestTimeConc;
-        pParam->nNumChanCombinedConc = pMac->roam.configParam.nNumChanCombinedConc;
+        pParam->nNumStaChanCombinedConc = pMac->roam.configParam.nNumStaChanCombinedConc;
+        pParam->nNumP2PChanCombinedConc = pMac->roam.configParam.nNumP2PChanCombinedConc;
 #endif
         //Change the unit from microsecond to second
         pParam->impsSleepTime = pMac->roam.configParam.impsSleepTime / PAL_TIMER_TO_SEC_UNIT;
         pParam->eBand = pMac->roam.configParam.eBand;
         pParam->nScanResultAgeCount = pMac->roam.configParam.agingCount;
-        pParam->scanAgeTimeNCNPS = pMac->roam.configParam.scanAgeTimeNCNPS;
-        pParam->scanAgeTimeNCPS = pMac->roam.configParam.scanAgeTimeNCPS;
-        pParam->scanAgeTimeCNPS = pMac->roam.configParam.scanAgeTimeCNPS;
-        pParam->scanAgeTimeCPS = pMac->roam.configParam.scanAgeTimeCPS;
+        pParam->scanAgeTimeNCNPS = pMac->roam.configParam.scanAgeTimeNCNPS;  
+        pParam->scanAgeTimeNCPS = pMac->roam.configParam.scanAgeTimeNCPS;   
+        pParam->scanAgeTimeCNPS = pMac->roam.configParam.scanAgeTimeCNPS;   
+        pParam->scanAgeTimeCPS = pMac->roam.configParam.scanAgeTimeCPS;   
         pParam->bCatRssiOffset = pMac->roam.configParam.bCatRssiOffset;
         pParam->nRoamingTime = pMac->roam.configParam.nRoamingTime;
         pParam->fEnforce11dChannels = pMac->roam.configParam.fEnforce11dChannels;
         pParam->fSupplicantCountryCodeHasPriority = pMac->roam.configParam.fSupplicantCountryCodeHasPriority;
         pParam->fEnforceCountryCodeMatch = pMac->roam.configParam.fEnforceCountryCodeMatch;
-        pParam->fEnforceDefaultDomain = pMac->roam.configParam.fEnforceDefaultDomain;
+        pParam->fEnforceDefaultDomain = pMac->roam.configParam.fEnforceDefaultDomain;        
         pParam->vccRssiThreshold = pMac->roam.configParam.vccRssiThreshold;
         pParam->vccUlMacLossThreshold = pMac->roam.configParam.vccUlMacLossThreshold;
         pParam->IsIdleScanEnabled = pMac->roam.configParam.IsIdleScanEnabled;
@@ -1792,16 +1889,61 @@
         pParam->scanCfgAgingTime = pMac->scan.scanResultCfgAgingTime;
 
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
-        palCopyMemory( pMac->hHdd, &pParam->neighborRoamConfig, &pMac->roam.configParam.neighborRoamConfig, sizeof(tCsrNeighborRoamConfigParams) );
+        vos_mem_copy(&pParam->neighborRoamConfig,
+                     &pMac->roam.configParam.neighborRoamConfig,
+                     sizeof(tCsrNeighborRoamConfigParams));
 #endif
 #ifdef WLAN_FEATURE_11AC
         pParam->nVhtChannelWidth = pMac->roam.configParam.nVhtChannelWidth;
         pParam->enableTxBF = pMac->roam.configParam.txBFEnable;
         pParam->txBFCsnValue = pMac->roam.configParam.txBFCsnValue;
         pParam->enableMuBformee = pMac->roam.configParam.txMuBformee;
+        pParam->enableVhtFor24GHz = pMac->roam.configParam.enableVhtFor24GHz;
 #endif
+#ifdef WLAN_FEATURE_VOWIFI_11R
+        vos_mem_copy(&pMac->roam.configParam.csr11rConfig,
+                     &pParam->csr11rConfig, sizeof(tCsr11rConfigParams));
+#endif
+#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
+        pParam->isFastTransitionEnabled = pMac->roam.configParam.isFastTransitionEnabled;
+        pParam->RoamRssiDiff = pMac->roam.configParam.RoamRssiDiff;
+        pParam->nImmediateRoamRssiDiff = pMac->roam.configParam.nImmediateRoamRssiDiff;
+        pParam->nRoamPrefer5GHz = pMac->roam.configParam.nRoamPrefer5GHz;
+        pParam->nRoamIntraBand = pMac->roam.configParam.nRoamIntraBand;
+        pParam->isWESModeEnabled = pMac->roam.configParam.isWESModeEnabled;
+        pParam->nProbes = pMac->roam.configParam.nProbes;
+        pParam->nRoamScanHomeAwayTime = pMac->roam.configParam.nRoamScanHomeAwayTime;
+#endif
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+        pParam->isRoamOffloadScanEnabled = pMac->roam.configParam.isRoamOffloadScanEnabled;
+        pParam->bFastRoamInConIniFeatureEnabled = pMac->roam.configParam.bFastRoamInConIniFeatureEnabled;
+#endif
+#ifdef FEATURE_WLAN_LFR
+        pParam->isFastRoamIniFeatureEnabled = pMac->roam.configParam.isFastRoamIniFeatureEnabled;
+#endif
+
+#ifdef FEATURE_WLAN_CCX
+        pParam->isCcxIniFeatureEnabled = pMac->roam.configParam.isCcxIniFeatureEnabled;
+#endif
+#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
+        vos_mem_copy(&pParam->neighborRoamConfig,
+                     &pMac->roam.configParam.neighborRoamConfig,
+                     sizeof(tCsrNeighborRoamConfigParams));
+        {
+           int i;
+           smsLog( pMac, LOG1, FL("Num of Channels in CFG Channel List: %d"), pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.numChannels);
+           for( i=0; i< pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.numChannels; i++)
+           {
+              smsLog( pMac, LOG1, "%d ", pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.channelList[i] );
+           }
+        }
+#endif
+
         pParam->enableTxLdpc = pMac->roam.configParam.txLdpcEnable;
 
+        pParam->isAmsduSupportInAMPDU = pMac->roam.configParam.isAmsduSupportInAMPDU;
+        pParam->nSelect5GHzMargin = pMac->roam.configParam.nSelect5GHzMargin;
+
         pParam->isCoalesingInIBSSAllowed =
                                 pMac->roam.configParam.isCoalesingInIBSSAllowed;
 
@@ -1829,8 +1971,8 @@
         {
             if(CSR_IS_RADIO_BG_ONLY(pMac)) break;
             if((eCSR_DOT11_MODE_11b & phyMode) || (eCSR_DOT11_MODE_11b_ONLY & phyMode) ||
-                (eCSR_DOT11_MODE_11g & phyMode) || (eCSR_DOT11_MODE_11g_ONLY & phyMode)
-                )
+                (eCSR_DOT11_MODE_11g & phyMode) || (eCSR_DOT11_MODE_11g_ONLY & phyMode) 
+                ) 
             {
                 break;
             }
@@ -1942,7 +2084,7 @@
     }
     return (status);
 }
-
+    
 void csrPruneChannelListForMode( tpAniSirGlobal pMac, tCsrChannel *pChannelList )
 {
     tANI_U8 Index;
@@ -1964,20 +2106,20 @@
                 }
             }
             // Cleanup the rest of channels.   Note we only need to clean up the channels if we had
-            // to trim the list.  Calling palZeroMemory() with a 0 size is going to throw asserts on
+            // to trim the list.  Calling palZeroMemory() with a 0 size is going to throw asserts on 
             // the debug builds so let's be a bit smarter about that.  Zero out the reset of the channels
             // only if we need to.
             //
-            // The amount of memory to clear is the number of channesl that we trimmed
+            // The amount of memory to clear is the number of channesl that we trimmed 
             // (pChannelList->numChannels - cChannels) times the size of a channel in the structure.
-
+           
             if ( pChannelList->numChannels > cChannels )
             {
-                palZeroMemory( pMac->hHdd, &pChannelList->channelList[ cChannels ],
-                               sizeof( pChannelList->channelList[ 0 ] ) * ( pChannelList->numChannels - cChannels ) );
-
+                vos_mem_set(&pChannelList->channelList[ cChannels ],
+                             sizeof( pChannelList->channelList[ 0 ] ) *
+                                 ( pChannelList->numChannels - cChannels ), 0);
             }
-
+            
             pChannelList->numChannels = cChannels;
         }
         else if ( CSR_IS_5G_BAND_ONLY( pMac ) )
@@ -1991,18 +2133,19 @@
                 }
             }
             // Cleanup the rest of channels.   Note we only need to clean up the channels if we had
-            // to trim the list.  Calling palZeroMemory() with a 0 size is going to throw asserts on
+            // to trim the list.  Calling palZeroMemory() with a 0 size is going to throw asserts on 
             // the debug builds so let's be a bit smarter about that.  Zero out the reset of the channels
             // only if we need to.
             //
-            // The amount of memory to clear is the number of channesl that we trimmed
+            // The amount of memory to clear is the number of channesl that we trimmed 
             // (pChannelList->numChannels - cChannels) times the size of a channel in the structure.
             if ( pChannelList->numChannels > cChannels )
             {
-                palZeroMemory( pMac->hHdd, &pChannelList->channelList[ cChannels ],
-                               sizeof( pChannelList->channelList[ 0 ] ) * ( pChannelList->numChannels - cChannels ) );
-            }
-
+                vos_mem_set(&pChannelList->channelList[ cChannels ],
+                            sizeof( pChannelList->channelList[ 0 ] ) *
+                            ( pChannelList->numChannels - cChannels ), 0);
+            }            
+                               
             pChannelList->numChannels = cChannels;
         }
     }
@@ -2022,125 +2165,6 @@
     return status;
 }
 
-eHalStatus csrGet5GChannels(tpAniSirGlobal pMac)
-{
-    eHalStatus status = eHAL_STATUS_SUCCESS;
-    tANI_U8 num20MHzChannelsFound = 0;
-    VOS_STATUS vosStatus;
-    tANI_U8 num40MHzChannelsFound = 0;
-    tANI_U8 Index = 0;
-    tANI_U8 channelList = 0;
-
-    // Updating the defaultpower Table for changed Domain Id
-    vosStatus = vos_nv_getChannelListWithPower( pMac->scan.defaultPowerTable, &num20MHzChannelsFound,
-                                                pMac->scan.defaultPowerTable40MHz, &num40MHzChannelsFound);
-
-    if ( (VOS_STATUS_SUCCESS != vosStatus) || (num20MHzChannelsFound == 0) )
-    {
-        smsLog( pMac, LOGE, FL("failed to get channels"));
-        status = eHAL_STATUS_FAILURE;
-    }
-    else
-    {
-        if ( num20MHzChannelsFound > WNI_CFG_VALID_CHANNEL_LIST_LEN )
-        {
-            num20MHzChannelsFound = WNI_CFG_VALID_CHANNEL_LIST_LEN;
-        }
-
-        // Move the only 5GHZ channel list to the global data,
-        // As 2.4GHZ list coming from the AP for the changed domain
-        // structure -- this will be used as the scan list
-        for(channelList = 0; channelList < WNI_CFG_VALID_CHANNEL_LIST_LEN; channelList++)
-        {
-            // If Channel is 5GHz just break the for loop
-            if(!(pMac->scan.base20MHzChannels.channelList[ channelList ] > 0 && pMac->scan.base20MHzChannels.channelList[ channelList ] <= 14))
-                break;
-        }
-        // Update the 5G channels from nv.bin
-        for ( Index = 0; Index < num20MHzChannelsFound; Index++)
-        {
-            if(pMac->scan.defaultPowerTable[Index].chanId >= 36 && pMac->scan.defaultPowerTable[Index].chanId <= 165)
-            {
-                if (channelList < WNI_CFG_VALID_CHANNEL_LIST_LEN)
-                {
-                    pMac->scan.base20MHzChannels.channelList[ channelList ] = pMac->scan.defaultPowerTable[Index].chanId;
-                    channelList++;
-                }
-            }
-        }
-
-        pMac->scan.numChannelsDefault = (num20MHzChannelsFound > channelList) ? num20MHzChannelsFound : channelList;
-        pMac->scan.base20MHzChannels.numChannels = (num20MHzChannelsFound > channelList) ? num20MHzChannelsFound : channelList;
-        // Filling the remaining index as Zero Just for causion
-        for(Index = pMac->scan.base20MHzChannels.numChannels; Index < WNI_CFG_VALID_CHANNEL_LIST_LEN; Index++)
-            pMac->scan.base20MHzChannels.channelList[ Index ] = 0;
-    }
-    return status;
-}
-
-eHalStatus csrGet24GChannels(tpAniSirGlobal pMac)
-{
-    eHalStatus status = eHAL_STATUS_SUCCESS;
-    tANI_U8 num20MHzChannelsFound = 0;
-    VOS_STATUS vosStatus;
-    tANI_U8 Index = 0;
-    tANI_U8 numChan = 0;
-    tANI_U8 num40MHzChannelsFound = 0;
-    tANI_U8 channelList5GBackup[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0}, nuum5GchannelListBackup;
-    tANI_U8 channelList = 0;
-
-    // Read the scan channel list (including the power limit) from EEPROM
-    vosStatus = vos_nv_getChannelListWithPower( pMac->scan.defaultPowerTable, &num20MHzChannelsFound,
-                                                pMac->scan.defaultPowerTable40MHz, &num40MHzChannelsFound);
-
-    if ( (VOS_STATUS_SUCCESS != vosStatus) || (num20MHzChannelsFound == 0) )
-    {
-        smsLog( pMac, LOGE, FL("failed to get channels \n"));
-        status = eHAL_STATUS_FAILURE;
-    }
-    else
-    {
-        if ( num20MHzChannelsFound > WNI_CFG_VALID_CHANNEL_LIST_LEN )
-        {
-            num20MHzChannelsFound = WNI_CFG_VALID_CHANNEL_LIST_LEN;
-        }
-
-        // Move the 2.4GHZ channel list only to the global data,
-        // As 5GHz list been provided by AP as part of 11d IE
-        // structure -- this will be used as the scan list
-        for(channelList = 0, nuum5GchannelListBackup = 0; channelList < WNI_CFG_VALID_CHANNEL_LIST_LEN; channelList++)
-        {
-            if(pMac->scan.base20MHzChannels.channelList[ channelList ] >= 36 && pMac->scan.base20MHzChannels.channelList[ channelList ] <= 165)
-            {
-                // First taking the 5GHz channel list backup
-                channelList5GBackup[nuum5GchannelListBackup] = pMac->scan.base20MHzChannels.channelList[ channelList ];
-                nuum5GchannelListBackup++;
-            }
-        }
-        // Updating the 2.4GHz list
-        for ( Index = 0, numChan = 0; Index < num20MHzChannelsFound; Index++)
-        {
-            if(pMac->scan.defaultPowerTable[Index].chanId > 0 && pMac->scan.defaultPowerTable[Index].chanId <= 14)
-            {
-                pMac->scan.base20MHzChannels.channelList[ numChan ] = pMac->scan.defaultPowerTable[Index].chanId;
-                numChan++;
-            }
-        }
-        // Restoring the Backed up 5 GHZ channels
-        for(channelList = 0;channelList < nuum5GchannelListBackup; channelList++ )
-        {
-            if (numChan < WNI_CFG_VALID_CHANNEL_LIST_LEN)
-            {
-                pMac->scan.base20MHzChannels.channelList[ numChan ] = channelList5GBackup[channelList];
-                numChan++;
-            }
-        }
-
-        pMac->scan.numChannelsDefault = (num20MHzChannelsFound > numChan) ? num20MHzChannelsFound : numChan;
-        pMac->scan.base20MHzChannels.numChannels = (num20MHzChannelsFound > numChan) ? num20MHzChannelsFound : numChan;
-    }
-    return (status);
-}
 
 eHalStatus csrInitGetChannels(tpAniSirGlobal pMac)
 {
@@ -2149,12 +2173,12 @@
     VOS_STATUS vosStatus;
     tANI_U8 Index = 0;
     tANI_U8 num40MHzChannelsFound = 0;
-
-
+    
+    
     //TODO: this interface changed to include the 40MHz channel list
     // this needs to be tied into the adapter structure somehow and referenced appropriately for CB operation
     // Read the scan channel list (including the power limit) from EEPROM
-    vosStatus = vos_nv_getChannelListWithPower( pMac->scan.defaultPowerTable, &num20MHzChannelsFound,
+    vosStatus = vos_nv_getChannelListWithPower( pMac->scan.defaultPowerTable, &num20MHzChannelsFound, 
                         pMac->scan.defaultPowerTable40MHz, &num40MHzChannelsFound);
     if ( (VOS_STATUS_SUCCESS != vosStatus) || (num20MHzChannelsFound == 0) )
     {
@@ -2185,7 +2209,7 @@
         }
         pMac->scan.base40MHzChannels.numChannels = num40MHzChannelsFound;
     }
-    return (status);
+    return (status);  
 }
 
 eHalStatus csrInitChannelList( tHalHandle hHal )
@@ -2198,10 +2222,10 @@
     csrSaveChannelPowerForBand(pMac, eANI_BOOLEAN_TRUE);
     // Apply the base channel list, power info, and set the Country code...
     csrApplyChannelPowerCountryInfo( pMac, &pMac->scan.base20MHzChannels, pMac->scan.countryCodeCurrent, eANI_BOOLEAN_TRUE );
-
+ 
     return (status);
 }
-eHalStatus csrChangeConfigParams(tpAniSirGlobal pMac,
+eHalStatus csrChangeConfigParams(tpAniSirGlobal pMac, 
                                  tCsrUpdateConfigParam *pUpdateConfigParam)
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
@@ -2224,12 +2248,12 @@
   {
      return (status);
   }
-  if ( ps11dinfo->Channels.numChannels && ( WNI_CFG_VALID_CHANNEL_LIST_LEN >= ps11dinfo->Channels.numChannels ) )
+  if ( ps11dinfo->Channels.numChannels && ( WNI_CFG_VALID_CHANNEL_LIST_LEN >= ps11dinfo->Channels.numChannels ) ) 
   {
-    pMac->scan.base20MHzChannels.numChannels = ps11dinfo->Channels.numChannels;
-    status = palCopyMemory(pMac->hHdd, pMac->scan.base20MHzChannels.channelList,
-                           ps11dinfo->Channels.channelList, ps11dinfo->Channels.numChannels);
-    if(!HAL_STATUS_SUCCESS(status)) return (status);
+     pMac->scan.base20MHzChannels.numChannels = ps11dinfo->Channels.numChannels;
+     vos_mem_copy(pMac->scan.base20MHzChannels.channelList,
+                 ps11dinfo->Channels.channelList,
+                 ps11dinfo->Channels.numChannels);
   }
   else
   {
@@ -2237,21 +2261,26 @@
      return (eHAL_STATUS_SUCCESS);
   }
   //legacy maintenance
-  status = palCopyMemory(pMac->hHdd, pMac->scan.countryCodeDefault,
-                         ps11dinfo->countryCode, WNI_CFG_COUNTRY_CODE_LEN);
-  if(!HAL_STATUS_SUCCESS(status)) return (status);
-  //Tush: at csropen get this initialized with default, during csr reset if this
+
+  vos_mem_copy(pMac->scan.countryCodeDefault, ps11dinfo->countryCode,
+               WNI_CFG_COUNTRY_CODE_LEN);
+
+
+  //Tush: at csropen get this initialized with default, during csr reset if this 
   // already set with some value no need initilaize with default again
   if(0 == pMac->scan.countryCodeCurrent[0])
   {
-     status = palCopyMemory(pMac->hHdd, pMac->scan.countryCodeCurrent,
-                         ps11dinfo->countryCode, WNI_CFG_COUNTRY_CODE_LEN);
-     if(!HAL_STATUS_SUCCESS(status)) return (status);
+      vos_mem_copy(pMac->scan.countryCodeCurrent, ps11dinfo->countryCode,
+                  WNI_CFG_COUNTRY_CODE_LEN);
   }
   // need to add the max power channel list
-  if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pChanInfo, sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN)))
+  pChanInfo = vos_mem_malloc(sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN);
+  if (pChanInfo != NULL)
   {
-      palZeroMemory(pMac->hHdd, pChanInfo, sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN);
+      vos_mem_set(pChanInfo,
+                  sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN ,
+                  0);
+
       pChanInfoStart = pChanInfo;
       for(index = 0; index < ps11dinfo->Channels.numChannels; index++)
       {
@@ -2265,7 +2294,7 @@
       {
           csrSaveToChannelPower2G_5G( pMac, count * sizeof(tSirMacChanInfo), pChanInfoStart );
       }
-      palFreeMemory(pMac->hHdd, pChanInfoStart);
+      vos_mem_free(pChanInfoStart);
   }
   //Only apply them to CFG when not in STOP state. Otherwise they will be applied later
   if( HAL_STATUS_SUCCESS(status) )
@@ -2300,9 +2329,12 @@
      return eHAL_STATUS_FAILURE;
   }
 
-  if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pChanInfo, sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN)))
+  pChanInfo = vos_mem_malloc(sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN);
+  if (pChanInfo != NULL)
   {
-      palZeroMemory(pMac->hHdd, pChanInfo, sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN);
+      vos_mem_set(pChanInfo,
+                  sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN,
+                  0);
       pChanInfoStart = pChanInfo;
 
       for(index = 0; index < ps11dinfo->Channels.numChannels; index++)
@@ -2317,7 +2349,7 @@
       {
           csrSaveToChannelPower2G_5G( pMac, count * sizeof(tSirMacChanInfo), pChanInfoStart );
       }
-      palFreeMemory(pMac->hHdd, pChanInfoStart);
+      vos_mem_free(pChanInfoStart);
   }
 
   return eHAL_STATUS_SUCCESS;
@@ -2348,17 +2380,17 @@
         // - the new roam command is a NewProfileList.
         // - the new roam command is a Forced Dissoc
         // - the new roam command is from an 802.11 OID (OID_SSID or OID_BSSID).
-        if (
+        if ( 
             (pCommand && ( pCommand->sessionId == pDupCommand->sessionId ) &&
                 ((pCommand->command == pDupCommand->command) &&
                 /* This peermac check is requried for Softap/GO scenarios
-                 * For STA scenario below OR check will suffice as pCommand will
+                 * For STA scenario below OR check will suffice as pCommand will 
                  * always be NULL for STA scenarios
                  */
                 (vos_mem_compare(pDupCommand->u.roamCmd.peerMac, pCommand->u.roamCmd.peerMac, sizeof(v_MACADDR_t))) &&
                  (pCommand->u.roamCmd.roamReason == pDupCommand->u.roamCmd.roamReason ||
                     eCsrForcedDisassoc == pCommand->u.roamCmd.roamReason ||
-                    eCsrHddIssued == pCommand->u.roamCmd.roamReason)))
+                    eCsrHddIssued == pCommand->u.roamCmd.roamReason))) 
                 ||
             //below the pCommand is NULL
             ( (sessionId == pDupCommand->sessionId) &&
@@ -2389,11 +2421,12 @@
     }
     csrLLClose(&localList);
 }
-eHalStatus csrRoamCallCallback(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamInfo *pRoamInfo,
+eHalStatus csrRoamCallCallback(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamInfo *pRoamInfo, 
                                tANI_U32 roamId, eRoamCmdStatus u1, eCsrRoamResult u2)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
+    tANI_U32 rssi = 0;
     WLAN_VOS_DIAG_EVENT_DEF(connectionStatus, vos_event_wlan_status_payload_type);
 #endif
     tCsrRoamSession *pSession;
@@ -2407,6 +2440,9 @@
        VOS_ASSERT(0);
        return eHAL_STATUS_FAILURE;
     }
+
+    smsLog(pMac, LOG4, "Recieved RoamCmdStatus %d with Roam Result %d", u1, u2);
+
     if(eCSR_ROAM_ASSOCIATION_COMPLETION == u1 && pRoamInfo)
     {
         smsLog(pMac, LOGW, " Assoc complete result = %d statusCode = %d reasonCode = %d", u2, pRoamInfo->statusCode, pRoamInfo->reasonCode);
@@ -2414,12 +2450,12 @@
     if ((u1 == eCSR_ROAM_FT_REASSOC_FAILED) && (pSession->bRefAssocStartCnt)) {
         /*
          * Decrement bRefAssocStartCnt for FT reassoc failure.
-         * Reason: For FT reassoc failures, we first call
-         * csrRoamCallCallback before notifying a failed roam
-         * completion through csrRoamComplete. The latter in
-         * turn calls csrRoamProcessResults which tries to
+         * Reason: For FT reassoc failures, we first call 
+         * csrRoamCallCallback before notifying a failed roam 
+         * completion through csrRoamComplete. The latter in 
+         * turn calls csrRoamProcessResults which tries to 
          * once again call csrRoamCallCallback if bRefAssocStartCnt
-         * is non-zero. Since this is redundant for FT reassoc
+         * is non-zero. Since this is redundant for FT reassoc 
          * failure, decrement bRefAssocStartCnt.
          */
         pSession->bRefAssocStartCnt--;
@@ -2439,7 +2475,7 @@
             pRoamInfo->sessionId = (tANI_U8)sessionId;
         }
 
-        /* avoid holding the global lock when making the roaming callback , original change came
+        /* avoid holding the global lock when making the roaming callback, original change came
         from a raised CR (CR304874).  Since this callback is in HDD a potential deadlock
         is possible on other OS ports where the callback may need to take locks to protect
         HDD state
@@ -2449,66 +2485,98 @@
         status = pSession->callback(pSession->pContext, pRoamInfo, roamId, u1, u2);
         // TODO: revisit: sme_AcquireGlobalLock( &pMac->sme );
     }
-    //EVENT_WLAN_STATUS: eCSR_ROAM_ASSOCIATION_COMPLETION,
-    //                   eCSR_ROAM_LOSTLINK, eCSR_ROAM_DISASSOCIATED,
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
-    palZeroMemory(pMac->hHdd, &connectionStatus, sizeof(vos_event_wlan_status_payload_type));
+    //EVENT_WLAN_STATUS: eCSR_ROAM_ASSOCIATION_COMPLETION, 
+    //                   eCSR_ROAM_LOSTLINK, eCSR_ROAM_DISASSOCIATED, 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR    
+    vos_mem_set(&connectionStatus,
+                sizeof(vos_event_wlan_status_payload_type), 0);
+
     if((eCSR_ROAM_ASSOCIATION_COMPLETION == u1) && (eCSR_ROAM_RESULT_ASSOCIATED == u2))
     {
        connectionStatus.eventId = eCSR_WLAN_STATUS_CONNECT;
        connectionStatus.bssType = pRoamInfo->u.pConnectedProfile->BSSType;
+
        if(NULL != pRoamInfo->pBssDesc)
        {
           connectionStatus.rssi = pRoamInfo->pBssDesc->rssi * (-1);
           connectionStatus.channel = pRoamInfo->pBssDesc->channelId;
        }
+       if (ccmCfgSetInt(pMac, WNI_CFG_CURRENT_RSSI, connectionStatus.rssi, NULL,
+                        eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE) {
+          smsLog(pMac, LOGE, "Could not pass WNI_CFG_CURRENT_RSSI to Cfg");
+       }
+
        connectionStatus.qosCapability = pRoamInfo->u.pConnectedProfile->qosConnection;
        connectionStatus.authType = (v_U8_t)diagAuthTypeFromCSRType(pRoamInfo->u.pConnectedProfile->AuthType);
        connectionStatus.encryptionType = (v_U8_t)diagEncTypeFromCSRType(pRoamInfo->u.pConnectedProfile->EncryptionType);
-       palCopyMemory(pMac->hHdd, connectionStatus.ssid, pRoamInfo->u.pConnectedProfile->SSID.ssId, 6);
+       vos_mem_copy(connectionStatus.ssid,
+                    pRoamInfo->u.pConnectedProfile->SSID.ssId, 6);
+
        connectionStatus.reason = eCSR_REASON_UNSPECIFIED;
+       vos_mem_copy(&pMac->sme.eventPayload, &connectionStatus,
+                    sizeof(vos_event_wlan_status_payload_type));
        WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
     }
     if((eCSR_ROAM_MIC_ERROR_IND == u1) || (eCSR_ROAM_RESULT_MIC_FAILURE == u2))
     {
+       vos_mem_copy(&connectionStatus, &pMac->sme.eventPayload,
+                    sizeof(vos_event_wlan_status_payload_type));
+       if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac, WNI_CFG_CURRENT_RSSI, &rssi)))
+           connectionStatus.rssi = rssi;
+
        connectionStatus.eventId = eCSR_WLAN_STATUS_DISCONNECT;
        connectionStatus.reason = eCSR_REASON_MIC_ERROR;
        WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
     }
     if(eCSR_ROAM_RESULT_FORCED == u2)
     {
+       vos_mem_copy(&connectionStatus, &pMac->sme.eventPayload,
+                    sizeof(vos_event_wlan_status_payload_type));
+       if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac, WNI_CFG_CURRENT_RSSI, &rssi)))
+           connectionStatus.rssi = rssi;
+
        connectionStatus.eventId = eCSR_WLAN_STATUS_DISCONNECT;
        connectionStatus.reason = eCSR_REASON_USER_REQUESTED;
        WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
     }
     if(eCSR_ROAM_RESULT_DISASSOC_IND == u2)
     {
+       vos_mem_copy(&connectionStatus, &pMac->sme.eventPayload,
+                    sizeof(vos_event_wlan_status_payload_type));
+       if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac, WNI_CFG_CURRENT_RSSI, &rssi)))
+           connectionStatus.rssi = rssi;
+
        connectionStatus.eventId = eCSR_WLAN_STATUS_DISCONNECT;
        connectionStatus.reason = eCSR_REASON_DISASSOC;
        WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
     }
     if(eCSR_ROAM_RESULT_DEAUTH_IND == u2)
     {
+       vos_mem_copy(&connectionStatus, &pMac->sme.eventPayload,
+                    sizeof(vos_event_wlan_status_payload_type));
+       if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac, WNI_CFG_CURRENT_RSSI, &rssi)))
+           connectionStatus.rssi = rssi;
+
        connectionStatus.eventId = eCSR_WLAN_STATUS_DISCONNECT;
        connectionStatus.reason = eCSR_REASON_DEAUTH;
        WLAN_VOS_DIAG_EVENT_REPORT(&connectionStatus, EVENT_WLAN_STATUS);
     }
 #endif //FEATURE_WLAN_DIAG_SUPPORT_CSR
-
+    
     return (status);
 }
 // Returns whether handoff is currently in progress or not
 tANI_BOOLEAN csrRoamIsHandoffInProgress(tpAniSirGlobal pMac)
 {
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
-    return csrNeighborRoamIsHandoffInProgress(pMac);
+    return csrNeighborRoamIsHandoffInProgress(pMac);                    
 #else
     return eANI_BOOLEAN_FALSE;
 #endif
 }
 eHalStatus csrRoamIssueDisassociate( tpAniSirGlobal pMac, tANI_U32 sessionId,
                                      eCsrRoamSubState NewSubstate, tANI_BOOLEAN fMICFailure )
-{
+{   
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tCsrBssid bssId = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
     tANI_U16 reasonCode;
@@ -2519,15 +2587,15 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
-    //Restore AC weight in case we change it
+    
+    //Restore AC weight in case we change it 
     if ( csrIsConnStateConnectedInfra( pMac, sessionId ) )
     {
         smsLog(pMac, LOG1, FL(" restore AC weights (%d-%d-%d-%d)"), pMac->roam.ucACWeights[0], pMac->roam.ucACWeights[1],
             pMac->roam.ucACWeights[2], pMac->roam.ucACWeights[3]);
         WLANTL_SetACWeights(pMac->roam.gVosContext, pMac->roam.ucACWeights);
     }
-
+    
     if ( fMICFailure )
     {
         reasonCode = eSIR_MAC_MIC_FAILURE_REASON;
@@ -2535,35 +2603,37 @@
     else if (NewSubstate == eCSR_ROAM_SUBSTATE_DISASSOC_HANDOFF)
     {
         reasonCode = eSIR_MAC_DISASSOC_DUE_TO_FTHANDOFF_REASON;
-    }
-    else
+    } 
+    else 
     {
         reasonCode = eSIR_MAC_UNSPEC_FAILURE_REASON;
-    }
+    }    
 #ifdef WLAN_FEATURE_VOWIFI_11R
-    if ( (csrRoamIsHandoffInProgress(pMac)) &&
+    if ( (csrRoamIsHandoffInProgress(pMac)) && 
          (NewSubstate != eCSR_ROAM_SUBSTATE_DISASSOC_HANDOFF))
     {
         tpCsrNeighborRoamControlInfo pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
-        palCopyMemory(pMac->hHdd, &bssId, pNeighborRoamInfo->csrNeighborRoamProfile.BSSIDs.bssid, sizeof(tSirMacAddr));
-    }
-    else
+        vos_mem_copy(&bssId,
+                     pNeighborRoamInfo->csrNeighborRoamProfile.BSSIDs.bssid,
+                     sizeof(tSirMacAddr));
+    } 
+    else 
 #endif
     if(pSession->pConnectBssDesc)
     {
-        palCopyMemory(pMac->hHdd, &bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
+        vos_mem_copy(&bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
     }
-
-
+    
+    
     smsLog( pMac, LOG2, "CSR Attempting to Disassociate Bssid=%02x-%02x-%02x-%02x-%02x-%02x"
-            "subState = %d reason=%d", bssId[ 0 ], bssId[ 1 ], bssId[ 2 ], bssId[ 3 ],
+            "subState = %d reason=%d", bssId[ 0 ], bssId[ 1 ], bssId[ 2 ], bssId[ 3 ], 
             bssId[ 4 ], bssId[ 5 ], NewSubstate, reasonCode);
 
     csrRoamSubstateChange( pMac, NewSubstate, sessionId);
 
-    status = csrSendMBDisassocReqMsg( pMac, sessionId, bssId, reasonCode );
-
-    if(HAL_STATUS_SUCCESS(status))
+    status = csrSendMBDisassocReqMsg( pMac, sessionId, bssId, reasonCode );    
+    
+    if(HAL_STATUS_SUCCESS(status)) 
     {
         csrRoamLinkDown(pMac, sessionId);
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
@@ -2591,8 +2661,8 @@
     \param reason - reason code, be one of the tSirMacReasonCodes
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus csrRoamIssueDisassociateStaCmd( tpAniSirGlobal pMac,
-                                           tANI_U32 sessionId,
+eHalStatus csrRoamIssueDisassociateStaCmd( tpAniSirGlobal pMac, 
+                                           tANI_U32 sessionId, 
                                            tANI_U8 *pPeerMacAddr,
                                            tANI_U32 reason)
 {
@@ -2602,7 +2672,7 @@
     do
     {
         pCommand = csrGetCommandBuffer( pMac );
-        if ( !pCommand )
+        if ( !pCommand ) 
         {
             smsLog( pMac, LOGE, FL(" fail to get command buffer") );
             status = eHAL_STATUS_RESOURCES;
@@ -2633,8 +2703,8 @@
     \param reason - reason code, be one of the tSirMacReasonCodes
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus csrRoamIssueDeauthStaCmd( tpAniSirGlobal pMac,
-                                     tANI_U32 sessionId,
+eHalStatus csrRoamIssueDeauthStaCmd( tpAniSirGlobal pMac, 
+                                     tANI_U32 sessionId, 
                                      tANI_U8 *pPeerMacAddr,
                                      tANI_U32 reason)
 {
@@ -2644,7 +2714,7 @@
     do
     {
         pCommand = csrGetCommandBuffer( pMac );
-        if ( !pCommand )
+        if ( !pCommand ) 
         {
             smsLog( pMac, LOGE, FL(" fail to get command buffer") );
             status = eHAL_STATUS_RESOURCES;
@@ -2679,7 +2749,7 @@
     }
     if (pSession->pConnectBssDesc)
     {
-        palCopyMemory(pMac->hHdd, &bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
+        vos_mem_copy(&bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
     }
     else
     {
@@ -2688,7 +2758,7 @@
     }
     smsLog( pMac, LOG2, "CSR issuing tkip counter measures for Bssid = %02x-%02x-%02x-%02x-%02x-%02x, Enable = %d",
                   bssId[ 0 ], bssId[ 1 ], bssId[ 2 ],
-                  bssId[ 3 ], bssId[ 4 ], bssId[ 5 ] , bEnable);
+                  bssId[ 3 ], bssId[ 4 ], bssId[ 5 ], bEnable);
     status = csrSendMBTkipCounterMeasuresReqMsg( pMac, sessionId, bEnable, bssId );
     return (status);
 }
@@ -2707,7 +2777,7 @@
     }
     if(pSession->pConnectBssDesc)
     {
-        palCopyMemory( pMac->hHdd, &bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid) );
+        vos_mem_copy(&bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
     }
     else
     {
@@ -2727,7 +2797,7 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tCsrBssid bssId = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-
+    
     if (!pSession)
     {
         smsLog( pMac, LOGE, "csrRoamGetWpsSessionOverlap:CSR Session not found");
@@ -2735,7 +2805,7 @@
     }
     if(pSession->pConnectBssDesc)
     {
-        palCopyMemory( pMac->hHdd, &bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid) );
+        vos_mem_copy(&bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
     }
     else
     {
@@ -2745,13 +2815,13 @@
     smsLog( pMac, LOG2, "CSR getting WPS Session Overlap for Bssid = %02x-%02x-%02x-%02x-%02x-%02x",
                   bssId[ 0 ], bssId[ 1 ], bssId[ 2 ],
                   bssId[ 3 ], bssId[ 4 ], bssId[ 5 ] );
-
-    status = csrSendMBGetWPSPBCSessions( pMac, sessionId, bssId, pUsrContext, pfnSapEventCallback, pRemoveMac);
-
+     
+    status = csrSendMBGetWPSPBCSessions( pMac, sessionId, bssId, pUsrContext, pfnSapEventCallback, pRemoveMac);            
+            
     return (status);
 }
 eHalStatus csrRoamIssueDeauth( tpAniSirGlobal pMac, tANI_U32 sessionId, eCsrRoamSubState NewSubstate )
-{
+{   
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tCsrBssid bssId = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
@@ -2761,16 +2831,16 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     if(pSession->pConnectBssDesc)
     {
-        palCopyMemory(pMac->hHdd, &bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
+        vos_mem_copy(&bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
     }
     smsLog( pMac, LOG2, "CSR Attempting to Deauth Bssid= %02x-%02x-%02x-%02x-%02x-%02x",
                   bssId[ 0 ], bssId[ 1 ], bssId[ 2 ],
-                  bssId[ 3 ], bssId[ 4 ], bssId[ 5 ] );
+                  bssId[ 3 ], bssId[ 4 ], bssId[ 5 ] );    
     csrRoamSubstateChange( pMac, NewSubstate, sessionId);
-
+    
     status = csrSendMBDeauthReqMsg( pMac, sessionId, bssId, eSIR_MAC_DEAUTH_LEAVING_BSS_REASON );
     if(!HAL_STATUS_SUCCESS(status))
     {
@@ -2791,14 +2861,14 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
-    // If no BSS description was found in this connection (happens with start IBSS), then
+    
+    // If no BSS description was found in this connection (happens with start IBSS), then 
     // nix the BSS description that we keep around for the connected BSS) and get out...
     if(NULL == pBssDesc)
     {
         csrFreeConnectBssDesc(pMac, sessionId);
     }
-    else
+    else 
     {
         size = pBssDesc->length + sizeof( pBssDesc->length );
         if(NULL != pSession->pConnectBssDesc)
@@ -2811,18 +2881,17 @@
         }
         if(NULL == pSession->pConnectBssDesc)
         {
-            status = palAllocateMemory( pMac->hHdd, (void **)&pSession->pConnectBssDesc, size);
+            pSession->pConnectBssDesc = vos_mem_malloc(size);
         }
-        if ( HAL_STATUS_SUCCESS(status) && pSession->pConnectBssDesc )
-        {
-            palCopyMemory( pMac->hHdd, pSession->pConnectBssDesc, pBssDesc, size );
-        }
-    }
-
+        if (NULL == pSession->pConnectBssDesc)
+            status = eHAL_STATUS_FAILURE;
+        else
+            vos_mem_copy(pSession->pConnectBssDesc, pBssDesc, size);
+     }
     return (status);
 }
 
-eHalStatus csrRoamPrepareBssConfig(tpAniSirGlobal pMac, tCsrRoamProfile *pProfile,
+eHalStatus csrRoamPrepareBssConfig(tpAniSirGlobal pMac, tCsrRoamProfile *pProfile, 
                                     tSirBssDescription *pBssDesc, tBssConfigParam *pBssConfig,
                                     tDot11fBeaconIEs *pIes)
 {
@@ -2834,13 +2903,14 @@
 
     do
     {
-        palCopyMemory(pMac->hHdd, &pBssConfig->BssCap, &pBssDesc->capabilityInfo, sizeof(tSirMacCapabilityInfo));
+        vos_mem_copy(&pBssConfig->BssCap, &pBssDesc->capabilityInfo,
+                     sizeof(tSirMacCapabilityInfo));
         //get qos
         pBssConfig->qosType = csrGetQoSFromBssDesc(pMac, pBssDesc, pIes);
         //get SSID
         if(pIes->SSID.present)
         {
-            palCopyMemory(pMac->hHdd, &pBssConfig->SSID.ssId, pIes->SSID.ssid, pIes->SSID.num_ssid);
+            vos_mem_copy(&pBssConfig->SSID.ssId, pIes->SSID.ssid, pIes->SSID.num_ssid);
             pBssConfig->SSID.length = pIes->SSID.num_ssid;
         }
         else
@@ -2869,7 +2939,7 @@
         {
             pBssConfig->uCfgDot11Mode = cfgDot11Mode;
         }
-        else
+        else 
         {
             smsLog(pMac, LOGW, "   Can not find match phy mode");
             //force it
@@ -2891,7 +2961,7 @@
             pBssConfig->qosType = eCSR_MEDIUM_ACCESS_DCF;
         }
 
-        if (((pBssConfig->uCfgDot11Mode == eCSR_CFG_DOT11_MODE_11N)  ||
+        if (((pBssConfig->uCfgDot11Mode == eCSR_CFG_DOT11_MODE_11N)  || 
                          (pBssConfig->uCfgDot11Mode == eCSR_CFG_DOT11_MODE_11AC)) &&
                          ((pBssConfig->qosType != eCSR_MEDIUM_ACCESS_WMM_eDCF_DSCP) ||
                           (pBssConfig->qosType != eCSR_MEDIUM_ACCESS_11e_HCF) ||
@@ -2903,7 +2973,7 @@
         }
 
         //auth type
-        switch( pProfile->negotiatedAuthType )
+        switch( pProfile->negotiatedAuthType ) 
         {
             default:
             case eCSR_AUTH_TYPE_WPA:
@@ -2931,7 +3001,7 @@
         if(pBssConfig->BssCap.ibss)
         {
             //We don't support 11h on IBSS
-            pBssConfig->f11hSupport = eANI_BOOLEAN_FALSE;
+            pBssConfig->f11hSupport = eANI_BOOLEAN_FALSE; 
         }
         else
         {
@@ -2942,21 +3012,21 @@
         //heartbeat
         if ( CSR_IS_11A_BSS( pBssDesc ) )
         {
-             pBssConfig->uHeartBeatThresh = pMac->roam.configParam.HeartbeatThresh50;
+             pBssConfig->uHeartBeatThresh = pMac->roam.configParam.HeartbeatThresh50;        
         }
         else
         {
              pBssConfig->uHeartBeatThresh = pMac->roam.configParam.HeartbeatThresh24;
         }
         //Join timeout
-        // if we find a BeaconInterval in the BssDescription, then set the Join Timeout to
-        // be 10 x the BeaconInterval.
+        // if we find a BeaconInterval in the BssDescription, then set the Join Timeout to 
+        // be 10 x the BeaconInterval.                          
         if ( pBssDesc->beaconInterval )
         {
             //Make sure it is bigger than the minimal
             pBssConfig->uJoinTimeOut = CSR_ROAM_MAX(10 * pBssDesc->beaconInterval, CSR_JOIN_FAILURE_TIMEOUT_MIN);
         }
-        else
+        else 
         {
             pBssConfig->uJoinTimeOut = CSR_JOIN_FAILURE_TIMEOUT_DEFAULT;
         }
@@ -2966,18 +3036,19 @@
     return (status);
 }
 
-static eHalStatus csrRoamPrepareBssConfigFromProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pProfile,
+static eHalStatus csrRoamPrepareBssConfigFromProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pProfile, 
                                                      tBssConfigParam *pBssConfig, tSirBssDescription *pBssDesc)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
-    tANI_U8 operationChannel = 0;
+    tANI_U8 operationChannel = 0; 
     tANI_U8 qAPisEnabled = FALSE;
     //SSID
     pBssConfig->SSID.length = 0;
     if(pProfile->SSIDs.numOfSSIDs)
     {
         //only use the first one
-        palCopyMemory(pMac->hHdd, &pBssConfig->SSID, &pProfile->SSIDs.SSIDList[0].SSID, sizeof(tSirMacSSid));
+        vos_mem_copy(&pBssConfig->SSID, &pProfile->SSIDs.SSIDList[0].SSID,
+                     sizeof(tSirMacSSid));
     }
     else
     {
@@ -3003,11 +3074,11 @@
     {
        operationChannel = pProfile->ChannelInfo.ChannelList[0];
     }
-    pBssConfig->uCfgDot11Mode = csrRoamGetPhyModeBandForBss(pMac, pProfile, operationChannel,
+    pBssConfig->uCfgDot11Mode = csrRoamGetPhyModeBandForBss(pMac, pProfile, operationChannel, 
                                         &pBssConfig->eBand);
     //QOS
     //Is this correct to always set to this //***
-    if ( pBssConfig->BssCap.ess == 1 )
+    if ( pBssConfig->BssCap.ess == 1 ) 
     {
         /*For Softap case enable WMM*/
         if(CSR_IS_INFRA_AP(pProfile) && (eCsrRoamWmmNoQos != pMac->roam.configParam.WMMSupportMode )){
@@ -3031,7 +3102,7 @@
     } else {
         pBssConfig->qosType = eCSR_MEDIUM_ACCESS_DCF;
     }
-
+    
     //auth type
     switch( pProfile->AuthType.authType[0] ) //Take the preferred Auth type.
     {
@@ -3064,7 +3135,7 @@
     //heartbeat
     if ( eCSR_BAND_5G == pBssConfig->eBand )
     {
-        pBssConfig->uHeartBeatThresh = pMac->roam.configParam.HeartbeatThresh50;
+        pBssConfig->uHeartBeatThresh = pMac->roam.configParam.HeartbeatThresh50;        
     }
     else
     {
@@ -3079,29 +3150,35 @@
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tDot11fBeaconIEs *pIes = NULL;
-
+   
   do
    {
       if(!HAL_STATUS_SUCCESS(csrGetParsedBssDescriptionIEs(pMac, pBssDesc, &pIes)))
       {
          //err msg
-         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, 
                    "csrRoamGetQosInfoFromBss() failed");
          break;
       }
       //check if the AP is QAP & it supports APSD
       if( CSR_IS_QOS_BSS(pIes) )
       {
-         return eHAL_STATUS_SUCCESS;
+         status = eHAL_STATUS_SUCCESS;
       }
    } while (0);
+
+   if (NULL != pIes)
+   {
+       vos_mem_free(pIes);
+   }
+
    return status;
 }
 
 void csrSetCfgPrivacy( tpAniSirGlobal pMac, tCsrRoamProfile *pProfile, tANI_BOOLEAN fPrivacy )
 {
-    // !! Note:  the only difference between this function and the csrSetCfgPrivacyFromProfile() is the
-    // setting of the privacy CFG based on the advertised privacy setting from the AP for WPA associations.
+    // !! Note:  the only difference between this function and the csrSetCfgPrivacyFromProfile() is the 
+    // setting of the privacy CFG based on the advertised privacy setting from the AP for WPA associations. 
     // See !!Note: below in this function...
     tANI_U32 PrivacyEnabled = 0;
     tANI_U32 RsnEnabled = 0;
@@ -3111,168 +3188,176 @@
     tANI_U32 Key1Length = 0;
     tANI_U32 Key2Length = 0;
     tANI_U32 Key3Length = 0;
-
-    // Reserve for the biggest key
+    
+    // Reserve for the biggest key 
     tANI_U8 Key0[ WNI_CFG_WEP_DEFAULT_KEY_1_LEN ];
     tANI_U8 Key1[ WNI_CFG_WEP_DEFAULT_KEY_2_LEN ];
     tANI_U8 Key2[ WNI_CFG_WEP_DEFAULT_KEY_3_LEN ];
     tANI_U8 Key3[ WNI_CFG_WEP_DEFAULT_KEY_4_LEN ];
-
+    
     switch ( pProfile->negotiatedUCEncryptionType )
     {
         case eCSR_ENCRYPT_TYPE_NONE:
-
+        
             // for NO encryption, turn off Privacy and Rsn.
-            PrivacyEnabled = 0;
+            PrivacyEnabled = 0;           
             RsnEnabled = 0;
-
+            
             // WEP key length and Wep Default Key ID don't matter in this case....
-
+            
             // clear out the WEP keys that may be hanging around.
             Key0Length = 0;
             Key1Length = 0;
             Key2Length = 0;
             Key3Length = 0;
-
+            
             break;
-
+            
         case eCSR_ENCRYPT_TYPE_WEP40_STATICKEY:
         case eCSR_ENCRYPT_TYPE_WEP40:
-
+            
             // Privacy is ON.  NO RSN for Wep40 static key.
-            PrivacyEnabled = 1;
+            PrivacyEnabled = 1;           
             RsnEnabled = 0;
-
+                        
             // Set the Wep default key ID.
             WepDefaultKeyId = pProfile->Keys.defaultIndex;
             // Wep key size if 5 bytes (40 bits).
-            WepKeyLength = WNI_CFG_WEP_KEY_LENGTH_5;
-
+            WepKeyLength = WNI_CFG_WEP_KEY_LENGTH_5;            
+            
             // set encryption keys in the CFG database or clear those that are not present in this profile.
-            if ( pProfile->Keys.KeyLength[0] )
+            if ( pProfile->Keys.KeyLength[0] ) 
             {
-                palCopyMemory( pMac->hHdd, Key0, pProfile->Keys.KeyMaterial[0], WNI_CFG_WEP_KEY_LENGTH_5 );
+                vos_mem_copy(Key0, pProfile->Keys.KeyMaterial[0],
+                             WNI_CFG_WEP_KEY_LENGTH_5);
                 Key0Length = WNI_CFG_WEP_KEY_LENGTH_5;
             }
             else
             {
                 Key0Length = 0;
             }
-
-            if ( pProfile->Keys.KeyLength[1] )
+            
+            if ( pProfile->Keys.KeyLength[1] ) 
             {
-                palCopyMemory( pMac->hHdd, Key1, pProfile->Keys.KeyMaterial[1], WNI_CFG_WEP_KEY_LENGTH_5 );
-                Key1Length = WNI_CFG_WEP_KEY_LENGTH_5;
+               vos_mem_copy(Key1, pProfile->Keys.KeyMaterial[1],
+                            WNI_CFG_WEP_KEY_LENGTH_5);
+               Key1Length = WNI_CFG_WEP_KEY_LENGTH_5;
             }
             else
             {
                 Key1Length = 0;
             }
-
-            if ( pProfile->Keys.KeyLength[2] )
+            
+            if ( pProfile->Keys.KeyLength[2] ) 
             {
-                palCopyMemory( pMac->hHdd, Key2, pProfile->Keys.KeyMaterial[2], WNI_CFG_WEP_KEY_LENGTH_5 );
-                Key2Length = WNI_CFG_WEP_KEY_LENGTH_5;
+                vos_mem_copy(Key2, pProfile->Keys.KeyMaterial[2],
+                             WNI_CFG_WEP_KEY_LENGTH_5);
+                Key2Length = WNI_CFG_WEP_KEY_LENGTH_5;                
             }
             else
             {
                 Key2Length = 0;
             }
-
-            if ( pProfile->Keys.KeyLength[3] )
+            
+            if ( pProfile->Keys.KeyLength[3] ) 
             {
-                palCopyMemory( pMac->hHdd, Key3, pProfile->Keys.KeyMaterial[3], WNI_CFG_WEP_KEY_LENGTH_5 );
-                Key3Length = WNI_CFG_WEP_KEY_LENGTH_5;
+                vos_mem_copy(Key3, pProfile->Keys.KeyMaterial[3],
+                             WNI_CFG_WEP_KEY_LENGTH_5);
+                Key3Length = WNI_CFG_WEP_KEY_LENGTH_5;                
             }
             else
             {
                 Key3Length = 0;
-            }
+            }      
             break;
-
+        
         case eCSR_ENCRYPT_TYPE_WEP104_STATICKEY:
         case eCSR_ENCRYPT_TYPE_WEP104:
-
+            
             // Privacy is ON.  NO RSN for Wep40 static key.
-            PrivacyEnabled = 1;
+            PrivacyEnabled = 1;           
             RsnEnabled = 0;
-
+            
             // Set the Wep default key ID.
             WepDefaultKeyId = pProfile->Keys.defaultIndex;
-
+           
             // Wep key size if 13 bytes (104 bits).
             WepKeyLength = WNI_CFG_WEP_KEY_LENGTH_13;
-
+            
             // set encryption keys in the CFG database or clear those that are not present in this profile.
-            if ( pProfile->Keys.KeyLength[0] )
+            if ( pProfile->Keys.KeyLength[0] ) 
             {
-                palCopyMemory( pMac->hHdd, Key0, pProfile->Keys.KeyMaterial[ 0 ], WNI_CFG_WEP_KEY_LENGTH_13 );
+                vos_mem_copy(Key0, pProfile->Keys.KeyMaterial[ 0 ],
+                             WNI_CFG_WEP_KEY_LENGTH_13);
                 Key0Length = WNI_CFG_WEP_KEY_LENGTH_13;
             }
             else
             {
                 Key0Length = 0;
             }
-
-            if ( pProfile->Keys.KeyLength[1] )
+            
+            if ( pProfile->Keys.KeyLength[1] ) 
             {
-                palCopyMemory( pMac->hHdd, Key1, pProfile->Keys.KeyMaterial[ 1 ], WNI_CFG_WEP_KEY_LENGTH_13 );
+                vos_mem_copy(Key1, pProfile->Keys.KeyMaterial[ 1 ],
+                             WNI_CFG_WEP_KEY_LENGTH_13);
                 Key1Length = WNI_CFG_WEP_KEY_LENGTH_13;
             }
             else
             {
                 Key1Length = 0;
             }
-
-            if ( pProfile->Keys.KeyLength[2] )
+            
+            if ( pProfile->Keys.KeyLength[2] ) 
             {
-                palCopyMemory( pMac->hHdd, Key2, pProfile->Keys.KeyMaterial[ 2 ], WNI_CFG_WEP_KEY_LENGTH_13 );
+                vos_mem_copy(Key2, pProfile->Keys.KeyMaterial[ 2 ],
+                             WNI_CFG_WEP_KEY_LENGTH_13);
                 Key2Length = WNI_CFG_WEP_KEY_LENGTH_13;
             }
             else
             {
                 Key2Length = 0;
             }
-
-            if ( pProfile->Keys.KeyLength[3] )
+            
+            if ( pProfile->Keys.KeyLength[3] ) 
             {
-                palCopyMemory( pMac->hHdd, Key3, pProfile->Keys.KeyMaterial[ 3 ], WNI_CFG_WEP_KEY_LENGTH_13 );
+                vos_mem_copy(Key3, pProfile->Keys.KeyMaterial[ 3 ],
+                             WNI_CFG_WEP_KEY_LENGTH_13);
                 Key3Length = WNI_CFG_WEP_KEY_LENGTH_13;
             }
             else
             {
                 Key3Length = 0;
             }
-
+           
             break;
-
+        
         case eCSR_ENCRYPT_TYPE_TKIP:
         case eCSR_ENCRYPT_TYPE_AES:
 #ifdef FEATURE_WLAN_WAPI
         case eCSR_ENCRYPT_TYPE_WPI:
 #endif /* FEATURE_WLAN_WAPI */
             // !! Note:  this is the only difference between this function and the csrSetCfgPrivacyFromProfile()
-            // (setting of the privacy CFG based on the advertised privacy setting from the AP for WPA/WAPI associations ).
+            // (setting of the privacy CFG based on the advertised privacy setting from the AP for WPA/WAPI associations ).        
             PrivacyEnabled = (0 != fPrivacy);
-
-            // turn on RSN enabled for WPA associations
+                         
+            // turn on RSN enabled for WPA associations   
             RsnEnabled = 1;
-
+            
             // WEP key length and Wep Default Key ID don't matter in this case....
-
+            
             // clear out the static WEP keys that may be hanging around.
             Key0Length = 0;
             Key1Length = 0;
             Key2Length = 0;
-            Key3Length = 0;
-
-            break;
+            Key3Length = 0;        
+          
+            break;     
         default:
             PrivacyEnabled = 0;
             RsnEnabled = 0;
-            break;
-    }
-
+            break;            
+    }           
+    
     ccmCfgSetInt(pMac, WNI_CFG_PRIVACY_ENABLED, PrivacyEnabled, NULL, eANI_BOOLEAN_FALSE);
     ccmCfgSetInt(pMac, WNI_CFG_RSN_ENABLED, RsnEnabled, NULL, eANI_BOOLEAN_FALSE);
     ccmCfgSetStr(pMac, WNI_CFG_WEP_DEFAULT_KEY_1, Key0, Key0Length, NULL, eANI_BOOLEAN_FALSE);
@@ -3340,10 +3425,10 @@
     int i;
     eCsrCfgDot11Mode cfgDot11Mode;
     tANI_U8 *pDstRate;
-    palZeroMemory(pMac->hHdd, pOpRateSet, sizeof(tSirMacRateSet));
-    palZeroMemory(pMac->hHdd, pExRateSet, sizeof(tSirMacRateSet));
+    vos_mem_set(pOpRateSet, sizeof(tSirMacRateSet), 0);
+    vos_mem_set(pExRateSet, sizeof(tSirMacRateSet), 0);
     VOS_ASSERT( pIes != NULL );
-
+    
     if( NULL != pIes )
     {
         csrIsPhyModeMatch( pMac, phyMode, pBssDesc, pProfile, &cfgDot11Mode, pIes );
@@ -3359,16 +3444,16 @@
         pDstRate = pOpRateSet->rate;
         if(pIes->SuppRates.present)
         {
-            for ( i = 0; i < pIes->SuppRates.num_rates; i++ )
+            for ( i = 0; i < pIes->SuppRates.num_rates; i++ ) 
             {
-                if ( csrRatesIsDot11RateSupported( pMac, pIes->SuppRates.rates[ i ] ) )
+                if ( csrRatesIsDot11RateSupported( pMac, pIes->SuppRates.rates[ i ] ) ) 
                 {
                     *pDstRate++ = pIes->SuppRates.rates[ i ];
                     pOpRateSet->numRates++;
                 }
             }
         }
-        if ( eCSR_CFG_DOT11_MODE_11G == cfgDot11Mode ||
+        if ( eCSR_CFG_DOT11_MODE_11G == cfgDot11Mode || 
              eCSR_CFG_DOT11_MODE_11N == cfgDot11Mode ||
              eCSR_CFG_DOT11_MODE_TAURUS == cfgDot11Mode ||
              eCSR_CFG_DOT11_MODE_ABG == cfgDot11Mode )
@@ -3379,9 +3464,9 @@
             pDstRate = pExRateSet->rate;
             if(pIes->ExtSuppRates.present)
             {
-                for ( i = 0; i < pIes->ExtSuppRates.num_rates; i++ )
+                for ( i = 0; i < pIes->ExtSuppRates.num_rates; i++ ) 
                 {
-                    if ( csrRatesIsDot11RateSupported( pMac, pIes->ExtSuppRates.rates[ i ] ) )
+                    if ( csrRatesIsDot11RateSupported( pMac, pIes->ExtSuppRates.rates[ i ] ) ) 
                     {
                         *pDstRate++ = pIes->ExtSuppRates.rates[ i ];
                         pExRateSet->numRates++;
@@ -3397,7 +3482,7 @@
     if (pOpRateSet->numRates > 0 || pExRateSet->numRates > 0) status = eHAL_STATUS_SUCCESS;
     return status;
 }
-
+    
 static void csrSetCfgRateSet( tpAniSirGlobal pMac, eCsrPhyMode phyMode, tCsrRoamProfile *pProfile,
                               tSirBssDescription *pBssDesc, tDot11fBeaconIEs *pIes)
 {
@@ -3429,7 +3514,7 @@
         pDstRate = OperationalRates;
         if(pIes->SuppRates.present)
         {
-            for ( i = 0; i < pIes->SuppRates.num_rates; i++ )
+            for ( i = 0; i < pIes->SuppRates.num_rates; i++ ) 
             {
                 if ( csrRatesIsDot11RateSupported( pMac, pIes->SuppRates.rates[ i ] ) &&
                      ( OperationalRatesLength < CSR_DOT11_SUPPORTED_RATES_MAX ))
@@ -3439,7 +3524,7 @@
                 }
             }
         }
-        if ( eCSR_CFG_DOT11_MODE_11G == cfgDot11Mode ||
+        if ( eCSR_CFG_DOT11_MODE_11G == cfgDot11Mode || 
              eCSR_CFG_DOT11_MODE_11N == cfgDot11Mode ||
              eCSR_CFG_DOT11_MODE_TAURUS == cfgDot11Mode ||
              eCSR_CFG_DOT11_MODE_ABG == cfgDot11Mode )
@@ -3450,7 +3535,7 @@
             pDstRate = ExtendedOperationalRates;
             if(pIes->ExtSuppRates.present)
             {
-                for ( i = 0; i < pIes->ExtSuppRates.num_rates; i++ )
+                for ( i = 0; i < pIes->ExtSuppRates.num_rates; i++ ) 
                 {
                     if ( csrRatesIsDot11RateSupported( pMac, pIes->ExtSuppRates.rates[ i ] ) &&
                      ( ExtendedOperationalRatesLength < CSR_DOT11_EXTENDED_SUPPORTED_RATES_MAX ))
@@ -3475,14 +3560,16 @@
         // set with any proprietary rates we found in the beacon, only if user
         // allows them...
         if ( PropRatesEnable && pIes->Airgo.PropSuppRates.present &&
-             ( pIes->Airgo.PropSuppRates.num_rates > 0 ))
+             ( pIes->Airgo.PropSuppRates.num_rates > 0 )) 
         {
             ProprietaryOperationalRatesLength = pIes->Airgo.PropSuppRates.num_rates;
             if ( ProprietaryOperationalRatesLength > sizeof(ProprietaryOperationalRates) )
             {
                ProprietaryOperationalRatesLength = sizeof (ProprietaryOperationalRates);
             }
-            palCopyMemory( pMac->hHdd, ProprietaryOperationalRates, pIes->Airgo.PropSuppRates.rates, ProprietaryOperationalRatesLength );
+            vos_mem_copy(ProprietaryOperationalRates,
+                         pIes->Airgo.PropSuppRates.rates,
+                         ProprietaryOperationalRatesLength);
         }
         else {
             // No proprietary modes...
@@ -3502,16 +3589,16 @@
            }
         }
         // Set the operational rate set CFG variables...
-        ccmCfgSetStr(pMac, WNI_CFG_OPERATIONAL_RATE_SET, OperationalRates,
+        ccmCfgSetStr(pMac, WNI_CFG_OPERATIONAL_RATE_SET, OperationalRates, 
                         OperationalRatesLength, NULL, eANI_BOOLEAN_FALSE);
-        ccmCfgSetStr(pMac, WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET, ExtendedOperationalRates,
+        ccmCfgSetStr(pMac, WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET, ExtendedOperationalRates, 
                             ExtendedOperationalRatesLength, NULL, eANI_BOOLEAN_FALSE);
-        ccmCfgSetStr(pMac, WNI_CFG_PROPRIETARY_OPERATIONAL_RATE_SET,
-                        ProprietaryOperationalRates,
+        ccmCfgSetStr(pMac, WNI_CFG_PROPRIETARY_OPERATIONAL_RATE_SET, 
+                        ProprietaryOperationalRates, 
                         ProprietaryOperationalRatesLength, NULL, eANI_BOOLEAN_FALSE);
         ccmCfgSetInt(pMac, WNI_CFG_PROPRIETARY_ANI_FEATURES_ENABLED, PropRatesEnable, NULL, eANI_BOOLEAN_FALSE);
-        ccmCfgSetStr(pMac, WNI_CFG_CURRENT_MCS_SET, MCSRateIdxSet,
-                        MCSRateLength, NULL, eANI_BOOLEAN_FALSE);
+        ccmCfgSetStr(pMac, WNI_CFG_CURRENT_MCS_SET, MCSRateIdxSet, 
+                        MCSRateLength, NULL, eANI_BOOLEAN_FALSE);        
     }//Parsing BSSDesc
     else
     {
@@ -3522,25 +3609,25 @@
 static void csrSetCfgRateSetFromProfile( tpAniSirGlobal pMac,
                                          tCsrRoamProfile *pProfile  )
 {
-    tSirMacRateSetIE DefaultSupportedRates11a = {  SIR_MAC_RATESET_EID,
-                                                   { 8,
-                                                     { SIR_MAC_RATE_6,
-                                                   SIR_MAC_RATE_9,
-                                                   SIR_MAC_RATE_12,
+    tSirMacRateSetIE DefaultSupportedRates11a = {  SIR_MAC_RATESET_EID, 
+                                                   { 8, 
+                                                     { SIR_MAC_RATE_6, 
+                                                   SIR_MAC_RATE_9, 
+                                                   SIR_MAC_RATE_12, 
                                                    SIR_MAC_RATE_18,
                                                    SIR_MAC_RATE_24,
                                                    SIR_MAC_RATE_36,
                                                    SIR_MAC_RATE_48,
                                                        SIR_MAC_RATE_54  } } };
-    tSirMacRateSetIE DefaultSupportedRates11b = {  SIR_MAC_RATESET_EID,
-                                                   { 4,
-                                                     { SIR_MAC_RATE_1,
-                                                   SIR_MAC_RATE_2,
-                                                   SIR_MAC_RATE_5_5,
+    tSirMacRateSetIE DefaultSupportedRates11b = {  SIR_MAC_RATESET_EID, 
+                                                   { 4, 
+                                                     { SIR_MAC_RATE_1, 
+                                                   SIR_MAC_RATE_2, 
+                                                   SIR_MAC_RATE_5_5, 
                                                        SIR_MAC_RATE_11  } } };
-
-
-    tSirMacPropRateSet DefaultSupportedPropRates = { 3,
+                                                              
+                                                              
+    tSirMacPropRateSet DefaultSupportedPropRates = { 3, 
                                                      { SIR_MAC_RATE_72,
                                                      SIR_MAC_RATE_96,
                                                        SIR_MAC_RATE_108 } };
@@ -3553,106 +3640,106 @@
     tANI_U8 ProprietaryOperationalRates[ 4 ];    // leave enough room for the max number of proprietary rates
     tANI_U32 ProprietaryOperationalRatesLength = 0;
     tANI_U32 PropRatesEnable = 0;
-    tANI_U8 operationChannel = 0;
+    tANI_U8 operationChannel = 0; 
     if(pProfile->ChannelInfo.ChannelList)
     {
        operationChannel = pProfile->ChannelInfo.ChannelList[0];
     }
     cfgDot11Mode = csrRoamGetPhyModeBandForBss( pMac, pProfile, operationChannel, &eBand );
-    // For 11a networks, the 11a rates go into the Operational Rate set.  For 11b and 11g
+    // For 11a networks, the 11a rates go into the Operational Rate set.  For 11b and 11g 
     // networks, the 11b rates appear in the Operational Rate set.  In either case,
-    // we can blindly put the rates we support into our Operational Rate set
-    // (including the basic rates, which we have already verified are supported
+    // we can blindly put the rates we support into our Operational Rate set 
+    // (including the basic rates, which we have already verified are supported 
     // earlier in the roaming decision).
-    if ( eCSR_BAND_5G == eBand )
-    {
-        // 11a rates into the Operational Rate Set.
+    if ( eCSR_BAND_5G == eBand ) 
+    {       
+        // 11a rates into the Operational Rate Set.                 
         OperationalRatesLength = DefaultSupportedRates11a.supportedRateSet.numRates *
                                             sizeof(*DefaultSupportedRates11a.supportedRateSet.rate);
-        palCopyMemory( pMac->hHdd, OperationalRates,
-                        DefaultSupportedRates11a.supportedRateSet.rate,
-                        OperationalRatesLength );
-
+        vos_mem_copy(OperationalRates,
+                     DefaultSupportedRates11a.supportedRateSet.rate,
+                     OperationalRatesLength);
+                         
         // Nothing in the Extended rate set.
         ExtendedOperationalRatesLength = 0;
         // populate proprietary rates if user allows them
-        if ( pMac->roam.configParam.ProprietaryRatesEnabled )
+        if ( pMac->roam.configParam.ProprietaryRatesEnabled ) 
         {
-            ProprietaryOperationalRatesLength = DefaultSupportedPropRates.numPropRates *
-                                                            sizeof(*DefaultSupportedPropRates.propRate);
-            palCopyMemory( pMac->hHdd, ProprietaryOperationalRates,
-                            DefaultSupportedPropRates.propRate,
-                            ProprietaryOperationalRatesLength );
-        }
-        else
-        {
+            ProprietaryOperationalRatesLength = DefaultSupportedPropRates.numPropRates * 
+                                                            sizeof(*DefaultSupportedPropRates.propRate);         
+            vos_mem_copy(ProprietaryOperationalRates,
+                         DefaultSupportedPropRates.propRate,
+                         ProprietaryOperationalRatesLength);
+        }    
+        else 
+        {       
             // No proprietary modes
-            ProprietaryOperationalRatesLength = 0;
-        }
-    }
-    else if ( eCSR_CFG_DOT11_MODE_11B == cfgDot11Mode )
-    {
-        // 11b rates into the Operational Rate Set.
+            ProprietaryOperationalRatesLength = 0;         
+        }    
+    }    
+    else if ( eCSR_CFG_DOT11_MODE_11B == cfgDot11Mode ) 
+    {       
+        // 11b rates into the Operational Rate Set.         
         OperationalRatesLength = DefaultSupportedRates11b.supportedRateSet.numRates *
                                               sizeof(*DefaultSupportedRates11b.supportedRateSet.rate);
-        palCopyMemory( pMac->hHdd, OperationalRates,
-                        DefaultSupportedRates11b.supportedRateSet.rate,
-                        OperationalRatesLength );
+        vos_mem_copy(OperationalRates,
+                     DefaultSupportedRates11b.supportedRateSet.rate,
+                     OperationalRatesLength);
         // Nothing in the Extended rate set.
         ExtendedOperationalRatesLength = 0;
         // No proprietary modes
         ProprietaryOperationalRatesLength = 0;
-    }
-    else
-    {
+    }    
+    else 
+    {       
         // 11G
-
-        // 11b rates into the Operational Rate Set.
-        OperationalRatesLength = DefaultSupportedRates11b.supportedRateSet.numRates *
+        
+        // 11b rates into the Operational Rate Set.         
+        OperationalRatesLength = DefaultSupportedRates11b.supportedRateSet.numRates * 
                                             sizeof(*DefaultSupportedRates11b.supportedRateSet.rate);
-        palCopyMemory( pMac->hHdd, OperationalRates,
-                        DefaultSupportedRates11b.supportedRateSet.rate,
-                        OperationalRatesLength );
-
+        vos_mem_copy(OperationalRates,
+                     DefaultSupportedRates11b.supportedRateSet.rate,
+                     OperationalRatesLength);
+        
         // 11a rates go in the Extended rate set.
-        ExtendedOperationalRatesLength = DefaultSupportedRates11a.supportedRateSet.numRates *
+        ExtendedOperationalRatesLength = DefaultSupportedRates11a.supportedRateSet.numRates * 
                                                     sizeof(*DefaultSupportedRates11a.supportedRateSet.rate);
-        palCopyMemory( pMac->hHdd, ExtendedOperationalRates,
-                        DefaultSupportedRates11a.supportedRateSet.rate,
-                        ExtendedOperationalRatesLength );
-
+        vos_mem_copy(ExtendedOperationalRates,
+                     DefaultSupportedRates11a.supportedRateSet.rate,
+                     ExtendedOperationalRatesLength);
+        
         // populate proprietary rates if user allows them
-        if ( pMac->roam.configParam.ProprietaryRatesEnabled )
+        if ( pMac->roam.configParam.ProprietaryRatesEnabled ) 
         {
             ProprietaryOperationalRatesLength = DefaultSupportedPropRates.numPropRates *
-                                                            sizeof(*DefaultSupportedPropRates.propRate);
-            palCopyMemory( pMac->hHdd, ProprietaryOperationalRates,
-                            DefaultSupportedPropRates.propRate,
-                            ProprietaryOperationalRatesLength );
-        }
-        else
-        {
+                                                            sizeof(*DefaultSupportedPropRates.propRate);         
+            vos_mem_copy(ProprietaryOperationalRates,
+                         DefaultSupportedPropRates.propRate,
+                         ProprietaryOperationalRatesLength);
+        }  
+        else 
+        {       
            // No proprietary modes
-            ProprietaryOperationalRatesLength = 0;
-        }
-    }
+            ProprietaryOperationalRatesLength = 0;         
+        }    
+    }  
     // set this to 1 if prop. rates need to be advertised in to the IBSS beacon and user wants to use them
-    if ( ProprietaryOperationalRatesLength && pMac->roam.configParam.ProprietaryRatesEnabled )
+    if ( ProprietaryOperationalRatesLength && pMac->roam.configParam.ProprietaryRatesEnabled ) 
     {
-        PropRatesEnable = 1;
+        PropRatesEnable = 1;                
     }
-    else
+    else 
     {
-        PropRatesEnable = 0;
+        PropRatesEnable = 0;    
     }
-
+        
     // Set the operational rate set CFG variables...
-    ccmCfgSetStr(pMac, WNI_CFG_OPERATIONAL_RATE_SET, OperationalRates,
+    ccmCfgSetStr(pMac, WNI_CFG_OPERATIONAL_RATE_SET, OperationalRates, 
                     OperationalRatesLength, NULL, eANI_BOOLEAN_FALSE);
-    ccmCfgSetStr(pMac, WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET, ExtendedOperationalRates,
+    ccmCfgSetStr(pMac, WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET, ExtendedOperationalRates, 
                         ExtendedOperationalRatesLength, NULL, eANI_BOOLEAN_FALSE);
-    ccmCfgSetStr(pMac, WNI_CFG_PROPRIETARY_OPERATIONAL_RATE_SET,
-                    ProprietaryOperationalRates,
+    ccmCfgSetStr(pMac, WNI_CFG_PROPRIETARY_OPERATIONAL_RATE_SET, 
+                    ProprietaryOperationalRates, 
                     ProprietaryOperationalRatesLength, NULL, eANI_BOOLEAN_FALSE);
     ccmCfgSetInt(pMac, WNI_CFG_PROPRIETARY_ANI_FEATURES_ENABLED, PropRatesEnable, NULL, eANI_BOOLEAN_FALSE);
 }
@@ -3692,8 +3779,8 @@
     }
     return (WNI_CFG_PHY_MODE_11A);
 }
-
-
+        
+        
 #ifdef WLAN_FEATURE_11AC
 ePhyChanBondState csrGetHTCBStateFromVHTCBState(ePhyChanBondState aniCBMode)
 {
@@ -3717,25 +3804,41 @@
 //pIes may be NULL
 eHalStatus csrRoamSetBssConfigCfg(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
                           tSirBssDescription *pBssDesc, tBssConfigParam *pBssConfig,
-                          tDot11fBeaconIEs *pIes)
+                          tDot11fBeaconIEs *pIes, tANI_BOOLEAN resetCountry)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tANI_U32   cfgCb = WNI_CFG_CHANNEL_BONDING_MODE_DISABLE;
     tANI_U8    channel = 0;
     //Make sure we have the domain info for the BSS we try to connect to.
     //Do we need to worry about sequence for OSs that are not Windows??
-    if(pBssDesc)
+    if (pBssDesc)
     {
-        if(csrLearnCountryInformation(pMac, pBssDesc, pIes, eANI_BOOLEAN_TRUE))
+        if (csrLearnCountryInformation(pMac, pBssDesc, pIes, eANI_BOOLEAN_TRUE))
         {
             //Make sure the 11d info from this BSSDesc can be applied
             pMac->scan.fAmbiguous11dInfoFound = eANI_BOOLEAN_FALSE;
-            csrApplyCountryInformation( pMac, TRUE );
+            if (VOS_TRUE == resetCountry)
+            {
+                csrApplyCountryInformation(pMac, FALSE);
+            }
+            else
+            {
+                csrApplyCountryInformation(pMac, TRUE);
+            }
         }
         if ((csrIs11dSupported (pMac)) && pIes)
         {
             if (!pIes->Country.present)
+            {
                 csrResetCountryInformation(pMac, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_FALSE );
+            }
+            else
+            {
+                //Let's also update the below to make sure we don't update CC while
+                //connected to an AP which is advertising some CC
+                vos_mem_copy(pMac->scan.currentCountryBssid,
+                             pBssDesc->bssId, sizeof(tSirMacAddr));
+            }
         }
     }
     //Qos
@@ -3748,7 +3851,7 @@
     //ccmCfgSetInt(pMac, WNI_CFG_RTS_THRESHOLD, csrGetRTSThresh(pMac), NULL, eANI_BOOLEAN_FALSE);
 
     //ccmCfgSetInt(pMac, WNI_CFG_DOT11_MODE, csrTranslateToWNICfgDot11Mode(pMac, pBssConfig->uCfgDot11Mode), NULL, eANI_BOOLEAN_FALSE);
-
+        
     //Auth type
     ccmCfgSetInt(pMac, WNI_CFG_AUTHENTICATION_TYPE, pBssConfig->authType, NULL, eANI_BOOLEAN_FALSE);
     //encryption type
@@ -3796,7 +3899,7 @@
         if(!WDA_getFwWlanFeatCaps(DOT11AC)) {
             cfgCb = csrGetHTCBStateFromVHTCBState(cfgCb);
         }
-        else
+        else 
         {
             ccmCfgSetInt(pMac, WNI_CFG_VHT_CHANNEL_WIDTH,  pMac->roam.configParam.nVhtChannelWidth, NULL, eANI_BOOLEAN_FALSE);
         }
@@ -3822,23 +3925,25 @@
     return (status);
 }
 
-eHalStatus csrRoamStopNetwork( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
+eHalStatus csrRoamStopNetwork( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, 
                                tSirBssDescription *pBssDesc, tDot11fBeaconIEs *pIes)
 {
     eHalStatus status;
     tBssConfigParam *pBssConfig;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-
+    
     if(!pSession)
     {
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
-    status = palAllocateMemory(pMac->hHdd, (void **)&pBssConfig, sizeof(tBssConfigParam));
-    if(HAL_STATUS_SUCCESS(status))
+    
+    pBssConfig = vos_mem_malloc(sizeof(tBssConfigParam));
+    if ( NULL == pBssConfig )
+        status = eHAL_STATUS_FAILURE;
+    else
     {
-        palZeroMemory(pMac->hHdd, pBssConfig, sizeof(tBssConfigParam));
+        vos_mem_set(pBssConfig, sizeof(tBssConfigParam), 0);
         status = csrRoamPrepareBssConfig(pMac, pProfile, pBssDesc, pBssConfig, pIes);
         if(HAL_STATUS_SUCCESS(status))
         {
@@ -3854,23 +3959,24 @@
             }
             // If we are in an IBSS, then stop the IBSS...
             ////Not worry about WDS connection for now
-            if ( csrIsConnStateIbss( pMac, sessionId ) )
+            if ( csrIsConnStateIbss( pMac, sessionId ) ) 
             {
                 status = csrRoamIssueStopBss( pMac, sessionId, eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING );
             }
-            else
+            else 
             {
                 // if we are in an Infrastructure association....
-                if ( csrIsConnStateInfra( pMac, sessionId ) )
+                if ( csrIsConnStateInfra( pMac, sessionId ) ) 
                 {
                     // and the new Bss is an Ibss OR we are roaming from Infra to Infra
-                    // across SSIDs (roaming to a new SSID)...            //
+                    // across SSIDs (roaming to a new SSID)...            //            
                     //Not worry about WDS connection for now
                     if ( pBssDesc && ( ( csrIsIbssBssDesc( pBssDesc ) ) ||
                           !csrIsSsidEqual( pMac, pSession->pConnectBssDesc, pBssDesc, pIes ) ) )
                     {
                         // then we need to disassociate from the Infrastructure network...
-                        status = csrRoamIssueDisassociate( pMac, sessionId, eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING, FALSE );
+                        status = csrRoamIssueDisassociate( pMac, sessionId,
+                                      eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING, FALSE );
                     }
                     else
                     {
@@ -3879,7 +3985,9 @@
                         if ( pBssDesc )
                         {
                             // Set parameters for this Bss.
-                            status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile, pBssDesc, pBssConfig, pIes);
+                            status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile,
+                                                                 pBssDesc, pBssConfig,
+                                                             pIes, eANI_BOOLEAN_FALSE);
                         }
                     }
                 }
@@ -3891,19 +3999,22 @@
                      || CSR_IS_INFRA_AP(pProfile)
                     )
                     {
+                        tANI_BOOLEAN  is11rRoamingFlag = eANI_BOOLEAN_FALSE;
+                        is11rRoamingFlag = csrRoamIs11rAssoc(pMac);
                         // Set parameters for this Bss.
-                        status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile, pBssDesc, pBssConfig, pIes);
+                        status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile,
+                                                              pBssDesc, pBssConfig,
+                                                              pIes, is11rRoamingFlag);
                     }
                 }
             }
         }//Success getting BSS config info
-        palFreeMemory(pMac->hHdd, pBssConfig);
+        vos_mem_free(pBssConfig);
     }//Allocate memory
-
     return (status);
 }
 
-eCsrJoinState csrRoamJoin( tpAniSirGlobal pMac, tANI_U32 sessionId,
+eCsrJoinState csrRoamJoin( tpAniSirGlobal pMac, tANI_U32 sessionId, 
                            tCsrScanResultInfo *pScanResult, tCsrRoamProfile *pProfile )
 {
     eCsrJoinState eRoamState = eCsrContinueRoaming;
@@ -3917,7 +4028,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return (eCsrStopRoaming);
     }
-
+    
     if( CSR_IS_WDS_STA( pProfile ) )
     {
         status = csrRoamStartWds( pMac, sessionId, pProfile, pBssDesc );
@@ -3933,24 +4044,24 @@
             smsLog(pMac, LOGE, FL(" fail to parse IEs"));
             return (eCsrStopRoaming);
         }
-        if ( csrIsInfraBssDesc( pBssDesc ) )
+        if ( csrIsInfraBssDesc( pBssDesc ) ) 
     {
         // If we are connected in infrastructure mode and the Join Bss description is for the same BssID, then we are
         // attempting to join the AP we are already connected with.  In that case, see if the Bss or Sta capabilities
         // have changed and handle the changes (without disturbing the current association).
-
-        if ( csrIsConnStateConnectedInfra(pMac, sessionId) &&
+                
+        if ( csrIsConnStateConnectedInfra(pMac, sessionId) && 
              csrIsBssIdEqual( pMac, pBssDesc, pSession->pConnectBssDesc ) &&
                  csrIsSsidEqual( pMac, pSession->pConnectBssDesc, pBssDesc, pIesLocal )
-           )
-        {
+           )               
+        {   
             // Check to see if the Auth type has changed in the Profile.  If so, we don't want to Reassociate
-            // with Authenticating first.  To force this, stop the current association (Disassociate) and
-            // then re 'Join' the AP, wihch will force an Authentication (with the new Auth type) followed by
+            // with Authenticating first.  To force this, stop the current association (Disassociate) and 
+            // then re 'Join' the AP, wihch will force an Authentication (with the new Auth type) followed by 
             // a new Association.
             if(csrIsSameProfile(pMac, &pSession->connectedProfile, pProfile))
             {
-                smsLog(pMac, LOGW, FL("  detect same profile authType = %d encryType = %d"), pProfile->AuthType, pProfile->EncryptionType);
+                smsLog(pMac, LOGW, FL("  detect same profile"));
                 if(csrRoamIsSameProfileKeys(pMac, &pSession->connectedProfile, pProfile))
                 {
                     eRoamState = eCsrReassocToSelfNoCapChange;
@@ -3959,14 +4070,16 @@
                 {
                     tBssConfigParam bssConfig;
                     //The key changes
-                    palZeroMemory(pMac->hHdd, &bssConfig, sizeof(bssConfig));
+                    vos_mem_set(&bssConfig, sizeof(bssConfig), 0);
                     status = csrRoamPrepareBssConfig(pMac, pProfile, pBssDesc, &bssConfig, pIesLocal);
                     if(HAL_STATUS_SUCCESS(status))
                     {
                         pSession->bssParams.uCfgDot11Mode = bssConfig.uCfgDot11Mode;
                         pSession->bssParams.cbMode = bssConfig.cbMode;
                         //Reapply the config including Keys so reassoc is happening.
-                        status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile, pBssDesc, &bssConfig, pIesLocal);
+                        status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile,
+                                                        pBssDesc, &bssConfig,
+                                                        pIesLocal, eANI_BOOLEAN_FALSE);
                         if(!HAL_STATUS_SUCCESS(status))
                         {
                             eRoamState = eCsrStopRoaming;
@@ -4011,18 +4124,18 @@
     }
         if( pIesLocal && !pScanResult->pvIes )
         {
-            palFreeMemory(pMac->hHdd, pIesLocal);
+            vos_mem_free(pIesLocal);
         }
     }
     return( eRoamState );
 }
 
-eHalStatus csrRoamShouldRoam(tpAniSirGlobal pMac, tANI_U32 sessionId,
+eHalStatus csrRoamShouldRoam(tpAniSirGlobal pMac, tANI_U32 sessionId, 
                              tSirBssDescription *pBssDesc, tANI_U32 roamId)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tCsrRoamInfo roamInfo;
-    palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+    vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
     roamInfo.pBssDesc = pBssDesc;
     status = csrRoamCallCallback(pMac, sessionId, &roamInfo, roamId, eCSR_ROAM_SHOULD_ROAM, eCSR_ROAM_RESULT_NONE);
     return (status);
@@ -4050,10 +4163,10 @@
              pCommand->u.roamCmd.roamProfile.negotiatedAuthType = eCSR_AUTH_TYPE_AUTOSWITCH;
              break;
     }
-    pCommand->u.roamCmd.roamProfile.negotiatedUCEncryptionType =
-    pCommand->u.roamCmd.roamProfile.EncryptionType.encryptionType[0];
+    pCommand->u.roamCmd.roamProfile.negotiatedUCEncryptionType = 
+    pCommand->u.roamCmd.roamProfile.EncryptionType.encryptionType[0]; 
     //In this case, the multicast encryption needs to follow the uncast ones.
-    pCommand->u.roamCmd.roamProfile.negotiatedMCEncryptionType =
+    pCommand->u.roamCmd.roamProfile.negotiatedMCEncryptionType = 
     pCommand->u.roamCmd.roamProfile.EncryptionType.encryptionType[0];
 }
 
@@ -4088,24 +4201,24 @@
     tCsrRoamInfo roamInfo, *pRoamInfo = NULL;
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
     v_U8_t acm_mask = 0;
-#endif
+#endif 
     tANI_U32 sessionId = pCommand->sessionId;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
     tCsrRoamProfile *pProfile = &pCommand->u.roamCmd.roamProfile;
     tANI_U8  concurrentChannel = 0;
-
+    
     if(!pSession)
     {
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return (eCsrStopRoaming);
     }
-
-    do
+    
+    do  
     {
         // Check for Cardbus eject condition, before trying to Roam to any BSS
         //***if( !balIsCardPresent(pAdapter) ) break;
-
-        palZeroMemory(pMac->hHdd, &roamInfo, sizeof(roamInfo));
+        
+        vos_mem_set(&roamInfo, sizeof(roamInfo), 0);
         memcpy (&roamInfo.bssid, &pSession->joinFailStatusCode.bssId, sizeof(tSirMacAddr));
         if(NULL != pBSSList)
         {
@@ -4131,7 +4244,7 @@
                     else
                     {
                         //We need to indicate to HDD that we are done with this one.
-                        //palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+                        //vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
                         roamInfo.pBssDesc = pCommand->u.roamCmd.pLastRoamBss;     //this shall not be NULL
                         roamInfo.statusCode = pSession->joinFailStatusCode.statusCode;
                         roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
@@ -4143,30 +4256,30 @@
                     pScanResult = GET_BASE_ADDR(pCommand->u.roamCmd.pRoamBssEntry, tCsrScanResult, Link);
                     /*If concurrency enabled take the concurrent connected channel first. */
                     /* Valid multichannel concurrent sessions exempted */
-                    if (vos_concurrent_sessions_running() &&
+                    if (vos_concurrent_sessions_running() && 
                         !csrIsValidMcConcurrentSession(pMac, sessionId, &pScanResult->Result.BssDescriptor))
                     {
-                        concurrentChannel =
+                        concurrentChannel = 
                             csrGetConcurrentOperationChannel(pMac);
                         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH, "%s: "
                                 " csr Concurrent Channel = %d", __func__, concurrentChannel);
-                        if ((concurrentChannel) &&
-                                (concurrentChannel ==
+                        if ((concurrentChannel) && 
+                                (concurrentChannel == 
                                  pScanResult->Result.BssDescriptor.channelId))
                         {
-                            //make this 0 because we do not want the
-                            //below check to pass as we don't want to
+                            //make this 0 because we do not want the 
+                            //below check to pass as we don't want to 
                             //connect on other channel
                             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
                                     FL("Concurrent channel match =%d"),
                                     concurrentChannel);
-                            concurrentChannel = 0;
+                            concurrentChannel = 0; 
                         }
                     }
 
                     if (!concurrentChannel)
                     {
-
+                        
                         if(HAL_STATUS_SUCCESS(csrRoamShouldRoam(pMac,
                             sessionId, &pScanResult->Result.BssDescriptor,
                             pCommand->u.roamCmd.roamId)))
@@ -4219,7 +4332,7 @@
                 csrSetAbortRoamingCommand(pMac, pCommand);
                 break;
             }
-            palZeroMemory(pMac->hHdd, &roamInfo, sizeof(roamInfo));
+            vos_mem_set(&roamInfo, sizeof(roamInfo), 0);
             if(pScanResult)
             {
                 tDot11fBeaconIEs *pIesLocal = (tDot11fBeaconIEs *)pScanResult->Result.pvIes;
@@ -4238,7 +4351,7 @@
                     CSR_IS_UAPSD_BSS(pIesLocal) )
                 {
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
-                    acm_mask = sme_QosGetACMMask(pMac, &pScanResult->Result.BssDescriptor,
+                    acm_mask = sme_QosGetACMMask(pMac, &pScanResult->Result.BssDescriptor, 
                          pIesLocal);
                     pCommand->u.roamCmd.roamProfile.uapsd_mask &= ~(acm_mask);
 #endif /* WLAN_MDM_CODE_REDUCTION_OPT*/
@@ -4249,7 +4362,7 @@
                 }
                 if( pIesLocal && !pScanResult->Result.pvIes)
                 {
-                    palFreeMemory(pMac->hHdd, pIesLocal);
+                    vos_mem_free(pIesLocal);
                 }
             }
             else
@@ -4258,13 +4371,13 @@
             }
             roamInfo.pProfile = pProfile;
             pSession->bRefAssocStartCnt++;
-            csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
+            csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
                                  eCSR_ROAM_ASSOCIATION_START, eCSR_ROAM_RESULT_NONE );
         }
-        if ( NULL == pCommand->u.roamCmd.pRoamBssEntry )
+        if ( NULL == pCommand->u.roamCmd.pRoamBssEntry ) 
         {
             // If this is a start IBSS profile, then we need to start the IBSS.
-            if ( CSR_IS_START_IBSS(pProfile) )
+            if ( CSR_IS_START_IBSS(pProfile) ) 
             {
                 tANI_BOOLEAN fSameIbss = eANI_BOOLEAN_FALSE;
                 // Attempt to start this IBSS...
@@ -4272,7 +4385,7 @@
                 status = csrRoamStartIbss( pMac, sessionId, pProfile, &fSameIbss );
                 if(HAL_STATUS_SUCCESS(status))
                 {
-                    if ( fSameIbss )
+                    if ( fSameIbss ) 
                     {
                         eRoamState = eCsrStartIbssSameIbss;
                     }
@@ -4300,21 +4413,21 @@
                 {
                     eRoamState = eCsrContinueRoaming;
                 }
-                else
+                else 
                 {
                     //it somehow fail need to stop
                     eRoamState = eCsrStopRoaming;
                 }
             }
-            else
+            else 
             {
                 //Nothing we can do
                 smsLog(pMac, LOGW, FL("cannot continue without BSS list"));
                 eRoamState = eCsrStopRoaming;
                 break;
             }
-        }
-        else //We have BSS
+        } 
+        else //We have BSS 
         {
             //Need to assign these value because they are used in csrIsSameProfile
             pScanResult = GET_BASE_ADDR(pCommand->u.roamCmd.pRoamBssEntry, tCsrScanResult, Link);
@@ -4327,7 +4440,7 @@
                 {
                     eRoamState = eCsrStartIbssSameIbss;
                     break;
-                }
+                } 
             }
             if( pCommand->u.roamCmd.fReassocToSelfNoCapChange )
             {
@@ -4340,7 +4453,7 @@
             eRoamState = csrRoamJoin( pMac, sessionId, &pScanResult->Result, pProfile );
             break;
         }
-
+        
     } while( 0 );
     if( (eCsrStopRoaming == eRoamState) && (CSR_IS_INFRASTRUCTURE( pProfile )) )
     {
@@ -4350,8 +4463,8 @@
             pSession->bRefAssocStartCnt--;
             //Complete the last association attemp because a new one is about to be tried
             pRoamInfo = &roamInfo;
-            csrRoamCallCallback(pMac, sessionId, pRoamInfo, pCommand->u.roamCmd.roamId,
-                                        eCSR_ROAM_ASSOCIATION_COMPLETION,
+            csrRoamCallCallback(pMac, sessionId, pRoamInfo, pCommand->u.roamCmd.roamId, 
+                                        eCSR_ROAM_ASSOCIATION_COMPLETION, 
                                         eCSR_ROAM_RESULT_NOT_ASSOCIATED);
         }
     }
@@ -4364,7 +4477,7 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     eCsrJoinState RoamState;
     tANI_U32 sessionId = pCommand->sessionId;
-
+    
     //***if( hddIsRadioStateOn( pAdapter ) )
     {
         // Attept to join a Bss...
@@ -4375,7 +4488,7 @@
         {
             tANI_BOOLEAN fComplete = eANI_BOOLEAN_FALSE;
             // and if connected in Infrastructure mode...
-            if ( csrIsConnStateInfra(pMac, sessionId) )
+            if ( csrIsConnStateInfra(pMac, sessionId) ) 
             {
                 //... then we need to issue a disassociation
                 status = csrRoamIssueDisassociate( pMac, sessionId, eCSR_ROAM_SUBSTATE_DISASSOC_NOTHING_TO_JOIN, FALSE );
@@ -4407,7 +4520,7 @@
                 }
             }
             else
-            {
+            {        
                 fComplete = eANI_BOOLEAN_TRUE;
             }
             if(fComplete)
@@ -4421,7 +4534,7 @@
                {
                    csrRoamComplete( pMac, eCsrNothingToJoin, NULL );
                }
-            }
+            }    
        }
        else if ( eCsrReassocToSelfNoCapChange == RoamState )
        {
@@ -4429,10 +4542,10 @@
        }
        else if ( eCsrStartIbssSameIbss == RoamState )
        {
-           csrRoamComplete( pMac, eCsrSilentlyStopRoaming, NULL );
+           csrRoamComplete( pMac, eCsrSilentlyStopRoaming, NULL );        
        }
     }//hddIsRadioStateOn
-
+    
     return status;
 }
 eHalStatus csrProcessFTReassocRoamCommand ( tpAniSirGlobal pMac, tSmeCmd *pCommand )
@@ -4450,12 +4563,12 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     if(CSR_IS_ROAMING(pSession) && pSession->fCancelRoaming)
     {
         //the roaming is cancelled. Simply complete the command
         smsLog(pMac, LOG1, FL("  Roam command cancelled"));
-        csrRoamComplete(pMac, eCsrNothingToJoin, NULL);
+        csrRoamComplete(pMac, eCsrNothingToJoin, NULL); 
         return eHAL_STATUS_FAILURE;
     }
     if (pCommand->u.roamCmd.pRoamBssEntry)
@@ -4467,10 +4580,10 @@
     {
         //the roaming is cancelled. Simply complete the command
         smsLog(pMac, LOG1, FL("  Roam command cancelled"));
-        csrRoamComplete(pMac, eCsrNothingToJoin, NULL);
+        csrRoamComplete(pMac, eCsrNothingToJoin, NULL); 
         return eHAL_STATUS_FAILURE;
     }
-    status = csrRoamIssueReassociate(pMac, sessionId, pBssDesc,
+    status = csrRoamIssueReassociate(pMac, sessionId, pBssDesc, 
         (tDot11fBeaconIEs *)( pScanResult->Result.pvIes ), &pCommand->u.roamCmd.roamProfile);
     return status;
 }
@@ -4487,7 +4600,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     switch ( pCommand->u.roamCmd.roamReason )
     {
     case eCsrForcedDisassoc:
@@ -4537,9 +4650,9 @@
                 roamInfo.pBssDesc = pSession->pConnectBssDesc;
                 roamInfo.pProfile = &pCommand->u.roamCmd.roamProfile;
                 pSession->bRefAssocStartCnt++;
-                csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
+                csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
                                      eCSR_ROAM_ASSOCIATION_START, eCSR_ROAM_RESULT_NONE );
-
+   
                 smsLog(pMac, LOG1, FL("  calling csrRoamIssueReassociate"));
                 status = csrRoamIssueReassociate( pMac, sessionId, pSession->pConnectBssDesc, pIes,
                                                   &pCommand->u.roamCmd.roamProfile );
@@ -4549,7 +4662,7 @@
                     csrReleaseCommandRoam( pMac, pCommand );
                 }
 
-                palFreeMemory(pMac->hHdd, pIes);
+                vos_mem_free(pIes);
                 pIes = NULL;
             }
         }
@@ -4558,10 +4671,10 @@
     case eCsrCapsChange:
         smsLog(pMac, LOGE, FL("received eCsrCapsChange "));
         csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINING, sessionId );
-        status = csrRoamIssueDisassociate( pMac, sessionId, eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING, FALSE);
+        status = csrRoamIssueDisassociate( pMac, sessionId, eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING, FALSE); 
         break;
     case eCsrSmeIssuedFTReassoc:
-        smsLog(pMac, LOGE, FL("received FT Reassoc Req "));
+        smsLog(pMac, LOG1, FL("received FT Reassoc Req "));
         status = csrProcessFTReassocRoamCommand(pMac, pCommand);
         break;
 
@@ -4573,20 +4686,20 @@
     case eCsrForcedDisassocSta:
        csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINING, sessionId);
        csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_DISASSOC_REQ, sessionId);
-       status = csrSendMBDisassocReqMsg( pMac, sessionId, pCommand->u.roamCmd.peerMac,
+       status = csrSendMBDisassocReqMsg( pMac, sessionId, pCommand->u.roamCmd.peerMac, 
                      pCommand->u.roamCmd.reason);
        break;
 
     case eCsrForcedDeauthSta:
        csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINING, sessionId);
        csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_DEAUTH_REQ, sessionId);
-       status = csrSendMBDeauthReqMsg( pMac, sessionId, pCommand->u.roamCmd.peerMac,
+       status = csrSendMBDeauthReqMsg( pMac, sessionId, pCommand->u.roamCmd.peerMac, 
                      pCommand->u.roamCmd.reason);
        break;
 
     case eCsrPerformPreauth:
         smsLog(pMac, LOG1, FL("Attempting FT PreAuth Req"));
-        status = csrRoamIssueFTPreauthReq(pMac, sessionId,
+        status = csrRoamIssueFTPreauthReq(pMac, sessionId, 
                 pCommand->u.roamCmd.pLastRoamBss);
         break;
 
@@ -4595,18 +4708,19 @@
 
         if( pCommand->u.roamCmd.fUpdateCurRoamProfile )
         {
-            //Remember the roaming profile
+            //Remember the roaming profile 
             csrFreeRoamProfile(pMac, sessionId);
-            if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pSession->pCurRoamProfile, sizeof(tCsrRoamProfile))))
+            pSession->pCurRoamProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+            if ( NULL != pSession->pCurRoamProfile )
             {
-                palZeroMemory(pMac->hHdd, pSession->pCurRoamProfile, sizeof(tCsrRoamProfile));
+                vos_mem_set(pSession->pCurRoamProfile, sizeof(tCsrRoamProfile), 0);
                 csrRoamCopyProfile(pMac, pSession->pCurRoamProfile, &pCommand->u.roamCmd.roamProfile);
             }
         }
-
+ 
         //At this point, original uapsd_mask is saved in pCurRoamProfile
         //uapsd_mask in the pCommand may change from this point on.
-
+ 
         // Attempt to roam with the new scan results (if we need to..)
         status = csrRoam( pMac, pCommand );
         if(!HAL_STATUS_SUCCESS(status))
@@ -4618,15 +4732,15 @@
     return (status);
 }
 
-void csrReinitPreauthCmd(tpAniSirGlobal pMac, tSmeCmd *pCommand)
+void csrReinitPreauthCmd(tpAniSirGlobal pMac, tSmeCmd *pCommand) 
 {
     pCommand->u.roamCmd.pLastRoamBss = NULL;
     pCommand->u.roamCmd.pRoamBssEntry = NULL;
     //Because u.roamCmd is union and share with scanCmd and StatusChange
-    palZeroMemory(pMac->hHdd, &pCommand->u.roamCmd, sizeof(tRoamCmd));
+    vos_mem_set(&pCommand->u.roamCmd, sizeof(tRoamCmd), 0);
 }
 
-void csrReinitRoamCmd(tpAniSirGlobal pMac, tSmeCmd *pCommand)
+void csrReinitRoamCmd(tpAniSirGlobal pMac, tSmeCmd *pCommand) 
 {
     if(pCommand->u.roamCmd.fReleaseBssList)
     {
@@ -4641,12 +4755,12 @@
     }
     pCommand->u.roamCmd.pRoamBssEntry = NULL;
     //Because u.roamCmd is union and share with scanCmd and StatusChange
-    palZeroMemory(pMac->hHdd, &pCommand->u.roamCmd, sizeof(tRoamCmd));
+    vos_mem_set(&pCommand->u.roamCmd, sizeof(tRoamCmd), 0);
 }
 
 void csrReinitWmStatusChangeCmd(tpAniSirGlobal pMac, tSmeCmd *pCommand)
 {
-    palZeroMemory(pMac->hHdd, &pCommand->u.wmStatusChangeCmd, sizeof(tWmStatusChangeCmd));
+    vos_mem_set(&pCommand->u.wmStatusChangeCmd, sizeof(tWmStatusChangeCmd), 0);
 }
 void csrRoamComplete( tpAniSirGlobal pMac, eCsrRoamCompleteResult Result, void *Context )
 {
@@ -4662,7 +4776,7 @@
         // and put this on the Free queue.
         if ( eSmeCommandRoam == pCommand->command )
         {
-            //we need to process the result first before removing it from active list because state changes
+            //we need to process the result first before removing it from active list because state changes 
             //still happening insides roamQProcessRoamResults so no other roam command should be issued
             fReleaseCommand = csrRoamProcessResults( pMac, pCommand, Result, Context );
             if( fReleaseCommand )
@@ -4706,7 +4820,8 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-    palZeroMemory( pMac->hHdd, &(pSession->PmkidCandidateInfo[0]), sizeof(tPmkidCandidateInfo) * CSR_MAX_PMKID_ALLOWED );
+    vos_mem_set(&(pSession->PmkidCandidateInfo[0]),
+                sizeof(tPmkidCandidateInfo) * CSR_MAX_PMKID_ALLOWED, 0);
     pSession->NumPmkidCandidate = 0;
 }
 #ifdef FEATURE_WLAN_WAPI
@@ -4718,13 +4833,14 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-    palZeroMemory( pMac->hHdd, &(pSession->BkidCandidateInfo[0]), sizeof(tBkidCandidateInfo) * CSR_MAX_BKID_ALLOWED );
+    vos_mem_set(&(pSession->BkidCandidateInfo[0]),
+                sizeof(tBkidCandidateInfo) * CSR_MAX_BKID_ALLOWED, 0);
     pSession->NumBkidCandidate = 0;
 }
 #endif /* FEATURE_WLAN_WAPI */
 extern tANI_U8 csrWpaOui[][ CSR_WPA_OUI_SIZE ];
 
-static eHalStatus csrRoamSaveSecurityRspIE(tpAniSirGlobal pMac, tANI_U32 sessionId, eCsrAuthType authType,
+static eHalStatus csrRoamSaveSecurityRspIE(tpAniSirGlobal pMac, tANI_U32 sessionId, eCsrAuthType authType, 
                                          tSirBssDescription *pSirBssDesc,
                                          tDot11fBeaconIEs *pIes)
 {
@@ -4737,7 +4853,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     if((eCSR_AUTH_TYPE_WPA == authType) ||
         (eCSR_AUTH_TYPE_WPA_PSK == authType) ||
         (eCSR_AUTH_TYPE_RSN == authType) ||
@@ -4747,7 +4863,7 @@
        (eCSR_AUTH_TYPE_FT_RSN == authType) ||
        (eCSR_AUTH_TYPE_FT_RSN_PSK == authType)
 #endif /* FEATURE_WLAN_WAPI */
-#ifdef FEATURE_WLAN_WAPI
+#ifdef FEATURE_WLAN_WAPI 
       ||
        (eCSR_AUTH_TYPE_WAPI_WAI_PSK == authType) ||
        (eCSR_AUTH_TYPE_WAPI_WAI_CERTIFICATE == authType)
@@ -4789,40 +4905,48 @@
                         nIeLen += 2 + pIesLocal->RSN.pmkid_count * 4;  //pmkid
                     }
                     //nIeLen doesn't count EID and length fields
-                    if(HAL_STATUS_SUCCESS((status = palAllocateMemory(pMac->hHdd, (void **)&pSession->pWpaRsnRspIE, nIeLen + 2))))
+                    pSession->pWpaRsnRspIE = vos_mem_malloc(nIeLen + 2);
+                    if (NULL == pSession->pWpaRsnRspIE)
+                        status = eHAL_STATUS_FAILURE;
+                    else
                     {
-                        palZeroMemory(pMac->hHdd, pSession->pWpaRsnRspIE, nIeLen + 2);
+                        vos_mem_set(pSession->pWpaRsnRspIE, nIeLen + 2, 0);
                         pSession->pWpaRsnRspIE[0] = DOT11F_EID_RSN;
                         pSession->pWpaRsnRspIE[1] = (tANI_U8)nIeLen;
                         //copy upto akm_suites
                         pIeBuf = pSession->pWpaRsnRspIE + 2;
-                        palCopyMemory(pMac->hHdd, pIeBuf, &pIesLocal->RSN.version, sizeof(pIesLocal->RSN.version));
+                        vos_mem_copy(pIeBuf, &pIesLocal->RSN.version,
+                                     sizeof(pIesLocal->RSN.version));
                         pIeBuf += sizeof(pIesLocal->RSN.version);
-                        palCopyMemory(pMac->hHdd, pIeBuf, &pIesLocal->RSN.gp_cipher_suite, sizeof(pIesLocal->RSN.gp_cipher_suite));
+                        vos_mem_copy(pIeBuf, &pIesLocal->RSN.gp_cipher_suite,
+                                     sizeof(pIesLocal->RSN.gp_cipher_suite));
                         pIeBuf += sizeof(pIesLocal->RSN.gp_cipher_suite);
-                        palCopyMemory(pMac->hHdd, pIeBuf, &pIesLocal->RSN.pwise_cipher_suite_count, sizeof(pIesLocal->RSN.pwise_cipher_suite_count));
+                        vos_mem_copy(pIeBuf, &pIesLocal->RSN.pwise_cipher_suite_count,
+                                     sizeof(pIesLocal->RSN.pwise_cipher_suite_count));
                         pIeBuf += sizeof(pIesLocal->RSN.pwise_cipher_suite_count );
                         if( pIesLocal->RSN.pwise_cipher_suite_count )
                         {
                             //copy pwise_cipher_suites
-                            palCopyMemory(pMac->hHdd, pIeBuf, pIesLocal->RSN.pwise_cipher_suites,
-                                            pIesLocal->RSN.pwise_cipher_suite_count * 4);
+                            vos_mem_copy(pIeBuf,
+                                         pIesLocal->RSN.pwise_cipher_suites,
+                                         pIesLocal->RSN.pwise_cipher_suite_count * 4);
                             pIeBuf += pIesLocal->RSN.pwise_cipher_suite_count * 4;
                         }
-                        palCopyMemory(pMac->hHdd, pIeBuf, &pIesLocal->RSN.akm_suite_count, 2);
+                        vos_mem_copy(pIeBuf, &pIesLocal->RSN.akm_suite_count, 2);
                         pIeBuf += 2;
                         if( pIesLocal->RSN.akm_suite_count )
                         {
                             //copy akm_suites
-                            palCopyMemory(pMac->hHdd, pIeBuf, pIesLocal->RSN.akm_suites,
-                                            pIesLocal->RSN.akm_suite_count * 4);
+                            vos_mem_copy(pIeBuf,
+                                         pIesLocal->RSN.akm_suites,
+                                         pIesLocal->RSN.akm_suite_count * 4);
                             pIeBuf += pIesLocal->RSN.akm_suite_count * 4;
                         }
                         //copy the rest
-                        palCopyMemory(pMac->hHdd, pIeBuf, pIesLocal->RSN.akm_suites +
-                                        pIesLocal->RSN.akm_suite_count * 4,
-                                        2 + pIesLocal->RSN.pmkid_count * 4);
-                        pSession->nWpaRsnRspIeLength = nIeLen + 2;
+                        vos_mem_copy(pIeBuf,
+                                     pIesLocal->RSN.akm_suites + pIesLocal->RSN.akm_suite_count * 4,
+                                     2 + pIesLocal->RSN.pmkid_count * 4);
+                        pSession->nWpaRsnRspIeLength = nIeLen + 2; 
                     }
                 }
             }
@@ -4841,21 +4965,25 @@
                     // remove it.  This is consistent with our assumptions in the
                     // frames compiler; c.f. bug 15234:
                     //nIeLen doesn't count EID and length fields
-                    if(HAL_STATUS_SUCCESS((status = palAllocateMemory(pMac->hHdd, (void **)&pSession->pWpaRsnRspIE, nIeLen + 2))))
+
+                    pSession->pWpaRsnRspIE = vos_mem_malloc(nIeLen + 2);
+                    if ( NULL == pSession->pWpaRsnRspIE )
+                        status = eHAL_STATUS_FAILURE;
+                    else
                     {
                         pSession->pWpaRsnRspIE[0] = DOT11F_EID_WPA;
                         pSession->pWpaRsnRspIE[1] = (tANI_U8)nIeLen;
                         pIeBuf = pSession->pWpaRsnRspIE + 2;
                         //Copy WPA OUI
-                        palCopyMemory(pMac->hHdd, pIeBuf, &csrWpaOui[1], 4);
+                        vos_mem_copy(pIeBuf, &csrWpaOui[1], 4);
                         pIeBuf += 4;
-                        palCopyMemory(pMac->hHdd, pIeBuf, &pIesLocal->WPA.version, 8 +
-                                        pIesLocal->WPA.unicast_cipher_count * 4);
+                        vos_mem_copy(pIeBuf, &pIesLocal->WPA.version,
+                                     8 + pIesLocal->WPA.unicast_cipher_count * 4);
                         pIeBuf += 8 + pIesLocal->WPA.unicast_cipher_count * 4;
-                        palCopyMemory(pMac->hHdd, pIeBuf, &pIesLocal->WPA.auth_suite_count, 2 +
-                                        pIesLocal->WPA.auth_suite_count * 4);
+                        vos_mem_copy(pIeBuf, &pIesLocal->WPA.auth_suite_count,
+                                     2 + pIesLocal->WPA.auth_suite_count * 4);
                         pIeBuf += pIesLocal->WPA.auth_suite_count * 4;
-                        pSession->nWpaRsnRspIeLength = nIeLen + 2;
+                        pSession->nWpaRsnRspIeLength = nIeLen + 2; 
                     }
                 }
             }
@@ -4866,7 +4994,7 @@
                 if(pIesLocal->WAPI.present)
                 {
                    //Calculate the actual length
-                   nIeLen = 4 //version + akm_suite_count
+                   nIeLen = 4 //version + akm_suite_count 
                       + pIesLocal->WAPI.akm_suite_count * 4 // akm_suites
                       + 2 //pwise_cipher_suite_count
                       + pIesLocal->WAPI.unicast_cipher_suite_count * 4    //pwise_cipher_suites
@@ -4875,39 +5003,57 @@
                       {
                            nIeLen += 2 + pIesLocal->WAPI.bkid_count * 4;  //bkid
         }
-
+                      
                    //nIeLen doesn't count EID and length fields
-                   if(HAL_STATUS_SUCCESS((status = palAllocateMemory(pMac->hHdd, (void **)&pSession->pWapiRspIE, nIeLen + 2))))
+                   pSession->pWapiRspIE = vos_mem_malloc(nIeLen + 2);
+                   if ( NULL == pSession->pWapiRspIE )
+                        status = eHAL_STATUS_FAILURE;
+                   else
                    {
                       pSession->pWapiRspIE[0] = DOT11F_EID_WAPI;
                       pSession->pWapiRspIE[1] = (tANI_U8)nIeLen;
                       pIeBuf = pSession->pWapiRspIE + 2;
                       //copy upto akm_suite_count
-                      palCopyMemory(pMac->hHdd, pIeBuf, &pIesLocal->WAPI.version, 4);
+                      vos_mem_copy(pIeBuf, &pIesLocal->WAPI.version, 2);
                       pIeBuf += 4;
                       if( pIesLocal->WAPI.akm_suite_count )
                       {
                          //copy akm_suites
-                         palCopyMemory(pMac->hHdd, pIeBuf, pIesLocal->WAPI.akm_suites,
-                                        pIesLocal->WAPI.akm_suite_count * 4);
+                         vos_mem_copy(pIeBuf, pIesLocal->WAPI.akm_suites,
+                                      pIesLocal->WAPI.akm_suite_count * 4);
                          pIeBuf += pIesLocal->WAPI.akm_suite_count * 4;
-    }
-                      palCopyMemory(pMac->hHdd, pIeBuf, &pIesLocal->WAPI.unicast_cipher_suite_count, 2);
+                      }
+                      vos_mem_copy(pIeBuf,
+                                   &pIesLocal->WAPI.unicast_cipher_suite_count,
+                                   2);
                       pIeBuf += 2;
                       if( pIesLocal->WAPI.unicast_cipher_suite_count )
                       {
                          //copy pwise_cipher_suites
-                         palCopyMemory(pMac->hHdd, pIeBuf, pIesLocal->WAPI.unicast_cipher_suites,
-                                        pIesLocal->WAPI.unicast_cipher_suite_count * 4);
+                         vos_mem_copy( pIeBuf,
+                                       pIesLocal->WAPI.unicast_cipher_suites,
+                                       pIesLocal->WAPI.unicast_cipher_suite_count * 4);
                          pIeBuf += pIesLocal->WAPI.unicast_cipher_suite_count * 4;
                       }
-                      //gp_cipher_suite + preauth + reserved + bkid_count
-                      palCopyMemory(pMac->hHdd, pIeBuf, &pIesLocal->WAPI.multicast_cipher_suite, 8);
-                      pIeBuf += 8;
+                      //gp_cipher_suite
+                      vos_mem_copy(pIeBuf,
+                                   pIesLocal->WAPI.multicast_cipher_suite,
+                                   4);
+                      pIeBuf += 4;
+                      //preauth + reserved
+                      vos_mem_copy(pIeBuf,
+                                   pIesLocal->WAPI.multicast_cipher_suite + 4,
+                                   2);
+                      pIeBuf += 2;
+                      //bkid_count
+                      vos_mem_copy(pIeBuf, &pIesLocal->WAPI.bkid_count, 2);
+
+                      pIeBuf += 2;
                       if( pIesLocal->WAPI.bkid_count )
                       {
                          //copy akm_suites
-                         palCopyMemory(pMac->hHdd, pIeBuf, pIesLocal->WAPI.bkid, pIesLocal->WAPI.bkid_count * 4);
+                         vos_mem_copy(pIeBuf, pIesLocal->WAPI.bkid,
+                                      pIesLocal->WAPI.bkid_count * 4);
                          pIeBuf += pIesLocal->WAPI.bkid_count * 4;
                       }
                       pSession->nWapiRspIeLength = nIeLen + 2;
@@ -4918,7 +5064,7 @@
             if( !pIes )
             {
                 //locally allocated
-                palFreeMemory(pMac->hHdd, pIesLocal);
+                vos_mem_free(pIesLocal);
         }
     }
     }
@@ -5023,9 +5169,37 @@
         }
     }
 
-    return (pMac->roam.configParam.isFastRoamIniFeatureEnabled &&
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    if (eANI_BOOLEAN_TRUE == CSR_IS_FASTROAM_IN_CONCURRENCY_INI_FEATURE_ENABLED(pMac))
+    {
+        return (pMac->roam.configParam.isFastRoamIniFeatureEnabled);
+    }
+    else
+#endif
+    {
+        return (pMac->roam.configParam.isFastRoamIniFeatureEnabled &&
             (!csrIsConcurrentSessionRunning(pMac)));
+    }
 }
+
+#ifdef FEATURE_WLAN_CCX
+/* ---------------------------------------------------------------------------
+    \fn csrNeighborRoamIsCCXAssoc
+
+    \brief  This function returns whether the current association
+            is a CCX assoc or not
+
+    \param  pMac - The handle returned by macOpen.
+
+    \return eANI_BOOLEAN_TRUE if current assoc is CCX, eANI_BOOLEAN_FALSE
+     otherwise
+---------------------------------------------------------------------------*/
+tANI_BOOLEAN csrNeighborRoamIsCCXAssoc(tpAniSirGlobal pMac)
+{
+    return pMac->roam.neighborRoamInfo.isCCXAssoc;
+}
+#endif /* FEATURE_WLAN_CCX */
+
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 //Returns whether "FW based BG scan" is currently enabled...or not
 tANI_BOOLEAN csrRoamIsRoamOffloadScanEnabled(tpAniSirGlobal pMac)
@@ -5035,12 +5209,19 @@
 #endif
 #endif
 
+#if defined(FEATURE_WLAN_CCX)
+tANI_BOOLEAN csrRoamIsCcxIniFeatureEnabled(tpAniSirGlobal pMac)
+{
+    return pMac->roam.configParam.isCcxIniFeatureEnabled;
+}
+#endif /*FEATURE_WLAN_CCX*/
+
 //Return true means the command can be release, else not
 static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pCommand,
                                        eCsrRoamCompleteResult Result, void *Context )
 {
     tANI_BOOLEAN fReleaseCommand = eANI_BOOLEAN_TRUE;
-    tSirBssDescription *pSirBssDesc = NULL;
+    tSirBssDescription *pSirBssDesc = NULL;   
     tSirMacAddr BroadcastMac = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
     tCsrScanResult *pScanResult = NULL;
     tCsrRoamInfo roamInfo;
@@ -5083,19 +5264,19 @@
             // Success Join Response from LIM.  Tell NDIS we are connected and save the
             // Connected state...
             smsLog(pMac, LOGW, FL("receives association indication"));
-            palZeroMemory(pMac->hHdd, &roamInfo, sizeof(roamInfo));
+            vos_mem_set(&roamInfo, sizeof(roamInfo), 0);
             //always free the memory here
             if(pSession->pWpaRsnRspIE)
             {
                 pSession->nWpaRsnRspIeLength = 0;
-                palFreeMemory(pMac->hHdd, pSession->pWpaRsnRspIE);
+                vos_mem_free(pSession->pWpaRsnRspIE);
                 pSession->pWpaRsnRspIE = NULL;
             }
 #ifdef FEATURE_WLAN_WAPI
             if(pSession->pWapiRspIE)
             {
                 pSession->nWapiRspIeLength = 0;
-                palFreeMemory(pMac->hHdd, pSession->pWapiRspIE);
+                vos_mem_free(pSession->pWapiRspIE);
                 pSession->pWapiRspIE = NULL;
             }
 #endif /* FEATURE_WLAN_WAPI */
@@ -5124,12 +5305,13 @@
                 pSirBssDesc = pSession->pConnectBssDesc;
                 if(pSirBssDesc)
                 {
-                    palCopyMemory(pMac->hHdd, &roamInfo.bssid, &pSirBssDesc->bssId, sizeof(tCsrBssid));
-                }
+                    vos_mem_copy(&roamInfo.bssid, &pSirBssDesc->bssId,
+                                 sizeof(tCsrBssid));
+                } 
             }
             else
             {
-
+     
                 if(pCommand->u.roamCmd.pRoamBssEntry)
                 {
                     pScanResult = GET_BASE_ADDR(pCommand->u.roamCmd.pRoamBssEntry, tCsrScanResult, Link);
@@ -5138,7 +5320,8 @@
                         pSirBssDesc = &pScanResult->Result.BssDescriptor;
                         //this can be NULL
                         pIes = (tDot11fBeaconIEs *)( pScanResult->Result.pvIes );
-                        palCopyMemory(pMac->hHdd, &roamInfo.bssid, &pSirBssDesc->bssId, sizeof(tCsrBssid));
+                        vos_mem_copy(&roamInfo.bssid, &pSirBssDesc->bssId,
+                                     sizeof(tCsrBssid));
                     }
                 }
             }
@@ -5151,28 +5334,28 @@
 #ifdef FEATURE_WLAN_CCX
                 roamInfo.isCCXAssoc = pSession->connectedProfile.isCCXAssoc;
 #endif
-
+                
                 // csrRoamStateChange also affects sub-state. Hence, csrRoamStateChange happens first and then
                 // substate change.
                 // Moving even save profile above so that below mentioned conditon is also met.
                 // JEZ100225: Moved to after saving the profile. Fix needed in main/latest
                 csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINED, sessionId );
-                // Make sure the Set Context is issued before link indication to NDIS.  After link indication is
+                // Make sure the Set Context is issued before link indication to NDIS.  After link indication is 
                 // made to NDIS, frames could start flowing.  If we have not set context with LIM, the frames
-                // will be dropped for the security context may not be set properly.
+                // will be dropped for the security context may not be set properly. 
                 //
                 // this was causing issues in the 2c_wlan_wep WHQL test when the SetContext was issued after the link
                 // indication.  (Link Indication happens in the profFSMSetConnectedInfra call).
                 //
                 // this reordering was done on titan_prod_usb branch and is being replicated here.
                 //
-
+            
                 if( CSR_IS_ENC_TYPE_STATIC( pProfile->negotiatedUCEncryptionType ) &&
                                         !pProfile->bWPSAssociation)
                 {
                     // Issue the set Context request to LIM to establish the Unicast STA context
                     if( !HAL_STATUS_SUCCESS( csrRoamIssueSetContextReq( pMac, sessionId,
-                                                pProfile->negotiatedUCEncryptionType,
+                                                pProfile->negotiatedUCEncryptionType, 
                                                 pSirBssDesc, &(pSirBssDesc->bssId),
                                                 FALSE, TRUE, eSIR_TX_RX, 0, 0, NULL, 0 ) ) ) // NO keys... these key parameters don't matter.
                     {
@@ -5199,7 +5382,7 @@
                     {
                         key_timeout_interval = CSR_WAIT_FOR_KEY_TIMEOUT_PERIOD;
                     }
-
+                    
                     //Save sessionId in case of timeout
                     pMac->roam.WaitForKeyTimerInfo.sessionId = (tANI_U8)sessionId;
                     //This time should be long enough for the rest of the process plus setting key
@@ -5210,7 +5393,7 @@
                         csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_NONE, sessionId);
                     }
                 }
-
+                
                 assocInfo.pBssDesc = pSirBssDesc; //could be NULL
                 assocInfo.pProfile = pProfile;
                 if(Context)
@@ -5221,39 +5404,30 @@
                     len = pJoinRsp->assocReqLength + pJoinRsp->assocRspLength + pJoinRsp->beaconLength;
 #ifdef WLAN_FEATURE_VOWIFI_11R
                     len += pJoinRsp->parsedRicRspLen;
-#endif /* WLAN_FEATURE_VOWIFI_11R */
+#endif /* WLAN_FEATURE_VOWIFI_11R */                    
 #ifdef FEATURE_WLAN_CCX
                     len += pJoinRsp->tspecIeLen;
 #endif
                     if(len)
                     {
-                        if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd,
-                                        (void **)&pSession->connectedInfo.pbFrames, len)))
+                        pSession->connectedInfo.pbFrames = vos_mem_malloc(len);
+                        if ( pSession->connectedInfo.pbFrames != NULL )
                         {
-                            if(HAL_STATUS_SUCCESS( palCopyMemory(pMac->hHdd,
-                                            pSession->connectedInfo.pbFrames, pJoinRsp->frames, len) ))
-                            {
-                                pSession->connectedInfo.nAssocReqLength = pJoinRsp->assocReqLength;
-                                pSession->connectedInfo.nAssocRspLength = pJoinRsp->assocRspLength;
-                                pSession->connectedInfo.nBeaconLength = pJoinRsp->beaconLength;
+                            vos_mem_copy(pSession->connectedInfo.pbFrames,
+                                         pJoinRsp->frames, len);
+                            pSession->connectedInfo.nAssocReqLength = pJoinRsp->assocReqLength;
+                            pSession->connectedInfo.nAssocRspLength = pJoinRsp->assocRspLength;
+                            pSession->connectedInfo.nBeaconLength = pJoinRsp->beaconLength;
 #ifdef WLAN_FEATURE_VOWIFI_11R
-                                pSession->connectedInfo.nRICRspLength = pJoinRsp->parsedRicRspLen;
-#endif /* WLAN_FEATURE_VOWIFI_11R */
+                            pSession->connectedInfo.nRICRspLength = pJoinRsp->parsedRicRspLen;
+#endif /* WLAN_FEATURE_VOWIFI_11R */                                
 #ifdef FEATURE_WLAN_CCX
-                                pSession->connectedInfo.nTspecIeLength = pJoinRsp->tspecIeLen;
+                            pSession->connectedInfo.nTspecIeLength = pJoinRsp->tspecIeLen;
 #endif
-                                roamInfo.nAssocReqLength = pJoinRsp->assocReqLength;
-                                roamInfo.nAssocRspLength = pJoinRsp->assocRspLength;
-                                roamInfo.nBeaconLength = pJoinRsp->beaconLength;
-                                roamInfo.pbFrames = pSession->connectedInfo.pbFrames;
-                            }
-                            else
-                            {
-                                smsLog(pMac, LOGE, "%s: Copying of memory failed for %d bytes !!!",
-                                        __func__, len);
-                                palFreeMemory( pMac->hHdd, pSession->connectedInfo.pbFrames );
-                                pSession->connectedInfo.pbFrames = NULL;
-                            }
+                            roamInfo.nAssocReqLength = pJoinRsp->assocReqLength;
+                            roamInfo.nAssocRspLength = pJoinRsp->assocRspLength;
+                            roamInfo.nBeaconLength = pJoinRsp->beaconLength;
+                            roamInfo.pbFrames = pSession->connectedInfo.pbFrames;
                         }
                     }
                     if(pCommand->u.roamCmd.fReassoc)
@@ -5277,8 +5451,8 @@
                    }
                 }
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
-                // Indicate SME-QOS with reassoc success event, only after
-                // copying the frames
+                // Indicate SME-QOS with reassoc success event, only after 
+                // copying the frames 
                 sme_QosCsrEventInd(pMac, (v_U8_t)sessionId, ind_qos, &assocInfo);
 #endif
                 roamInfo.pBssDesc = pSirBssDesc;
@@ -5305,10 +5479,11 @@
                 }
                 pSession->connectedProfile.dot11Mode = pSession->bssParams.uCfgDot11Mode;
                 roamInfo.u.pConnectedProfile = &pSession->connectedProfile;
+
                 if( pSession->bRefAssocStartCnt > 0 )
                 {
                     pSession->bRefAssocStartCnt--;
-                    //Remove this code once SLM_Sessionization is supported
+                    //Remove this code once SLM_Sessionization is supported 
                     //BMPS_WORKAROUND_NOT_NEEDED
                     if(!IS_FEATURE_SUPPORTED_BY_FW(SLM_SESSIONIZATION) && ( csrIsConcurrentSessionRunning( pMac )))
                     {
@@ -5316,14 +5491,14 @@
                     }
                     csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, eCSR_ROAM_ASSOCIATION_COMPLETION, eCSR_ROAM_RESULT_ASSOCIATED);
                 }
-
+                
                 csrRoamCompletion(pMac, sessionId, NULL, pCommand, eCSR_ROAM_RESULT_NONE, eANI_BOOLEAN_TRUE);
                 // reset the PMKID candidate list
                 csrResetPMKIDCandidateList( pMac, sessionId );
                 //Update TL's AC weight base on the current EDCA parameters
                 //These parameters may change in the course of the connection, that sictuation
                 //is not taken care here. This change is mainly to address a WIFI WMM test where
-                //BE has a equal or higher TX priority than VI.
+                //BE has a equal or higher TX priority than VI. 
                 //We only do this for infra link
                 if( csrIsConnStateConnectedInfra(pMac, sessionId ) && pIes )
                 {
@@ -5347,7 +5522,7 @@
             }
             //Check if BMPS is required and start the BMPS retry timer.  Timer period is large
             //enough to let security and DHCP handshake succeed before entry into BMPS
-            if (pmcShouldBmpsTimerRun(pMac))
+            if (!pMac->psOffloadEnabled && pmcShouldBmpsTimerRun(pMac))
             {
                 if (pmcStartTrafficTimer(pMac, BMPS_TRAFFIC_TIMER_ALLOW_SECURITY_DHCP)
                     != eHAL_STATUS_SUCCESS)
@@ -5368,7 +5543,7 @@
             smsLog(pMac, LOG2, FL("receives start BSS ok indication"));
             status = eHAL_STATUS_FAILURE;
             pSmeStartBssRsp = (tSirSmeStartBssRsp *)Context;
-            palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
             if( CSR_IS_IBSS( pProfile ) )
             {
                 pSession->connectState = eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED;
@@ -5390,13 +5565,13 @@
                     smsLog(pMac, LOG2, FL("cannot parse IBSS IEs"));
                     roamInfo.pBssDesc = pSirBssDesc;
                     //We need to associate_complete it first, becasue Associate_start already indicated.
-                    csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
+                    csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
                             eCSR_ROAM_IBSS_IND, eCSR_ROAM_RESULT_IBSS_START_FAILED );
                     break;
                 }
                 if (!CSR_IS_INFRA_AP(pProfile))
                 {
-                    pScanResult = csrScanAppendBssDescription( pMac, pSirBssDesc, pIes );
+                    pScanResult = csrScanAppendBssDescription( pMac, pSirBssDesc, pIes, FALSE );
                 }
                 csrRoamSaveConnectedBssDesc(pMac, sessionId, pSirBssDesc);
                 csrRoamFreeConnectProfile(pMac, &pSession->connectedProfile);
@@ -5404,18 +5579,19 @@
                 if(pSirBssDesc)
                 {
                     csrRoamSaveConnectedInfomation(pMac, sessionId, pProfile, pSirBssDesc, pIes);
-                    palCopyMemory(pMac->hHdd, &roamInfo.bssid, &pSirBssDesc->bssId, sizeof(tCsrBssid));
+                    vos_mem_copy(&roamInfo.bssid, &pSirBssDesc->bssId,
+                                 sizeof(tCsrBssid));
                 }
                 //We are doen with the IEs so free it
-                palFreeMemory(pMac->hHdd, pIes);
+                vos_mem_free(pIes);
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
                 {
                     vos_log_ibss_pkt_type *pIbssLog;
                     tANI_U32 bi;
-
+    
                     WLAN_VOS_DIAG_LOG_ALLOC(pIbssLog, vos_log_ibss_pkt_type, LOG_WLAN_IBSS_C);
                     if(pIbssLog)
-                    {
+                    { 
                         if(CSR_INVALID_SCANRESULT_HANDLE == pCommand->u.roamCmd.hBSSList)
                         {
                             //We start the IBSS (didn't find any matched IBSS out there)
@@ -5427,7 +5603,7 @@
                         }
                         if(pSirBssDesc)
                         {
-                            palCopyMemory(pMac->hHdd, pIbssLog->bssid, pSirBssDesc->bssId, 6);
+                            vos_mem_copy(pIbssLog->bssid, pSirBssDesc->bssId, 6);
                             pIbssLog->operatingChannel = pSirBssDesc->channelId;
                         }
                         if(HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac, WNI_CFG_BEACON_INTERVAL, &bi)))
@@ -5444,8 +5620,8 @@
                 if( CSR_IS_ENC_TYPE_STATIC( pProfile->negotiatedUCEncryptionType ) && !CSR_IS_INFRA_AP( pSession->pCurRoamProfile ))
                 {
                     // Issue the set Context request to LIM to establish the Broadcast STA context for the Ibss.
-                    csrRoamIssueSetContextReq( pMac, sessionId,
-                                        pProfile->negotiatedMCEncryptionType,
+                    csrRoamIssueSetContextReq( pMac, sessionId, 
+                                        pProfile->negotiatedMCEncryptionType, 
                                         pSirBssDesc, &BroadcastMac,
                                         FALSE, FALSE, eSIR_TX_RX, 0, 0, NULL, 0 ); // NO keys... these key parameters don't matter.
                 }
@@ -5472,7 +5648,7 @@
                 }
             }
             //Only tell upper layer is we start the BSS because Vista doesn't like multiple connection
-            //indications. If we don't start the BSS ourself, handler of eSIR_SME_JOINED_NEW_BSS will
+            //indications. If we don't start the BSS ourself, handler of eSIR_SME_JOINED_NEW_BSS will 
             //trigger the connection start indication in Vista
             if( !CSR_IS_JOIN_TO_IBSS( pProfile ) )
             {
@@ -5488,21 +5664,19 @@
                     roamStatus = eCSR_ROAM_INFRA_IND;
                     roamResult = eCSR_ROAM_RESULT_INFRA_STARTED;
                 }
-
+                 
                 //Only tell upper layer is we start the BSS because Vista doesn't like multiple connection
-                //indications. If we don't start the BSS ourself, handler of eSIR_SME_JOINED_NEW_BSS will
+                //indications. If we don't start the BSS ourself, handler of eSIR_SME_JOINED_NEW_BSS will 
                 //trigger the connection start indication in Vista
-                palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+                vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
                 roamInfo.statusCode = pSession->joinFailStatusCode.statusCode;
                 roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
-                if(CSR_INVALID_SCANRESULT_HANDLE == pCommand->u.roamCmd.hBSSList)
-                {
-                    //We start the IBSS (didn't find any matched IBSS out there)
-                    roamInfo.pBssDesc = pSirBssDesc;
-                }
+                //We start the IBSS (didn't find any matched IBSS out there)
+                roamInfo.pBssDesc = pSirBssDesc;
                 roamInfo.staId = (tANI_U8)pSmeStartBssRsp->staId;
-                vos_mem_copy (roamInfo.bssid, pSirBssDesc->bssId, sizeof(tCsrBssid));
-                 //Remove this code once SLM_Sessionization is supported
+                vos_mem_copy(roamInfo.bssid, pSirBssDesc->bssId,
+                             sizeof(tCsrBssid));
+                 //Remove this code once SLM_Sessionization is supported 
                  //BMPS_WORKAROUND_NOT_NEEDED
                 if(!IS_FEATURE_SUPPORTED_BY_FW(SLM_SESSIONIZATION) &&
                    ( csrIsConcurrentSessionRunning( pMac )))
@@ -5512,25 +5686,14 @@
 
                 csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, roamStatus, roamResult );
             }
-
+    
             csrScanCancelIdleScan(pMac);
-            //Only use this timer for ibss. BAP has its own timer for WDS
-            if( CSR_IS_IBSS( pProfile) && CSR_INVALID_SCANRESULT_HANDLE != pCommand->u.roamCmd.hBSSList)
-            {
-              //start the join IBSS timer
-                csrRoamStartIbssJoinTimer(pMac, sessionId, CSR_IBSS_JOIN_TIMEOUT_PERIOD); //interval
-                pSession->ibss_join_pending = TRUE;
-            }
-            if( HAL_STATUS_SUCCESS( status ) )
-            {
-                //Already sent join_req for the WDS station
-                fReleaseCommand = eANI_BOOLEAN_FALSE;
-            }
-            else if( CSR_IS_WDS_STA( pProfile ) )
+
+            if( CSR_IS_WDS_STA( pProfile ) )
             {
                 //need to send stop BSS because we fail to send join_req
                 csrRoamIssueDisassociateCmd( pMac, sessionId, eCSR_DISCONNECT_REASON_UNSPECIFIED );
-                csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
+                csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
                                         eCSR_ROAM_WDS_IND, eCSR_ROAM_RESULT_WDS_STOPPED );
             }
             break;
@@ -5566,7 +5729,7 @@
             {
                 pSirBssDesc = NULL;
             }
-            palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
             roamInfo.pBssDesc = pSirBssDesc;
             //We need to associate_complete it first, becasue Associate_start already indicated.
             csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, roamStatus, roamResult );
@@ -5579,30 +5742,32 @@
             smsLog(pMac, LOGW, FL("receives silently roaming indication"));
             csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINED, sessionId );
             csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_NONE, sessionId );
-            palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
             roamInfo.pBssDesc = pSession->pConnectBssDesc;
             if( roamInfo.pBssDesc )
             {
-                palCopyMemory(pMac->hHdd, &roamInfo.bssid, &roamInfo.pBssDesc->bssId, sizeof(tCsrBssid));
+                vos_mem_copy(&roamInfo.bssid, &roamInfo.pBssDesc->bssId,
+                             sizeof(tCsrBssid));
             }
             //Since there is no change in the current state, simply pass back no result otherwise
             //HDD may be mistakenly mark to disconnected state.
-            csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
+            csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
                                         eCSR_ROAM_IBSS_IND, eCSR_ROAM_RESULT_NONE );
             break;
         case eCsrSilentlyStopRoamingSaveState:
             //We are here because we try to connect to the same AP
             //No message to PE
             smsLog(pMac, LOGW, FL("receives silently stop roaming indication"));
-            palZeroMemory(pMac->hHdd, &roamInfo, sizeof(roamInfo));
-
+            vos_mem_set(&roamInfo, sizeof(roamInfo), 0);
+            
             //to aviod resetting the substate to NONE
             pMac->roam.curState[sessionId] = eCSR_ROAMING_STATE_JOINED;
             //No need to change substate to wai_for_key because there is no state change
             roamInfo.pBssDesc = pSession->pConnectBssDesc;
             if( roamInfo.pBssDesc )
             {
-                palCopyMemory(pMac->hHdd, &roamInfo.bssid, &roamInfo.pBssDesc->bssId, sizeof(tCsrBssid));
+                vos_mem_copy(&roamInfo.bssid, &roamInfo.pBssDesc->bssId,
+                             sizeof(tCsrBssid));
             }
             roamInfo.statusCode = pSession->joinFailStatusCode.statusCode;
             roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
@@ -5614,7 +5779,7 @@
             roamInfo.u.pConnectedProfile = &pSession->connectedProfile;
             VOS_ASSERT( roamInfo.staId != 0 );
             pSession->bRefAssocStartCnt--;
-            csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
+            csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
                                         eCSR_ROAM_ASSOCIATION_COMPLETION, eCSR_ROAM_RESULT_ASSOCIATED);
             csrRoamCompletion(pMac, sessionId, NULL, pCommand, eCSR_ROAM_RESULT_ASSOCIATED, eANI_BOOLEAN_TRUE);
             break;
@@ -5627,12 +5792,12 @@
             csrFreeConnectBssDesc(pMac, sessionId);
             csrRoamFreeConnectProfile(pMac, &pSession->connectedProfile);
             csrRoamFreeConnectedInfo( pMac, &pSession->connectedInfo );
-            palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
             roamInfo.pBssDesc = pCommand->u.roamCmd.pLastRoamBss;
             roamInfo.statusCode = pSession->joinFailStatusCode.statusCode;
             roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
-            csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
-                                    eCSR_ROAM_WDS_IND,
+            csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
+                                    eCSR_ROAM_WDS_IND, 
                                     eCSR_ROAM_RESULT_WDS_NOT_ASSOCIATED);
             //Need to issue stop_bss
             break;
@@ -5644,7 +5809,7 @@
             smsLog(pMac, LOGW, FL("receives no association indication"));
             smsLog(pMac, LOG1, FL("Assoc ref count %d"),
                    pSession->bRefAssocStartCnt);
-            if( CSR_IS_INFRASTRUCTURE( &pSession->connectedProfile ) ||
+            if( CSR_IS_INFRASTRUCTURE( &pSession->connectedProfile ) || 
                 CSR_IS_ROAM_SUBSTATE_STOP_BSS_REQ( pMac, sessionId ) )
             {
                 //do not free for the other profiles as we need to send down stop BSS later
@@ -5664,11 +5829,13 @@
                 case eCsrHddIssued:
                 case eCsrSmeIssuedDisassocForHandoff:
                     csrRoamStateChange( pMac, eCSR_ROAMING_STATE_IDLE, sessionId );
-                    palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+                    vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
                     roamInfo.pBssDesc = pCommand->u.roamCmd.pLastRoamBss;
                     roamInfo.statusCode = pSession->joinFailStatusCode.statusCode;
                     roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
-                    palCopyMemory(pMac->hHdd, &roamInfo.bssid, &pSession->joinFailStatusCode.bssId, sizeof(tCsrBssid));
+                    vos_mem_copy(&roamInfo.bssid,
+                                 &pSession->joinFailStatusCode.bssId,
+                                 sizeof(tCsrBssid));
 
                     /* Defeaturize this later if needed */
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
@@ -5684,14 +5851,14 @@
                             pSession->bRefAssocStartCnt--;
                             if(eCsrJoinFailureDueToConcurrency == Result)
                             {
-                                csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
-                                                eCSR_ROAM_ASSOCIATION_COMPLETION,
+                                csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
+                                                eCSR_ROAM_ASSOCIATION_COMPLETION, 
                                                 eCSR_ROAM_RESULT_ASSOC_FAIL_CON_CHANNEL);
                             }
                             else
                             {
-                                csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
-                                                eCSR_ROAM_ASSOCIATION_COMPLETION,
+                                csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
+                                                eCSR_ROAM_ASSOCIATION_COMPLETION, 
                                                 eCSR_ROAM_RESULT_FAILURE);
                             }
                         }
@@ -5727,7 +5894,7 @@
                     csrRoamStateChange( pMac, eCSR_ROAMING_STATE_IDLE, sessionId);
 
                     csrRoamCallCallback(pMac, sessionId, NULL, pCommand->u.roamCmd.roamId, eCSR_ROAM_DISASSOCIATED, eCSR_ROAM_RESULT_FORCED);
-#ifndef WLAN_MDM_CODE_REDUCTION_OPT
+#ifndef WLAN_MDM_CODE_REDUCTION_OPT                                        
                     sme_QosCsrEventInd(pMac, (tANI_U8)sessionId, SME_QOS_CSR_DISCONNECT_IND, NULL);
 #endif
                     csrRoamCompletion(pMac, sessionId, NULL, pCommand, eCSR_ROAM_RESULT_FAILURE, eANI_BOOLEAN_FALSE);
@@ -5745,8 +5912,8 @@
                     }
                     else
                     {
-                        csrRoamCallCallback(pMac, sessionId, NULL,
-                                            pCommand->u.roamCmd.roamId,
+                        csrRoamCallCallback(pMac, sessionId, NULL, 
+                                            pCommand->u.roamCmd.roamId, 
                                             eCSR_ROAM_DISASSOCIATED, eCSR_ROAM_RESULT_FORCED);
                     }
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
@@ -5756,8 +5923,8 @@
                     csrScanStartIdleScan(pMac);
                     break;
                 case eCsrForcedIbssLeave:
-                     csrRoamCallCallback(pMac, sessionId, NULL,
-                                        pCommand->u.roamCmd.roamId,
+                     csrRoamCallCallback(pMac, sessionId, NULL, 
+                                        pCommand->u.roamCmd.roamId, 
                                         eCSR_ROAM_IBSS_LEAVE,
                                         eCSR_ROAM_RESULT_IBSS_STOP);
                     break;
@@ -5771,16 +5938,16 @@
                     csrScanStartIdleScan(pMac);
                     break;
                 case eCsrStopBss:
-                    csrRoamCallCallback(pMac, sessionId, NULL,
-                                        pCommand->u.roamCmd.roamId,
-                                        eCSR_ROAM_INFRA_IND,
+                    csrRoamCallCallback(pMac, sessionId, NULL, 
+                                        pCommand->u.roamCmd.roamId, 
+                                        eCSR_ROAM_INFRA_IND, 
                                         eCSR_ROAM_RESULT_INFRA_STOPPED);
                     break;
                 case eCsrForcedDisassocSta:
                 case eCsrForcedDeauthSta:
                    csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINED, sessionId);
                    if( CSR_IS_SESSION_VALID(pMac, sessionId) )
-                   {
+                   {                    
                        pSession = CSR_GET_SESSION(pMac, sessionId);
                        if (!pSession)
                            break;
@@ -5788,12 +5955,13 @@
                        if ( CSR_IS_INFRA_AP(&pSession->connectedProfile) )
                        {
                            roamInfo.u.pConnectedProfile = &pSession->connectedProfile;
-                           palCopyMemory(pMac->hHdd, roamInfo.peerMac,
-                              pCommand->u.roamCmd.peerMac, sizeof(tSirMacAddr));
+                           vos_mem_copy(roamInfo.peerMac,
+                                        pCommand->u.roamCmd.peerMac,
+                                        sizeof(tSirMacAddr));
                            roamInfo.reasonCode = eCSR_ROAM_RESULT_FORCED;
                            roamInfo.statusCode = eSIR_SME_SUCCESS;
-                           status = csrRoamCallCallback(pMac, sessionId,
-                                       &roamInfo, pCommand->u.roamCmd.roamId,
+                           status = csrRoamCallCallback(pMac, sessionId, 
+                                       &roamInfo, pCommand->u.roamCmd.roamId, 
                                        eCSR_ROAM_LOSTLINK, eCSR_ROAM_RESULT_FORCED);
                        }
                    }
@@ -5830,97 +5998,139 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tANI_U32 size = 0;
-
+    
     do
     {
-        palZeroMemory(pMac->hHdd, pDstProfile, sizeof(tCsrRoamProfile));
+        vos_mem_set(pDstProfile, sizeof(tCsrRoamProfile), 0);
         if(pSrcProfile->BSSIDs.numOfBSSIDs)
         {
             size = sizeof(tCsrBssid) * pSrcProfile->BSSIDs.numOfBSSIDs;
-            status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->BSSIDs.bssid, size);
+            pDstProfile->BSSIDs.bssid = vos_mem_malloc(size);
+            if ( NULL == pDstProfile->BSSIDs.bssid )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pDstProfile->BSSIDs.numOfBSSIDs = pSrcProfile->BSSIDs.numOfBSSIDs;
-            palCopyMemory(pMac->hHdd, pDstProfile->BSSIDs.bssid, pSrcProfile->BSSIDs.bssid, size);
+            vos_mem_copy(pDstProfile->BSSIDs.bssid,
+                         pSrcProfile->BSSIDs.bssid, size);
         }
         if(pSrcProfile->SSIDs.numOfSSIDs)
         {
             size = sizeof(tCsrSSIDInfo) * pSrcProfile->SSIDs.numOfSSIDs;
-            status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->SSIDs.SSIDList, size);
-            if(!HAL_STATUS_SUCCESS(status))
+            pDstProfile->SSIDs.SSIDList = vos_mem_malloc(size);
+            if ( NULL == pDstProfile->SSIDs.SSIDList )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+            if (!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pDstProfile->SSIDs.numOfSSIDs = pSrcProfile->SSIDs.numOfSSIDs;
-            palCopyMemory(pMac->hHdd, pDstProfile->SSIDs.SSIDList, pSrcProfile->SSIDs.SSIDList, size);
+            vos_mem_copy(pDstProfile->SSIDs.SSIDList,
+                         pSrcProfile->SSIDs.SSIDList, size);
         }
         if(pSrcProfile->nWPAReqIELength)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->pWPAReqIE, pSrcProfile->nWPAReqIELength);
-            if(!HAL_STATUS_SUCCESS(status))
+            pDstProfile->pWPAReqIE = vos_mem_malloc(pSrcProfile->nWPAReqIELength);
+            if ( NULL == pDstProfile->pWPAReqIE )
+               status = eHAL_STATUS_FAILURE;
+            else
+               status = eHAL_STATUS_SUCCESS;
+
+            if (!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pDstProfile->nWPAReqIELength = pSrcProfile->nWPAReqIELength;
-            palCopyMemory(pMac->hHdd, pDstProfile->pWPAReqIE, pSrcProfile->pWPAReqIE, pSrcProfile->nWPAReqIELength);
+            vos_mem_copy(pDstProfile->pWPAReqIE, pSrcProfile->pWPAReqIE,
+                         pSrcProfile->nWPAReqIELength);
         }
         if(pSrcProfile->nRSNReqIELength)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->pRSNReqIE, pSrcProfile->nRSNReqIELength);
-            if(!HAL_STATUS_SUCCESS(status))
+            pDstProfile->pRSNReqIE = vos_mem_malloc(pSrcProfile->nRSNReqIELength);
+            if ( NULL == pDstProfile->pRSNReqIE )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+
+            if (!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pDstProfile->nRSNReqIELength = pSrcProfile->nRSNReqIELength;
-            palCopyMemory(pMac->hHdd, pDstProfile->pRSNReqIE, pSrcProfile->pRSNReqIE, pSrcProfile->nRSNReqIELength);
+            vos_mem_copy(pDstProfile->pRSNReqIE, pSrcProfile->pRSNReqIE,
+                         pSrcProfile->nRSNReqIELength);
         }
 #ifdef FEATURE_WLAN_WAPI
         if(pSrcProfile->nWAPIReqIELength)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->pWAPIReqIE, pSrcProfile->nWAPIReqIELength);
+            pDstProfile->pWAPIReqIE = vos_mem_malloc(pSrcProfile->nWAPIReqIELength);
+            if ( NULL == pDstProfile->pWAPIReqIE )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pDstProfile->nWAPIReqIELength = pSrcProfile->nWAPIReqIELength;
-            palCopyMemory(pMac->hHdd, pDstProfile->pWAPIReqIE, pSrcProfile->pWAPIReqIE, pSrcProfile->nWAPIReqIELength);
+            vos_mem_copy(pDstProfile->pWAPIReqIE, pSrcProfile->pWAPIReqIE,
+                         pSrcProfile->nWAPIReqIELength);
         }
 #endif /* FEATURE_WLAN_WAPI */
         if(pSrcProfile->nAddIEScanLength)
         {
-            status = palAllocateMemory(pMac->hHdd,
-                     (void **)&pDstProfile->pAddIEScan, pSrcProfile->nAddIEScanLength);
+            pDstProfile->pAddIEScan = vos_mem_malloc(pSrcProfile->nAddIEScanLength);
+            if ( NULL == pDstProfile->pAddIEScan )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pDstProfile->nAddIEScanLength = pSrcProfile->nAddIEScanLength;
-            palCopyMemory(pMac->hHdd, pDstProfile->pAddIEScan, pSrcProfile->pAddIEScan,
-                pSrcProfile->nAddIEScanLength);
+            vos_mem_copy(pDstProfile->pAddIEScan, pSrcProfile->pAddIEScan,
+                         pSrcProfile->nAddIEScanLength);
         }
         if(pSrcProfile->nAddIEAssocLength)
         {
-            status = palAllocateMemory(pMac->hHdd,
-                     (void **)&pDstProfile->pAddIEAssoc, pSrcProfile->nAddIEAssocLength);
+            pDstProfile->pAddIEAssoc = vos_mem_malloc(pSrcProfile->nAddIEAssocLength);
+            if ( NULL == pDstProfile->pAddIEAssoc )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pDstProfile->nAddIEAssocLength = pSrcProfile->nAddIEAssocLength;
-            palCopyMemory(pMac->hHdd, pDstProfile->pAddIEAssoc, pSrcProfile->pAddIEAssoc,
-                pSrcProfile->nAddIEAssocLength);
+            vos_mem_copy(pDstProfile->pAddIEAssoc, pSrcProfile->pAddIEAssoc,
+                         pSrcProfile->nAddIEAssocLength);
         }
         if(pSrcProfile->ChannelInfo.ChannelList)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->ChannelInfo.ChannelList, pSrcProfile->ChannelInfo.numOfChannels);
+            pDstProfile->ChannelInfo.ChannelList = vos_mem_malloc(
+                                    pSrcProfile->ChannelInfo.numOfChannels);
+            if ( NULL == pDstProfile->ChannelInfo.ChannelList )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pDstProfile->ChannelInfo.numOfChannels = pSrcProfile->ChannelInfo.numOfChannels;
-            palCopyMemory(pMac->hHdd, pDstProfile->ChannelInfo.ChannelList, pSrcProfile->ChannelInfo.ChannelList, pSrcProfile->ChannelInfo.numOfChannels);
+            vos_mem_copy(pDstProfile->ChannelInfo.ChannelList,
+                         pSrcProfile->ChannelInfo.ChannelList,
+                         pSrcProfile->ChannelInfo.numOfChannels);
         }
         pDstProfile->AuthType = pSrcProfile->AuthType;
         pDstProfile->EncryptionType = pSrcProfile->EncryptionType;
@@ -5936,7 +6146,7 @@
         pDstProfile->BSSType = pSrcProfile->BSSType;
         pDstProfile->phyMode = pSrcProfile->phyMode;
         pDstProfile->csrPersona = pSrcProfile->csrPersona;
-
+        
 #ifdef FEATURE_WLAN_WAPI
         if(csrIsProfileWapi(pSrcProfile))
         {
@@ -5955,14 +6165,15 @@
         pDstProfile->fwdWPSPBCProbeReq = pSrcProfile->fwdWPSPBCProbeReq;
         pDstProfile->csr80211AuthType  = pSrcProfile->csr80211AuthType;
         pDstProfile->dtimPeriod        = pSrcProfile->dtimPeriod;
-        pDstProfile->ApUapsdEnable     = pSrcProfile->ApUapsdEnable;
+        pDstProfile->ApUapsdEnable     = pSrcProfile->ApUapsdEnable;   
         pDstProfile->SSIDs.SSIDList[0].ssidHidden = pSrcProfile->SSIDs.SSIDList[0].ssidHidden;
-        pDstProfile->protEnabled       = pSrcProfile->protEnabled;
-        pDstProfile->obssProtEnabled   = pSrcProfile->obssProtEnabled;
+        pDstProfile->protEnabled       = pSrcProfile->protEnabled;  
+        pDstProfile->obssProtEnabled   = pSrcProfile->obssProtEnabled;  
         pDstProfile->cfg_protection    = pSrcProfile->cfg_protection;
         pDstProfile->wps_state         = pSrcProfile->wps_state;
         pDstProfile->ieee80211d        = pSrcProfile->ieee80211d;
-        palCopyMemory(pMac->hHdd, &pDstProfile->Keys, &pSrcProfile->Keys, sizeof(pDstProfile->Keys));
+        vos_mem_copy(&pDstProfile->Keys, &pSrcProfile->Keys,
+                     sizeof(pDstProfile->Keys));
 #ifdef WLAN_FEATURE_VOWIFI_11R
         if (pSrcProfile->MDID.mdiePresent)
         {
@@ -5971,35 +6182,44 @@
         }
 #endif
     }while(0);
-
+    
     if(!HAL_STATUS_SUCCESS(status))
     {
         csrReleaseProfile(pMac, pDstProfile);
         pDstProfile = NULL;
     }
-
+    
     return (status);
 }
 eHalStatus csrRoamCopyConnectedProfile(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pDstProfile )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
-    tCsrRoamConnectedProfile *pSrcProfile = &pMac->roam.roamSession[sessionId].connectedProfile;
+    tCsrRoamConnectedProfile *pSrcProfile = &pMac->roam.roamSession[sessionId].connectedProfile; 
     do
     {
-        palZeroMemory(pMac->hHdd, pDstProfile, sizeof(tCsrRoamProfile));
+        vos_mem_set(pDstProfile, sizeof(tCsrRoamProfile), 0);
         if(pSrcProfile->bssid)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->BSSIDs.bssid, sizeof(tCsrBssid));
+            pDstProfile->BSSIDs.bssid = vos_mem_malloc(sizeof(tCsrBssid));
+            if ( NULL == pDstProfile->BSSIDs.bssid )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pDstProfile->BSSIDs.numOfBSSIDs = 1;
-            palCopyMemory(pMac->hHdd, pDstProfile->BSSIDs.bssid, pSrcProfile->bssid, sizeof(tCsrBssid));
+            vos_mem_copy(pDstProfile->BSSIDs.bssid, pSrcProfile->bssid,
+                         sizeof(tCsrBssid));
         }
         if(pSrcProfile->SSID.ssId)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->SSIDs.SSIDList, sizeof(tCsrSSIDInfo));
+            pDstProfile->SSIDs.SSIDList = vos_mem_malloc(sizeof(tCsrSSIDInfo));
+            if ( NULL == pDstProfile->SSIDs.SSIDList )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
@@ -6007,21 +6227,31 @@
             pDstProfile->SSIDs.numOfSSIDs = 1;
             pDstProfile->SSIDs.SSIDList[0].handoffPermitted = pSrcProfile->handoffPermitted;
             pDstProfile->SSIDs.SSIDList[0].ssidHidden = pSrcProfile->ssidHidden;
-            palCopyMemory(pMac->hHdd, &pDstProfile->SSIDs.SSIDList[0].SSID, &pSrcProfile->SSID, sizeof(tSirMacSSid));
+            vos_mem_copy(&pDstProfile->SSIDs.SSIDList[0].SSID,
+                         &pSrcProfile->SSID, sizeof(tSirMacSSid));
         }
         if(pSrcProfile->nAddIEAssocLength)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->pAddIEAssoc, pSrcProfile->nAddIEAssocLength);
+            pDstProfile->pAddIEAssoc = vos_mem_malloc(pSrcProfile->nAddIEAssocLength);
+            if ( NULL == pDstProfile->pAddIEAssoc)
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 smsLog( pMac, LOGE, FL(" failed to allocate memory for additional IEs ") );
                 break;
             }
             pDstProfile->nAddIEAssocLength = pSrcProfile->nAddIEAssocLength;
-            palCopyMemory(pMac->hHdd, pDstProfile->pAddIEAssoc, pSrcProfile->pAddIEAssoc,
-                pSrcProfile->nAddIEAssocLength);
+            vos_mem_copy(pDstProfile->pAddIEAssoc, pSrcProfile->pAddIEAssoc,
+                         pSrcProfile->nAddIEAssocLength);
         }
-        status = palAllocateMemory(pMac->hHdd, (void **)&pDstProfile->ChannelInfo.ChannelList, 1);
+        pDstProfile->ChannelInfo.ChannelList = vos_mem_malloc(1);
+        if ( NULL == pDstProfile->ChannelInfo.ChannelList )
+                status = eHAL_STATUS_FAILURE;
+        else
+                status = eHAL_STATUS_SUCCESS;
+
         if(!HAL_STATUS_SUCCESS(status))
         {
            break;
@@ -6039,7 +6269,8 @@
         pDstProfile->negotiatedMCEncryptionType = pSrcProfile->mcEncryptionType;
         pDstProfile->BSSType = pSrcProfile->BSSType;
         pDstProfile->CBMode = pSrcProfile->CBMode;
-        palCopyMemory(pMac->hHdd, &pDstProfile->Keys, &pSrcProfile->Keys, sizeof(pDstProfile->Keys));
+        vos_mem_copy(&pDstProfile->Keys, &pSrcProfile->Keys,
+                     sizeof(pDstProfile->Keys));
 #ifdef WLAN_FEATURE_VOWIFI_11R
         if (pSrcProfile->MDID.mdiePresent)
         {
@@ -6047,26 +6278,26 @@
             pDstProfile->MDID.mobilityDomain = pSrcProfile->MDID.mobilityDomain;
         }
 #endif
-
+    
     }while(0);
-
+    
     if(!HAL_STATUS_SUCCESS(status))
     {
         csrReleaseProfile(pMac, pDstProfile);
         pDstProfile = NULL;
     }
-
+    
     return (status);
 }
 
-eHalStatus csrRoamIssueConnect(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
-                                tScanResultHandle hBSSList,
+eHalStatus csrRoamIssueConnect(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, 
+                                tScanResultHandle hBSSList, 
                                 eCsrRoamReason reason, tANI_U32 roamId, tANI_BOOLEAN fImediate,
                                 tANI_BOOLEAN fClearScan)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSmeCmd *pCommand;
-
+    
     pCommand = csrGetCommandBuffer(pMac);
     if(NULL == pCommand)
     {
@@ -6086,11 +6317,11 @@
             //We can roam now
             //Since pProfile is NULL, we need to build our own profile, set everything to default
             //We can only support open and no encryption
-            pCommand->u.roamCmd.roamProfile.AuthType.numEntries = 1;
+            pCommand->u.roamCmd.roamProfile.AuthType.numEntries = 1; 
             pCommand->u.roamCmd.roamProfile.AuthType.authType[0] = eCSR_AUTH_TYPE_OPEN_SYSTEM;
             pCommand->u.roamCmd.roamProfile.EncryptionType.numEntries = 1;
             pCommand->u.roamCmd.roamProfile.EncryptionType.encryptionType[0] = eCSR_ENCRYPT_TYPE_NONE;
-            pCommand->u.roamCmd.roamProfile.csrPersona = VOS_STA_MODE;
+            pCommand->u.roamCmd.roamProfile.csrPersona = VOS_STA_MODE; 
         }
         else
         {
@@ -6101,6 +6332,7 @@
                 pCommand->u.roamCmd.fReleaseProfile = eANI_BOOLEAN_TRUE;
             }
         }
+
         pCommand->command = eSmeCommandRoam;
         pCommand->sessionId = (tANI_U8)sessionId;
         pCommand->u.roamCmd.hBSSList = hBSSList;
@@ -6119,7 +6351,7 @@
             csrReleaseCommandRoam( pMac, pCommand );
         }
     }
-
+    
     return (status);
 }
 eHalStatus csrRoamIssueReassoc(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
@@ -6128,7 +6360,7 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSmeCmd *pCommand;
-
+    
     pCommand = csrGetCommandBuffer(pMac);
     if(NULL == pCommand)
     {
@@ -6163,7 +6395,7 @@
         pCommand->u.roamCmd.roamReason = reason;
         //We need to free the BssList when the command is done
         //For reassoc there is no BSS list, so the boolean set to false
-        pCommand->u.roamCmd.hBSSList = CSR_INVALID_SCANRESULT_HANDLE;
+        pCommand->u.roamCmd.hBSSList = CSR_INVALID_SCANRESULT_HANDLE; 
         pCommand->u.roamCmd.fReleaseBssList = eANI_BOOLEAN_FALSE;
         pCommand->u.roamCmd.fReassoc = eANI_BOOLEAN_TRUE;
         status = csrQueueSmeCommand(pMac, pCommand, fImediate);
@@ -6179,11 +6411,11 @@
 
 eHalStatus csrRoamEnqueuePreauth(tpAniSirGlobal pMac, tANI_U32 sessionId, tpSirBssDescription pBssDescription,
                                 eCsrRoamReason reason, tANI_BOOLEAN fImmediate)
-//                               , eCsrRoamReason reason, tANI_U32 roamId, tANI_BOOLEAN fImediate)
+//                              , eCsrRoamReason reason, tANI_U32 roamId, tANI_BOOLEAN fImediate)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSmeCmd *pCommand;
-
+    
     pCommand = csrGetCommandBuffer(pMac);
     if(NULL == pCommand)
     {
@@ -6199,7 +6431,7 @@
             pCommand->sessionId = (tANI_U8)sessionId;
             pCommand->u.roamCmd.roamReason = reason;
             //this is the important parameter
-            //in this case we are using this field for the "next" BSS
+            //in this case we are using this field for the "next" BSS 
             pCommand->u.roamCmd.pLastRoamBss = pBssDescription;
             status = csrQueueSmeCommand(pMac, pCommand, fImmediate);
             if( !HAL_STATUS_SUCCESS( status ) )
@@ -6225,9 +6457,9 @@
     if ( pEntry )
     {
         pCommand = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
-        if ( (eSmeCommandRoam == pCommand->command) &&
+        if ( (eSmeCommandRoam == pCommand->command) && 
                 (eCsrPerformPreauth == pCommand->u.roamCmd.roamReason))
-        {
+        {             
             smsLog( pMac, LOG1, FL("DQ-Command = %d, Reason = %d"),
                     pCommand->command, pCommand->u.roamCmd.roamReason);
             if (csrLLRemoveEntry( &pMac->sme.smeCmdActiveList, pEntry, LL_ACCESS_LOCK )) {
@@ -6245,7 +6477,7 @@
     return eHAL_STATUS_SUCCESS;
 }
 
-eHalStatus csrRoamConnectWithBSSList(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
+eHalStatus csrRoamConnectWithBSSList(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, 
                                      tScanResultHandle hBssListIn, tANI_U32 *pRoamId)
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
@@ -6259,7 +6491,7 @@
         {
             *pRoamId = roamId;
         }
-        status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, eCsrHddIssued,
+        status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, eCsrHddIssued, 
                                         roamId, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_FALSE);
         if(!HAL_STATUS_SUCCESS(status))
         {
@@ -6270,7 +6502,7 @@
     return (status);
 }
 
-eHalStatus csrRoamConnect(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
+eHalStatus csrRoamConnect(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, 
                           tScanResultHandle hBssListIn, tANI_U32 *pRoamId)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -6286,7 +6518,7 @@
     }
     smsLog(pMac, LOG1, FL("called  BSSType = %d authtype = %d  encryType = %d"),
                 pProfile->BSSType, pProfile->AuthType.authType[0], pProfile->EncryptionType.encryptionType[0]);
-    if( CSR_IS_WDS( pProfile ) &&
+    if( CSR_IS_WDS( pProfile ) && 
         !HAL_STATUS_SUCCESS( status = csrIsBTAMPAllowed( pMac, pProfile->operationChannel ) ) )
     {
         smsLog(pMac, LOGE, FL("Request for BT AMP connection failed, channel requested is different than infra = %d"),
@@ -6312,7 +6544,7 @@
         }
     }
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
-    pSession->maxRetryCount = CSR_JOIN_MAX_RETRY_COUNT;
+    pSession->maxRetryCount = CSR_JOIN_MAX_RETRY_COUNT; 
 #endif
     if(CSR_INVALID_SCANRESULT_HANDLE != hBssListIn)
     {
@@ -6329,10 +6561,14 @@
     }
     else
     {
-        status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
+        pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+        if ( NULL == pScanFilter )
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
         if(HAL_STATUS_SUCCESS(status))
         {
-            palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
+            vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
             //Try to connect to any BSS
             if(NULL == pProfile)
             {
@@ -6340,7 +6576,7 @@
                 pScanFilter->EncryptionType.numEntries = 1;
                 pScanFilter->EncryptionType.encryptionType[0] = eCSR_ENCRYPT_TYPE_NONE;
             }//we don't have a profile
-            else
+            else 
             {
                 //Here is the profile we need to connect to
                 status = csrRoamPrepareFilterFromProfile(pMac, pProfile, pScanFilter);
@@ -6350,7 +6586,7 @@
             {
                 *pRoamId = roamId;
             }
-
+            
             if(HAL_STATUS_SUCCESS(status))
             {
                 /*Save the WPS info*/
@@ -6369,7 +6605,7 @@
                     )
                     {
                         //This can be started right away
-                        status = csrRoamIssueConnect(pMac, sessionId, pProfile, NULL, eCsrHddIssued,
+                        status = csrRoamIssueConnect(pMac, sessionId, pProfile, NULL, eCsrHddIssued, 
                                                     roamId, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_FALSE);
                         if(!HAL_STATUS_SUCCESS(status))
                         {
@@ -6386,7 +6622,7 @@
                     smsLog(pMac, LOG1, "************ csrScanGetResult Status ********* %d", status);
                     if(HAL_STATUS_SUCCESS(status))
                     {
-                        status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, eCsrHddIssued,
+                        status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, eCsrHddIssued, 
                                                     roamId, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_FALSE);
                         if(!HAL_STATUS_SUCCESS(status))
                         {
@@ -6400,7 +6636,7 @@
                         //Check whether it is for start ibss
                         if(CSR_IS_START_IBSS(pProfile))
                         {
-                            status = csrRoamIssueConnect(pMac, sessionId, pProfile, NULL, eCsrHddIssued,
+                            status = csrRoamIssueConnect(pMac, sessionId, pProfile, NULL, eCsrHddIssued, 
                                                         roamId, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_FALSE);
                             if(!HAL_STATUS_SUCCESS(status))
                             {
@@ -6411,7 +6647,7 @@
                         else
                         {
                             //scan for this SSID
-                            status = csrScanForSSID(pMac, sessionId, pProfile, roamId);
+                            status = csrScanForSSID(pMac, sessionId, pProfile, roamId, TRUE);
                             if(!HAL_STATUS_SUCCESS(status))
                             {
                                 smsLog(pMac, LOGE, FL("   CSR failed to issue SSID scan command with status = 0x%08X"), status);
@@ -6434,8 +6670,8 @@
                     csrFreeScanFilter(pMac, pScanFilter);
                 }
             }//Got the scan filter from profile
-
-            palFreeMemory(pMac->hHdd, pScanFilter);
+            
+            vos_mem_free(pScanFilter);
         }//allocated memory for pScanFilter
     }//No Bsslist coming in
     //tell the caller if we fail to trigger a join request
@@ -6443,9 +6679,9 @@
     {
         csrRoamCallCallback(pMac, sessionId, NULL, roamId, eCSR_ROAM_FAILED, eCSR_ROAM_RESULT_FAILURE);
     }
-
+   
     return (status);
-}
+}                         
 eHalStatus csrRoamReassoc(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
                           tCsrRoamModifyProfileFields modProfileFields,
                           tANI_U32 *pRoamId)
@@ -6469,7 +6705,7 @@
    {
       if(pProfile)
       {
-         if(pProfile->SSIDs.numOfSSIDs &&
+         if(pProfile->SSIDs.numOfSSIDs && 
             csrIsSsidInList(pMac, &pSession->connectedProfile.SSID, &pProfile->SSIDs))
          {
             fCallCallback = eANI_BOOLEAN_FALSE;
@@ -6479,9 +6715,9 @@
             smsLog(pMac, LOG1, FL("Not connected to the same SSID asked in the profile"));
          }
       }
-      else if(!palEqualMemory(pMac->hHdd, &modProfileFields,
-                              &pSession->connectedProfile.modifyProfileFields,
-                              sizeof(tCsrRoamModifyProfileFields)))
+      else if (!vos_mem_compare(&modProfileFields,
+                                &pSession->connectedProfile.modifyProfileFields,
+                                sizeof(tCsrRoamModifyProfileFields)))
       {
          fCallCallback = eANI_BOOLEAN_FALSE;
       }
@@ -6503,12 +6739,12 @@
          *pRoamId = roamId;
       }
 
-      status = csrRoamIssueReassoc(pMac, sessionId, pProfile, &modProfileFields,
+      status = csrRoamIssueReassoc(pMac, sessionId, pProfile, &modProfileFields, 
                                    eCsrHddIssuedReassocToSameAP, roamId, eANI_BOOLEAN_FALSE);
    }
    else
    {
-      status = csrRoamCallCallback(pMac, sessionId, NULL, roamId,
+      status = csrRoamCallCallback(pMac, sessionId, NULL, roamId, 
                                    eCSR_ROAM_FAILED, eCSR_ROAM_RESULT_FAILURE);
    }
    return status;
@@ -6527,7 +6763,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     do
     {
         if(pSession->pCurRoamProfile)
@@ -6535,19 +6771,28 @@
             csrScanCancelIdleScan(pMac);
             csrScanAbortMacScanNotForConnect(pMac, sessionId);
             //We have to make a copy of pCurRoamProfile because it will be free inside csrRoamIssueConnect
-            status = palAllocateMemory(pMac->hHdd, (void **)&pProfile, sizeof(tCsrRoamProfile));
+            pProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+            if ( NULL == pProfile )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
                 break;
-            palZeroMemory(pMac->hHdd, pProfile, sizeof(tCsrRoamProfile));
+            vos_mem_set(pProfile, sizeof(tCsrRoamProfile), 0);
             status = csrRoamCopyProfile(pMac, pProfile, pSession->pCurRoamProfile);
-            if(!HAL_STATUS_SUCCESS(status))
+            if (!HAL_STATUS_SUCCESS(status))
                 break;
-            status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
+            pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+            if ( NULL  == pScanFilter )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
-            palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
+            vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
             status = csrRoamPrepareFilterFromProfile(pMac, pProfile, pScanFilter);
             if(!HAL_STATUS_SUCCESS(status))
             {
@@ -6559,7 +6804,7 @@
             {
                 //we want to put the last connected BSS to the very beginning, if possible
                 csrMoveBssToHeadFromBSSID(pMac, &pSession->connectedProfile.bssid, hBSSList);
-                status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, eCsrHddIssued,
+                status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, eCsrHddIssued, 
                                                 roamId, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_FALSE);
                 if(!HAL_STATUS_SUCCESS(status))
                 {
@@ -6571,7 +6816,7 @@
             {
                 //Do a scan on this profile
                 //scan for this SSID only in case the AP suppresses SSID
-                status = csrScanForSSID(pMac, sessionId, pProfile, roamId);
+                status = csrScanForSSID(pMac, sessionId, pProfile, roamId, TRUE);
                 if(!HAL_STATUS_SUCCESS(status))
                 {
                     break;
@@ -6587,12 +6832,12 @@
     if(pScanFilter)
     {
         csrFreeScanFilter(pMac, pScanFilter);
-        palFreeMemory(pMac->hHdd, pScanFilter);
+        vos_mem_free(pScanFilter);
     }
     if(NULL != pProfile)
     {
         csrReleaseProfile(pMac, pProfile);
-        palFreeMemory(pMac->hHdd, pProfile);
+        vos_mem_free(pProfile);
     }
     return (status);
 }
@@ -6629,7 +6874,7 @@
     tANI_BOOLEAN fComplete = eANI_BOOLEAN_FALSE;
     eCsrRoamSubState NewSubstate;
     tANI_U32 sessionId = pCommand->sessionId;
-
+    
     // change state to 'Roaming'...
     csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINING, sessionId );
 
@@ -6643,7 +6888,7 @@
     {
         smsLog(pMac, LOG1, FL(" restore AC weights (%d-%d-%d-%d)"), pMac->roam.ucACWeights[0], pMac->roam.ucACWeights[1],
             pMac->roam.ucACWeights[2], pMac->roam.ucACWeights[3]);
-        //Restore AC weight in case we change it
+        //Restore AC weight in case we change it 
         WLANTL_SetACWeights(pMac->roam.gVosContext, pMac->roam.ucACWeights);
         // in Infrasturcture, we need to disassociate from the Infrastructure network...
         NewSubstate = eCSR_ROAM_SUBSTATE_DISASSOC_FORCED;
@@ -6671,11 +6916,11 @@
         //This has to be WDS station
         else  if( csrIsConnStateConnectedWds( pMac, sessionId ) ) //This has to be WDS station
         {
-
+ 
             pCommand->u.roamCmd.fStopWds = eANI_BOOLEAN_TRUE;
             if( fDisassoc )
             {
-                status = csrRoamIssueDisassociate( pMac, sessionId,
+                status = csrRoamIssueDisassociate( pMac, sessionId, 
                                 eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING, fMICFailure );
                 fComplete = (!HAL_STATUS_SUCCESS(status));
             }
@@ -6695,7 +6940,7 @@
     {
         if ( csrIsConnStateInfra( pMac, sessionId ) )
         {
-            //Set the state to disconnect here
+            //Set the state to disconnect here 
             pMac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED;
         }
     }
@@ -6727,7 +6972,7 @@
     {
         smsLog( pMac, LOG1, FL("  reason = %d"), reason );
         pCommand = csrGetCommandBuffer( pMac );
-        if ( !pCommand )
+        if ( !pCommand ) 
         {
             smsLog( pMac, LOGE, FL(" fail to get command buffer") );
             status = eHAL_STATUS_RESOURCES;
@@ -6781,7 +7026,7 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSmeCmd *pCommand;
     pCommand = csrGetCommandBuffer( pMac );
-    if ( NULL != pCommand )
+    if ( NULL != pCommand ) 
     {
         //Change the substate in case it is wait-for-key
         if( CSR_IS_WAIT_FOR_KEY( pMac, sessionId) )
@@ -6817,7 +7062,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
     //Stop te retry
     pSession->maxRetryCount = 0;
@@ -6825,10 +7070,10 @@
 #endif
     //Not to call cancel roaming here
     //Only issue disconnect when necessary
-    if(csrIsConnStateConnected(pMac, sessionId) || csrIsBssTypeIBSS(pSession->connectedProfile.BSSType)
-                || csrIsBssTypeWDS(pSession->connectedProfile.BSSType)
+    if(csrIsConnStateConnected(pMac, sessionId) || csrIsBssTypeIBSS(pSession->connectedProfile.BSSType) 
+                || csrIsBssTypeWDS(pSession->connectedProfile.BSSType) 
                 || csrIsRoamCommandWaitingForSession(pMac, sessionId) )
-
+                
     {
         smsLog(pMac, LOG2, FL("called"));
         status = csrRoamIssueDisassociateCmd(pMac, sessionId, reason);
@@ -6845,16 +7090,14 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     csrRoamCancelRoaming(pMac, sessionId);
-    pSession->ibss_join_pending = FALSE;
-    csrRoamStopIbssJoinTimer(pMac, sessionId);
     csrRoamRemoveDuplicateCommand(pMac, sessionId, NULL, eCsrForcedDisassoc);
-
+    
     return (csrRoamDisconnectInternal(pMac, sessionId, reason));
 }
 
-eHalStatus csrRoamSaveConnectedInfomation(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
+eHalStatus csrRoamSaveConnectedInfomation(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, 
                                           tSirBssDescription *pSirBssDesc, tDot11fBeaconIEs *pIes)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -6868,8 +7111,12 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
-    palZeroMemory(pMac->hHdd, &pSession->connectedProfile, sizeof(tCsrRoamConnectedProfile));
+    if(pConnectProfile->pAddIEAssoc)
+    {
+        vos_mem_free(pConnectProfile->pAddIEAssoc);
+        pConnectProfile->pAddIEAssoc = NULL;
+    }
+    vos_mem_set(&pSession->connectedProfile, sizeof(tCsrRoamConnectedProfile), 0);
     pConnectProfile->AuthType = pProfile->negotiatedAuthType;
         pConnectProfile->AuthInfo = pProfile->AuthType;
     pConnectProfile->CBMode = pProfile->CBMode;  //*** this may not be valid
@@ -6882,22 +7129,25 @@
     pConnectProfile->operationChannel = pSirBssDesc->channelId;
     pConnectProfile->beaconInterval = pSirBssDesc->beaconInterval;
 
-    palCopyMemory(pMac->hHdd, &pConnectProfile->Keys, &pProfile->Keys, sizeof(tCsrKeys));
+    vos_mem_copy(&pConnectProfile->Keys, &pProfile->Keys, sizeof(tCsrKeys));
     /* saving the addional IE`s like Hot spot indication element and extended capabilities */
     if(pProfile->nAddIEAssocLength)
     {
-        status = palAllocateMemory(pMac->hHdd,
-                 (void **)&pConnectProfile->pAddIEAssoc, pProfile->nAddIEAssocLength);
-        if(!HAL_STATUS_SUCCESS(status))
+        pConnectProfile->pAddIEAssoc = vos_mem_malloc(pProfile->nAddIEAssocLength);
+        if ( NULL ==  pConnectProfile->pAddIEAssoc )
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
+        if (!HAL_STATUS_SUCCESS(status))
         {
             smsLog(pMac, LOGE, FL("Failed to allocate memory for additional IEs")) ;
             return eHAL_STATUS_FAILURE;
         }
         pConnectProfile->nAddIEAssocLength = pProfile->nAddIEAssocLength;
-        palCopyMemory(pMac->hHdd, pConnectProfile->pAddIEAssoc, pProfile->pAddIEAssoc,
-                pProfile->nAddIEAssocLength);
+        vos_mem_copy(pConnectProfile->pAddIEAssoc, pProfile->pAddIEAssoc,
+                     pProfile->nAddIEAssocLength);
     }
-
+    
     //Save bssid
     csrGetBssIdBssDesc(pMac, pSirBssDesc, &pConnectProfile->bssid);
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -6912,12 +7162,12 @@
         status = csrGetParsedBssDescriptionIEs(pMac, pSirBssDesc, &pIesTemp);
     }
 #ifdef FEATURE_WLAN_CCX
-    if ((csrIsProfileCCX(pProfile) ||
-         ((pIesTemp->CCXVersion.present)
-          && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM)
-              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA)
-              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA_PSK)
-              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN)
+    if ((csrIsProfileCCX(pProfile) || 
+         ((pIesTemp->CCXVersion.present) 
+          && ((pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_OPEN_SYSTEM) 
+              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA) 
+              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_WPA_PSK) 
+              || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN) 
 #ifdef WLAN_FEATURE_11W
               || (pProfile->negotiatedAuthType == eCSR_AUTH_TYPE_RSN_PSK_SHA256)
 #endif
@@ -6933,13 +7183,13 @@
         if(pIesTemp->SSID.present)
         {
             pConnectProfile->SSID.length = pIesTemp->SSID.num_ssid;
-            palCopyMemory(pMac->hHdd, pConnectProfile->SSID.ssId,
-                            pIesTemp->SSID.ssid, pIesTemp->SSID.num_ssid);
+            vos_mem_copy(pConnectProfile->SSID.ssId, pIesTemp->SSID.ssid,
+                         pIesTemp->SSID.num_ssid);
         }
-
+        
         //Save the bss desc
         status = csrRoamSaveConnectedBssDesc(pMac, sessionId, pSirBssDesc);
-
+           
            if( CSR_IS_QOS_BSS(pIesTemp) || pIesTemp->HTCaps.present)
            {
               //Some HT AP's dont send WMM IE so in that case we assume all HT Ap's are Qos Enabled AP's
@@ -6952,28 +7202,29 @@
         if ( NULL == pIes )
         {
             //Free memory if it allocated locally
-            palFreeMemory(pMac->hHdd, pIesTemp);
+            vos_mem_free(pIesTemp);
         }
     }
     //Save Qos connection
     pConnectProfile->qosConnection = pMac->roam.roamSession[sessionId].fWMMConnection;
-
+    
     if(!HAL_STATUS_SUCCESS(status))
     {
         csrFreeConnectBssDesc(pMac, sessionId);
     }
     for(index = 0; index < pProfile->SSIDs.numOfSSIDs; index++)
     {
-       if((pProfile->SSIDs.SSIDList[index].SSID.length == pConnectProfile->SSID.length) &&
-          palEqualMemory(pMac->hHdd, pProfile->SSIDs.SSIDList[index].SSID.ssId,
-                         pConnectProfile->SSID.ssId, pConnectProfile->SSID.length))
+        if ((pProfile->SSIDs.SSIDList[index].SSID.length == pConnectProfile->SSID.length) &&
+            vos_mem_compare(pProfile->SSIDs.SSIDList[index].SSID.ssId,
+                            pConnectProfile->SSID.ssId,
+                            pConnectProfile->SSID.length))
        {
           pConnectProfile->handoffPermitted = pProfile->SSIDs.SSIDList[index].handoffPermitted;
           break;
        }
        pConnectProfile->handoffPermitted = FALSE;
     }
-
+    
     return (status);
 }
 
@@ -6987,7 +7238,7 @@
    {
        pCommand = GET_BASE_ADDR(pEntry, tSmeCmd, Link);
    }
-   if ( eSIR_SME_SUCCESS == pSmeJoinRsp->statusCode )
+   if ( eSIR_SME_SUCCESS == pSmeJoinRsp->statusCode ) 
    {
             if(pCommand && eCsrSmeIssuedAssocToSimilarAP == pCommand->u.roamCmd.roamReason)
             {
@@ -7006,8 +7257,8 @@
             smsLog(pMac, LOGE, FL("  session %d not found "), pSmeJoinRsp->sessionId);
             return;
         }
-
-
+        
+        
         //The head of the active list is the request we sent
         //Try to get back the same profile and roam again
         if(pCommand)
@@ -7016,7 +7267,7 @@
         }
         pSession->joinFailStatusCode.statusCode = pSmeJoinRsp->statusCode;
         pSession->joinFailStatusCode.reasonCode = pSmeJoinRsp->protStatusCode;
-        smsLog( pMac, LOGW, "SmeJoinReq failed with statusCode= 0x%08lX [%d]", pSmeJoinRsp->statusCode, pSmeJoinRsp->statusCode );
+        smsLog( pMac, LOGW, "SmeJoinReq failed with statusCode= 0x%08X [%d]", pSmeJoinRsp->statusCode, pSmeJoinRsp->statusCode );
 #if   defined WLAN_FEATURE_NEIGHBOR_ROAMING
         /* If Join fails while Handoff is in progress, indicate disassociated event to supplicant to reconnect */
         if (csrRoamIsHandoffInProgress(pMac))
@@ -7041,8 +7292,8 @@
             else
             {
                 csrRoam(pMac, pCommand);
-            }
-        }
+            }    
+        }    
         else
         {
            csrRoamComplete( pMac, eCsrNothingToJoin, NULL );
@@ -7050,7 +7301,7 @@
     } /*else: ( eSIR_SME_SUCCESS == pSmeJoinRsp->statusCode ) */
 }
 
-eHalStatus csrRoamIssueJoin( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDescription *pSirBssDesc,
+eHalStatus csrRoamIssueJoin( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDescription *pSirBssDesc, 
                              tDot11fBeaconIEs *pIes,
                              tCsrRoamProfile *pProfile, tANI_U32 roamId )
 {
@@ -7058,7 +7309,7 @@
     smsLog( pMac, LOG1, "Attempting to Join Bssid= %02x-%02x-%02x-%02x-%02x-%02x",
                   pSirBssDesc->bssId[ 0 ],pSirBssDesc->bssId[ 1 ],pSirBssDesc->bssId[ 2 ],
                   pSirBssDesc->bssId[ 3 ],pSirBssDesc->bssId[ 4 ],pSirBssDesc->bssId[ 5 ] );
-
+    
     // Set the roaming substate to 'join attempt'...
     csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_JOIN_REQ, sessionId);
     // attempt to Join this BSS...
@@ -7066,7 +7317,7 @@
     return (status);
 }
 
-static eHalStatus csrRoamIssueReassociate( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDescription *pSirBssDesc,
+static eHalStatus csrRoamIssueReassociate( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDescription *pSirBssDesc, 
                               tDot11fBeaconIEs *pIes, tCsrRoamProfile *pProfile)
 {
     csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINING, sessionId);
@@ -7074,7 +7325,7 @@
     csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_REASSOC_REQ, sessionId );
 
     smsLog(pMac, LOGE, FL(" calling csrSendJoinReqMsg (eWNI_SME_REASSOC_REQ)"));
-
+    
     // attempt to Join this BSS...
     return csrSendJoinReqMsg( pMac, sessionId, pSirBssDesc, pProfile, pIes, eWNI_SME_REASSOC_REQ);
 }
@@ -7086,7 +7337,7 @@
     tCsrRoamInfo roamInfo;
     tANI_U32 sessionId;
     tCsrRoamSession *pSession;
-
+            
     pEntry = csrLLPeekHead(&pMac->sme.smeCmdActiveList, LL_ACCESS_LOCK);
     if(pEntry)
     {
@@ -7101,25 +7352,25 @@
                 smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
                 return;
             }
-
+            
             if( pCommand->u.roamCmd.fStopWds )
             {
-                palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+                vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
                 roamInfo.pBssDesc = pCommand->u.roamCmd.pLastRoamBss;
                 roamInfo.statusCode = pSession->joinFailStatusCode.statusCode;
                 roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
                 if (CSR_IS_WDS(&pSession->connectedProfile)){
                 pSession->connectState = eCSR_ASSOC_STATE_TYPE_WDS_DISCONNECTED;
-                csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
-                                        eCSR_ROAM_WDS_IND,
+                csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, 
+                                        eCSR_ROAM_WDS_IND, 
                                         eCSR_ROAM_RESULT_WDS_DISASSOCIATED);
                                 }else if (CSR_IS_INFRA_AP(&pSession->connectedProfile)){
                                         pSession->connectState = eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTED;
                                         csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId,
                                                                                 eCSR_ROAM_INFRA_IND,
                                                                                 eCSR_ROAM_RESULT_INFRA_DISASSOCIATED);
-                                }
-
+                                }  
+ 
 
                 if( !HAL_STATUS_SUCCESS( csrRoamIssueStopBss( pMac, sessionId, eCSR_ROAM_SUBSTATE_STOP_BSS_REQ ) ) )
                 {
@@ -7138,7 +7389,7 @@
             smsLog(pMac, LOGW, "  Command is not roaming after disassociated");
         }
     }
-    else
+    else 
     {
         smsLog(pMac, LOGE, "   Disassoc rsp cannot continue because no command is available");
     }
@@ -7219,8 +7470,8 @@
     if( pEntry )
     {
         pCommand = GET_BASE_ADDR(pEntry, tCsrCmd, Link);
-        if( ( eCsrRoamCommandScan == pCommand->command ) &&
-            ( ( eCsrScanForSsid == pCommand->u.scanCmd.reason ) ||
+        if( ( eCsrRoamCommandScan == pCommand->command ) && 
+            ( ( eCsrScanForSsid == pCommand->u.scanCmd.reason ) || 
               ( eCsrScanForCapsChange == pCommand->u.scanCmd.reason ) ||
               ( eCsrScanP2PFindPeer == pCommand->u.scanCmd.reason ) ) )
         {
@@ -7236,13 +7487,13 @@
     tSmeCmd *pCommand = NULL;
     tANI_BOOLEAN fHighPriority = eANI_BOOLEAN_TRUE;
     tANI_BOOLEAN fRemoveCmd = FALSE;
-    tListElem *pEntry;
+    tListElem *pEntry; 
     // Delete the old assoc command. All is setup for reassoc to be serialized
     pEntry = csrLLPeekHead( &pMac->sme.smeCmdActiveList, LL_ACCESS_LOCK );
     if ( pEntry )
     {
         pCommand = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
-        if ( !pCommand )
+        if ( !pCommand ) 
         {
             smsLog( pMac, LOGE, FL(" fail to get command buffer") );
             return eHAL_STATUS_RESOURCES;
@@ -7253,7 +7504,7 @@
             {
                 fRemoveCmd = csrLLRemoveEntry( &pMac->sme.smeCmdActiveList, pEntry, LL_ACCESS_LOCK );
             }
-            else
+            else 
             {
                 smsLog( pMac, LOGE, FL(" Unexpected active roam command present ") );
             }
@@ -7270,7 +7521,7 @@
         smsLog( pMac, LOGE, FL(" fail to get command buffer as expected based on previous connect roam command") );
         return eHAL_STATUS_RESOURCES;
     }
-    do
+    do 
     {
         //Change the substate in case it is wait-for-key
         if( CSR_IS_WAIT_FOR_KEY( pMac, sessionId ) )
@@ -7313,12 +7564,12 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-
+    
     if(CSR_IS_ROAMING(pSession) && pSession->fCancelRoaming)
     {
         //the roaming is cancelled. Simply complete the command
         smsLog(pMac, LOGW, FL("  Roam command cancelled"));
-        csrRoamComplete(pMac, eCsrNothingToJoin, NULL);
+        csrRoamComplete(pMac, eCsrNothingToJoin, NULL); 
     }
     /* If the roaming has stopped, not to continue the roaming command*/
     else if ( !CSR_IS_ROAMING(pSession) && CSR_IS_ROAMING_COMMAND(pCommand) )
@@ -7342,12 +7593,12 @@
                 pBssDesc = &pScanResult->Result.BssDescriptor;
             }
             if ( csrIsBssTypeIBSS( pCommand->u.roamCmd.roamProfile.BSSType ) ||
-                 CSR_IS_WDS( &pCommand->u.roamCmd.roamProfile )
-                  || CSR_IS_INFRA_AP(&pCommand->u.roamCmd.roamProfile)
+                 CSR_IS_WDS( &pCommand->u.roamCmd.roamProfile ) 
+                  || CSR_IS_INFRA_AP(&pCommand->u.roamCmd.roamProfile) 
             )
             {
                 if(!HAL_STATUS_SUCCESS(csrRoamIssueStartBss( pMac, sessionId,
-                                        &pSession->bssParams, &pCommand->u.roamCmd.roamProfile,
+                                        &pSession->bssParams, &pCommand->u.roamCmd.roamProfile, 
                                         pBssDesc, pCommand->u.roamCmd.roamId )))
                 {
                     smsLog(pMac, LOGW, " CSR start BSS failed");
@@ -7363,9 +7614,9 @@
                     //We need to complete the command
                     csrRoamComplete(pMac, eCsrJoinFailure, NULL);
                     return;
-                }
+                } 
                 // If we are roaming TO an Infrastructure BSS...
-                VOS_ASSERT(pScanResult != NULL);
+                VOS_ASSERT(pScanResult != NULL); 
                 if ( csrIsInfraBssDesc( pBssDesc ) )
                 {
                     tDot11fBeaconIEs *pIesLocal = (tDot11fBeaconIEs *)pScanResult->Result.pvIes;
@@ -7375,7 +7626,7 @@
                     if( csrIsConnStateConnectedInfra( pMac, sessionId ) )
                     {
                         // ...and the SSIDs are equal, then we Reassoc.
-                        if (  csrIsSsidEqual( pMac, pSession->pConnectBssDesc, pBssDesc,
+                        if (  csrIsSsidEqual( pMac, pSession->pConnectBssDesc, pBssDesc, 
                                                     pIesLocal ) )
                         // ..and currently in an infrastructure connection
                         {
@@ -7386,11 +7637,11 @@
                         }
                         else
                         {
-
+                                                     
                             // otherwise, we have to issue a new Join request to LIM because we disassociated from the
                             // previously associated AP.
-                            if(!HAL_STATUS_SUCCESS(csrRoamIssueJoin( pMac, sessionId, pBssDesc,
-                                                                                                            pIesLocal,
+                            if(!HAL_STATUS_SUCCESS(csrRoamIssueJoin( pMac, sessionId, pBssDesc, 
+                                                                                                            pIesLocal, 
                                                     &pCommand->u.roamCmd.roamProfile, pCommand->u.roamCmd.roamId )))
                             {
                                 //try something else
@@ -7401,22 +7652,22 @@
                     else
                     {
                         eHalStatus  status = eHAL_STATUS_SUCCESS;
-
+                         
                         /* We need to come with other way to figure out that this is because of HO in BMP
                            The below API will be only available for Android as it uses a different HO algorithm */
-                        /* Reassoc request will be used only for CCX and 11r handoff whereas other legacy roaming should
+                        /* Reassoc request will be used only for CCX and 11r handoff whereas other legacy roaming should 
                          * use join request */
 #ifdef WLAN_FEATURE_VOWIFI_11R
-                        if (csrRoamIsHandoffInProgress(pMac) &&
+                        if (csrRoamIsHandoffInProgress(pMac) && 
                                                 csrRoamIs11rAssoc(pMac))
                         {
-                            status = csrRoamIssueReassociate(pMac, sessionId, pBssDesc,
+                            status = csrRoamIssueReassociate(pMac, sessionId, pBssDesc, 
                                     (tDot11fBeaconIEs *)( pScanResult->Result.pvIes ), &pCommand->u.roamCmd.roamProfile);
                         }
                         else
 #endif
 #ifdef FEATURE_WLAN_CCX
-                        if (csrRoamIsHandoffInProgress(pMac) &&
+                        if (csrRoamIsHandoffInProgress(pMac) && 
                                                 csrRoamIsCCXAssoc(pMac))
                         {
                             // Now serialize the reassoc command.
@@ -7425,7 +7676,7 @@
                         else
 #endif
 #ifdef FEATURE_WLAN_LFR
-                        if (csrRoamIsHandoffInProgress(pMac) &&
+                        if (csrRoamIsHandoffInProgress(pMac) && 
                                                 csrRoamIsFastRoamEnabled(pMac, sessionId))
                         {
                             // Now serialize the reassoc command.
@@ -7436,7 +7687,7 @@
                         // else we are not connected and attempting to Join.  Issue the
                         // Join request.
                         {
-                            status = csrRoamIssueJoin( pMac, sessionId, pBssDesc,
+                            status = csrRoamIssueJoin( pMac, sessionId, pBssDesc, 
                                                 (tDot11fBeaconIEs *)( pScanResult->Result.pvIes ),
                                                 &pCommand->u.roamCmd.roamProfile, pCommand->u.roamCmd.roamId );
                         }
@@ -7449,7 +7700,7 @@
                         if( !pScanResult->Result.pvIes )
                         {
                             //Locally allocated
-                            palFreeMemory(pMac->hHdd, pIesLocal);
+                           vos_mem_free(pIesLocal);
                         }
                     }
                 }//if ( csrIsInfraBssDesc( pBssDesc ) )
@@ -7461,7 +7712,7 @@
         }//if ( WNI_CFG_SUCCESS == result )
         else
         {
-            // In the event the configuration failed,  for infra let the roam processor
+            // In the event the configuration failed,  for infra let the roam processor 
             //attempt to join something else...
             if( pCommand->u.roamCmd.pRoamBssEntry && CSR_IS_INFRASTRUCTURE( &pCommand->u.roamCmd.roamProfile ) )
             {
@@ -7487,7 +7738,7 @@
 {
     //No one is sending eWNI_SME_AUTH_REQ to PE.
     smsLog(pMac, LOGW, FL("is no-op"));
-    if ( eSIR_SME_SUCCESS == pSmeAuthRsp->statusCode )
+    if ( eSIR_SME_SUCCESS == pSmeAuthRsp->statusCode ) 
     {
         smsLog( pMac, LOGW, "CSR SmeAuthReq Successful" );
         // Successfully authenticated with a new Bss.  Attempt to stop the current Bss and
@@ -7496,7 +7747,7 @@
         roamStopNetwork( pAdapter, &pBssDesc->SirBssDescription );***/
     }
     else {
-        smsLog( pMac, LOGW, "CSR SmeAuthReq failed with statusCode= 0x%08lX [%d]", pSmeAuthRsp->statusCode, pSmeAuthRsp->statusCode );
+        smsLog( pMac, LOGW, "CSR SmeAuthReq failed with statusCode= 0x%08X [%d]", pSmeAuthRsp->statusCode, pSmeAuthRsp->statusCode );
         /***profHandleLostLinkAfterReset(pAdapter);
         // In the event the authenticate fails, let the roam processor attempt to join something else...
         roamRoam( pAdapter );***/
@@ -7509,14 +7760,14 @@
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     tCsrRoamInfo roamInfo;
     tANI_U32 roamId = 0;
-
-    if ( eSIR_SME_SUCCESS == pSmeJoinRsp->statusCode )
+    
+    if ( eSIR_SME_SUCCESS == pSmeJoinRsp->statusCode ) 
     {
         smsLog( pMac, LOGW, "CSR SmeReassocReq Successful" );
         result = eCsrReassocSuccess;
         /* Defeaturize this part later if needed */
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
-        /* Since the neighbor roam algorithm uses reassoc req for handoff instead of join,
+        /* Since the neighbor roam algorithm uses reassoc req for handoff instead of join, 
          * we need the response contents while processing the result in csrRoamProcessResults() */
         if (csrRoamIsHandoffInProgress(pMac))
         {
@@ -7534,13 +7785,13 @@
      * to call csrRoamComplete() with state as CsrJoinFailure */
     else
     {
-        smsLog( pMac, LOGW, "CSR SmeReassocReq failed with statusCode= 0x%08lX [%d]", pSmeJoinRsp->statusCode, pSmeJoinRsp->statusCode );
+        smsLog( pMac, LOGW, "CSR SmeReassocReq failed with statusCode= 0x%08X [%d]", pSmeJoinRsp->statusCode, pSmeJoinRsp->statusCode );
         result = eCsrReassocFailure;
 #ifdef WLAN_FEATURE_VOWIFI_11R
         if ((eSIR_SME_FT_REASSOC_TIMEOUT_FAILURE == pSmeJoinRsp->statusCode) ||
                         (eSIR_SME_FT_REASSOC_FAILURE == pSmeJoinRsp->statusCode))
         {
-                // Inform HDD to turn off FT flag in HDD
+                // Inform HDD to turn off FT flag in HDD 
                 if (pNeighborRoamInfo)
                 {
                         vos_mem_zero(&roamInfo, sizeof(tCsrRoamInfo));
@@ -7548,12 +7799,12 @@
                                         &roamInfo, roamId, eCSR_ROAM_FT_REASSOC_FAILED, eSIR_SME_SUCCESS);
                         /*
                          * Since the above callback sends a disconnect
-                         * to HDD, we should clean-up our state
+                         * to HDD, we should clean-up our state 
                          * machine as well to be in sync with the upper
-                         * layers. There is no need to send a disassoc
-                         * since: 1) we will never reassoc to the current
-                         * AP in LFR, and 2) there is no need to issue a
-                         * disassoc to the AP with which we were trying
+                         * layers. There is no need to send a disassoc 
+                         * since: 1) we will never reassoc to the current 
+                         * AP in LFR, and 2) there is no need to issue a 
+                         * disassoc to the AP with which we were trying 
                          * to reassoc.
                          */
                         csrRoamComplete( pMac, eCsrJoinFailure, NULL );
@@ -7637,7 +7888,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-
+    
     if ( CSR_IS_ROAM_SUBSTATE_DISASSOC_NO_JOIN( pMac, sessionId ) )
     {
         csrRoamComplete( pMac, eCsrNothingToJoin, NULL );
@@ -7649,7 +7900,7 @@
         {
             smsLog( pMac, LOG2, "CSR SmeDisassocReq force disassociated Successfully" );
             //A callback to HDD will be issued from csrRoamComplete so no need to do anything here
-        }
+        } 
         csrRoamComplete( pMac, eCsrNothingToJoin, NULL );
     }
     else if ( CSR_IS_ROAM_SUBSTATE_DISASSOC_HO( pMac, sessionId ) )
@@ -7660,11 +7911,15 @@
         * First ensure if the roam profile is in the scan cache.
         * If not, post a reassoc failure and disconnect.
         */
-       status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
+       pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+       if ( NULL == pScanFilter )
+           status = eHAL_STATUS_FAILURE;
+       else
+           status = eHAL_STATUS_SUCCESS;
        if(HAL_STATUS_SUCCESS(status))
        {
-           palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
-           status = csrRoamPrepareFilterFromProfile(pMac,
+           vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
+           status = csrRoamPrepareFilterFromProfile(pMac, 
                     &pMac->roam.neighborRoamInfo.csrNeighborRoamProfile, pScanFilter);
            if(!HAL_STATUS_SUCCESS(status))
            {
@@ -7705,7 +7960,7 @@
             {
 
                 /*
-                 * we need to process the result first before removing it from active list
+                 * we need to process the result first before removing it from active list 
                  * because state changes still happening insides roamQProcessRoamResults so
                  * no other roam command should be issued.
                  */
@@ -7736,22 +7991,22 @@
         /* Notify HDD about handoff and provide the BSSID too */
         roamInfo.reasonCode = eCsrRoamReasonBetterAP;
 
-        palCopyMemory(pMac->hHdd, roamInfo.bssid,
-            pMac->roam.neighborRoamInfo.csrNeighborRoamProfile.BSSIDs.bssid,
-            sizeof(tSirMacAddr));
+        vos_mem_copy(roamInfo.bssid,
+                     pMac->roam.neighborRoamInfo.csrNeighborRoamProfile.BSSIDs.bssid,
+                     sizeof(tSirMacAddr));
 
-        csrRoamCallCallback(pMac,sessionId, &roamInfo, 0,
+        csrRoamCallCallback(pMac,sessionId, &roamInfo, 0, 
             eCSR_ROAM_ROAMING_START, eCSR_ROAM_RESULT_NONE);
 
         /* Copy the connected profile to apply the same for this connection as well */
-        if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd,
-           (void **)&pCurRoamProfile, sizeof(tCsrRoamProfile))))
+        pCurRoamProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+        if ( pCurRoamProfile != NULL )
         {
-            palZeroMemory(pMac->hHdd, pCurRoamProfile, sizeof(tCsrRoamProfile));
+            vos_mem_set(pCurRoamProfile, sizeof(tCsrRoamProfile), 0);
             csrRoamCopyProfile(pMac, pCurRoamProfile, pSession->pCurRoamProfile);
             //make sure to put it at the head of the cmd queue
-            status = csrRoamIssueConnect(pMac, sessionId, pCurRoamProfile,
-                    hBSSList, eCsrSmeIssuedAssocToSimilarAP,
+            status = csrRoamIssueConnect(pMac, sessionId, pCurRoamProfile, 
+                    hBSSList, eCsrSmeIssuedAssocToSimilarAP, 
                     roamId, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_FALSE);
 
             if(!HAL_STATUS_SUCCESS(status))
@@ -7760,13 +8015,13 @@
                         __func__, status);
                 fCallCallback = eANI_BOOLEAN_TRUE;
             }
-
+        
             /* Notify sub-modules like QoS etc. that handoff happening */
             sme_QosCsrEventInd(pMac, sessionId, SME_QOS_CSR_HANDOFF_ASSOC_REQ, NULL);
             csrReleaseProfile(pMac, pCurRoamProfile);
-            palFreeMemory(pMac->hHdd, pCurRoamProfile);
+            vos_mem_free(pCurRoamProfile);
             csrFreeScanFilter(pMac, pScanFilter);
-            palFreeMemory( pMac->hHdd, pScanFilter );
+            vos_mem_free(pScanFilter);
             return;
         }
 
@@ -7774,24 +8029,24 @@
         if (pScanFilter)
         {
             csrFreeScanFilter(pMac, pScanFilter);
-            palFreeMemory( pMac->hHdd, pScanFilter );
+            vos_mem_free(pScanFilter);
         }
         if (pCurRoamProfile)
-            palFreeMemory(pMac->hHdd, pCurRoamProfile);
+            vos_mem_free(pCurRoamProfile);
 
         /* Inform the upper layers that the reassoc failed */
         vos_mem_zero(&roamInfo, sizeof(tCsrRoamInfo));
         csrRoamCallCallback(pMac, sessionId,
                 &roamInfo, 0, eCSR_ROAM_FT_REASSOC_FAILED, eSIR_SME_SUCCESS);
 
-        /*
+        /* 
          * Issue a disassoc request so that PE/LIM uses this to clean-up the FT session.
          * Upon success, we would re-enter this routine after receiving the disassoc
          * response and will fall into the reassoc fail sub-state. And, eventually
-         * call csrRoamComplete which would remove the roam command from SME active
+         * call csrRoamComplete which would remove the roam command from SME active 
          * queue.
          */
-        if (!HAL_STATUS_SUCCESS(csrRoamIssueDisassociate(pMac, sessionId,
+        if (!HAL_STATUS_SUCCESS(csrRoamIssueDisassociate(pMac, sessionId, 
             eCSR_ROAM_SUBSTATE_DISASSOC_REASSOC_FAILURE, FALSE)))
         {
             smsLog( pMac, LOGE,"%s: csrRoamIssueDisassociate failed with status %d",
@@ -7818,12 +8073,12 @@
             // Infrastructure network.
             // - Third is where we are doing an Infra to Infra roam between networks with different
             // SSIDs.  In all cases, we set the new Bss configuration here and attempt to join
-
+            
             smsLog( pMac, LOG2, "CSR SmeDisassocReq disassociated Successfully" );
         }
         else
         {
-            smsLog( pMac, LOGE, "SmeDisassocReq failed with statusCode= 0x%08lX", statusCode );
+            smsLog( pMac, LOGE, "SmeDisassocReq failed with statusCode= 0x%08X", statusCode );
         }
         //We are not done yet. Get the data and continue roaming
         csrRoamReissueRoamCommand(pMac);
@@ -7842,7 +8097,7 @@
     }
     else
     {
-        if ( eSIR_SME_SUCCESS == statusCode )
+        if ( eSIR_SME_SUCCESS == statusCode ) 
         {
             // Successfully deauth from the 'old' Bss...
             //
@@ -7850,7 +8105,7 @@
         }
         else
         {
-            smsLog( pMac, LOGW, "SmeDeauthReq failed with statusCode= 0x%08lX", statusCode );
+            smsLog( pMac, LOGW, "SmeDeauthReq failed with statusCode= 0x%08X", statusCode );
         }
         //We are not done yet. Get the data and continue roaming
         csrRoamReissueRoamCommand(pMac);
@@ -7860,15 +8115,15 @@
 static void csrRoamRoamingStateStartBssRspProcessor( tpAniSirGlobal pMac, tSirSmeStartBssRsp *pSmeStartBssRsp )
 {
     eCsrRoamCompleteResult result;
-
-    if ( eSIR_SME_SUCCESS == pSmeStartBssRsp->statusCode )
+    
+    if ( eSIR_SME_SUCCESS == pSmeStartBssRsp->statusCode ) 
     {
         smsLog( pMac, LOGW, "SmeStartBssReq Successful" );
         result = eCsrStartBssSuccess;
     }
-    else
+    else 
     {
-        smsLog( pMac, LOGW, "SmeStartBssReq failed with statusCode= 0x%08lX", pSmeStartBssRsp->statusCode );
+        smsLog( pMac, LOGW, "SmeStartBssReq failed with statusCode= 0x%08X", pSmeStartBssRsp->statusCode );
         //Let csrRoamComplete decide what to do
         result = eCsrStartBssFailure;
     }
@@ -7879,7 +8134,7 @@
   We need to be careful on whether to cast pMsgBuf (pSmeRsp) to other type of strucutres.
   It depends on how the message is constructed. If the message is sent by limSendSmeRsp,
   the pMsgBuf is only a generic response and can only be used as pointer to tSirSmeRsp.
-  For the messages where sender allocates memory for specific structures, then it can be
+  For the messages where sender allocates memory for specific structures, then it can be 
   cast accordingly.
 */
 void csrRoamingStateMsgProcessor( tpAniSirGlobal pMac, void *pMsgBuf )
@@ -7896,9 +8151,9 @@
     pSmeRsp->messageType = (pSmeRsp->messageType);
     pSmeRsp->length = (pSmeRsp->length);
     pSmeRsp->statusCode = (pSmeRsp->statusCode);
-    switch (pSmeRsp->messageType)
+    switch (pSmeRsp->messageType) 
     {
-
+        
         case eWNI_SME_JOIN_RSP:      // in Roaming state, process the Join response message...
             if (CSR_IS_ROAM_SUBSTATE_JOIN_REQ(pMac, pSmeRsp->sessionId))
             {
@@ -7906,28 +8161,28 @@
                 csrRoamJoinRspProcessor( pMac, (tSirSmeJoinRsp *)pSmeRsp );
             }
             break;
-
+                
         case eWNI_SME_AUTH_RSP:       // or the Authenticate response message...
-            if (CSR_IS_ROAM_SUBSTATE_AUTH_REQ( pMac, pSmeRsp->sessionId) )
+            if (CSR_IS_ROAM_SUBSTATE_AUTH_REQ( pMac, pSmeRsp->sessionId) ) 
             {
                 //We sent a AUTH_REQ
                 csrRoamRoamingStateAuthRspProcessor( pMac, (tSirSmeAuthRsp *)pSmeRsp );
             }
             break;
-
+                
         case eWNI_SME_REASSOC_RSP:     // or the Reassociation response message...
-            if (CSR_IS_ROAM_SUBSTATE_REASSOC_REQ( pMac, pSmeRsp->sessionId) )
+            if (CSR_IS_ROAM_SUBSTATE_REASSOC_REQ( pMac, pSmeRsp->sessionId) ) 
             {
                 csrRoamRoamingStateReassocRspProcessor( pMac, (tpSirSmeJoinRsp )pSmeRsp );
             }
             break;
-
+                   
         case eWNI_SME_STOP_BSS_RSP:    // or the Stop Bss response message...
             {
                 csrRoamRoamingStateStopBssRspProcessor(pMac, pSmeRsp);
             }
             break;
-
+                
         case eWNI_SME_DISASSOC_RSP:    // or the Disassociate response message...
             if ( CSR_IS_ROAM_SUBSTATE_DISASSOC_REQ( pMac, pSmeRsp->sessionId )      ||
                  CSR_IS_ROAM_SUBSTATE_DISASSOC_NO_JOIN( pMac, pSmeRsp->sessionId )  ||
@@ -7941,23 +8196,23 @@
                 csrRoamRoamingStateDisassocRspProcessor( pMac, (tSirSmeDisassocRsp *)pSmeRsp );
             }
             break;
-
+                   
         case eWNI_SME_DEAUTH_RSP:    // or the Deauthentication response message...
-            if ( CSR_IS_ROAM_SUBSTATE_DEAUTH_REQ( pMac, pSmeRsp->sessionId ) )
+            if ( CSR_IS_ROAM_SUBSTATE_DEAUTH_REQ( pMac, pSmeRsp->sessionId ) ) 
             {
                 csrRoamRoamingStateDeauthRspProcessor( pMac, (tSirSmeDeauthRsp *)pSmeRsp );
             }
             break;
-
+                   
         case eWNI_SME_START_BSS_RSP:      // or the Start BSS response message...
-            if (CSR_IS_ROAM_SUBSTATE_START_BSS_REQ( pMac, pSmeRsp->sessionId ) )
+            if (CSR_IS_ROAM_SUBSTATE_START_BSS_REQ( pMac, pSmeRsp->sessionId ) ) 
             {
                 csrRoamRoamingStateStartBssRspProcessor( pMac, (tSirSmeStartBssRsp *)pSmeRsp );
-            }
+            } 
             break;
-
+                   
         case WNI_CFG_SET_CNF:    // process the Config Confirm messages when we are in 'Config' substate...
-            if ( CSR_IS_ROAM_SUBSTATE_CONFIG( pMac, pSmeRsp->sessionId ) )
+            if ( CSR_IS_ROAM_SUBSTATE_CONFIG( pMac, pSmeRsp->sessionId ) ) 
             {
                 csrRoamingStateConfigCnfProcessor( pMac, ((tCsrCfgSetRsp *)pSmeRsp)->respStatus );
             }
@@ -7966,13 +8221,14 @@
         case eWNI_SME_IBSS_PEER_DEPARTED_IND:
             pIbssPeerInd = (tSmeIbssPeerInd*)pSmeRsp;
             smsLog(pMac, LOGE, "CSR: Peer departed notification from LIM in joining state");
-            palZeroMemory( pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo) );
-                        roamInfo.staId = (tANI_U8)pIbssPeerInd->staId;
+            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
+            roamInfo.staId = (tANI_U8)pIbssPeerInd->staId;
             roamInfo.ucastSig = (tANI_U8)pIbssPeerInd->ucastSig;
             roamInfo.bcastSig = (tANI_U8)pIbssPeerInd->bcastSig;
-            palCopyMemory(pMac->hHdd, &roamInfo.peerMac, pIbssPeerInd->peerAddr, sizeof(tCsrBssid));
-            csrRoamCallCallback(pMac, sessionId, &roamInfo, 0,
-                                eCSR_ROAM_CONNECT_STATUS_UPDATE,
+            vos_mem_copy(&roamInfo.peerMac, pIbssPeerInd->peerAddr,
+                         sizeof(tCsrBssid));
+            csrRoamCallCallback(pMac, sessionId, &roamInfo, 0, 
+                                eCSR_ROAM_CONNECT_STATUS_UPDATE, 
                                 eCSR_ROAM_RESULT_IBSS_PEER_DEPARTED);
             break;
         default:
@@ -7980,19 +8236,19 @@
                       pSmeRsp->messageType, pSmeRsp->messageType,
                       pMac->roam.curSubState[pSmeRsp->sessionId] );
 
-            //If we are connected, check the link status change
+            //If we are connected, check the link status change 
                         if(!csrIsConnStateDisconnected(pMac, sessionId))
                         {
                                 csrRoamCheckForLinkStatusChange( pMac, pSmeRsp );
                         }
-            break;
+            break;          
     }
 }
 
 void csrRoamJoinedStateMsgProcessor( tpAniSirGlobal pMac, void *pMsgBuf )
 {
     tSirSmeRsp *pSirMsg = (tSirSmeRsp *)pMsgBuf;
-    switch (pSirMsg->messageType)
+    switch (pSirMsg->messageType) 
     {
        case eWNI_SME_GET_STATISTICS_RSP:
           smsLog( pMac, LOG2, FL("Stats rsp from PE"));
@@ -8007,7 +8263,7 @@
             tANI_U32 sessionId;
             eHalStatus status;
             smsLog( pMac, LOG1, FL("ASSOCIATION confirmation can be given to upper layer "));
-            palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
             pRoamInfo = &roamInfo;
             pUpperLayerAssocCnf = (tSirSmeAssocIndToUpperLayerCnf *)pMsgBuf;
             status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pUpperLayerAssocCnf->bssId, &sessionId );
@@ -8018,16 +8274,18 @@
                 smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
                 return;
             }
-
-            pRoamInfo->statusCode = eSIR_SME_SUCCESS; //send the status code as Success
+            
+            pRoamInfo->statusCode = eSIR_SME_SUCCESS; //send the status code as Success 
             pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
             pRoamInfo->staId = (tANI_U8)pUpperLayerAssocCnf->aid;
             pRoamInfo->rsnIELen = (tANI_U8)pUpperLayerAssocCnf->rsnIE.length;
             pRoamInfo->prsnIE = pUpperLayerAssocCnf->rsnIE.rsnIEdata;
             pRoamInfo->addIELen = (tANI_U8)pUpperLayerAssocCnf->addIE.length;
-            pRoamInfo->paddIE = pUpperLayerAssocCnf->addIE.addIEdata;
-            palCopyMemory(pMac->hHdd, pRoamInfo->peerMac, pUpperLayerAssocCnf->peerMacAddr, sizeof(tSirMacAddr));
-            palCopyMemory(pMac->hHdd, &pRoamInfo->bssid, pUpperLayerAssocCnf->bssId, sizeof(tCsrBssid));
+            pRoamInfo->paddIE = pUpperLayerAssocCnf->addIE.addIEdata;           
+            vos_mem_copy(pRoamInfo->peerMac, pUpperLayerAssocCnf->peerMacAddr,
+                         sizeof(tSirMacAddr));
+            vos_mem_copy(&pRoamInfo->bssid, pUpperLayerAssocCnf->bssId,
+                         sizeof(tCsrBssid));
             pRoamInfo->wmmEnabledSta = pUpperLayerAssocCnf->wmmEnabledSta;
             if(CSR_IS_INFRA_AP(pRoamInfo->u.pConnectedProfile) )
             {
@@ -8050,45 +8308,45 @@
     }
 }
 
-eHalStatus csrRoamIssueSetContextReq( tpAniSirGlobal pMac, tANI_U32 sessionId, eCsrEncryptionType EncryptType,
+eHalStatus csrRoamIssueSetContextReq( tpAniSirGlobal pMac, tANI_U32 sessionId, eCsrEncryptionType EncryptType, 
                                      tSirBssDescription *pBssDescription,
                                 tSirMacAddr *bssId, tANI_BOOLEAN addKey,
-                                 tANI_BOOLEAN fUnicast, tAniKeyDirection aniKeyDirection,
-                                 tANI_U8 keyId, tANI_U16 keyLength,
+                                 tANI_BOOLEAN fUnicast, tAniKeyDirection aniKeyDirection, 
+                                 tANI_U8 keyId, tANI_U16 keyLength, 
                                  tANI_U8 *pKey, tANI_U8 paeRole )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tAniEdType edType;
-
+    
     if(eCSR_ENCRYPT_TYPE_UNKNOWN == EncryptType)
     {
         EncryptType = eCSR_ENCRYPT_TYPE_NONE; //***
     }
-
+    
     edType = csrTranslateEncryptTypeToEdType( EncryptType );
-
+    
     // Allow 0 keys to be set for the non-WPA encrypt types...  For WPA encrypt types, the num keys must be non-zero
     // or LIM will reject the set context (assumes the SET_CONTEXT does not occur until the keys are distrubuted).
     if ( CSR_IS_ENC_TYPE_STATIC( EncryptType ) ||
-           addKey )
+           addKey )     
     {
         tCsrRoamSetKey setKey;
         setKey.encType = EncryptType;
         setKey.keyDirection = aniKeyDirection;    //Tx, Rx or Tx-and-Rx
-        palCopyMemory( pMac->hHdd, &setKey.peerMac, bssId, sizeof(tCsrBssid) );
+        vos_mem_copy(&setKey.peerMac, bssId, sizeof(tCsrBssid));
         setKey.paeRole = paeRole;      //0 for supplicant
         setKey.keyId = keyId;  // Kye index
-        setKey.keyLength = keyLength;
+        setKey.keyLength = keyLength;  
         if( keyLength )
         {
-            palCopyMemory( pMac->hHdd, setKey.Key, pKey, keyLength );
+            vos_mem_copy(setKey.Key, pKey, keyLength);
         }
         status = csrRoamIssueSetKeyCommand( pMac, sessionId, &setKey, 0 );
     }
     return (status);
 }
 
-static eHalStatus csrRoamIssueSetKeyCommand( tpAniSirGlobal pMac, tANI_U32 sessionId,
+static eHalStatus csrRoamIssueSetKeyCommand( tpAniSirGlobal pMac, tANI_U32 sessionId, 
                                              tCsrRoamSetKey *pSetKey, tANI_U32 roamId )
 {
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
@@ -8096,7 +8354,7 @@
 #ifdef FEATURE_WLAN_CCX
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
 #endif /* FEATURE_WLAN_CCX */
-
+ 
     do
     {
         pCommand = csrGetCommandBuffer(pMac);
@@ -8110,39 +8368,41 @@
         pCommand->sessionId = (tANI_U8)sessionId;
         // validate the key length,  Adjust if too long...
         // for static WEP the keys are not set thru' SetContextReq
-        if ( ( eCSR_ENCRYPT_TYPE_WEP40 == pSetKey->encType ) ||
-             ( eCSR_ENCRYPT_TYPE_WEP40_STATICKEY == pSetKey->encType ) )
+        if ( ( eCSR_ENCRYPT_TYPE_WEP40 == pSetKey->encType ) || 
+             ( eCSR_ENCRYPT_TYPE_WEP40_STATICKEY == pSetKey->encType ) ) 
         {
             //KeyLength maybe 0 for static WEP
             if( pSetKey->keyLength )
             {
-                if ( pSetKey->keyLength < CSR_WEP40_KEY_LEN )
+                if ( pSetKey->keyLength < CSR_WEP40_KEY_LEN ) 
                 {
                     smsLog( pMac, LOGW, "Invalid WEP40 keylength [= %d] in SetContext call", pSetKey->keyLength );
-                    break;
+                    break;        
                 }
-
+                
                 pCommand->u.setKeyCmd.keyLength = CSR_WEP40_KEY_LEN;
-                palCopyMemory( pMac->hHdd, pCommand->u.setKeyCmd.Key, pSetKey->Key, CSR_WEP40_KEY_LEN );
+                vos_mem_copy(pCommand->u.setKeyCmd.Key, pSetKey->Key,
+                             CSR_WEP40_KEY_LEN);
             }
         }
-        else if ( ( eCSR_ENCRYPT_TYPE_WEP104 == pSetKey->encType ) ||
-             ( eCSR_ENCRYPT_TYPE_WEP104_STATICKEY == pSetKey->encType ) )
+        else if ( ( eCSR_ENCRYPT_TYPE_WEP104 == pSetKey->encType ) || 
+             ( eCSR_ENCRYPT_TYPE_WEP104_STATICKEY == pSetKey->encType ) ) 
         {
             //KeyLength maybe 0 for static WEP
             if( pSetKey->keyLength )
             {
-                if ( pSetKey->keyLength < CSR_WEP104_KEY_LEN )
+                if ( pSetKey->keyLength < CSR_WEP104_KEY_LEN ) 
                 {
                     smsLog( pMac, LOGW, "Invalid WEP104 keylength [= %d] in SetContext call", pSetKey->keyLength );
-                    break;
+                    break;        
                 }
-
+                
                 pCommand->u.setKeyCmd.keyLength = CSR_WEP104_KEY_LEN;
-                palCopyMemory( pMac->hHdd, pCommand->u.setKeyCmd.Key, pSetKey->Key, CSR_WEP104_KEY_LEN );
+                vos_mem_copy(pCommand->u.setKeyCmd.Key, pSetKey->Key,
+                             CSR_WEP104_KEY_LEN);
             }
         }
-        else if ( eCSR_ENCRYPT_TYPE_TKIP == pSetKey->encType )
+        else if ( eCSR_ENCRYPT_TYPE_TKIP == pSetKey->encType ) 
         {
             if ( pSetKey->keyLength < CSR_TKIP_KEY_LEN )
             {
@@ -8150,9 +8410,10 @@
                 break;
             }
             pCommand->u.setKeyCmd.keyLength = CSR_TKIP_KEY_LEN;
-            palCopyMemory( pMac->hHdd, pCommand->u.setKeyCmd.Key, pSetKey->Key, CSR_TKIP_KEY_LEN );
+            vos_mem_copy(pCommand->u.setKeyCmd.Key, pSetKey->Key,
+                         CSR_TKIP_KEY_LEN);
         }
-        else if ( eCSR_ENCRYPT_TYPE_AES == pSetKey->encType )
+        else if ( eCSR_ENCRYPT_TYPE_AES == pSetKey->encType ) 
         {
             if ( pSetKey->keyLength < CSR_AES_KEY_LEN )
             {
@@ -8160,10 +8421,11 @@
                 break;
             }
             pCommand->u.setKeyCmd.keyLength = CSR_AES_KEY_LEN;
-            palCopyMemory( pMac->hHdd, pCommand->u.setKeyCmd.Key, pSetKey->Key, CSR_AES_KEY_LEN );
+            vos_mem_copy(pCommand->u.setKeyCmd.Key, pSetKey->Key,
+                         CSR_AES_KEY_LEN);
         }
 #ifdef FEATURE_WLAN_WAPI
-        else if ( eCSR_ENCRYPT_TYPE_WPI == pSetKey->encType )
+        else if ( eCSR_ENCRYPT_TYPE_WPI == pSetKey->encType ) 
         {
             if ( pSetKey->keyLength < CSR_WAPI_KEY_LEN )
             {
@@ -8171,18 +8433,20 @@
                 break;
             }
             pCommand->u.setKeyCmd.keyLength = CSR_WAPI_KEY_LEN;
-            palCopyMemory( pMac->hHdd, pCommand->u.setKeyCmd.Key, pSetKey->Key, CSR_WAPI_KEY_LEN );
+            vos_mem_copy(pCommand->u.setKeyCmd.Key, pSetKey->Key,
+                         CSR_WAPI_KEY_LEN);
         }
 #endif /* FEATURE_WLAN_WAPI */
 #ifdef FEATURE_WLAN_CCX
-        else if ( eCSR_ENCRYPT_TYPE_KRK == pSetKey->encType )
+        else if ( eCSR_ENCRYPT_TYPE_KRK == pSetKey->encType ) 
         {
             if ( pSetKey->keyLength < CSR_KRK_KEY_LEN )
             {
                 smsLog( pMac, LOGW, "Invalid KRK keylength [= %d] in SetContext call", pSetKey->keyLength );
                 break;
             }
-            palCopyMemory( pMac->hHdd, pSession->ccxCckmInfo.krk, pSetKey->Key, CSR_KRK_KEY_LEN );
+            vos_mem_copy(pSession->ccxCckmInfo.krk, pSetKey->Key,
+                         CSR_KRK_KEY_LEN);
             pSession->ccxCckmInfo.reassoc_req_num=1;
             pSession->ccxCckmInfo.krk_plumbed = eANI_BOOLEAN_TRUE;
             status = eHAL_STATUS_SUCCESS;
@@ -8200,31 +8464,32 @@
                 break;
             }
             pCommand->u.setKeyCmd.keyLength = CSR_AES_KEY_LEN;
-            palCopyMemory(pMac->hHdd, pCommand->u.setKeyCmd.Key, pSetKey->Key, CSR_AES_KEY_LEN);
+            vos_mem_copy(pCommand->u.setKeyCmd.Key, pSetKey->Key, CSR_AES_KEY_LEN);
         }
 #endif
         status = eHAL_STATUS_SUCCESS;
         pCommand->u.setKeyCmd.roamId = roamId;
         pCommand->u.setKeyCmd.encType = pSetKey->encType;
         pCommand->u.setKeyCmd.keyDirection = pSetKey->keyDirection;    //Tx, Rx or Tx-and-Rx
-        palCopyMemory( pMac->hHdd, &pCommand->u.setKeyCmd.peerMac, &pSetKey->peerMac, sizeof(tCsrBssid) );
+        vos_mem_copy(&pCommand->u.setKeyCmd.peerMac, &pSetKey->peerMac,
+                     sizeof(tCsrBssid));
         pCommand->u.setKeyCmd.paeRole = pSetKey->paeRole;      //0 for supplicant
         pCommand->u.setKeyCmd.keyId = pSetKey->keyId;
-        palCopyMemory( pMac->hHdd, pCommand->u.setKeyCmd.keyRsc, pSetKey->keyRsc, CSR_MAX_RSC_LEN );
+        vos_mem_copy(pCommand->u.setKeyCmd.keyRsc, pSetKey->keyRsc, CSR_MAX_RSC_LEN);
         //Always put set key to the head of the Q because it is the only thing to get executed in case of WT_KEY state
-
+         
         status = csrQueueSmeCommand(pMac, pCommand, eANI_BOOLEAN_TRUE);
         if( !HAL_STATUS_SUCCESS( status ) )
         {
             smsLog( pMac, LOGE, FL(" fail to send message status = %d"), status );
         }
     } while (0);
-    // Free the command if there has been a failure, or it is a
+    // Free the command if there has been a failure, or it is a 
     // "local" operation like the set CCX CCKM KRK key.
     if ( ( NULL != pCommand ) &&
          ( (!HAL_STATUS_SUCCESS( status ) )
 #ifdef FEATURE_WLAN_CCX
-            || ( eCSR_ENCRYPT_TYPE_KRK == pSetKey->encType )
+            || ( eCSR_ENCRYPT_TYPE_KRK == pSetKey->encType ) 
 #endif /* FEATURE_WLAN_CCX */
            ) )
     {
@@ -8241,7 +8506,7 @@
     tANI_BOOLEAN fImediate = eANI_BOOLEAN_TRUE;
     do
     {
-        if( !csrIsSetKeyAllowed(pMac, sessionId) )
+        if( !csrIsSetKeyAllowed(pMac, sessionId) ) 
         {
             smsLog( pMac, LOGW, FL(" wrong state not allowed to set key") );
             status = eHAL_STATUS_CSR_WRONG_STATE;
@@ -8258,7 +8523,8 @@
         pCommand->sessionId = (tANI_U8)sessionId;
         pCommand->u.removeKeyCmd.roamId = roamId;
         pCommand->u.removeKeyCmd.encType = pRemoveKey->encType;
-        palCopyMemory( pMac->hHdd, &pCommand->u.removeKeyCmd.peerMac, &pRemoveKey->peerMac, sizeof(tSirMacAddr) );
+        vos_mem_copy(&pCommand->u.removeKeyCmd.peerMac, &pRemoveKey->peerMac,
+                     sizeof(tSirMacAddr));
         pCommand->u.removeKeyCmd.keyId = pRemoveKey->keyId;
         if( CSR_IS_WAIT_FOR_KEY( pMac, sessionId ) )
         {
@@ -8269,8 +8535,8 @@
             pRemoveKey->encType, pRemoveKey->keyId,
             pCommand->u.removeKeyCmd.peerMac[0],
             pCommand->u.removeKeyCmd.peerMac[1],
-            pCommand->u.removeKeyCmd.peerMac[2],
-            pCommand->u.removeKeyCmd.peerMac[3],
+            pCommand->u.removeKeyCmd.peerMac[2], 
+            pCommand->u.removeKeyCmd.peerMac[3], 
             pCommand->u.removeKeyCmd.peerMac[4],
             pCommand->u.removeKeyCmd.peerMac[5]);
         status = csrQueueSmeCommand(pMac, pCommand, fImediate);
@@ -8296,11 +8562,11 @@
     tANI_U32 sessionId = pCommand->sessionId;
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-    eCsrEncryptionType eCEType = (eCsrEncryptionType)edType;
     WLAN_VOS_DIAG_EVENT_DEF(setKeyEvent, vos_event_wlan_security_payload_type);
-    if(eCSR_ENCRYPT_TYPE_NONE != eCEType)
+    if(eSIR_ED_NONE != edType)
     {
-        palZeroMemory(pMac->hHdd, &setKeyEvent, sizeof(vos_event_wlan_security_payload_type));
+        vos_mem_set(&setKeyEvent,
+                    sizeof(vos_event_wlan_security_payload_type), 0);
         if( *(( tANI_U8 *)&pCommand->u.setKeyCmd.peerMac) & 0x01 )
         {
             setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_GTK_REQ;
@@ -8313,8 +8579,8 @@
             setKeyEvent.encryptionModeUnicast = (v_U8_t)diagEncTypeFromCSRType(pCommand->u.setKeyCmd.encType);
             setKeyEvent.encryptionModeMulticast = (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.mcEncryptionType);
         }
-        palCopyMemory( pMac->hHdd, setKeyEvent.bssid, pSession->connectedProfile.bssid, 6 );
-        if(CSR_IS_ENC_TYPE_STATIC(eCEType))
+        vos_mem_copy(setKeyEvent.bssid, pSession->connectedProfile.bssid, 6);
+        if(CSR_IS_ENC_TYPE_STATIC(pCommand->u.setKeyCmd.encType))
         {
             tANI_U32 defKeyId;
             //It has to be static WEP here
@@ -8333,11 +8599,11 @@
 #endif //FEATURE_WLAN_DIAG_SUPPORT_CSR
     if( csrIsSetKeyAllowed(pMac, sessionId) )
     {
-        status = csrSendMBSetContextReqMsg( pMac, sessionId,
-                    ( tANI_U8 *)&pCommand->u.setKeyCmd.peerMac,
-                                            numKeys, edType, fUnicast, pCommand->u.setKeyCmd.keyDirection,
-                                            pCommand->u.setKeyCmd.keyId, pCommand->u.setKeyCmd.keyLength,
-                    pCommand->u.setKeyCmd.Key, pCommand->u.setKeyCmd.paeRole,
+        status = csrSendMBSetContextReqMsg( pMac, sessionId, 
+                    ( tANI_U8 *)&pCommand->u.setKeyCmd.peerMac, 
+                                            numKeys, edType, fUnicast, pCommand->u.setKeyCmd.keyDirection, 
+                                            pCommand->u.setKeyCmd.keyId, pCommand->u.setKeyCmd.keyLength, 
+                    pCommand->u.setKeyCmd.Key, pCommand->u.setKeyCmd.paeRole, 
                     pCommand->u.setKeyCmd.keyRsc);
     }
     else
@@ -8351,7 +8617,7 @@
         smsLog( pMac, LOGE, FL("  error status %d"), status );
         csrRoamCallCallback( pMac, sessionId, NULL, pCommand->u.setKeyCmd.roamId, eCSR_ROAM_SET_KEY_COMPLETE, eCSR_ROAM_RESULT_FAILURE);
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
-        if(eCSR_ENCRYPT_TYPE_NONE != eCEType)
+        if(eSIR_ED_NONE != edType)
         {
             if( *(( tANI_U8 *)&pCommand->u.setKeyCmd.peerMac) & 0x01 )
             {
@@ -8379,18 +8645,23 @@
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
     WLAN_VOS_DIAG_EVENT_DEF(removeKeyEvent, vos_event_wlan_security_payload_type);
-    palZeroMemory(pMac->hHdd, &removeKeyEvent, sizeof(vos_event_wlan_security_payload_type));
+    vos_mem_set(&removeKeyEvent,
+                sizeof(vos_event_wlan_security_payload_type),0);
     removeKeyEvent.eventId = WLAN_SECURITY_EVENT_REMOVE_KEY_REQ;
     removeKeyEvent.encryptionModeMulticast = (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.mcEncryptionType);
     removeKeyEvent.encryptionModeUnicast = (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.EncryptionType);
-    palCopyMemory( pMac->hHdd, removeKeyEvent.bssid, pSession->connectedProfile.bssid, 6 );
+    vos_mem_copy(removeKeyEvent.bssid, pSession->connectedProfile.bssid, 6);
     removeKeyEvent.keyId = pCommand->u.removeKeyCmd.keyId;
     removeKeyEvent.authMode = (v_U8_t)diagAuthTypeFromCSRType(pSession->connectedProfile.AuthType);
     WLAN_VOS_DIAG_EVENT_REPORT(&removeKeyEvent, EVENT_WLAN_SECURITY);
 #endif //FEATURE_WLAN_DIAG_SUPPORT_CSR
     if( csrIsSetKeyAllowed(pMac, sessionId) )
     {
-        status = palAllocateMemory( pMac->hHdd, (void **)&pMsg, wMsgLen );
+        pMsg = vos_mem_malloc(wMsgLen);
+        if ( NULL == pMsg )
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
     }
     else
     {
@@ -8400,7 +8671,7 @@
     }
     if( HAL_STATUS_SUCCESS( status ) )
     {
-        palZeroMemory(pMac->hHdd, pMsg, wMsgLen);
+        vos_mem_set(pMsg, wMsgLen ,0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_REMOVEKEY_REQ);
                 pMsg->length = pal_cpu_to_be16(wMsgLen);
         pMsg->sessionId = (tANI_U8)sessionId;
@@ -8408,16 +8679,18 @@
         p = (tANI_U8 *)pMsg + sizeof(pMsg->messageType) + sizeof(pMsg->length) +
             sizeof(pMsg->sessionId) + sizeof(pMsg->transactionId);
         // bssId - copy from session Info
-        palCopyMemory( pMac->hHdd, p, &pMac->roam.roamSession[sessionId].connectedProfile.bssid, sizeof(tSirMacAddr) );
+        vos_mem_copy(p,
+                     &pMac->roam.roamSession[sessionId].connectedProfile.bssid,
+                     sizeof(tSirMacAddr));
         p += sizeof(tSirMacAddr);
         // peerMacAddr
-        palCopyMemory( pMac->hHdd, p, pCommand->u.removeKeyCmd.peerMac, sizeof(tSirMacAddr) );
+        vos_mem_copy(p, pCommand->u.removeKeyCmd.peerMac, sizeof(tSirMacAddr));
         p += sizeof(tSirMacAddr);
         // edType
         *p = (tANI_U8)csrTranslateEncryptTypeToEdType( pCommand->u.removeKeyCmd.encType );
         p++;
         // weptype
-        if( ( eCSR_ENCRYPT_TYPE_WEP40_STATICKEY == pCommand->u.removeKeyCmd.encType ) ||
+        if( ( eCSR_ENCRYPT_TYPE_WEP40_STATICKEY == pCommand->u.removeKeyCmd.encType ) || 
             ( eCSR_ENCRYPT_TYPE_WEP104_STATICKEY == pCommand->u.removeKeyCmd.encType ) )
         {
             *p = (tANI_U8)eSIR_WEP_STATIC;
@@ -8435,7 +8708,7 @@
     }
     if( !HAL_STATUS_SUCCESS( status ) )
     {
-        smsLog( pMac, LOGE, FL(" error status "), status );
+        smsLog( pMac, LOGE, FL(" error status %d"), status );
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
         removeKeyEvent.eventId = WLAN_SECURITY_EVENT_REMOVE_KEY_RSP;
         removeKeyEvent.status = WLAN_SECURITY_STATUS_FAILURE;
@@ -8449,7 +8722,7 @@
 eHalStatus csrRoamSetKey( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamSetKey *pSetKey, tANI_U32 roamId )
 {
     eHalStatus status;
-
+ 
     if( !csrIsSetKeyAllowed(pMac, sessionId) )
     {
         status = eHAL_STATUS_CSR_WRONG_STATE;
@@ -8463,28 +8736,32 @@
 
 /*
    Prepare a filter base on a profile for parsing the scan results.
-   Upon successful return, caller MUST call csrFreeScanFilter on
+   Upon successful return, caller MUST call csrFreeScanFilter on 
    pScanFilter when it is done with the filter.
 */
-eHalStatus csrRoamPrepareFilterFromProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pProfile,
+eHalStatus csrRoamPrepareFilterFromProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pProfile, 
                                            tCsrScanResultFilter *pScanFilter)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tANI_U32 size = 0;
     tANI_U8  index = 0;
-
+    
     do
     {
         if(pProfile->BSSIDs.numOfBSSIDs)
         {
             size = sizeof(tCsrBssid) * pProfile->BSSIDs.numOfBSSIDs;
-            status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter->BSSIDs.bssid, size);
+            pScanFilter->BSSIDs.bssid = vos_mem_malloc(size);
+            if ( NULL == pScanFilter->BSSIDs.bssid )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pScanFilter->BSSIDs.numOfBSSIDs = pProfile->BSSIDs.numOfBSSIDs;
-            palCopyMemory(pMac->hHdd, pScanFilter->BSSIDs.bssid, pProfile->BSSIDs.bssid, size);
+            vos_mem_copy(pScanFilter->BSSIDs.bssid, pProfile->BSSIDs.bssid, size);
         }
         if(pProfile->SSIDs.numOfSSIDs)
         {
@@ -8499,12 +8776,17 @@
                 pScanFilter->SSIDs.numOfSSIDs = 1;
             }
             size = sizeof(tCsrSSIDInfo) * pProfile->SSIDs.numOfSSIDs;
-            status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter->SSIDs.SSIDList, size);
+            pScanFilter->SSIDs.SSIDList = vos_mem_malloc(size);
+            if ( NULL == pScanFilter->SSIDs.SSIDList )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
-            palCopyMemory(pMac->hHdd, pScanFilter->SSIDs.SSIDList, pProfile->SSIDs.SSIDList, size);
+            vos_mem_copy(pScanFilter->SSIDs.SSIDList, pProfile->SSIDs.SSIDList,
+                         size);
         }
         if(!pProfile->ChannelInfo.ChannelList || (pProfile->ChannelInfo.ChannelList[0] == 0) )
         {
@@ -8513,7 +8795,14 @@
         }
         else if(pProfile->ChannelInfo.numOfChannels)
         {
-           status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter->ChannelInfo.ChannelList, sizeof(*pScanFilter->ChannelInfo.ChannelList) * pProfile->ChannelInfo.numOfChannels);
+           pScanFilter->ChannelInfo.ChannelList = vos_mem_malloc(
+                                     sizeof(*pScanFilter->ChannelInfo.ChannelList) *
+                                     pProfile->ChannelInfo.numOfChannels);
+           if ( NULL == pScanFilter->ChannelInfo.ChannelList )
+               status = eHAL_STATUS_FAILURE;
+           else
+               status = eHAL_STATUS_SUCCESS;
+
            pScanFilter->ChannelInfo.numOfChannels = 0;
             if(HAL_STATUS_SUCCESS(status))
             {
@@ -8521,11 +8810,11 @@
               {
                  if(csrRoamIsChannelValid(pMac, pProfile->ChannelInfo.ChannelList[index]))
                  {
-                    pScanFilter->ChannelInfo.ChannelList[pScanFilter->ChannelInfo.numOfChannels]
+                    pScanFilter->ChannelInfo.ChannelList[pScanFilter->ChannelInfo.numOfChannels] 
                        = pProfile->ChannelInfo.ChannelList[index];
                     pScanFilter->ChannelInfo.numOfChannels++;
                  }
-                 else
+                 else 
                  {
                          smsLog(pMac, LOG1, FL("process a channel (%d) that is invalid"), pProfile->ChannelInfo.ChannelList[index]);
                  }
@@ -8536,7 +8825,7 @@
                 break;
             }
         }
-        else
+        else 
         {
             smsLog(pMac, LOGW, FL("Channel list empty"));
             status = eHAL_STATUS_FAILURE;
@@ -8572,8 +8861,8 @@
         if( pProfile->countryCode[0] )
         {
             //This causes the matching function to use countryCode as one of the criteria.
-            palCopyMemory( pMac->hHdd, pScanFilter->countryCode, pProfile->countryCode,
-                        WNI_CFG_COUNTRY_CODE_LEN );
+            vos_mem_copy(pScanFilter->countryCode, pProfile->countryCode,
+                         WNI_CFG_COUNTRY_CODE_LEN);
         }
 #ifdef WLAN_FEATURE_VOWIFI_11R
         if (pProfile->MDID.mdiePresent)
@@ -8582,14 +8871,14 @@
             pScanFilter->MDID.mobilityDomain = pProfile->MDID.mobilityDomain;
         }
 #endif
-
+    
     }while(0);
-
+    
     if(!HAL_STATUS_SUCCESS(status))
     {
         csrFreeScanFilter(pMac, pScanFilter);
     }
-
+    
     return(status);
 }
 
@@ -8619,13 +8908,15 @@
         pCommand->u.wmStatusChangeCmd.Type = Type;
         if ( eCsrDisassociated ==  Type )
         {
-            palCopyMemory( pMac->hHdd, &pCommand->u.wmStatusChangeCmd.u.DisassocIndMsg, pSmeRsp,
-                                sizeof( pCommand->u.wmStatusChangeCmd.u.DisassocIndMsg ) );
+            vos_mem_copy(&pCommand->u.wmStatusChangeCmd.u.DisassocIndMsg,
+                         pSmeRsp,
+                         sizeof( pCommand->u.wmStatusChangeCmd.u.DisassocIndMsg ));
         }
         else
         {
-            palCopyMemory( pMac->hHdd, &pCommand->u.wmStatusChangeCmd.u.DeauthIndMsg, pSmeRsp,
-                            sizeof( pCommand->u.wmStatusChangeCmd.u.DeauthIndMsg ) );
+            vos_mem_copy(&pCommand->u.wmStatusChangeCmd.u.DeauthIndMsg,
+                         pSmeRsp,
+                         sizeof( pCommand->u.wmStatusChangeCmd.u.DeauthIndMsg ));
         }
         if( HAL_STATUS_SUCCESS( csrQueueSmeCommand(pMac, pCommand, eANI_BOOLEAN_TRUE) ) )
         {
@@ -8647,11 +8938,12 @@
 {
     v_S7_t  rssi = 0;
     tAniGetRssiReq *pGetRssiReq = (tAniGetRssiReq*)pMsg;
+    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
     if(pGetRssiReq)
     {
         if(NULL != pGetRssiReq->pVosContext)
         {
-            WLANTL_GetRssi(pGetRssiReq->pVosContext, pGetRssiReq->staId, &rssi);
+            vosStatus = WLANTL_GetRssi(pGetRssiReq->pVosContext, pGetRssiReq->staId, &rssi,pGetRssiReq);
         }
         else
         {
@@ -8661,7 +8953,9 @@
 
         if(NULL != pGetRssiReq->rssiCallback)
         {
-            ((tCsrRssiCallback)(pGetRssiReq->rssiCallback))(rssi, pGetRssiReq->staId, pGetRssiReq->pDevContext);
+            if(vosStatus!=VOS_STATUS_E_BUSY)
+               ((tCsrRssiCallback)(pGetRssiReq->rssiCallback))(rssi, pGetRssiReq->staId, pGetRssiReq->pDevContext);
+            else smsLog( pMac, LOGE, FL("rssi request is posted. waiting for reply"));
         }
         else
         {
@@ -8674,6 +8968,39 @@
         smsLog( pMac, LOGE, FL("pGetRssiReq is NULL"));
     }
     return;
+
+}
+
+static void csrUpdateSnr(tpAniSirGlobal pMac, void* pMsg)
+{
+    tANI_S8  snr = 0;
+    tAniGetSnrReq *pGetSnrReq = (tAniGetSnrReq*)pMsg;
+
+    if (pGetSnrReq)
+    {
+        if (VOS_STATUS_SUCCESS !=
+            WDA_GetSnr(pGetSnrReq->staId, &snr))
+        {
+            smsLog(pMac, LOGE, FL("Error in WLANTL_GetSnr"));
+            return;
+        }
+
+        if (pGetSnrReq->snrCallback)
+        {
+            ((tCsrSnrCallback)(pGetSnrReq->snrCallback))(snr, pGetSnrReq->staId,
+                                                       pGetSnrReq->pDevContext);
+        }
+        else
+        {
+            smsLog(pMac, LOGE, FL("pGetSnrReq->snrCallback is NULL"));
+            return;
+        }
+    }
+    else
+    {
+        smsLog(pMac, LOGE, FL("pGetSnrReq is NULL"));
+    }
+    return;
 }
 #if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
 void csrRoamRssiRspProcessor(tpAniSirGlobal pMac, void* pMsg)
@@ -8710,6 +9037,89 @@
 }
 #endif
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+void csrTsmStatsRspProcessor(tpAniSirGlobal pMac, void* pMsg)
+{
+  tAniGetTsmStatsRsp* pTsmStatsRsp = (tAniGetTsmStatsRsp*)pMsg;
+
+  if (NULL != pTsmStatsRsp)
+  {
+    /* Get roam Rssi request is backed up and passed back to the response,
+              Extract the request message to fetch callback */
+    tpAniGetTsmStatsReq reqBkp
+       = (tAniGetTsmStatsReq*)pTsmStatsRsp->tsmStatsReq;
+
+    if (NULL != reqBkp)
+    {
+      if (NULL != reqBkp->tsmStatsCallback)
+      {
+        ((tCsrTsmStatsCallback)(reqBkp->tsmStatsCallback))(
+                                pTsmStatsRsp->tsmMetrics,
+                                pTsmStatsRsp->staId,
+                                reqBkp->pDevContext
+                                );
+        reqBkp->tsmStatsCallback = NULL;
+      }
+      vos_mem_free(reqBkp);
+    }
+    else
+    {
+        smsLog( pMac, LOGE, FL("reqBkp is NULL"));
+        if (NULL != reqBkp)
+        {
+            vos_mem_free(reqBkp);
+        }
+    }
+  }
+  else
+  {
+      smsLog( pMac, LOGE, FL("pTsmStatsRsp is NULL"));
+  }
+  return;
+}
+
+void csrSendCcxAdjacentApRepInd(tpAniSirGlobal pMac, tCsrRoamSession *pSession)
+{
+    tANI_U32 roamTS2 = 0;
+    tCsrRoamInfo roamInfo;
+    tpPESession pSessionEntry = NULL;
+    tANI_U8 sessionId = CSR_SESSION_ID_INVALID;
+
+    if (NULL == pSession)
+    {
+        smsLog(pMac, LOGE, FL("pSession is NULL"));
+        return;
+    }
+
+    roamTS2 = vos_timer_get_system_time();
+    roamInfo.tsmRoamDelay = roamTS2 - pSession->roamTS1;
+    smsLog(pMac, LOG1,
+           "Bssid(%02X:%02X:%02X:%02X:%02X:%02X) Roaming Delay(%u ms)",
+           pSession->connectedProfile.bssid[0],
+           pSession->connectedProfile.bssid[1],
+           pSession->connectedProfile.bssid[2],
+           pSession->connectedProfile.bssid[3],
+           pSession->connectedProfile.bssid[4],
+           pSession->connectedProfile.bssid[5],
+           roamInfo.tsmRoamDelay);
+
+    pSessionEntry = peFindSessionByBssid(pMac,
+                                         pSession->connectedProfile.bssid,
+                                         &sessionId);
+    if (NULL == pSessionEntry)
+    {
+        smsLog(pMac, LOGE, FL("session %d not found"), sessionId);
+        return;
+    }
+
+    pSessionEntry->ccxContext.tsm.tsmMetrics.RoamingDly
+       = roamInfo.tsmRoamDelay;
+
+    csrRoamCallCallback(pMac, pSession->sessionId, &roamInfo,
+                        0, eCSR_ROAM_CCX_ADJ_AP_REPORT_IND, 0);
+}
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
+
 static void csrRoamRssiIndHdlr(tpAniSirGlobal pMac, void* pMsg)
 {
     WLANTL_TlIndicationReq *pTlRssiInd = (WLANTL_TlIndicationReq*)pMsg;
@@ -8740,13 +9150,17 @@
 
     /* Create the message and send to lim */
     len = sizeof(tSirResetAPCapsChange);
-    status = palAllocateMemory( pMac->hHdd, (void **)&pMsg, len );
+    pMsg = vos_mem_malloc(len);
+    if ( NULL == pMsg )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
     if (HAL_STATUS_SUCCESS(status))
     {
-        palZeroMemory(pMac->hHdd, pMsg, sizeof(tSirResetAPCapsChange) );
+        vos_mem_set(pMsg, sizeof(tSirResetAPCapsChange), 0);
         pMsg->messageType     = eWNI_SME_RESET_AP_CAPS_CHANGED;
         pMsg->length          = len;
-        palCopyMemory( pMac->hHdd, pMsg->bssId, bssId, sizeof(tSirMacAddr) );
+        vos_mem_copy(pMsg->bssId, bssId, sizeof(tSirMacAddr));
         smsLog( pMac, LOG1, FL("CSR reset caps change for Bssid= %02x-%02x-%02x-%02x-%02x-%02x"),
                 pMsg->bssId[ 0 ], pMsg->bssId[ 1 ], pMsg->bssId[ 2 ],
                 pMsg->bssId[ 3 ], pMsg->bssId[ 4 ], pMsg->bssId[ 5 ]);
@@ -8782,8 +9196,8 @@
     pSirMsg->messageType = (pSirMsg->messageType);
     pSirMsg->length = (pSirMsg->length);
     pSirMsg->statusCode = (pSirMsg->statusCode);
-    palZeroMemory(pMac->hHdd, &roamInfo, sizeof(roamInfo));
-    switch( pSirMsg->messageType )
+    vos_mem_set(&roamInfo, sizeof(roamInfo), 0);
+    switch( pSirMsg->messageType ) 
     {
         case eWNI_SME_ASSOC_IND:
             {
@@ -8808,18 +9222,20 @@
                 pRoamInfo->assocReqPtr = pAssocInd->assocReqPtr;
 
                 pRoamInfo->beaconPtr = pAssocInd->beaconPtr;
-                pRoamInfo->beaconLength = pAssocInd->beaconLength;
-                pRoamInfo->statusCode = eSIR_SME_SUCCESS; //send the status code as Success
+                pRoamInfo->beaconLength = pAssocInd->beaconLength;                
+                pRoamInfo->statusCode = eSIR_SME_SUCCESS; //send the status code as Success 
                 pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
 
                     pRoamInfo->staId = (tANI_U8)pAssocInd->staId;
                     pRoamInfo->rsnIELen = (tANI_U8)pAssocInd->rsnIE.length;
                     pRoamInfo->prsnIE = pAssocInd->rsnIE.rsnIEdata;
-
+                
                 pRoamInfo->addIELen = (tANI_U8)pAssocInd->addIE.length;
                 pRoamInfo->paddIE =  pAssocInd->addIE.addIEdata;
-                    palCopyMemory(pMac->hHdd, pRoamInfo->peerMac, pAssocInd->peerMacAddr, sizeof(tSirMacAddr));
-                    palCopyMemory(pMac->hHdd, &pRoamInfo->bssid, pAssocInd->bssId, sizeof(tCsrBssid));
+                    vos_mem_copy(pRoamInfo->peerMac, pAssocInd->peerMacAddr,
+                                 sizeof(tSirMacAddr));
+                    vos_mem_copy(&pRoamInfo->bssid, pAssocInd->bssId,
+                                 sizeof(tCsrBssid));
                     pRoamInfo->wmmEnabledSta = pAssocInd->wmmEnabledSta;
                     if(CSR_IS_WDS_AP( pRoamInfo->u.pConnectedProfile))
                         status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_WDS_IND, eCSR_ROAM_RESULT_WDS_ASSOCIATION_IND);//Sta
@@ -8827,7 +9243,7 @@
                     {
                         if( CSR_IS_ENC_TYPE_STATIC( pSession->pCurRoamProfile->negotiatedUCEncryptionType ))
                         {
-                            csrRoamIssueSetContextReq( pMac, sessionId, pSession->pCurRoamProfile->negotiatedUCEncryptionType,
+                            csrRoamIssueSetContextReq( pMac, sessionId, pSession->pCurRoamProfile->negotiatedUCEncryptionType, 
                                     pSession->pConnectBssDesc,
                                     &(pRoamInfo->peerMac),
                                     FALSE, TRUE, eSIR_TX_RX, 0, 0, NULL, 0 ); // NO keys... these key parameters don't matter.
@@ -8839,11 +9255,11 @@
                         }
                         status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_INFRA_ASSOCIATION_IND);
                         if (!HAL_STATUS_SUCCESS(status))
-                            pRoamInfo->statusCode = eSIR_SME_ASSOC_REFUSED;// Refused due to Mac filtering
+                            pRoamInfo->statusCode = eSIR_SME_ASSOC_REFUSED;// Refused due to Mac filtering 
                     }
                     /* Send Association completion message to PE */
                     status = csrSendAssocCnfMsg( pMac, pAssocInd, status );//Sta
-
+                    
                     /* send a message to CSR itself just to avoid the EAPOL frames going
                      * OTA before association response */
                     if(CSR_IS_WDS_AP( pRoamInfo->u.pConnectedProfile))
@@ -8860,7 +9276,6 @@
             }
             break;
         case eWNI_SME_DISASSOC_IND:
-            smsLog( pMac, LOGE, FL("DISASSOCIATION Indication from MAC"));
             // Check if AP dis-associated us because of MIC failure. If so,
             // then we need to take action immediately and not wait till the
             // the WmStatusChange requests is pushed and processed
@@ -8868,9 +9283,14 @@
             status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pDisassocInd->bssId, &sessionId );
             if( HAL_STATUS_SUCCESS( status ) )
             {
+                smsLog( pMac, LOGE, FL("DISASSOCIATION Indication from MAC for session %d "), sessionId);
+                smsLog( pMac, LOGE, FL("DISASSOCIATION from peer =" MAC_ADDRESS_STR " "
+                                       " reason = %d status = %d "),
+                                       MAC_ADDR_ARRAY(pDisassocInd->peerMacAddr),
+                                       pDisassocInd->reasonCode, pDisassocInd->statusCode);
                 // If we are in neighbor preauth done state then on receiving
                 // disassoc or deauth we dont roam instead we just disassoc
-                // from current ap and then go to disconnected state
+                // from current ap and then go to disconnected state 
                 // This happens for CCX and 11r FT connections ONLY.
 #ifdef WLAN_FEATURE_VOWIFI_11R
                 if (csrRoamIs11rAssoc(pMac) && (csrNeighborRoamStatePreauthDone(pMac)))
@@ -8912,27 +9332,36 @@
 
                     pRoamInfo = &roamInfo;
 
-                    pRoamInfo->statusCode = pDisassocInd->statusCode;
+                    pRoamInfo->statusCode = pDisassocInd->statusCode; 
                     pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
 
                     pRoamInfo->staId = (tANI_U8)pDisassocInd->staId;
 
-                    palCopyMemory(pMac->hHdd, pRoamInfo->peerMac, pDisassocInd->peerMacAddr, sizeof(tSirMacAddr));
-                    palCopyMemory(pMac->hHdd, &pRoamInfo->bssid, pDisassocInd->bssId, sizeof(tCsrBssid));
+                    vos_mem_copy(pRoamInfo->peerMac, pDisassocInd->peerMacAddr,
+                                 sizeof(tSirMacAddr));
+                    vos_mem_copy(&pRoamInfo->bssid, pDisassocInd->bssId,
+                                 sizeof(tCsrBssid));
 
                     status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_DISASSOC_IND);
 
                     /*
-                    *  STA/P2P client got  disassociated so remove any pending deauth
+                    *  STA/P2P client got  disassociated so remove any pending deauth 
                     *  commands in sme pending list
                     */
                     pCommand.command = eSmeCommandRoam;
                     pCommand.sessionId = (tANI_U8)sessionId;
                     pCommand.u.roamCmd.roamReason = eCsrForcedDeauthSta;
-                    vos_mem_copy(pCommand.u.roamCmd.peerMac, pDisassocInd->peerMacAddr, sizeof(tSirMacAddr));
+                    vos_mem_copy(pCommand.u.roamCmd.peerMac,
+                                 pDisassocInd->peerMacAddr,
+                                 sizeof(tSirMacAddr));
                     csrRoamRemoveDuplicateCommand(pMac, sessionId, &pCommand, eCsrForcedDeauthSta);
                 }
             }
+            else
+            {
+                smsLog(pMac, LOGE, FL(" Session Id not found for BSSID " MAC_ADDRESS_STR),
+                                        MAC_ADDR_ARRAY(pDisassocInd->bssId));
+            }
             break;
         case eWNI_SME_DEAUTH_IND:
             smsLog( pMac, LOG1, FL("DEAUTHENTICATION Indication from MAC"));
@@ -8942,7 +9371,7 @@
             {
                 // If we are in neighbor preauth done state then on receiving
                 // disassoc or deauth we dont roam instead we just disassoc
-                // from current ap and then go to disconnected state
+                // from current ap and then go to disconnected state 
                 // This happens for CCX and 11r FT connections ONLY.
 #ifdef WLAN_FEATURE_VOWIFI_11R
                 if (csrRoamIs11rAssoc(pMac) && (csrNeighborRoamStatePreauthDone(pMac)))
@@ -8989,14 +9418,16 @@
 
                     pRoamInfo->staId = (tANI_U8)pDeauthInd->staId;
 
-                    palCopyMemory(pMac->hHdd, pRoamInfo->peerMac, pDeauthInd->peerMacAddr, sizeof(tSirMacAddr));
-                    palCopyMemory(pMac->hHdd, &pRoamInfo->bssid, pDeauthInd->bssId, sizeof(tCsrBssid));
+                    vos_mem_copy(pRoamInfo->peerMac, pDeauthInd->peerMacAddr,
+                                 sizeof(tSirMacAddr));
+                    vos_mem_copy(&pRoamInfo->bssid, pDeauthInd->bssId,
+                                 sizeof(tCsrBssid));
 
                     status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_DEAUTH_IND);
                 }
             }
             break;
-
+        
         case eWNI_SME_SWITCH_CHL_REQ:        // in case of STA, the SWITCH_CHANNEL originates from its AP
             smsLog( pMac, LOGW, FL("eWNI_SME_SWITCH_CHL_REQ from SME"));
             pSwitchChnInd = (tpSirSmeSwitchChannelInd)pSirMsg;
@@ -9018,14 +9449,14 @@
                 }
             }
             break;
-
+                
         case eWNI_SME_DEAUTH_RSP:
             smsLog( pMac, LOGW, FL("eWNI_SME_DEAUTH_RSP from SME"));
             {
                 tSirSmeDeauthRsp* pDeauthRsp = (tSirSmeDeauthRsp *)pSirMsg;
                 sessionId = pDeauthRsp->sessionId;
                 if( CSR_IS_SESSION_VALID(pMac, sessionId) )
-                {
+                {                    
                     pSession = CSR_GET_SESSION(pMac, sessionId);
                     if(!pSession)
                     {
@@ -9036,7 +9467,8 @@
                     {
                         pRoamInfo = &roamInfo;
                         pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
-                        palCopyMemory(pMac->hHdd, pRoamInfo->peerMac, pDeauthRsp->peerMacAddr, sizeof(tSirMacAddr));
+                        vos_mem_copy(pRoamInfo->peerMac, pDeauthRsp->peerMacAddr,
+                                     sizeof(tSirMacAddr));
                         pRoamInfo->reasonCode = eCSR_ROAM_RESULT_FORCED;
                         pRoamInfo->statusCode = pDeauthRsp->statusCode;
                         status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_LOSTLINK, eCSR_ROAM_RESULT_FORCED);
@@ -9044,7 +9476,7 @@
                 }
             }
             break;
-
+            
         case eWNI_SME_DISASSOC_RSP:
             /* session id is invalid here so cant use it to access the array curSubstate as index */
             smsLog( pMac, LOGW, FL("eWNI_SME_DISASSOC_RSP from SME "));
@@ -9052,7 +9484,7 @@
                 tSirSmeDisassocRsp *pDisassocRsp = (tSirSmeDisassocRsp *)pSirMsg;
                 sessionId = pDisassocRsp->sessionId;
                 if( CSR_IS_SESSION_VALID(pMac, sessionId) )
-                {
+                {                    
                     pSession = CSR_GET_SESSION(pMac, sessionId);
                     if(!pSession)
                     {
@@ -9063,7 +9495,8 @@
                     {
                         pRoamInfo = &roamInfo;
                         pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
-                        palCopyMemory(pMac->hHdd, pRoamInfo->peerMac, pDisassocRsp->peerMacAddr, sizeof(tSirMacAddr));
+                        vos_mem_copy(pRoamInfo->peerMac, pDisassocRsp->peerMacAddr,
+                                     sizeof(tSirMacAddr));
                         pRoamInfo->reasonCode = eCSR_ROAM_RESULT_FORCED;
                         pRoamInfo->statusCode = pDisassocRsp->statusCode;
                         status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_LOSTLINK, eCSR_ROAM_RESULT_FORCED);
@@ -9076,31 +9509,11 @@
                 tpSirSmeMicFailureInd pMicInd = (tpSirSmeMicFailureInd)pSirMsg;
                 tCsrRoamInfo roamInfo, *pRoamInfo = NULL;
                 eCsrRoamResult result = eCSR_ROAM_RESULT_MIC_ERROR_UNICAST;
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
-                {
-                    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-                    WLAN_VOS_DIAG_EVENT_DEF(secEvent, vos_event_wlan_security_payload_type);
-                    if(!pSession)
-                    {
-                        smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
-                        return;
-                    }
-                    palZeroMemory(pMac->hHdd, &secEvent, sizeof(vos_event_wlan_security_payload_type));
-                    secEvent.eventId = WLAN_SECURITY_EVENT_MIC_ERROR;
-                    secEvent.encryptionModeMulticast =
-                        (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.mcEncryptionType);
-                    secEvent.encryptionModeUnicast =
-                        (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.EncryptionType);
-                    secEvent.authMode =
-                        (v_U8_t)diagAuthTypeFromCSRType(pSession->connectedProfile.AuthType);
-                    palCopyMemory( pMac->hHdd, secEvent.bssid, pSession->connectedProfile.bssid, 6 );
-                    WLAN_VOS_DIAG_EVENT_REPORT(&secEvent, EVENT_WLAN_SECURITY);
-                }
-#endif//FEATURE_WLAN_DIAG_SUPPORT_CSR
+
                 status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pMicInd->bssId, &sessionId );
                 if( HAL_STATUS_SUCCESS( status ) )
                 {
-                    palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+                    vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
                     roamInfo.u.pMICFailureInfo = &pMicInd->info;
                     pRoamInfo = &roamInfo;
                     if(pMicInd->info.multicast)
@@ -9113,6 +9526,30 @@
                     }
                     csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_MIC_ERROR_IND, result);
                 }
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
+                {
+                    WLAN_VOS_DIAG_EVENT_DEF(secEvent, vos_event_wlan_security_payload_type);
+                    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
+                    if(!pSession)
+                    {
+                        smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                        return;
+                    }
+
+                    vos_mem_set(&secEvent, sizeof(vos_event_wlan_security_payload_type), 0);
+                    secEvent.eventId = WLAN_SECURITY_EVENT_MIC_ERROR;
+                    secEvent.encryptionModeMulticast = 
+                        (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.mcEncryptionType);
+                    secEvent.encryptionModeUnicast = 
+                        (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.EncryptionType);
+                    secEvent.authMode = 
+                        (v_U8_t)diagAuthTypeFromCSRType(pSession->connectedProfile.AuthType);
+                    vos_mem_copy(secEvent.bssid,
+                                 pSession->connectedProfile.bssid, 6);
+                    WLAN_VOS_DIAG_EVENT_REPORT(&secEvent, EVENT_WLAN_SECURITY);
+                }
+#endif//FEATURE_WLAN_DIAG_SUPPORT_CSR
             }
             break;
         case eWNI_SME_WPS_PBC_PROBE_REQ_IND:
@@ -9120,21 +9557,21 @@
                 tpSirSmeProbeReqInd pProbeReqInd = (tpSirSmeProbeReqInd)pSirMsg;
                 tCsrRoamInfo roamInfo;
                 smsLog( pMac, LOG1, FL("WPS PBC Probe request Indication from SME"));
-
+           
                 status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pProbeReqInd->bssId, &sessionId );
                 if( HAL_STATUS_SUCCESS( status ) )
                 {
-                    palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+                    vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
                     roamInfo.u.pWPSPBCProbeReq = &pProbeReqInd->WPSPBCProbeReq;
-                    csrRoamCallCallback(pMac, sessionId, &roamInfo, 0, eCSR_ROAM_WPS_PBC_PROBE_REQ_IND,
+                    csrRoamCallCallback(pMac, sessionId, &roamInfo, 0, eCSR_ROAM_WPS_PBC_PROBE_REQ_IND, 
                         eCSR_ROAM_RESULT_WPS_PBC_PROBE_REQ_IND);
                 }
             }
-            break;
-
+            break;        
+            
         case eWNI_SME_WM_STATUS_CHANGE_NTF:
             pStatusChangeMsg = (tSirSmeWmStatusChangeNtf *)pSirMsg;
-            switch( pStatusChangeMsg->statusChangeCode )
+            switch( pStatusChangeMsg->statusChangeCode ) 
             {
                 case eSIR_SME_IBSS_ACTIVE:
                     sessionId = csrFindIbssSession( pMac );
@@ -9149,7 +9586,9 @@
                         pSession->connectState = eCSR_ASSOC_STATE_TYPE_IBSS_CONNECTED;
                         if(pSession->pConnectBssDesc)
                         {
-                            palCopyMemory(pMac->hHdd, &roamInfo.bssid, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
+                            vos_mem_copy(&roamInfo.bssid,
+                                         pSession->pConnectBssDesc->bssId,
+                                         sizeof(tCsrBssid));
                             roamInfo.u.pConnectedProfile = &pSession->connectedProfile;
                             pRoamInfo = &roamInfo;
                         }
@@ -9198,10 +9637,11 @@
                                 pIbssLog->eventId = WLAN_IBSS_EVENT_COALESCING;
                                 if(pNewBss)
                                 {
-                                    palCopyMemory(pMac->hHdd, pIbssLog->bssid, pNewBss->bssId, 6);
+                                    vos_mem_copy(pIbssLog->bssid, pNewBss->bssId, 6);
                                     if(pNewBss->ssId.length)
                                     {
-                                        palCopyMemory(pMac->hHdd, pIbssLog->ssid, pNewBss->ssId.ssId, pNewBss->ssId.length);
+                                        vos_mem_copy(pIbssLog->ssid, pNewBss->ssId.ssId,
+                                                     pNewBss->ssId.length);
                                     }
                                     pIbssLog->operatingChannel = pNewBss->channelNumber;
                                 }
@@ -9215,26 +9655,26 @@
                         }
 #endif //FEATURE_WLAN_DIAG_SUPPORT_CSR
                         csrRoamUpdateConnectedProfileFromNewBss( pMac, sessionId, pNewBss );
-                        csrRoamIssueSetContextReq( pMac, sessionId, pSession->connectedProfile.EncryptionType,
-                                                    pSession->pConnectBssDesc,
-                                                &Broadcastaddr,
-                                                FALSE, FALSE, eSIR_TX_RX, 0, 0, NULL, 0 );
+
+                        if ((eCSR_ENCRYPT_TYPE_NONE ==
+                                    pSession->connectedProfile.EncryptionType ))
+                        {
+                            csrRoamIssueSetContextReq( pMac, sessionId,
+                                     pSession->connectedProfile.EncryptionType,
+                                     pSession->pConnectBssDesc,
+                                     &Broadcastaddr,
+                                     FALSE, FALSE, eSIR_TX_RX, 0, 0, NULL, 0 );
+                        }
                         result = eCSR_ROAM_RESULT_IBSS_COALESCED;
                         roamStatus = eCSR_ROAM_IBSS_IND;
-                        palCopyMemory(pMac->hHdd, &roamInfo.bssid, &pNewBss->bssId, sizeof(tCsrBssid));
+                        vos_mem_copy(&roamInfo.bssid, &pNewBss->bssId,
+                                     sizeof(tCsrBssid));
                         pRoamInfo = &roamInfo;
                         //This BSSID is th ereal BSSID, let's save it
                         if(pSession->pConnectBssDesc)
                         {
-                            palCopyMemory(pMac->hHdd, pSession->pConnectBssDesc->bssId, &pNewBss->bssId, sizeof(tCsrBssid));
-                        }
-                        // Stop the join IBSS timer in case of join, for
-                        // genuine merge do nothing
-                        if(pSession->ibss_join_pending)
-                        {
-                           pSession->ibss_join_pending = FALSE;
-                           csrRoamStopIbssJoinTimer(pMac, sessionId);
-                           result = eCSR_ROAM_RESULT_IBSS_JOIN_SUCCESS;
+                            vos_mem_copy(pSession->pConnectBssDesc->bssId,
+                                         &pNewBss->bssId, sizeof(tCsrBssid));
                         }
                     }
                     smsLog(pMac, LOGW, "CSR:  eSIR_SME_JOINED_NEW_BSS received from PE");
@@ -9291,7 +9731,7 @@
                 if(pIbssLog)
                 {
                     pIbssLog->eventId = WLAN_IBSS_EVENT_PEER_JOIN;
-                    palCopyMemory(pMac->hHdd, pIbssLog->peerMacAddr, &pIbssPeerInd->peerAddr, 6);
+                    vos_mem_copy(pIbssLog->peerMacAddr, &pIbssPeerInd->peerAddr, 6);
                     WLAN_VOS_DIAG_LOG_REPORT(pIbssLog);
                 }
             }
@@ -9309,27 +9749,38 @@
             // Issue the set Context request to LIM to establish the Unicast STA context for the new peer...
                 if(pSession->pConnectBssDesc)
                 {
-                    palCopyMemory(pMac->hHdd, &roamInfo.peerMac, pIbssPeerInd->peerAddr, sizeof(tCsrBssid));
-                    palCopyMemory(pMac->hHdd, &roamInfo.bssid, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
+                    vos_mem_copy(&roamInfo.peerMac, pIbssPeerInd->peerAddr,
+                                 sizeof(tCsrBssid));
+                    vos_mem_copy(&roamInfo.bssid, pSession->pConnectBssDesc->bssId,
+                                 sizeof(tCsrBssid));
                     if(pIbssPeerInd->mesgLen > sizeof(tSmeIbssPeerInd))
                     {
-                        status = palAllocateMemory(pMac->hHdd, (void **)&roamInfo.pbFrames,
-                                                (pIbssPeerInd->mesgLen - sizeof(tSmeIbssPeerInd)));
-                        if(HAL_STATUS_SUCCESS(status))
+                        roamInfo.pbFrames = vos_mem_malloc((pIbssPeerInd->mesgLen
+                                                    - sizeof(tSmeIbssPeerInd)));
+                        if ( NULL == roamInfo.pbFrames )
+                            status = eHAL_STATUS_FAILURE;
+                        else
+                            status = eHAL_STATUS_SUCCESS;
+                        if (HAL_STATUS_SUCCESS(status))
                         {
                             roamInfo.nBeaconLength = (pIbssPeerInd->mesgLen - sizeof(tSmeIbssPeerInd));
-                            palCopyMemory(pMac->hHdd, roamInfo.pbFrames, ((tANI_U8 *)pIbssPeerInd) + sizeof(tSmeIbssPeerInd),
-                                                roamInfo.nBeaconLength);
+                            vos_mem_copy(roamInfo.pbFrames,
+                                        ((tANI_U8 *)pIbssPeerInd) + sizeof(tSmeIbssPeerInd),
+                                         roamInfo.nBeaconLength);
                         }
                         roamInfo.staId = (tANI_U8)pIbssPeerInd->staId;
                         roamInfo.ucastSig = (tANI_U8)pIbssPeerInd->ucastSig;
                         roamInfo.bcastSig = (tANI_U8)pIbssPeerInd->bcastSig;
-                        status = palAllocateMemory(pMac->hHdd, (void **)&roamInfo.pBssDesc,
-                                                pSession->pConnectBssDesc->length);
-                        if(HAL_STATUS_SUCCESS(status))
+                        roamInfo.pBssDesc = vos_mem_malloc(pSession->pConnectBssDesc->length);
+                        if ( NULL == roamInfo.pBssDesc )
+                            status = eHAL_STATUS_FAILURE;
+                        else
+                            status = eHAL_STATUS_SUCCESS;
+                        if (HAL_STATUS_SUCCESS(status))
                         {
-                            palCopyMemory(pMac->hHdd, roamInfo.pBssDesc, pSession->pConnectBssDesc,
-                                                pSession->pConnectBssDesc->length);
+                            vos_mem_copy(roamInfo.pBssDesc,
+                                         pSession->pConnectBssDesc,
+                                         pSession->pConnectBssDesc->length);
                         }
                         if(HAL_STATUS_SUCCESS(status))
                         {
@@ -9339,11 +9790,11 @@
                         {
                             if(roamInfo.pbFrames)
                             {
-                                palFreeMemory(pMac->hHdd, roamInfo.pbFrames);
+                                vos_mem_free(roamInfo.pbFrames);
                             }
                             if(roamInfo.pBssDesc)
                             {
-                                palFreeMemory(pMac->hHdd, roamInfo.pBssDesc);
+                                vos_mem_free(roamInfo.pBssDesc);
                             }
                         }
                     }
@@ -9351,10 +9802,15 @@
                     {
                         pRoamInfo = &roamInfo;
                     }
-                        csrRoamIssueSetContextReq( pMac, sessionId, pSession->connectedProfile.EncryptionType,
-                                            pSession->pConnectBssDesc,
-                                            &(pIbssPeerInd->peerAddr),
-                                            FALSE, TRUE, eSIR_TX_RX, 0, 0, NULL, 0 ); // NO keys... these key parameters don't matter.
+                    if ((eCSR_ENCRYPT_TYPE_NONE ==
+                              pSession->connectedProfile.EncryptionType ))
+                    {
+                       csrRoamIssueSetContextReq( pMac, sessionId,
+                                     pSession->connectedProfile.EncryptionType,
+                                     pSession->pConnectBssDesc,
+                                     &(pIbssPeerInd->peerAddr),
+                                     FALSE, TRUE, eSIR_TX_RX, 0, 0, NULL, 0 ); // NO keys... these key parameters don't matter.
+                    }
                 }
                 else
                 {
@@ -9365,17 +9821,17 @@
                 {
                     pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
                 }
-                csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0,
+                csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, 
                             eCSR_ROAM_CONNECT_STATUS_UPDATE, eCSR_ROAM_RESULT_IBSS_NEW_PEER);
                 if(pRoamInfo)
                 {
                     if(roamInfo.pbFrames)
                     {
-                        palFreeMemory(pMac->hHdd, roamInfo.pbFrames);
+                        vos_mem_free(roamInfo.pbFrames);
                     }
                     if(roamInfo.pBssDesc)
                     {
-                        palFreeMemory(pMac->hHdd, roamInfo.pBssDesc);
+                        vos_mem_free(roamInfo.pBssDesc);
                     }
                 }
             }
@@ -9388,14 +9844,15 @@
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
                 {
                     vos_log_ibss_pkt_type *pIbssLog;
-
+ 
                     WLAN_VOS_DIAG_LOG_ALLOC(pIbssLog, vos_log_ibss_pkt_type, LOG_WLAN_IBSS_C);
                     if(pIbssLog)
                     {
                         pIbssLog->eventId = WLAN_IBSS_EVENT_PEER_LEAVE;
                         if(pIbssPeerInd)
                         {
-                            palCopyMemory(pMac->hHdd, pIbssLog->peerMacAddr, &pIbssPeerInd->peerAddr, 6);
+                           vos_mem_copy(pIbssLog->peerMacAddr,
+                                        &pIbssPeerInd->peerAddr, 6);
                         }
                         WLAN_VOS_DIAG_LOG_REPORT(pIbssLog);
                     }
@@ -9405,8 +9862,9 @@
                 roamInfo.staId = (tANI_U8)pIbssPeerInd->staId;
                 roamInfo.ucastSig = (tANI_U8)pIbssPeerInd->ucastSig;
                 roamInfo.bcastSig = (tANI_U8)pIbssPeerInd->bcastSig;
-                palCopyMemory(pMac->hHdd, &roamInfo.peerMac, pIbssPeerInd->peerAddr, sizeof(tCsrBssid));
-                csrRoamCallCallback(pMac, sessionId, &roamInfo, 0,
+                vos_mem_copy(&roamInfo.peerMac, pIbssPeerInd->peerAddr,
+                             sizeof(tCsrBssid));
+                csrRoamCallCallback(pMac, sessionId, &roamInfo, 0, 
                         eCSR_ROAM_CONNECT_STATUS_UPDATE, eCSR_ROAM_RESULT_IBSS_PEER_DEPARTED);
             }
             break;
@@ -9415,14 +9873,14 @@
                 tSirSmeSetContextRsp *pRsp = (tSirSmeSetContextRsp *)pSirMsg;
                 tListElem *pEntry;
                 tSmeCmd *pCommand;
-
+                
                 pEntry = csrLLPeekHead( &pMac->sme.smeCmdActiveList, LL_ACCESS_LOCK );
                 if ( pEntry )
                 {
                     pCommand = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
                     if ( eSmeCommandSetKey == pCommand->command )
-                    {
-                        sessionId = pCommand->sessionId;
+                    {                
+                        sessionId = pCommand->sessionId;        
                         pSession = CSR_GET_SESSION( pMac, sessionId );
 
                         if(!pSession)
@@ -9430,12 +9888,13 @@
                             smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
                             return;
                         }
-
+       
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
                         if(eCSR_ENCRYPT_TYPE_NONE != pSession->connectedProfile.EncryptionType)
                         {
                             WLAN_VOS_DIAG_EVENT_DEF(setKeyEvent, vos_event_wlan_security_payload_type);
-                            palZeroMemory(pMac->hHdd, &setKeyEvent, sizeof(vos_event_wlan_security_payload_type));
+                            vos_mem_set(&setKeyEvent,
+                                        sizeof(vos_event_wlan_security_payload_type), 0);
                             if( pRsp->peerMacAddr[0] & 0x01 )
                             {
                                 setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_GTK_RSP;
@@ -9444,12 +9903,13 @@
                             {
                                 setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_PTK_RSP;
                             }
-                            setKeyEvent.encryptionModeMulticast =
+                            setKeyEvent.encryptionModeMulticast = 
                                 (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.mcEncryptionType);
-                            setKeyEvent.encryptionModeUnicast =
+                            setKeyEvent.encryptionModeUnicast = 
                                 (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.EncryptionType);
-                            palCopyMemory( pMac->hHdd, setKeyEvent.bssid, pSession->connectedProfile.bssid, 6 );
-                            setKeyEvent.authMode =
+                            vos_mem_copy(setKeyEvent.bssid,
+                                         pSession->connectedProfile.bssid, 6);
+                            setKeyEvent.authMode = 
                                 (v_U8_t)diagAuthTypeFromCSRType(pSession->connectedProfile.AuthType);
                             if( eSIR_SME_SUCCESS != pRsp->statusCode )
                             {
@@ -9464,30 +9924,31 @@
 
                             //We are done with authentication, whethere succeed or not
                             csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_NONE, sessionId);
-                            //We do it here because this linkup function is not called after association
-                            //when a key needs to be set.
-                            if( csrIsConnStateConnectedInfra(pMac, sessionId) )
+                            //We do it here because this linkup function is not called after association 
+                            //when a key needs to be set. 
+                            if( csrIsConnStateConnectedInfra(pMac, sessionId) ) 
                             {
                                 csrRoamLinkUp(pMac, pSession->connectedProfile.bssid);
                             }
                         }
                         if( eSIR_SME_SUCCESS == pRsp->statusCode )
                         {
-                            palCopyMemory( pMac, &roamInfo.peerMac, &pRsp->peerMacAddr, sizeof(tCsrBssid) );
+                            vos_mem_copy(&roamInfo.peerMac,
+                                         &pRsp->peerMacAddr, sizeof(tCsrBssid));
                                 //Make sure we install the GTK before indicating to HDD as authenticated
                                 //This is to prevent broadcast packets go out after PTK and before GTK.
-                                if( palEqualMemory( pMac->hHdd, &Broadcastaddr, pRsp->peerMacAddr,
-                                           sizeof(tSirMacAddr) ) )
+                                if ( vos_mem_compare( &Broadcastaddr, pRsp->peerMacAddr,
+                                                     sizeof(tSirMacAddr) ) )
                                 {
 #ifdef WLAN_ACTIVEMODE_OFFLOAD_FEATURE
                                     if(IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE)
                                     {
                                        tpSirSetActiveModeSetBncFilterReq pMsg;
-                                       palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof(tSirSetActiveModeSetBncFilterReq));
+                                       pMsg = vos_mem_malloc(sizeof(tSirSetActiveModeSetBncFilterReq));
                                        pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_SET_BCN_FILTER_REQ);
                                        pMsg->length = pal_cpu_to_be16(sizeof( tANI_U8));
                                        pMsg->seesionId = sessionId;
-                                       status = palSendMBMessage(pMac->hHdd, pMsg );
+                                       status = palSendMBMessage(pMac->hHdd, pMsg ); 
                                     }
 #endif
                                        result = eCSR_ROAM_RESULT_AUTHENTICATED;
@@ -9505,7 +9966,7 @@
                                 pRsp->statusCode, pRsp->peerMacAddr[0], pRsp->peerMacAddr[1], pRsp->peerMacAddr[2],
                                 pRsp->peerMacAddr[3], pRsp->peerMacAddr[4], pRsp->peerMacAddr[5] );
                         }
-                        csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.setKeyCmd.roamId,
+                        csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.setKeyCmd.roamId, 
                                             eCSR_ROAM_SET_KEY_COMPLETE, result);
                         // Indicate SME_QOS that the SET_KEY is completed, so that SME_QOS
                         // can go ahead and initiate the TSPEC if any are pending
@@ -9513,10 +9974,12 @@
 #ifdef FEATURE_WLAN_CCX
                         //Send Adjacent AP repot to new AP.
                         if (result == eCSR_ROAM_RESULT_AUTHENTICATED &&
-                            pSession->isPrevApInfoValid &&
+                            pSession->isPrevApInfoValid && 
                             pSession->connectedProfile.isCCXAssoc)
                         {
-#ifdef WLAN_FEATURE_VOWIFI
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+                            csrSendCcxAdjacentApRepInd(pMac, pSession);
+#else
                             csrCcxSendAdjacentApRepMsg(pMac, pSession);
 #endif
                             pSession->isPrevApInfoValid = FALSE;
@@ -9544,13 +10007,13 @@
                 tSirSmeRemoveKeyRsp *pRsp = (tSirSmeRemoveKeyRsp *)pSirMsg;
                 tListElem *pEntry;
                 tSmeCmd *pCommand;
-
+                
                 pEntry = csrLLPeekHead( &pMac->sme.smeCmdActiveList, LL_ACCESS_LOCK );
                 if ( pEntry )
                 {
                     pCommand = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
                     if ( eSmeCommandRemoveKey == pCommand->command )
-                    {
+                    {                
                         sessionId = pCommand->sessionId;
                         pSession = CSR_GET_SESSION( pMac, sessionId );
 
@@ -9562,14 +10025,16 @@
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
                         {
                             WLAN_VOS_DIAG_EVENT_DEF(removeKeyEvent, vos_event_wlan_security_payload_type);
-                            palZeroMemory(pMac->hHdd, &removeKeyEvent, sizeof(vos_event_wlan_security_payload_type));
+                            vos_mem_set(&removeKeyEvent,
+                                        sizeof(vos_event_wlan_security_payload_type), 0);
                             removeKeyEvent.eventId = WLAN_SECURITY_EVENT_REMOVE_KEY_RSP;
-                            removeKeyEvent.encryptionModeMulticast =
+                            removeKeyEvent.encryptionModeMulticast = 
                                 (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.mcEncryptionType);
-                            removeKeyEvent.encryptionModeUnicast =
+                            removeKeyEvent.encryptionModeUnicast = 
                                 (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.EncryptionType);
-                            palCopyMemory( pMac->hHdd, removeKeyEvent.bssid, pSession->connectedProfile.bssid, 6 );
-                            removeKeyEvent.authMode =
+                            vos_mem_copy( removeKeyEvent.bssid,
+                                          pSession->connectedProfile.bssid, 6);
+                            removeKeyEvent.authMode = 
                                 (v_U8_t)diagAuthTypeFromCSRType(pSession->connectedProfile.AuthType);
                             if( eSIR_SME_SUCCESS != pRsp->statusCode )
                             {
@@ -9580,7 +10045,8 @@
 #endif //FEATURE_WLAN_DIAG_SUPPORT_CSR
                         if( eSIR_SME_SUCCESS == pRsp->statusCode )
                         {
-                            palCopyMemory( pMac, &roamInfo.peerMac, &pRsp->peerMacAddr, sizeof(tCsrBssid) );
+                            vos_mem_copy(&roamInfo.peerMac, &pRsp->peerMacAddr,
+                                         sizeof(tCsrBssid));
                             result = eCSR_ROAM_RESULT_NONE;
                             pRoamInfo = &roamInfo;
                         }
@@ -9588,7 +10054,7 @@
                         {
                             result = eCSR_ROAM_RESULT_FAILURE;
                         }
-                        csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.setKeyCmd.roamId,
+                        csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.setKeyCmd.roamId, 
                                             eCSR_ROAM_REMOVE_KEY_COMPLETE, result);
                         if( csrLLRemoveEntry( &pMac->sme.smeCmdActiveList, pEntry, LL_ACCESS_LOCK ) )
                         {
@@ -9617,11 +10083,22 @@
             csrRoamRssiRspProcessor( pMac, pSirMsg );
             break;
 #endif
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+        case eWNI_SME_GET_TSM_STATS_RSP:
+            smsLog( pMac, LOG2, FL("TSM Stats rsp from PE"));
+            csrTsmStatsRspProcessor( pMac, pSirMsg );
+            break;
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
         case eWNI_SME_GET_RSSI_REQ:
             smsLog( pMac, LOG2, FL("GetRssiReq from self"));
             csrUpdateRssi( pMac, pSirMsg );
             break;
 
+        case eWNI_SME_GET_SNR_REQ:
+            smsLog( pMac, LOG2, FL("GetSnrReq from self"));
+            csrUpdateSnr(pMac, pSirMsg);
+            break;
+
 #ifdef WLAN_FEATURE_VOWIFI_11R
         case eWNI_SME_FT_PRE_AUTH_RSP:
             csrRoamFTPreAuthRspProcessor( pMac, (tpSirFTPreAuthRsp)pSirMsg );
@@ -9632,11 +10109,12 @@
             smsLog( pMac, LOG1, FL("send indication that max assoc have been reached and the new peer cannot be accepted"));
             sessionId = pSmeMaxAssocInd->sessionId;
             roamInfo.sessionId = sessionId;
-            palCopyMemory(pMac->hHdd, &roamInfo.peerMac, pSmeMaxAssocInd->peerMac, sizeof(tCsrBssid));
-            csrRoamCallCallback(pMac, sessionId, &roamInfo, 0,
+            vos_mem_copy(&roamInfo.peerMac, pSmeMaxAssocInd->peerMac,
+                         sizeof(tCsrBssid));
+            csrRoamCallCallback(pMac, sessionId, &roamInfo, 0, 
                     eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_MAX_ASSOC_EXCEEDED);
             break;
-
+            
         case eWNI_SME_BTAMP_LOG_LINK_IND:
             smsLog( pMac, LOG1, FL("Establish logical link req from HCI serialized through MC thread"));
             btampEstablishLogLinkHdlr( pSirMsg );
@@ -9650,6 +10128,10 @@
             smsLog( pMac, LOG2, FL("Candidate found indication from PE"));
             csrNeighborRoamCandidateFoundIndHdlr( pMac, pSirMsg );
         break;
+        case eWNI_SME_HANDOFF_REQ:
+            smsLog( pMac, LOG2, FL("Handoff Req from self"));
+            csrNeighborRoamHandoffReqHdlr( pMac, pSirMsg );
+            break;
 #endif
 
         default:
@@ -9657,7 +10139,7 @@
     }  // end switch on message type
 }
 
-void csrCallRoamingCompletionCallback(tpAniSirGlobal pMac, tCsrRoamSession *pSession,
+void csrCallRoamingCompletionCallback(tpAniSirGlobal pMac, tCsrRoamSession *pSession, 
                                       tCsrRoamInfo *pRoamInfo, tANI_U32 roamId, eCsrRoamResult roamResult)
 {
    if(pSession)
@@ -9667,8 +10149,8 @@
          pSession->bRefAssocStartCnt--;
          VOS_ASSERT( pSession->bRefAssocStartCnt == 0);
          //Need to call association_completion because there is an assoc_start pending.
-         csrRoamCallCallback(pMac, pSession->sessionId, NULL, roamId,
-                                               eCSR_ROAM_ASSOCIATION_COMPLETION,
+         csrRoamCallCallback(pMac, pSession->sessionId, NULL, roamId, 
+                                               eCSR_ROAM_ASSOCIATION_COMPLETION, 
                                                eCSR_ROAM_RESULT_FAILURE);
       }
       csrRoamCallCallback(pMac, pSession->sessionId, pRoamInfo, roamId, eCSR_ROAM_ROAMING_COMPLETION, roamResult);
@@ -9683,7 +10165,7 @@
 eHalStatus csrRoamStartRoaming(tpAniSirGlobal pMac, tANI_U32 sessionId, eCsrRoamingReason roamingReason)
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
-    if(CSR_IS_LOSTLINK_ROAMING(roamingReason) &&
+    if(CSR_IS_LOSTLINK_ROAMING(roamingReason) && 
         (eANI_BOOLEAN_FALSE == pMac->roam.roamSession[sessionId].fCancelRoaming))
     {
         status = csrScanRequestLostLink1( pMac, sessionId );
@@ -9692,7 +10174,7 @@
 }
 
 //return a boolean to indicate whether roaming completed or continue.
-tANI_BOOLEAN csrRoamCompleteRoaming(tpAniSirGlobal pMac, tANI_U32 sessionId,
+tANI_BOOLEAN csrRoamCompleteRoaming(tpAniSirGlobal pMac, tANI_U32 sessionId, 
                                     tANI_BOOLEAN fForce, eCsrRoamResult roamResult)
 {
     tANI_BOOLEAN fCompleted = eANI_BOOLEAN_TRUE;
@@ -9705,7 +10187,7 @@
         return eANI_BOOLEAN_FALSE;
     }
     //Check whether time is up
-    if(pSession->fCancelRoaming || fForce ||
+    if(pSession->fCancelRoaming || fForce || 
        ((curTime - pSession->roamingStartTime) > roamTime) ||
        eCsrReassocRoaming == pSession->roamingReason ||
        eCsrDynamicRoaming == pSession->roamingReason)
@@ -9762,7 +10244,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-
+    
     if(CSR_IS_ROAMING(pSession))
     {
         smsLog(pMac, LOGW, "   Cancelling roaming");
@@ -9773,9 +10255,9 @@
         }
         else
         {
-            eCsrRoamResult roamResult = CSR_IS_LOSTLINK_ROAMING(pSession->roamingReason) ?
+            eCsrRoamResult roamResult = CSR_IS_LOSTLINK_ROAMING(pSession->roamingReason) ? 
                                                     eCSR_ROAM_RESULT_LOSTLINK : eCSR_ROAM_RESULT_NONE;
-            //Roaming is stopped after here
+            //Roaming is stopped after here 
             csrRoamCompleteRoaming(pMac, sessionId, eANI_BOOLEAN_TRUE, roamResult);
             //Since CSR may be in lostlink roaming situation, abort all roaming related activities
             csrScanAbortMacScan(pMac, sessionId);
@@ -9796,8 +10278,8 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-
-    if(eANI_BOOLEAN_FALSE == pSession->fCancelRoaming)
+    
+    if(eANI_BOOLEAN_FALSE == pSession->fCancelRoaming) 
     {
         if(!HAL_STATUS_SUCCESS(csrRoamStartRoaming(pMac, sessionId, pSession->roamingReason)))
         {
@@ -9817,17 +10299,17 @@
         smsLog(pMac, LOGE, FL("  session %d not found"), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     smsLog(pMac, LOG1, " csrScanStartRoamingTimer");
     pSession->roamingTimerInfo.sessionId = (tANI_U8)sessionId;
-    status = palTimerStart(pMac->hHdd, pSession->hTimerRoaming, interval, eANI_BOOLEAN_FALSE);
-
+    status = vos_timer_start(&pSession->hTimerRoaming, interval/PAL_TIMER_TO_MS_UNIT);
+    
     return (status);
 }
 
 eHalStatus csrRoamStopRoamingTimer(tpAniSirGlobal pMac, tANI_U32 sessionId)
 {
-    return (palTimerStop(pMac->hHdd, pMac->roam.roamSession[sessionId].hTimerRoaming));
+    return (vos_timer_stop(&pMac->roam.roamSession[sessionId].hTimerRoaming));
 }
 
 void csrRoamWaitForKeyTimeOutHandler(void *pv)
@@ -9845,9 +10327,9 @@
 #ifdef FEATURE_WLAN_LFR
         if (csrNeighborRoamIsHandoffInProgress(pMac))
         {
-            /*
+            /* 
              * Enable heartbeat timer when hand-off is in progress
-             * and Key Wait timer expired.
+             * and Key Wait timer expired. 
              */
             smsLog(pMac, LOG2, "Enabling HB timer after WaitKey expiry"
                     " (nHBCount=%d)",
@@ -9858,11 +10340,17 @@
         }
 #endif
         smsLog(pMac, LOGW, " SME pre-auth state timeout. ");
+
         //Change the substate so command queue is unblocked.
-        csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_NONE, pInfo->sessionId);
+        if (CSR_ROAM_SESSION_MAX > pInfo->sessionId)
+        {
+            csrRoamSubstateChange(pMac, eCSR_ROAM_SUBSTATE_NONE,
+                                  pInfo->sessionId);
+        }
+
         if (pSession)
         {
-            if( csrIsConnStateConnectedInfra(pMac, pInfo->sessionId) )
+            if( csrIsConnStateConnectedInfra(pMac, pInfo->sessionId) ) 
             {
                 csrRoamLinkUp(pMac, pSession->connectedProfile.bssid);
                 smeProcessPendingQueue(pMac);
@@ -9878,7 +10366,7 @@
             smsLog(pMac, LOGW, "%s: session not found", __func__);
         }
     }
-
+    
 }
 
 eHalStatus csrRoamStartWaitForKeyTimer(tpAniSirGlobal pMac, tANI_U32 interval)
@@ -9896,8 +10384,8 @@
     }
 #endif
     smsLog(pMac, LOG1, " csrScanStartWaitForKeyTimer");
-    status = palTimerStart(pMac->hHdd, pMac->roam.hTimerWaitForKey, interval, eANI_BOOLEAN_FALSE);
-
+    status = vos_timer_start(&pMac->roam.hTimerWaitForKey, interval/PAL_TIMER_TO_MS_UNIT);
+    
     return (status);
 }
 
@@ -9909,9 +10397,9 @@
 #ifdef FEATURE_WLAN_LFR
     if (csrNeighborRoamIsHandoffInProgress(pMac))
     {
-        /*
+        /* 
          * Enable heartbeat timer when hand-off is in progress
-         * and Key Wait timer got stopped for some reason
+         * and Key Wait timer got stopped for some reason 
          */
         smsLog(pMac, LOG2, "Enabling HB timer after WaitKey stop"
                 " (nHBCount=%d)",
@@ -9921,51 +10409,10 @@
             NULL, eANI_BOOLEAN_FALSE);
     }
 #endif
-    return (palTimerStop(pMac->hHdd, pMac->roam.hTimerWaitForKey));
+    return (vos_timer_stop(&pMac->roam.hTimerWaitForKey));
 }
 
-void csrRoamIbssJoinTimerHandler(void *pv)
-{
-    tCsrTimerInfo *pInfo = (tCsrTimerInfo *)pv;
-    tpAniSirGlobal pMac = pInfo->pMac;
-    eCsrRoamDisconnectReason reason = eCSR_DISCONNECT_REASON_IBSS_JOIN_FAILURE;
-    tANI_U32 sessionId = pInfo->sessionId;
-    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-
-    if(!pSession)
-    {
-        smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
-        return;
-    }
-
-    pSession->ibss_join_pending = FALSE;
-    // JEZ100225:  As of main/latest "tip", we are no longer doing this. Check on this.
-    //csrRoamCallCallback(pMac, sessionId, NULL, 0, eCSR_ROAM_IBS_IND, eCSR_ROAM_RESULT_IBSS_JOIN_FAILED);
-    // Send an IBSS stop request to PE
-    csrRoamDisconnectInternal(pMac, sessionId, reason);
-}
-eHalStatus csrRoamStartIbssJoinTimer(tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U32 interval)
-{
-    eHalStatus status;
-    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-
-    if(!pSession)
-    {
-        smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
-        return eHAL_STATUS_FAILURE;
-    }
-
-    smsLog(pMac, LOG1, " csrRoamStartIbssJoinTimer");
-    pSession->ibssJoinTimerInfo.sessionId = (tANI_U8)sessionId;
-    status = palTimerStart(pMac->hHdd, pSession->hTimerIbssJoining, interval, eANI_BOOLEAN_FALSE);
-
-    return (status);
-}
-eHalStatus csrRoamStopIbssJoinTimer(tpAniSirGlobal pMac, tANI_U32 sessionId)
-{
-    return (palTimerStop(pMac->hHdd, pMac->roam.roamSession[sessionId].hTimerIbssJoining));
-}
-void csrRoamCompletion(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamInfo *pRoamInfo, tSmeCmd *pCommand,
+void csrRoamCompletion(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamInfo *pRoamInfo, tSmeCmd *pCommand, 
                         eCsrRoamResult roamResult, tANI_BOOLEAN fSuccess)
 {
     eRoamCmdStatus roamStatus = csrGetRoamCompleteStatus(pMac, sessionId);
@@ -9977,7 +10424,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-
+    
     if(pCommand)
     {
         roamId = pCommand->u.roamCmd.roamId;
@@ -10041,13 +10488,13 @@
         result = eCSR_ROAM_RESULT_NONE;
         pSession->joinFailStatusCode.reasonCode = 1;
     }
-
+    
     // call profile lost link routine here
     if(!CSR_IS_INFRA_AP(&pSession->connectedProfile))
     {
         csrRoamCallCallback(pMac, sessionId, NULL, 0, eCSR_ROAM_LOSTLINK_DETECTED, result);
     }
-
+    
     if ( eWNI_SME_DISASSOC_IND == type )
     {
         status = csrSendMBDisassocCnfMsg(pMac, pDisassocIndMsg);
@@ -10063,19 +10510,21 @@
     }
 
     //prepare to tell HDD to disconnect
-    palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+    vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
     roamInfo.statusCode = (tSirResultCodes)pSession->roamingStatusCode;
     roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
     if( eWNI_SME_DISASSOC_IND == type)
     {
         //staMacAddr
-        palCopyMemory(pMac->hHdd, roamInfo.peerMac, pDisassocIndMsg->peerMacAddr, sizeof(tSirMacAddr));
+        vos_mem_copy(roamInfo.peerMac, pDisassocIndMsg->peerMacAddr,
+                     sizeof(tSirMacAddr));
         roamInfo.staId = (tANI_U8)pDisassocIndMsg->staId;
     }
     else if( eWNI_SME_DEAUTH_IND == type )
     {
         //staMacAddr
-        palCopyMemory(pMac->hHdd, roamInfo.peerMac, pDeauthIndMsg->peerMacAddr, sizeof(tSirMacAddr));
+        vos_mem_copy(roamInfo.peerMac, pDeauthIndMsg->peerMacAddr,
+                     sizeof(tSirMacAddr));
         roamInfo.staId = (tANI_U8)pDeauthIndMsg->staId;
     }
     smsLog(pMac, LOGW, FL("roamInfo.staId (%d)"), roamInfo.staId);
@@ -10091,10 +10540,10 @@
         if( pMac->roam.configParam.nRoamingTime )
         {
             if(HAL_STATUS_SUCCESS(status = csrRoamStartRoaming(pMac, sessionId,
-                        ( eWNI_SME_DEAUTH_IND == type ) ?
+                        ( eWNI_SME_DEAUTH_IND == type ) ? 
                         eCsrLostlinkRoamingDeauth : eCsrLostlinkRoamingDisassoc)))
             {
-                palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+                vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
                 //For IBSS, we need to give some more info to HDD
                 if(csrIsBssTypeIBSS(pSession->connectedProfile.BSSType))
                 {
@@ -10107,7 +10556,7 @@
                    roamInfo.reasonCode = eCsrRoamReasonSmeIssuedForLostLink;
                 }
                     pRoamInfo = &roamInfo;
-                pSession->roamingReason = ( eWNI_SME_DEAUTH_IND == type ) ?
+                pSession->roamingReason = ( eWNI_SME_DEAUTH_IND == type ) ? 
                         eCsrLostlinkRoamingDeauth : eCsrLostlinkRoamingDisassoc;
                 pSession->roamingStartTime = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
                 csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_ROAMING_START, eCSR_ROAM_RESULT_LOSTLINK);
@@ -10136,14 +10585,14 @@
             csrRoamCallCallback(pMac, sessionId, &roamInfo, 0, eCSR_ROAM_LOSTLINK, result);
         }
 
-       /*No need to start idle scan in case of IBSS/SAP
+       /*No need to start idle scan in case of IBSS/SAP 
          Still enable idle scan for polling in case concurrent sessions are running */
         if(CSR_IS_INFRASTRUCTURE(&pSession->connectedProfile))
         {
             csrScanStartIdleScan(pMac);
         }
     }
-
+    
     return (status);
 }
 
@@ -10159,7 +10608,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     pSession->fCancelRoaming =  eANI_BOOLEAN_FALSE;
     //Only remove the connected BSS in infrastructure mode
     csrRoamRemoveConnectedBssFromScanCache(pMac, &pSession->connectedProfile);
@@ -10192,7 +10641,7 @@
        //We are told not to roam, indicate lostlink
        status = eHAL_STATUS_FAILURE;
     }
-
+    
     return (status);
 }
 void csrRoamWmStatusChangeComplete( tpAniSirGlobal pMac )
@@ -10209,13 +10658,13 @@
             // roaming sequence.
             if( csrLLRemoveEntry( &pMac->sme.smeCmdActiveList, pEntry, LL_ACCESS_LOCK ) )
             {
-                csrReleaseCommandWmStatusChange( pMac, pCommand );
+                csrReleaseCommandWmStatusChange( pMac, pCommand );            
             }
             else
             {
                 smsLog( pMac, LOGE, " ******csrRoamWmStatusChangeComplete fail to release command");
             }
-
+            
         }
         else
         {
@@ -10240,7 +10689,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), pCommand->sessionId);
         return;
     }
-
+    
     switch ( pCommand->u.wmStatusChangeCmd.Type )
     {
         case eCsrDisassociated:
@@ -10272,16 +10721,16 @@
 //This function returns band and mode information.
 //The only tricky part is that if phyMode is set to 11abg, this function may return eCSR_CFG_DOT11_MODE_11B
 //instead of eCSR_CFG_DOT11_MODE_11G if everything is set to auto-pick.
-static eCsrCfgDot11Mode csrRoamGetPhyModeBandForBss( tpAniSirGlobal pMac, tCsrRoamProfile *pProfile,
+static eCsrCfgDot11Mode csrRoamGetPhyModeBandForBss( tpAniSirGlobal pMac, tCsrRoamProfile *pProfile, 
                                                      tANI_U8 operationChn, eCsrBand *pBand )
 {
     eCsrPhyMode phyModeIn = (eCsrPhyMode)pProfile->phyMode;
-    eCsrCfgDot11Mode cfgDot11Mode = csrGetCfgDot11ModeFromCsrPhyMode(pProfile, phyModeIn,
+    eCsrCfgDot11Mode cfgDot11Mode = csrGetCfgDot11ModeFromCsrPhyMode(pProfile, phyModeIn, 
                                             pMac->roam.configParam.ProprietaryRatesEnabled);
     eCsrBand eBand;
-
+    
     //If the global setting for dot11Mode is set to auto/abg, we overwrite the setting in the profile.
-    if( ((!CSR_IS_INFRA_AP(pProfile )&& !CSR_IS_WDS(pProfile )) &&
+    if( ((!CSR_IS_INFRA_AP(pProfile )&& !CSR_IS_WDS(pProfile )) && 
          ((eCSR_CFG_DOT11_MODE_AUTO == pMac->roam.configParam.uCfgDot11Mode) ||
          (eCSR_CFG_DOT11_MODE_ABG == pMac->roam.configParam.uCfgDot11Mode))) ||
         (eCSR_CFG_DOT11_MODE_AUTO == cfgDot11Mode) || (eCSR_CFG_DOT11_MODE_ABG == cfgDot11Mode) )
@@ -10299,15 +10748,112 @@
             case eCSR_CFG_DOT11_MODE_11G:
                 cfgDot11Mode = eCSR_CFG_DOT11_MODE_11G;
                 eBand = eCSR_BAND_24;
-                break;
+                break;            
             case eCSR_CFG_DOT11_MODE_11N:
                 cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
-                eBand = eCSR_BAND_24;
+                eBand = CSR_IS_CHANNEL_24GHZ(operationChn) ? eCSR_BAND_24 : eCSR_BAND_5G;
                 break;
-            //case eCSR_CFG_DOT11_MODE_BEST:
-            //    cfgDot11Mode = eCSR_CFG_DOT11_MODE_BEST;
-            //    eBand = eCSR_BAND_24;
-            //    break;
+#ifdef WLAN_FEATURE_11AC
+            case eCSR_CFG_DOT11_MODE_11AC:
+                if (IS_FEATURE_SUPPORTED_BY_FW(DOT11AC))
+                {
+                    /* If the operating channel is in 2.4 GHz band, check for
+                     * INI item to disable VHT operation in 2.4 GHz band
+                     */
+                    if (CSR_IS_CHANNEL_24GHZ(operationChn) &&
+                        !pMac->roam.configParam.enableVhtFor24GHz)
+                    {
+                       /* Disable 11AC operation */
+                       cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
+                    }
+                    else
+                    {
+                       cfgDot11Mode = eCSR_CFG_DOT11_MODE_11AC;
+                    }
+                    eBand = CSR_IS_CHANNEL_24GHZ(operationChn) ? eCSR_BAND_24 : eCSR_BAND_5G;
+                }
+                else
+                {
+                    cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
+                    eBand = CSR_IS_CHANNEL_24GHZ(operationChn) ? eCSR_BAND_24 : eCSR_BAND_5G;
+                }
+                break;
+            case eCSR_CFG_DOT11_MODE_11AC_ONLY:
+                if (IS_FEATURE_SUPPORTED_BY_FW(DOT11AC))
+                {
+                    /* If the operating channel is in 2.4 GHz band, check for
+                     * INI item to disable VHT operation in 2.4 GHz band
+                     */
+                    if (CSR_IS_CHANNEL_24GHZ(operationChn) &&
+                        !pMac->roam.configParam.enableVhtFor24GHz)
+                    {
+                       /* Disable 11AC operation */
+                       cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
+                    }
+                    else
+                    {
+                       cfgDot11Mode = eCSR_CFG_DOT11_MODE_11AC_ONLY;
+                    }
+                    eBand = CSR_IS_CHANNEL_24GHZ(operationChn) ? eCSR_BAND_24 : eCSR_BAND_5G;
+                }
+                else
+                {
+                    eBand = CSR_IS_CHANNEL_24GHZ(operationChn) ? eCSR_BAND_24 : eCSR_BAND_5G;
+                    cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
+                }
+                break;
+#endif
+            case eCSR_CFG_DOT11_MODE_AUTO:
+                eBand = pMac->roam.configParam.eBand;
+                if (eCSR_BAND_24 == eBand)
+                {
+                    // WiFi tests require IBSS networks to start in 11b mode
+                    // without any change to the default parameter settings
+                    // on the adapter.  We use ACU to start an IBSS through
+                    // creation of a startIBSS profile. This startIBSS profile
+                    // has Auto MACProtocol and the adapter property setting
+                    // for dot11Mode is also AUTO.   So in this case, let's
+                    // start the IBSS network in 11b mode instead of 11g mode.
+                    // So this is for Auto=profile->MacProtocol && Auto=Global.
+                    // dot11Mode && profile->channel is < 14, then start the IBSS
+                    // in b mode.
+                    //
+                    // Note:  we used to have this start as an 11g IBSS for best
+                    // performance... now to specify that the user will have to
+                    // set the do11Mode in the property page to 11g to force it.
+                    cfgDot11Mode = eCSR_CFG_DOT11_MODE_11B;
+                }
+                else
+                {
+#ifdef WLAN_FEATURE_11AC
+                    if (IS_FEATURE_SUPPORTED_BY_FW(DOT11AC))
+                    {
+                        /* If the operating channel is in 2.4 GHz band, check for
+                         * INI item to disable VHT operation in 2.4 GHz band
+                         */
+                        if (CSR_IS_CHANNEL_24GHZ(operationChn) &&
+                            !pMac->roam.configParam.enableVhtFor24GHz)
+                        {
+                           /* Disable 11AC operation */
+                           cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
+                        }
+                        else
+                        {
+                           cfgDot11Mode = eCSR_CFG_DOT11_MODE_11AC;
+                        }
+                        eBand = CSR_IS_CHANNEL_24GHZ(operationChn) ? eCSR_BAND_24 : eCSR_BAND_5G;
+                    }
+                    else
+                    {
+                        cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
+                        eBand = CSR_IS_CHANNEL_24GHZ(operationChn) ? eCSR_BAND_24 : eCSR_BAND_5G;
+                    }
+#else
+                    cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
+                    eBand = CSR_IS_CHANNEL_24GHZ(operationChn) ? eCSR_BAND_24 : eCSR_BAND_5G;
+#endif
+                }
+                break;
             default:
                 // Global dot11 Mode setting is 11a/b/g.
                 // use the channel number to determine the Mode setting.
@@ -10328,24 +10874,25 @@
                 }
                 else if ( CSR_IS_CHANNEL_24GHZ(operationChn) )
                 {
-                    // channel is a 2.4GHz channel.  Set mode to 11g.
+                    // WiFi tests require IBSS networks to start in 11b mode
+                    // without any change to the default parameter settings
+                    // on the adapter.  We use ACU to start an IBSS through
+                    // creation of a startIBSS profile. This startIBSS profile
+                    // has Auto MACProtocol and the adapter property setting
+                    // for dot11Mode is also AUTO.   So in this case, let's
+                    // start the IBSS network in 11b mode instead of 11g mode.
+                    // So this is for Auto=profile->MacProtocol && Auto=Global.
+                    // dot11Mode && profile->channel is < 14, then start the IBSS
+                    // in b mode.
                     //
-                    // !!LAC - WiFi tests require IBSS networks to start in 11b mode without any change to the
-                    // default parameter settings on the adapter.  We use ACU to start an IBSS through creation
-                    // of a startIBSS profile.   this startIBSS profile has Auto MACProtocol and the
-                    // adapter property setting for dot11Mode is also AUTO.   So in this case, let's start
-                    // the IBSS network in 11b mode instead of 11g mode.
-                    //
-                    // so this is for Auto=profile->MacProtocol && Auto=Global.dot11Mode && profile->channel is < 14,
-                    // then start the IBSS in b mode.
-                    //
-                    // Note:  we used to have this start as an 11g IBSS for best performance... now to specify that
-                    // the user will have to set the do11Mode in the property page to 11g to force it.
+                    // Note:  we used to have this start as an 11g IBSS for best
+                    // performance... now to specify that the user will have to
+                    // set the do11Mode in the property page to 11g to force it.
                     cfgDot11Mode = eCSR_CFG_DOT11_MODE_11B;
                     eBand = eCSR_BAND_24;
                 }
-                else
-                {
+                else 
+                {   
                     // else, it's a 5.0GHz channel.  Set mode to 11a.
                     cfgDot11Mode = eCSR_CFG_DOT11_MODE_11A;
                     eBand = eCSR_BAND_5G;
@@ -10358,7 +10905,7 @@
             //dot11 mode is set, lets pick the band
             if ( eCSR_OPERATING_CHANNEL_AUTO == operationChn )
             {
-                // channel is Auto also.
+                // channel is Auto also. 
                 eBand = pMac->roam.configParam.eBand;
                 if(eCSR_BAND_ALL == eBand)
                 {
@@ -10370,17 +10917,17 @@
             {
                 eBand = eCSR_BAND_24;
             }
-            else
-            {
+            else 
+            {   
                 eBand = eCSR_BAND_5G;
             }
-        }
+    }
     if(pBand)
     {
         *pBand = eBand;
     }
-
-   if (operationChn == 14){
+    
+   if (operationChn == 14){ 
      smsLog(pMac, LOGE, FL("  Switching to Dot11B mode "));
      cfgDot11Mode = eCSR_CFG_DOT11_MODE_11B;
    }
@@ -10416,7 +10963,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
     {
         vos_log_ibss_pkt_type *pIbssLog;
@@ -10428,8 +10975,6 @@
         }
     }
 #endif //FEATURE_WLAN_DIAG_SUPPORT_CSR
-    pSession->ibss_join_pending = FALSE;
-    csrRoamStopIbssJoinTimer(pMac, sessionId );
     // Set the roaming substate to 'stop Bss request'...
     csrRoamSubstateChange( pMac, NewSubstate, sessionId );
 
@@ -10445,7 +10990,7 @@
 //pNumChan is a caller allocated space with the sizeof pChannels
 eHalStatus csrGetCfgValidChannels(tpAniSirGlobal pMac, tANI_U8 *pChannels, tANI_U32 *pNumChan)
 {
-
+   
     return (ccmCfgGetStr(pMac, WNI_CFG_VALID_CHANNEL_LIST,
                   (tANI_U8 *)pChannels,
                   pNumChan));
@@ -10475,11 +11020,15 @@
     else
         return  maxTxPwr;
 
-    status = palAllocateMemory(pMac->hHdd, (void **)&pCountryInfo, cfgLength);
+    pCountryInfo = vos_mem_malloc(cfgLength);
+    if ( NULL == pCountryInfo )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
     if (status != eHAL_STATUS_SUCCESS)
     {
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                 FL("%s: palAllocateMemory() failed, status = %d"),
+                 FL("%s: failed to allocate memory, status = %d"),
               __FUNCTION__, status);
         goto error;
     }
@@ -10504,7 +11053,7 @@
 
 error:
     if (NULL != pCountryInfo)
-        palFreeMemory(pMac->hHdd, pCountryInfo);
+        vos_mem_free(pCountryInfo);
 
     return maxTxPwr;
 }
@@ -10515,7 +11064,7 @@
     tANI_BOOLEAN fValid = FALSE;
     tANI_U32 idxValidChannels;
     tANI_U32 len = sizeof(pMac->roam.validChannelList);
-
+    
     if (HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac, pMac->roam.validChannelList, &len)))
     {
         for ( idxValidChannels = 0; ( idxValidChannels < len ); idxValidChannels++ )
@@ -10526,8 +11075,8 @@
                 break;
             }
         }
-    }
-    pMac->roam.numValidChannels = len;
+    }    
+    pMac->roam.numValidChannels = len;   
     return fValid;
 }
 
@@ -10567,7 +11116,7 @@
         {
             if(pIes->HTInfo.present)
             {
-                /* This is called during INFRA STA/CLIENT and should use the merged value of
+                /* This is called during INFRA STA/CLIENT and should use the merged value of 
                  * supported channel width and recommended tx width as per standard
                  */
                 smsLog(pMac, LOG1, "scws %u rtws %u sco %u",
@@ -10634,13 +11183,17 @@
     tANI_BOOLEAN fCheck = eANI_BOOLEAN_FALSE;
     tCsrScanResultFilter *pScanFilter = NULL;
     eHalStatus status = eHAL_STATUS_SUCCESS;
-
+    
     if(pProfile1 && pProfile2)
     {
-        status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
+        pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+        if ( NULL == pScanFilter )
+           status = eHAL_STATUS_FAILURE;
+        else
+           status = eHAL_STATUS_SUCCESS;
         if(HAL_STATUS_SUCCESS(status))
         {
-            palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
+            vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
             status = csrRoamPrepareFilterFromProfile(pMac, pProfile2, pScanFilter);
             if(HAL_STATUS_SUCCESS(status))
             {
@@ -10650,7 +11203,7 @@
                     tANI_U32 i;
                     for(i = 0; i < pScanFilter->SSIDs.numOfSSIDs; i++)
                     {
-                        fCheck = csrIsSsidMatch( pMac, pScanFilter->SSIDs.SSIDList[i].SSID.ssId,
+                        fCheck = csrIsSsidMatch( pMac, pScanFilter->SSIDs.SSIDList[i].SSID.ssId, 
                                                 pScanFilter->SSIDs.SSIDList[i].SSID.length,
                                                 pProfile1->SSID.ssId, pProfile1->SSID.length, eANI_BOOLEAN_FALSE );
                         if ( fCheck ) break;
@@ -10682,10 +11235,10 @@
                 }while(0);
                 csrFreeScanFilter(pMac, pScanFilter);
             }
-            palFreeMemory(pMac->hHdd, pScanFilter);
+           vos_mem_free(pScanFilter);
         }
     }
-
+    
     return (fCheck);
 }
 
@@ -10707,8 +11260,8 @@
         for(i = 0; i < CSR_MAX_NUM_KEY; i++)
         {
             if(pConnProfile->Keys.KeyLength[i] != pProfile2->Keys.KeyLength[i]) break;
-            if(!palEqualMemory(pMac->hHdd, &pConnProfile->Keys.KeyMaterial[i],
-                            &pProfile2->Keys.KeyMaterial[i], pProfile2->Keys.KeyLength[i]))
+            if (!vos_mem_compare(&pConnProfile->Keys.KeyMaterial[i],
+                                &pProfile2->Keys.KeyMaterial[i], pProfile2->Keys.KeyLength[i]))
             {
                 break;
             }
@@ -10725,12 +11278,12 @@
 
 tANI_U8 csrRoamGetIbssStartChannelNumber50( tpAniSirGlobal pMac )
 {
-    tANI_U8 channel = 0;
+    tANI_U8 channel = 0;     
     tANI_U32 idx;
     tANI_U32 idxValidChannels;
     tANI_BOOLEAN fFound = FALSE;
     tANI_U32 len = sizeof(pMac->roam.validChannelList);
-
+    
     if(eCSR_OPERATING_CHANNEL_ANY != pMac->roam.configParam.AdHocChannel5G)
     {
         channel = pMac->roam.configParam.AdHocChannel5G;
@@ -10741,7 +11294,7 @@
     }
     if (0 == channel && HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac, (tANI_U8 *)pMac->roam.validChannelList, &len)))
     {
-        for ( idx = 0; ( idx < CSR_NUM_IBSS_START_CHANNELS_50 ) && !fFound; idx++ )
+        for ( idx = 0; ( idx < CSR_NUM_IBSS_START_CHANNELS_50 ) && !fFound; idx++ ) 
         {
             for ( idxValidChannels = 0; ( idxValidChannels < len ) && !fFound; idxValidChannels++ )
             {
@@ -10753,7 +11306,7 @@
             }
         }
         // this is rare, but if it does happen, we find anyone in 11a bandwidth and return the first 11a channel found!
-        if (!fFound)
+        if (!fFound)    
         {
             for ( idxValidChannels = 0; idxValidChannels < len ; idxValidChannels++ )
             {
@@ -10765,8 +11318,8 @@
             }
         }
     }//if
-
-    return( channel );
+    
+    return( channel );    
 }
 
 tANI_U8 csrRoamGetIbssStartChannelNumber24( tpAniSirGlobal pMac )
@@ -10776,7 +11329,7 @@
     tANI_U32 idxValidChannels;
     tANI_BOOLEAN fFound = FALSE;
     tANI_U32 len = sizeof(pMac->roam.validChannelList);
-
+    
     if(eCSR_OPERATING_CHANNEL_ANY != pMac->roam.configParam.AdHocChannel24)
     {
         channel = pMac->roam.configParam.AdHocChannel24;
@@ -10785,10 +11338,10 @@
             channel = 0;
         }
     }
-
+    
     if (0 == channel && HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac, (tANI_U8 *)pMac->roam.validChannelList, &len)))
     {
-        for ( idx = 0; ( idx < CSR_NUM_IBSS_START_CHANNELS_24 ) && !fFound; idx++ )
+        for ( idx = 0; ( idx < CSR_NUM_IBSS_START_CHANNELS_24 ) && !fFound; idx++ ) 
         {
             for ( idxValidChannels = 0; ( idxValidChannels < len ) && !fFound; idxValidChannels++ )
             {
@@ -10800,33 +11353,33 @@
             }
         }
     }
-
-    return( channel );
+    
+    return( channel );    
 }
 
-static void csrRoamGetBssStartParms( tpAniSirGlobal pMac, tCsrRoamProfile *pProfile,
+static void csrRoamGetBssStartParms( tpAniSirGlobal pMac, tCsrRoamProfile *pProfile, 
                                       tCsrRoamStartBssParams *pParam )
 {
     eCsrCfgDot11Mode cfgDot11Mode;
     eCsrBand eBand;
     tANI_U8 channel = 0;
     tSirNwType nwType;
-    tANI_U8 operationChannel = 0;
-
+    tANI_U8 operationChannel = 0; 
+    
     if(pProfile->ChannelInfo.numOfChannels && pProfile->ChannelInfo.ChannelList)
     {
        operationChannel = pProfile->ChannelInfo.ChannelList[0];
     }
-
+    
     cfgDot11Mode = csrRoamGetPhyModeBandForBss( pMac, pProfile, operationChannel, &eBand );
-
+    
     if( ( (pProfile->csrPersona == VOS_P2P_CLIENT_MODE) ||
           (pProfile->csrPersona == VOS_P2P_GO_MODE) )
      && ( cfgDot11Mode == eCSR_CFG_DOT11_MODE_11B)
       )
     {
         /* This should never happen */
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL,
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL, 
               FL("For P2PClient/P2P-GO (persona %d) cfgDot11Mode is 11B"),
               pProfile->csrPersona);
         VOS_ASSERT(0);
@@ -10838,7 +11391,7 @@
             break;
         case eCSR_CFG_DOT11_MODE_11B:
             nwType = eSIR_11B_NW_TYPE;
-            break;
+            break;   
         case eCSR_CFG_DOT11_MODE_11A:
             nwType = eSIR_11A_NW_TYPE;
             break;
@@ -10855,7 +11408,7 @@
                 nwType = eSIR_11A_NW_TYPE;
             }
             break;
-    }
+    }   
 
     pParam->extendedRateSet.numRates = 0;
 
@@ -10864,9 +11417,9 @@
         default:
             smsLog(pMac, LOGE, FL("sees an unknown pSirNwType (%d)"), nwType);
         case eSIR_11A_NW_TYPE:
-
+        
             pParam->operationalRateSet.numRates = 8;
-
+        
             pParam->operationalRateSet.rate[0] = SIR_MAC_RATE_6 | CSR_DOT11_BASIC_RATE_MASK;
             pParam->operationalRateSet.rate[1] = SIR_MAC_RATE_9;
             pParam->operationalRateSet.rate[2] = SIR_MAC_RATE_12 | CSR_DOT11_BASIC_RATE_MASK;
@@ -10875,13 +11428,13 @@
             pParam->operationalRateSet.rate[5] = SIR_MAC_RATE_36;
             pParam->operationalRateSet.rate[6] = SIR_MAC_RATE_48;
             pParam->operationalRateSet.rate[7] = SIR_MAC_RATE_54;
-
-            if ( eCSR_OPERATING_CHANNEL_ANY == operationChannel )
+            
+            if ( eCSR_OPERATING_CHANNEL_ANY == operationChannel ) 
             {
                 channel = csrRoamGetIbssStartChannelNumber50( pMac );
                 if( 0 == channel &&
-                    CSR_IS_PHY_MODE_DUAL_BAND(pProfile->phyMode) &&
-                    CSR_IS_PHY_MODE_DUAL_BAND(pMac->roam.configParam.phyMode)
+                    CSR_IS_PHY_MODE_DUAL_BAND(pProfile->phyMode) && 
+                    CSR_IS_PHY_MODE_DUAL_BAND(pMac->roam.configParam.phyMode) 
                     )
                 {
                     //We could not find a 5G channel by auto pick, let's try 2.4G channels
@@ -10895,36 +11448,36 @@
                    pParam->operationalRateSet.rate[3] = SIR_MAC_RATE_11 | CSR_DOT11_BASIC_RATE_MASK;
                 }
             }
-            else
+            else 
             {
                 channel = operationChannel;
             }
             break;
-
+            
         case eSIR_11B_NW_TYPE:
             pParam->operationalRateSet.numRates = 4;
             pParam->operationalRateSet.rate[0] = SIR_MAC_RATE_1 | CSR_DOT11_BASIC_RATE_MASK;
             pParam->operationalRateSet.rate[1] = SIR_MAC_RATE_2 | CSR_DOT11_BASIC_RATE_MASK;
             pParam->operationalRateSet.rate[2] = SIR_MAC_RATE_5_5 | CSR_DOT11_BASIC_RATE_MASK;
             pParam->operationalRateSet.rate[3] = SIR_MAC_RATE_11 | CSR_DOT11_BASIC_RATE_MASK;
-            if ( eCSR_OPERATING_CHANNEL_ANY == operationChannel )
+            if ( eCSR_OPERATING_CHANNEL_ANY == operationChannel ) 
             {
                 channel = csrRoamGetIbssStartChannelNumber24( pMac );
             }
-            else
+            else 
             {
                 channel = operationChannel;
             }
-
-            break;
+            
+            break;     
         case eSIR_11G_NW_TYPE:
-            /* For P2P Client and P2P GO, disable 11b rates */
+            /* For P2P Client and P2P GO, disable 11b rates */ 
             if( (pProfile->csrPersona == VOS_P2P_CLIENT_MODE) ||
                 (pProfile->csrPersona == VOS_P2P_GO_MODE)
               )
             {
                 pParam->operationalRateSet.numRates = 8;
-
+            
                 pParam->operationalRateSet.rate[0] = SIR_MAC_RATE_6 | CSR_DOT11_BASIC_RATE_MASK;
                 pParam->operationalRateSet.rate[1] = SIR_MAC_RATE_9;
                 pParam->operationalRateSet.rate[2] = SIR_MAC_RATE_12 | CSR_DOT11_BASIC_RATE_MASK;
@@ -10941,7 +11494,7 @@
             pParam->operationalRateSet.rate[1] = SIR_MAC_RATE_2 | CSR_DOT11_BASIC_RATE_MASK;
             pParam->operationalRateSet.rate[2] = SIR_MAC_RATE_5_5 | CSR_DOT11_BASIC_RATE_MASK;
             pParam->operationalRateSet.rate[3] = SIR_MAC_RATE_11 | CSR_DOT11_BASIC_RATE_MASK;
-
+               
             pParam->extendedRateSet.numRates = 8;
                         pParam->extendedRateSet.rate[0] = SIR_MAC_RATE_6;
             pParam->extendedRateSet.rate[1] = SIR_MAC_RATE_9;
@@ -10952,33 +11505,33 @@
             pParam->extendedRateSet.rate[6] = SIR_MAC_RATE_48;
             pParam->extendedRateSet.rate[7] = SIR_MAC_RATE_54;
             }
-
-            if ( eCSR_OPERATING_CHANNEL_ANY == operationChannel )
+            
+            if ( eCSR_OPERATING_CHANNEL_ANY == operationChannel ) 
             {
                 channel = csrRoamGetIbssStartChannelNumber24( pMac );
             }
-            else
+            else 
             {
                 channel = operationChannel;
             }
-
-            break;
+            
+            break;            
     }
     pParam->operationChn = channel;
     pParam->sirNwType = nwType;
 }
 
-static void csrRoamGetBssStartParmsFromBssDesc( tpAniSirGlobal pMac, tSirBssDescription *pBssDesc,
+static void csrRoamGetBssStartParmsFromBssDesc( tpAniSirGlobal pMac, tSirBssDescription *pBssDesc, 
                                                  tDot11fBeaconIEs *pIes, tCsrRoamStartBssParams *pParam )
 {
-
+    
     if( pParam )
     {
         pParam->sirNwType = pBssDesc->nwType;
         pParam->cbMode = PHY_SINGLE_CHANNEL_CENTERED;
         pParam->operationChn = pBssDesc->channelId;
-        palCopyMemory( pMac->hHdd, &pParam->bssid, pBssDesc->bssId, sizeof(tCsrBssid) );
-
+        vos_mem_copy(&pParam->bssid, pBssDesc->bssId, sizeof(tCsrBssid));
+    
         if( pIes )
         {
             if(pIes->SuppRates.present)
@@ -10990,13 +11543,29 @@
                       pIes->SuppRates.num_rates);
                     pIes->SuppRates.num_rates = SIR_MAC_RATESET_EID_MAX;
                 }
-                palCopyMemory(pMac->hHdd, pParam->operationalRateSet.rate, pIes->SuppRates.rates,
-                    sizeof(*pIes->SuppRates.rates) * pIes->SuppRates.num_rates);
+                vos_mem_copy(pParam->operationalRateSet.rate, pIes->SuppRates.rates,
+                             sizeof(*pIes->SuppRates.rates) * pIes->SuppRates.num_rates);
+            }
+            if (pIes->ExtSuppRates.present)
+            {
+                pParam->extendedRateSet.numRates = pIes->ExtSuppRates.num_rates;
+                if(pIes->ExtSuppRates.num_rates > SIR_MAC_EXTENDED_RATE_EID_MAX)
+                {
+                   smsLog(pMac, LOGE, FL("num_rates :%d is more than \
+                                         SIR_MAC_RATESET_EID_MAX, resetting to \
+                                         SIR_MAC_RATESET_EID_MAX"),
+                                         pIes->ExtSuppRates.num_rates);
+                   pIes->ExtSuppRates.num_rates = SIR_MAC_EXTENDED_RATE_EID_MAX;
+                }
+                vos_mem_copy(pParam->extendedRateSet.rate,
+                             pIes->ExtSuppRates.rates,
+                             sizeof(*pIes->ExtSuppRates.rates) * pIes->ExtSuppRates.num_rates);
             }
             if( pIes->SSID.present )
             {
                 pParam->ssId.length = pIes->SSID.num_ssid;
-                palCopyMemory(pMac->hHdd, pParam->ssId.ssId, pIes->SSID.ssid, pParam->ssId.length);
+                vos_mem_copy(pParam->ssId.ssId, pIes->SSID.ssid,
+                             pParam->ssId.length);
             }
             pParam->cbMode = csrGetCBModeFromIes(pMac, pParam->operationChn, pIes);
         }
@@ -11012,22 +11581,22 @@
 {
     tANI_U8 MaxRate = 0;
     tANI_U32 i;
-    tANI_U8 *pRate;
-
+    tANI_U8 *pRate;    
+   
     pRate = pSirRateSet->rate;
     for ( i = 0; i < pSirRateSet->numRates; i++ )
     {
         MaxRate = CSR_MAX( MaxRate, ( pRate[ i ] & (~CSR_DOT11_BASIC_RATE_MASK) ) );
     }
-
+    
     // Save the max rate in the connected state information...
-
+    
     // modify LastRates variable as well
-
+    
     return;
 }
 
-eHalStatus csrRoamIssueStartBss( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamStartBssParams *pParam,
+eHalStatus csrRoamIssueStartBss( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamStartBssParams *pParam, 
                                  tCsrRoamProfile *pProfile, tSirBssDescription *pBssDesc, tANI_U32 roamId )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -11045,14 +11614,13 @@
             if(pBssDesc)
             {
                 pIbssLog->eventId = WLAN_IBSS_EVENT_JOIN_IBSS_REQ;
-                palCopyMemory(pMac->hHdd, pIbssLog->bssid, pBssDesc->bssId, 6);
+                vos_mem_copy(pIbssLog->bssid, pBssDesc->bssId, 6);
             }
             else
             {
                 pIbssLog->eventId = WLAN_IBSS_EVENT_START_IBSS_REQ;
             }
-            palCopyMemory(pMac->hHdd, pIbssLog->ssid, pParam->ssId.ssId,
-                pParam->ssId.length);
+            vos_mem_copy(pIbssLog->ssid, pParam->ssId.ssId, pParam->ssId.length);
             if(pProfile->ChannelInfo.numOfChannels == 0)
             {
                 pIbssLog->channelSetting = AUTO_PICK;
@@ -11071,7 +11639,7 @@
     pParam->pRSNIE = pProfile->pRSNReqIE;
 
     pParam->privacy           = pProfile->privacy;
-    pParam->fwdWPSPBCProbeReq = pProfile->fwdWPSPBCProbeReq;
+    pParam->fwdWPSPBCProbeReq = pProfile->fwdWPSPBCProbeReq;   
     pParam->authType          = pProfile->csr80211AuthType;
     pParam->beaconInterval    = pProfile->beaconInterval;
     pParam->dtimPeriod        = pProfile->dtimPeriod;
@@ -11081,15 +11649,15 @@
     {
         if (csrIsValidChannel(pMac, pParam->operationChn) != eHAL_STATUS_SUCCESS)
         {
-            pParam->operationChn = INFRA_AP_DEFAULT_CHANNEL;
-        }
+            pParam->operationChn = INFRA_AP_DEFAULT_CHANNEL;                   
+        }  
     }
     pParam->protEnabled     = pProfile->protEnabled;
     pParam->obssProtEnabled = pProfile->obssProtEnabled;
     pParam->ht_protection   = pProfile->cfg_protection;
     pParam->wps_state       = pProfile->wps_state;
 
-    pParam->uCfgDot11Mode = csrRoamGetPhyModeBandForBss(pMac, pProfile, pParam->operationChn /* pProfile->operationChannel*/,
+    pParam->uCfgDot11Mode = csrRoamGetPhyModeBandForBss(pMac, pProfile, pParam->operationChn /* pProfile->operationChannel*/, 
                                         &eBand);
     pParam->bssPersona = pProfile->csrPersona;
     // When starting an IBSS, start on the channel from the Profile.
@@ -11097,7 +11665,7 @@
     return (status);
 }
 
-static void csrRoamPrepareBssParams(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
+static void csrRoamPrepareBssParams(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, 
                                      tSirBssDescription *pBssDesc, tBssConfigParam *pBssConfig, tDot11fBeaconIEs *pIes)
 {
     tANI_U8 Channel;
@@ -11109,7 +11677,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-
+    
     if( pBssDesc )
     {
         csrRoamGetBssStartParmsFromBssDesc( pMac, pBssDesc, pIes, &pSession->bssParams );
@@ -11118,7 +11686,8 @@
         //For WDS station, use selfMac as the self BSSID
         if( CSR_IS_WDS_STA( pProfile ) )
         {
-            palCopyMemory(pMac->hHdd, &pSession->bssParams.bssid, &pSession->selfMacAddr, sizeof(tCsrBssid));
+            vos_mem_copy(&pSession->bssParams.bssid, &pSession->selfMacAddr,
+                         sizeof(tCsrBssid));
         }
     }
     else
@@ -11127,36 +11696,39 @@
         //Use the first SSID
         if(pProfile->SSIDs.numOfSSIDs)
         {
-            palCopyMemory(pMac->hHdd, &pSession->bssParams.ssId, pProfile->SSIDs.SSIDList, sizeof(tSirMacSSid));
+            vos_mem_copy(&pSession->bssParams.ssId, pProfile->SSIDs.SSIDList,
+                         sizeof(tSirMacSSid));
         }
         //For WDS station, use selfMac as the self BSSID
         if( CSR_IS_WDS_STA( pProfile ) )
         {
-            palCopyMemory(pMac->hHdd, &pSession->bssParams.bssid, &pSession->selfMacAddr, sizeof(tCsrBssid));
+           vos_mem_copy(&pSession->bssParams.bssid, &pSession->selfMacAddr,
+                        sizeof(tCsrBssid));
         }
         //Use the first BSSID
         else if( pProfile->BSSIDs.numOfBSSIDs )
         {
-            palCopyMemory(pMac->hHdd, &pSession->bssParams.bssid, pProfile->BSSIDs.bssid, sizeof(tCsrBssid));
+           vos_mem_copy(&pSession->bssParams.bssid, pProfile->BSSIDs.bssid,
+                        sizeof(tCsrBssid));
         }
         else
         {
-            palZeroMemory( pMac->hHdd, &pSession->bssParams.bssid, sizeof(tCsrBssid) );
+            vos_mem_set(&pSession->bssParams.bssid, sizeof(tCsrBssid), 0);
         }
     }
     Channel = pSession->bssParams.operationChn;
-    //Set operating channel in pProfile which will be used
+    //Set operating channel in pProfile which will be used 
     //in csrRoamSetBssConfigCfg() to determine channel bonding
-    //mode and will be configured in CFG later
+    //mode and will be configured in CFG later 
     pProfile->operationChannel = Channel;
-
+    
     if(Channel == 0)
     {
         smsLog(pMac, LOGW, "   CSR cannot find a channel to start IBSS");
     }
     else
     {
-
+  
         csrRoamDetermineMaxRateForAdHoc( pMac, &pSession->bssParams.operationalRateSet );
         if (CSR_IS_INFRA_AP(pProfile) || CSR_IS_START_IBSS( pProfile ) )
         {
@@ -11175,38 +11747,42 @@
     }
 }
 
-static eHalStatus csrRoamStartIbss( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
+static eHalStatus csrRoamStartIbss( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, 
                                     tANI_BOOLEAN *pfSameIbss )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tANI_BOOLEAN fSameIbss = FALSE;
-
-    if ( csrIsConnStateIbss( pMac, sessionId ) )
-    {
+     
+    if ( csrIsConnStateIbss( pMac, sessionId ) ) 
+    { 
         // Check if any profile parameter has changed ? If any profile parameter
         // has changed then stop old BSS and start a new one with new parameters
-        if ( csrIsSameProfile( pMac, &pMac->roam.roamSession[sessionId].connectedProfile, pProfile ) )
+        if ( csrIsSameProfile( pMac, &pMac->roam.roamSession[sessionId].connectedProfile, pProfile ) ) 
         {
             fSameIbss = TRUE;
         }
         else
         {
             status = csrRoamIssueStopBss( pMac, sessionId, eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING );
-        }
+        }       
     }
-    else if ( csrIsConnStateConnectedInfra( pMac, sessionId ) )
+    else if ( csrIsConnStateConnectedInfra( pMac, sessionId ) ) 
     {
         // Disassociate from the connected Infrastructure network...
         status = csrRoamIssueDisassociate( pMac, sessionId, eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING, FALSE );
     }
-    else
+    else 
     {
         tBssConfigParam *pBssConfig;
-
-        status = palAllocateMemory(pMac->hHdd, (void **)&pBssConfig, sizeof(tBssConfigParam));
+        
+        pBssConfig = vos_mem_malloc(sizeof(tBssConfigParam));
+        if ( NULL == pBssConfig )
+           status = eHAL_STATUS_FAILURE;
+        else
+           status = eHAL_STATUS_SUCCESS;
         if(HAL_STATUS_SUCCESS(status))
         {
-            palZeroMemory(pMac->hHdd, pBssConfig, sizeof(tBssConfigParam));
+            vos_mem_set(pBssConfig, sizeof(tBssConfigParam), 0);
             // there is no Bss description before we start an IBSS so we need to adopt
             // all Bss configuration parameters from the Profile.
             status = csrRoamPrepareBssConfigFromProfile(pMac, pProfile, pBssConfig, NULL);
@@ -11216,13 +11792,15 @@
                 pMac->roam.roamSession[sessionId].bssParams.uCfgDot11Mode = pBssConfig->uCfgDot11Mode;
                 //Prepare some more parameters for this IBSS
                 csrRoamPrepareBssParams(pMac, sessionId, pProfile, NULL, pBssConfig, NULL);
-                status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile, NULL, pBssConfig, NULL);
+                status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile,
+                                                NULL, pBssConfig,
+                                                NULL, eANI_BOOLEAN_FALSE);
             }
 
-            palFreeMemory(pMac->hHdd, pBssConfig);
+            vos_mem_free(pBssConfig);
         }//Allocate memory
     }
-
+    
     if(pfSameIbss)
     {
         *pfSameIbss = fSameIbss;
@@ -11230,7 +11808,7 @@
     return( status );
 }
 
-static void csrRoamUpdateConnectedProfileFromNewBss( tpAniSirGlobal pMac, tANI_U32 sessionId,
+static void csrRoamUpdateConnectedProfileFromNewBss( tpAniSirGlobal pMac, tANI_U32 sessionId, 
                                                      tSirSmeNewBssInfo *pNewBss )
 {
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
@@ -11240,14 +11818,14 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-
+    
     if( pNewBss )
     {
         // Set the operating channel.
         pSession->connectedProfile.operationChannel = pNewBss->channelNumber;
         // move the BSSId from the BSS description into the connected state information.
-        palCopyMemory( pMac->hHdd, &pSession->connectedProfile.bssid,
-                      &(pNewBss->bssId), sizeof( tCsrBssid ) );
+        vos_mem_copy(&pSession->connectedProfile.bssid, &(pNewBss->bssId),
+                     sizeof( tCsrBssid ));
     }
     return;
 }
@@ -11272,8 +11850,9 @@
        pSession->NumBkidCache = (tANI_U16)numItems;
        if(numItems && pBKIDCache)
        {
-           status = palCopyMemory( pMac->hHdd, pSession->BkidCacheInfo, pBKIDCache,
-                           sizeof(tBkidCacheInfo) * numItems );
+           vos_mem_copy(pSession->BkidCacheInfo, pBKIDCache,
+                        sizeof(tBkidCacheInfo) * numItems);
+           status = eHAL_STATUS_SUCCESS;
        }
    }
    return (status);
@@ -11304,8 +11883,8 @@
                  pSession->NumBkidCache);
                pSession->NumBkidCache = CSR_MAX_PMKID_ALLOWED;
            }
-           palCopyMemory( pMac->hHdd, pBkidCache, pSession->BkidCacheInfo,
-                           sizeof(tBkidCacheInfo) * pSession->NumBkidCache );
+           vos_mem_copy(pBkidCache, pSession->BkidCacheInfo,
+                        sizeof(tBkidCacheInfo) * pSession->NumBkidCache);
            *pNum = pSession->NumBkidCache;
            status = eHAL_STATUS_SUCCESS;
        }
@@ -11322,27 +11901,28 @@
 {
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-
+    
     if(!pSession)
     {
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     smsLog(pMac, LOGW, "csrRoamSetPMKIDCache called, numItems = %d", numItems);
     if(numItems <= CSR_MAX_PMKID_ALLOWED)
     {
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
         {
             WLAN_VOS_DIAG_EVENT_DEF(secEvent, vos_event_wlan_security_payload_type);
-            palZeroMemory(pMac->hHdd, &secEvent, sizeof(vos_event_wlan_security_payload_type));
+            vos_mem_set(&secEvent,
+                        sizeof(vos_event_wlan_security_payload_type), 0);
             secEvent.eventId = WLAN_SECURITY_EVENT_PMKID_UPDATE;
-            secEvent.encryptionModeMulticast =
+            secEvent.encryptionModeMulticast = 
                 (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.mcEncryptionType);
-            secEvent.encryptionModeUnicast =
+            secEvent.encryptionModeUnicast = 
                 (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.EncryptionType);
-            palCopyMemory( pMac->hHdd, secEvent.bssid, pSession->connectedProfile.bssid, 6 );
-            secEvent.authMode =
+            vos_mem_copy(secEvent.bssid, pSession->connectedProfile.bssid, 6);
+            secEvent.authMode = 
                 (v_U8_t)diagAuthTypeFromCSRType(pSession->connectedProfile.AuthType);
             WLAN_VOS_DIAG_EVENT_REPORT(&secEvent, EVENT_WLAN_SECURITY);
         }
@@ -11352,8 +11932,9 @@
         pSession->NumPmkidCache = (tANI_U16)numItems;
         if(numItems && pPMKIDCache)
         {
-            status = palCopyMemory( pMac->hHdd, pSession->PmkidCacheInfo, pPMKIDCache,
-                            sizeof(tPmkidCacheInfo) * numItems );
+            vos_mem_copy(pSession->PmkidCacheInfo, pPMKIDCache,
+                         sizeof(tPmkidCacheInfo) * numItems);
+            status = eHAL_STATUS_SUCCESS;
         }
     }
     return (status);
@@ -11377,14 +11958,14 @@
         {
             smsLog(pMac, LOGW, "Delete PMKID for %02X-%02X-%02X-%02X-%02X-%02X ",
                 pBSSId[0], pBSSId[1], pBSSId[2], pBSSId[3], pBSSId[4], pBSSId[5]);
-            if( palEqualMemory( pMac->hHdd, pBSSId, pSession->PmkidCacheInfo[Index].BSSID, sizeof(tCsrBssid) ) )
+            if( vos_mem_compare( pBSSId, pSession->PmkidCacheInfo[Index].BSSID, sizeof(tCsrBssid) ) )
             {
                 fMatchFound = TRUE;
                 break;
             }
         }
         if( !fMatchFound ) break;
-        palZeroMemory( pMac->hHdd, pSession->PmkidCacheInfo[Index].BSSID, sizeof(tPmkidCacheInfo));
+        vos_mem_set(pSession->PmkidCacheInfo[Index].BSSID, sizeof(tPmkidCacheInfo), 0);
         status = eHAL_STATUS_SUCCESS;
     }
     while( 0 );
@@ -11407,7 +11988,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     if(pNum && pPmkidCache)
     {
         if(pSession->NumPmkidCache == 0)
@@ -11423,8 +12004,8 @@
                   pSession->NumPmkidCache);
                 pSession->NumPmkidCache = CSR_MAX_PMKID_ALLOWED;
             }
-            palCopyMemory( pMac->hHdd, pPmkidCache, pSession->PmkidCacheInfo,
-                            sizeof(tPmkidCacheInfo) * pSession->NumPmkidCache );
+            vos_mem_copy(pPmkidCache, pSession->PmkidCacheInfo,
+                         sizeof(tPmkidCacheInfo) * pSession->NumPmkidCache);
             *pNum = pSession->NumPmkidCache;
             status = eHAL_STATUS_SUCCESS;
         }
@@ -11437,13 +12018,13 @@
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
     tANI_U32 len;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-
+    
     if(!pSession)
     {
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     if(pLen)
     {
         len = *pLen;
@@ -11452,7 +12033,9 @@
         {
             if(len >= pSession->nWpaRsnReqIeLength)
             {
-                status = palCopyMemory(pMac->hHdd, pBuf, pSession->pWpaRsnReqIE, pSession->nWpaRsnReqIeLength);
+                vos_mem_copy(pBuf, pSession->pWpaRsnReqIE,
+                             pSession->nWpaRsnReqIeLength);
+                status = eHAL_STATUS_SUCCESS;
             }
         }
     }
@@ -11470,7 +12053,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     if(pLen)
     {
         len = *pLen;
@@ -11479,7 +12062,9 @@
         {
             if(len >= pSession->nWpaRsnRspIeLength)
             {
-                status = palCopyMemory(pMac->hHdd, pBuf, pSession->pWpaRsnRspIE, pSession->nWpaRsnRspIeLength);
+                vos_mem_copy(pBuf, pSession->pWpaRsnRspIE,
+                             pSession->nWpaRsnRspIeLength);
+                status = eHAL_STATUS_SUCCESS;
             }
         }
     }
@@ -11497,7 +12082,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     if(pLen)
     {
         len = *pLen;
@@ -11506,7 +12091,9 @@
         {
             if(len >= pSession->nWapiReqIeLength)
             {
-                status = palCopyMemory(pMac->hHdd, pBuf, pSession->pWapiReqIE, pSession->nWapiReqIeLength);
+                vos_mem_copy(pBuf, pSession->pWapiReqIE,
+                             pSession->nWapiReqIeLength);
+                status = eHAL_STATUS_SUCCESS;
             }
         }
     }
@@ -11523,7 +12110,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     if(pLen)
     {
         len = *pLen;
@@ -11532,7 +12119,9 @@
         {
             if(len >= pSession->nWapiRspIeLength)
             {
-                status = palCopyMemory(pMac->hHdd, pBuf, pSession->pWapiRspIE, pSession->nWapiRspIeLength);
+                vos_mem_copy(pBuf, pSession->pWapiRspIE,
+                             pSession->nWapiRspIeLength);
+                status = eHAL_STATUS_SUCCESS;
             }
         }
     }
@@ -11549,7 +12138,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return (retStatus);
     }
-
+    
     if(CSR_IS_ROAMING(pSession))
     {
         retStatus = eCSR_ROAM_ROAMING_COMPLETION;
@@ -11574,18 +12163,32 @@
         do
         {
             //Prepare the filter. Only fill in the necessary fields. Not all fields are needed
-            status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
+            pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+            if ( NULL == pScanFilter )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status)) break;
-            palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
-            status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter->BSSIDs.bssid, sizeof(tCsrBssid));
+            vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
+            pScanFilter->BSSIDs.bssid = vos_mem_malloc(sizeof(tCsrBssid));
+            if ( NULL == pScanFilter->BSSIDs.bssid )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status)) break;
-            palCopyMemory(pMac->hHdd, pScanFilter->BSSIDs.bssid, &pConnProfile->bssid, sizeof(tCsrBssid));
+            vos_mem_copy(pScanFilter->BSSIDs.bssid, &pConnProfile->bssid,
+                         sizeof(tCsrBssid));
             pScanFilter->BSSIDs.numOfBSSIDs = 1;
             if(!csrIsNULLSSID(pConnProfile->SSID.ssId, pConnProfile->SSID.length))
             {
-                status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter->SSIDs.SSIDList, sizeof(tCsrSSIDInfo));
-                if(!HAL_STATUS_SUCCESS(status)) break;
-                palCopyMemory(pMac->hHdd, &pScanFilter->SSIDs.SSIDList[0].SSID, &pConnProfile->SSID, sizeof(tSirMacSSid));
+                pScanFilter->SSIDs.SSIDList = vos_mem_malloc(sizeof(tCsrSSIDInfo));
+                if ( NULL  == pScanFilter->SSIDs.SSIDList )
+                    status = eHAL_STATUS_FAILURE;
+                else
+                    status = eHAL_STATUS_SUCCESS;
+                if (!HAL_STATUS_SUCCESS(status)) break;
+                vos_mem_copy(&pScanFilter->SSIDs.SSIDList[0].SSID,
+                             &pConnProfile->SSID, sizeof(tSirMacSSid));
             }
             pScanFilter->authType.numEntries = 1;
             pScanFilter->authType.authType[0] = pConnProfile->AuthType;
@@ -11603,17 +12206,17 @@
             pScanFilter->phyMode = eCSR_DOT11_MODE_TAURUS;
             csrLLLock(&pMac->scan.scanResultList);
             pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_NOLOCK );
-            while( pEntry )
+            while( pEntry ) 
             {
                 pResult = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
                                 pIes = (tDot11fBeaconIEs *)( pResult->Result.pvIes );
-                fMatch = csrMatchBSS(pMac, &pResult->Result.BssDescriptor,
+                fMatch = csrMatchBSS(pMac, &pResult->Result.BssDescriptor, 
                                pScanFilter, NULL, NULL, NULL, &pIes);
                 //Release the IEs allocated by csrMatchBSS is needed
                 if( !pResult->Result.pvIes )
                 {
                     //need to free the IEs since it is allocated by csrMatchBSS
-                    palFreeMemory(pMac->hHdd, pIes);
+                    vos_mem_free(pIes);
                 }
                 if(fMatch)
                 {
@@ -11632,7 +12235,7 @@
         if(pScanFilter)
         {
             csrFreeScanFilter(pMac, pScanFilter);
-            palFreeMemory(pMac->hHdd, pScanFilter);
+            vos_mem_free(pScanFilter);
         }
     }
     return (status);
@@ -11656,7 +12259,7 @@
             }
             if( csrIsConnStateInfra( pMac, sessionId ) )
             {
-                if( chnId &&
+                if( chnId && 
                     ( (tANI_U8)chnId != pMac->roam.roamSession[sessionId].connectedProfile.operationChannel ) )
                 {
                     smsLog( pMac, LOGW, " BTAMP is not allowed due to channel (%d) diff than infr channel (%d)",
@@ -11681,26 +12284,27 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
-    if ( csrIsConnStateIbss( pMac, sessionId ) )
-    {
+    
+    if ( csrIsConnStateIbss( pMac, sessionId ) ) 
+    { 
         status = csrRoamIssueStopBss( pMac, sessionId, eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING );
     }
-    else if ( csrIsConnStateConnectedInfra( pMac, sessionId ) )
+    else if ( csrIsConnStateConnectedInfra( pMac, sessionId ) ) 
     {
         // Disassociate from the connected Infrastructure network...
         status = csrRoamIssueDisassociate( pMac, sessionId, eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING, FALSE );
     }
     else
     {
-        //We don't expect Bt-AMP HDD not to disconnect the last connection first at this time.
+        //We don't expect Bt-AMP HDD not to disconnect the last connection first at this time. 
         //Otherwise we need to add code to handle the
-        //situation just like IBSS. Though for WDS station, we need to send disassoc to PE first then
+        //situation just like IBSS. Though for WDS station, we need to send disassoc to PE first then 
         //send stop_bss to PE, before we can continue.
         VOS_ASSERT( !csrIsConnStateWds( pMac, sessionId ) );
-        palZeroMemory(pMac->hHdd, &bssConfig, sizeof(tBssConfigParam));
+        vos_mem_set(&bssConfig, sizeof(tBssConfigParam), 0);
         /* Assume HDD provide bssid in profile */
-        palCopyMemory( pMac->hHdd, &pSession->bssParams.bssid, pProfile->BSSIDs.bssid[0], sizeof(tCsrBssid) );
+        vos_mem_copy(&pSession->bssParams.bssid, pProfile->BSSIDs.bssid[0],
+                     sizeof(tCsrBssid));
         // there is no Bss description before we start an WDS so we need
         // to adopt all Bss configuration parameters from the Profile.
         status = csrRoamPrepareBssConfigFromProfile(pMac, pProfile, &bssConfig, pBssDesc);
@@ -11708,16 +12312,18 @@
         {
             //Save profile for late use
             csrFreeRoamProfile( pMac, sessionId );
-            if (HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd,
-                                   (void **)&pSession->pCurRoamProfile,
-                                   sizeof(tCsrRoamProfile))))
+            pSession->pCurRoamProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+            if (pSession->pCurRoamProfile != NULL )
             {
-                palZeroMemory(pMac->hHdd, pSession->pCurRoamProfile, sizeof(tCsrRoamProfile));
+                vos_mem_set(pSession->pCurRoamProfile,
+                            sizeof(tCsrRoamProfile), 0);
                 csrRoamCopyProfile(pMac, pSession->pCurRoamProfile, pProfile);
             }
             //Prepare some more parameters for this WDS
             csrRoamPrepareBssParams(pMac, sessionId, pProfile, NULL, &bssConfig, NULL);
-            status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile, NULL, &bssConfig, NULL);
+            status = csrRoamSetBssConfigCfg(pMac, sessionId, pProfile,
+                                            NULL, &bssConfig,
+                                            NULL, eANI_BOOLEAN_FALSE);
         }
     }
 
@@ -11753,14 +12359,14 @@
     }
     else
         fTmp = (tAniBool)0;
-
+   
     // corresponds to --- pMsg->spectrumMgtIndicator = ON;
-    palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&fTmp, sizeof(tAniBool) );
+    vos_mem_copy(pBuf, (tANI_U8 *)&fTmp, sizeof(tAniBool));
     pBuf += sizeof(tAniBool);
     *pBuf++ = MIN_STA_PWR_CAP_DBM; // it is for pMsg->powerCap.minTxPower = 0;
     found = csrSearchChannelListForTxPower(pMac, pBssDescription, &channelGroup);
     // This is required for 11k test VoWiFi Ent: Test 2.
-    // We need the power capabilities for Assoc Req.
+    // We need the power capabilities for Assoc Req. 
     // This macro is provided by the halPhyCfg.h. We pick our
     // max and min capability by the halPhy provided macros
     pwrLimit = csrGetCfgMaxTxPower (pMac, pBssDescription->channelId);
@@ -11774,19 +12380,19 @@
     }
     size = sizeof(pMac->roam.validChannelList);
     if(HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac, (tANI_U8 *)pMac->roam.validChannelList, &size)))
-    {
-        *pBuf++ = (tANI_U8)size;        //tSirSupChnl->numChnl
-        for ( i = 0; i < size; i++)
+    { 
+        *pBuf++ = (tANI_U8)size;        //tSirSupChnl->numChnl        
+        for ( i = 0; i < size; i++) 
         {
             *pBuf++ = pMac->roam.validChannelList[ i ];   //tSirSupChnl->channelList[ i ]
-
+             
         }
     }
     else
     {
         smsLog(pMac, LOGE, FL("can not find any valid channel"));
         *pBuf++ = 0;  //tSirSupChnl->numChnl
-    }
+    }                                                                                                                     
     //Check whether it is ok to enter UAPSD
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
     if( btcIsReadyForUapsd(pMac) )
@@ -11801,14 +12407,14 @@
         *pBuf++ = 0;
     }
 #endif /* WLAN_MDM_CODE_REDUCTION_OPT*/
-
+  
     // move the entire BssDescription into the join request.
-    palCopyMemory( pMac->hHdd, pBuf, pBssDescription,
-                    pBssDescription->length + sizeof( pBssDescription->length ) );
+    vos_mem_copy(pBuf, pBssDescription,
+                 pBssDescription->length + sizeof( pBssDescription->length ));
     pBuf += pBssDescription->length + sizeof( pBssDescription->length );   // update to new location
 }
 
-/*
+/* 
   * The communication between HDD and LIM is thru mailbox (MB).
   * Both sides will access the data structure "tSirSmeJoinReq".
   *  The rule is, while the components of "tSirSmeJoinReq" can be accessed in the regular way like tSirSmeJoinReq.assocType, this guideline
@@ -11816,7 +12422,7 @@
   *  with the component "tSirBssDescription". And since the size of actual 'tSirBssDescription' varies, the receiving side (which is the routine
   *  limJoinReqSerDes() of limSerDesUtils.cc) should keep in mind not to access the components DIRECTLY after tSirRSNie.
   */
-eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDescription *pBssDescription,
+eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDescription *pBssDescription, 
                               tCsrRoamProfile *pProfile, tDot11fBeaconIEs *pIes, tANI_U16 messageType )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -11848,19 +12454,23 @@
         pSession->joinFailStatusCode.reasonCode = 0;
         memcpy (&pSession->joinFailStatusCode.bssId, &pBssDescription->bssId, sizeof(tSirMacAddr));
         // There are a number of variable length fields to consider.  First, the tSirSmeJoinReq
-        // includes a single bssDescription.   bssDescription includes a single tANI_U32 for the
-        // IE fields, but the length field in the bssDescription needs to be interpreted to
+        // includes a single bssDescription.   bssDescription includes a single tANI_U32 for the 
+        // IE fields, but the length field in the bssDescription needs to be interpreted to 
         // determine length of the IE fields.
         //
-        // So, take the size of the JoinReq, subtract the size of the bssDescription and
+        // So, take the size of the JoinReq, subtract the size of the bssDescription and 
         // add in the length from the bssDescription (then add the size of the 'length' field
         // itself because that is NOT included in the length field).
-        msgLen = sizeof( tSirSmeJoinReq ) - sizeof( *pBssDescription ) +
+        msgLen = sizeof( tSirSmeJoinReq ) - sizeof( *pBssDescription ) + 
             pBssDescription->length + sizeof( pBssDescription->length ) +
             sizeof( tCsrWpaIe ) + sizeof( tCsrWpaAuthIe ) + sizeof( tANI_U16 ); // add in the size of the WPA IE that we may build.
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
+        pMsg = vos_mem_malloc(msgLen);
+        if (NULL == pMsg)
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
         if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, msgLen);
+        vos_mem_set(pMsg, msgLen , 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)messageType);
         pMsg->length = pal_cpu_to_be16(msgLen);
         pBuf = &pMsg->sessionId;
@@ -11877,7 +12487,7 @@
             // ssId len
             *pBuf = pIes->SSID.num_ssid;
             pBuf++;
-            palCopyMemory( pMac->hHdd, pBuf, pIes->SSID.ssid, pIes->SSID.num_ssid );
+            vos_mem_copy(pBuf, pIes->SSID.ssid, pIes->SSID.num_ssid);
             pBuf += pIes->SSID.num_ssid;
         }
         else
@@ -11886,12 +12496,13 @@
             pBuf++;
         }
         // selfMacAddr
-        palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, &pSession->selfMacAddr, sizeof(tSirMacAddr) );
+        vos_mem_copy((tSirMacAddr *)pBuf, &pSession->selfMacAddr,
+                     sizeof(tSirMacAddr));
         pBuf += sizeof(tSirMacAddr);
         // bsstype
         dwTmp = pal_cpu_to_be32( csrTranslateBsstypeToMacType( pProfile->BSSType ) );
         if (dwTmp == eSIR_BTAMP_STA_MODE) dwTmp = eSIR_BTAMP_AP_MODE; // Override BssType for BTAMP
-        palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tSirBssType) );
+        vos_mem_copy(pBuf, &dwTmp, sizeof(tSirBssType));
         pBuf += sizeof(tSirBssType);
         // dot11mode
         ucDot11Mode = csrTranslateToWNICfgDot11Mode( pMac, pSession->bssParams.uCfgDot11Mode );
@@ -11926,13 +12537,13 @@
             // OperationalRateSet
             if (OpRateSet.numRates) {
                 *pBuf++ = OpRateSet.numRates;
-                palCopyMemory(pMac->hHdd, pBuf, OpRateSet.rate, OpRateSet.numRates);
+                vos_mem_copy(pBuf, OpRateSet.rate, OpRateSet.numRates);
                 pBuf += OpRateSet.numRates;
             } else *pBuf++ = 0;
             // ExtendedRateSet
             if (ExRateSet.numRates) {
                 *pBuf++ = ExRateSet.numRates;
-                palCopyMemory(pMac->hHdd, pBuf, ExRateSet.rate, ExRateSet.numRates);
+                vos_mem_copy(pBuf, ExRateSet.rate, ExRateSet.numRates);
                 pBuf += ExRateSet.numRates;
             } else *pBuf++ = 0;
         }
@@ -11982,17 +12593,21 @@
                 {
                     if(pSession->pWapiReqIE && pSession->nWapiReqIeLength)
                     {
-                        palFreeMemory(pMac->hHdd, pSession->pWapiReqIE);
+                        vos_mem_free(pSession->pWapiReqIE);
                     }
-                    status = palAllocateMemory(pMac->hHdd, (void **)&pSession->pWapiReqIE, ieLen);
+                    pSession->pWapiReqIE = vos_mem_malloc(ieLen);
+                    if (NULL == pSession->pWapiReqIE)
+                        status = eHAL_STATUS_FAILURE;
+                    else
+                        status = eHAL_STATUS_SUCCESS;
                     if(!HAL_STATUS_SUCCESS(status)) break;
                 }
                 pSession->nWapiReqIeLength = ieLen;
-                palCopyMemory(pMac->hHdd, pSession->pWapiReqIE, wpaRsnIE, ieLen);
+                vos_mem_copy(pSession->pWapiReqIE, wpaRsnIE, ieLen);
                 wTmp = pal_cpu_to_be16( ieLen );
-                palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof(tANI_U16) );
+                vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
                 pBuf += sizeof(tANI_U16);
-                palCopyMemory( pMac->hHdd, pBuf, wpaRsnIE, ieLen );
+                vos_mem_copy(pBuf, wpaRsnIE, ieLen);
                 pBuf += ieLen;
             }
             else//should be WPA/WPA2 otherwise
@@ -12003,17 +12618,21 @@
                 {
                     if(pSession->pWpaRsnReqIE && pSession->nWpaRsnReqIeLength)
                     {
-                        palFreeMemory(pMac->hHdd, pSession->pWpaRsnReqIE);
+                        vos_mem_free(pSession->pWpaRsnReqIE);
                     }
-                    status = palAllocateMemory(pMac->hHdd, (void **)&pSession->pWpaRsnReqIE, ieLen);
+                    pSession->pWpaRsnReqIE = vos_mem_malloc(ieLen);
+                    if (NULL == pSession->pWpaRsnReqIE)
+                        status = eHAL_STATUS_FAILURE;
+                    else
+                        status = eHAL_STATUS_SUCCESS;
                     if(!HAL_STATUS_SUCCESS(status)) break;
                 }
                 pSession->nWpaRsnReqIeLength = ieLen;
-                palCopyMemory(pMac->hHdd, pSession->pWpaRsnReqIE, wpaRsnIE, ieLen);
+                vos_mem_copy(pSession->pWpaRsnReqIE, wpaRsnIE, ieLen);
                 wTmp = pal_cpu_to_be16( ieLen );
-                palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof(tANI_U16) );
+                vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
                 pBuf += sizeof(tANI_U16);
-                palCopyMemory( pMac->hHdd, pBuf, wpaRsnIE, ieLen );
+                vos_mem_copy(pBuf, wpaRsnIE, ieLen);
                 pBuf += ieLen;
             }
         }
@@ -12023,14 +12642,14 @@
             pSession->nWpaRsnReqIeLength = 0;
             if(pSession->pWpaRsnReqIE)
             {
-                palFreeMemory(pMac->hHdd, pSession->pWpaRsnReqIE);
+                vos_mem_free(pSession->pWpaRsnReqIE);
                 pSession->pWpaRsnReqIE = NULL;
             }
 #ifdef FEATURE_WLAN_WAPI
             pSession->nWapiReqIeLength = 0;
             if(pSession->pWapiReqIE)
             {
-                palFreeMemory(pMac->hHdd, pSession->pWapiReqIE);
+                vos_mem_free(pSession->pWapiReqIE);
                 pSession->pWapiReqIE = NULL;
             }
 #endif /* FEATURE_WLAN_WAPI */
@@ -12054,6 +12673,11 @@
             if( csrIsProfileCCX( pProfile ) )
             {
                 // Insert the CCKM IE into the join request
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+                ieLen = pSession->suppCckmIeInfo.cckmIeLen;
+					 vos_mem_copy((void *) (wpaRsnIE),
+							 pSession->suppCckmIeInfo.cckmIe, ieLen);
+#else
                 ieLen = csrConstructCcxCckmIe( pMac,
                                           pSession,
                                           pProfile,
@@ -12061,6 +12685,7 @@
                                           pSession->pWpaRsnReqIE,
                                           pSession->nWpaRsnReqIeLength,
                                           (void *)( wpaRsnIE ) );
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
             }
             else
             {
@@ -12071,9 +12696,9 @@
             {
                 //Copy the CCKM IE over from the temp buffer (wpaRsnIE)
                 wTmp = pal_cpu_to_be16( ieLen );
-                palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof(tANI_U16) );
+                vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
                 pBuf += sizeof(tANI_U16);
-                palCopyMemory( pMac->hHdd, pBuf, wpaRsnIE, ieLen );
+                vos_mem_copy(pBuf, wpaRsnIE, ieLen);
                 pBuf += ieLen;
             }
             else
@@ -12094,19 +12719,21 @@
             {
                 if(pSession->pAddIEScan && pSession->nAddIEScanLength)
                 {
-                    palFreeMemory(pMac->hHdd, pSession->pAddIEScan);
+                    vos_mem_free(pSession->pAddIEScan);
                 }
-                status = palAllocateMemory(pMac->hHdd,
-                                 (void **)&pSession->pAddIEScan, ieLen);
+                pSession->pAddIEScan = vos_mem_malloc(ieLen);
+                if (NULL == pSession->pAddIEScan)
+                    status = eHAL_STATUS_FAILURE;
+                else
+                    status = eHAL_STATUS_SUCCESS;
                 if(!HAL_STATUS_SUCCESS(status)) break;
             }
             pSession->nAddIEScanLength = ieLen;
-            palCopyMemory(pMac->hHdd, pSession->pAddIEScan,
-                                      pProfile->pAddIEScan, ieLen);
+            vos_mem_copy(pSession->pAddIEScan, pProfile->pAddIEScan, ieLen);
             wTmp = pal_cpu_to_be16( ieLen );
-            palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof(tANI_U16) );
+            vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
             pBuf += sizeof(tANI_U16);
-            palCopyMemory( pMac->hHdd, pBuf, pProfile->pAddIEScan, ieLen );
+            vos_mem_copy(pBuf, pProfile->pAddIEScan, ieLen);
             pBuf += ieLen;
         }
         else
@@ -12114,7 +12741,7 @@
             pSession->nAddIEScanLength = 0;
             if(pSession->pAddIEScan)
             {
-                palFreeMemory(pMac->hHdd, pSession->pAddIEScan);
+                vos_mem_free(pSession->pAddIEScan);
                 pSession->pAddIEScan = NULL;
             }
             *pBuf = 0;
@@ -12128,20 +12755,22 @@
             if(ieLen > pSession->nAddIEAssocLength)
             {
                 if(pSession->pAddIEAssoc && pSession->nAddIEAssocLength)
-        {
-                    palFreeMemory(pMac->hHdd, pSession->pAddIEAssoc);
-        }
-                status = palAllocateMemory(pMac->hHdd,
-                                 (void **)&pSession->pAddIEAssoc, ieLen);
+                {
+                    vos_mem_free(pSession->pAddIEAssoc);
+                }
+                pSession->pAddIEAssoc = vos_mem_malloc(ieLen);
+                if (NULL == pSession->pAddIEAssoc)
+                    status = eHAL_STATUS_FAILURE;
+                else
+                    status = eHAL_STATUS_SUCCESS;
                 if(!HAL_STATUS_SUCCESS(status)) break;
-        }
+            }
             pSession->nAddIEAssocLength = ieLen;
-            palCopyMemory(pMac->hHdd, pSession->pAddIEAssoc,
-                                      pProfile->pAddIEAssoc, ieLen);
+            vos_mem_copy(pSession->pAddIEAssoc, pProfile->pAddIEAssoc, ieLen);
             wTmp = pal_cpu_to_be16( ieLen );
-            palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof(tANI_U16) );
+            vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
             pBuf += sizeof(tANI_U16);
-            palCopyMemory( pMac->hHdd, pBuf, pProfile->pAddIEAssoc, ieLen );
+            vos_mem_copy(pBuf, pProfile->pAddIEAssoc, ieLen);
             pBuf += ieLen;
         }
         else
@@ -12149,7 +12778,7 @@
             pSession->nAddIEAssocLength = 0;
             if(pSession->pAddIEAssoc)
             {
-                palFreeMemory(pMac->hHdd, pSession->pAddIEAssoc);
+                vos_mem_free(pSession->pAddIEAssoc);
                 pSession->pAddIEAssoc = NULL;
             }
             *pBuf = 0;
@@ -12178,11 +12807,11 @@
         }
 
         dwTmp = pal_cpu_to_be32( csrTranslateEncryptTypeToEdType( pProfile->negotiatedUCEncryptionType) );
-        palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tANI_U32) );
+        vos_mem_copy(pBuf, &dwTmp, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
 
         dwTmp = pal_cpu_to_be32( csrTranslateEncryptTypeToEdType( pProfile->negotiatedMCEncryptionType) );
-        palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tANI_U32) );
+        vos_mem_copy(pBuf, &dwTmp, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
 #ifdef WLAN_FEATURE_11W
         //MgmtEncryption
@@ -12194,7 +12823,7 @@
         {
             dwTmp = pal_cpu_to_be32(eSIR_ED_NONE);
         }
-        palCopyMemory(pMac->hHdd, pBuf, &dwTmp, sizeof(tANI_U32));
+        vos_mem_copy(pBuf, &dwTmp, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
 #endif
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -12208,18 +12837,33 @@
         {
             // is11Rconnection;
             dwTmp = pal_cpu_to_be32(TRUE);
-            palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool)) ;
             pBuf += sizeof(tAniBool);
         }
         else
         {
             // is11Rconnection;
             dwTmp = pal_cpu_to_be32(FALSE);
-            palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool));
             pBuf += sizeof(tAniBool);
         }
 #endif
 #ifdef FEATURE_WLAN_CCX
+
+        // isCCXFeatureIniEnabled
+        if (TRUE == pMac->roam.configParam.isCcxIniFeatureEnabled)
+        {
+            dwTmp = pal_cpu_to_be32(TRUE);
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool));
+            pBuf += sizeof(tAniBool);
+        }
+        else
+        {
+            dwTmp = pal_cpu_to_be32(FALSE);
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool));
+            pBuf += sizeof(tAniBool);
+        }
+
         /* A profile can not be both CCX and 11R. But an 802.11R AP
          * may be advertising support for CCX as well. So if we are
          * associating Open or explicitly CCX then we will get CCX.
@@ -12240,14 +12884,14 @@
         {
             // isCCXconnection;
             dwTmp = pal_cpu_to_be32(TRUE);
-            palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool));
             pBuf += sizeof(tAniBool);
         }
         else
         {
             //isCCXconnection;
             dwTmp = pal_cpu_to_be32(FALSE);
-            palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool));
             pBuf += sizeof(tAniBool);
         }
 
@@ -12256,8 +12900,8 @@
             tCCXTspecInfo ccxTspec;
             // CCX-Tspec IEs in the ASSOC request is presently not supported
             // so nullify the TSPEC parameters
-            palZeroMemory(pMac->hHdd, &ccxTspec, sizeof(tCCXTspecInfo));
-            palCopyMemory( pMac->hHdd, pBuf, &ccxTspec, sizeof(tCCXTspecInfo));
+            vos_mem_set(&ccxTspec, sizeof(tCCXTspecInfo), 0);
+            vos_mem_copy(pBuf, &ccxTspec, sizeof(tCCXTspecInfo));
             pBuf += sizeof(tCCXTspecInfo);
         }
         else if (eWNI_SME_REASSOC_REQ == messageType)
@@ -12276,13 +12920,14 @@
         {
            tCCXTspecInfo ccxTspec;
            // CCX Tspec information
-           palZeroMemory(pMac->hHdd, &ccxTspec, sizeof(tCCXTspecInfo));
+           vos_mem_set(&ccxTspec, sizeof(tCCXTspecInfo), 0);
            ccxTspec.numTspecs = sme_QosCCxRetrieveTspecInfo(pMac, sessionId, (tTspecInfo *) &ccxTspec.tspec[0]);
            *pBuf = ccxTspec.numTspecs;
            pBuf += sizeof(tANI_U8);
            // Copy the TSPEC information only if present
            if (ccxTspec.numTspecs) {
-               palCopyMemory(pMac->hHdd, pBuf, (void*)&ccxTspec.tspec[0], (ccxTspec.numTspecs*sizeof(tTspecInfo)));
+               vos_mem_copy(pBuf, (void*)&ccxTspec.tspec[0],
+                           (ccxTspec.numTspecs*sizeof(tTspecInfo)));
            }
            pBuf += sizeof(ccxTspec.tspec);
         }
@@ -12291,8 +12936,8 @@
                 tCCXTspecInfo ccxTspec;
                 // CCX-Tspec IEs in the ASSOC request is presently not supported
                 // so nullify the TSPEC parameters
-                palZeroMemory(pMac->hHdd, &ccxTspec, sizeof(tCCXTspecInfo));
-                palCopyMemory( pMac->hHdd, pBuf, &ccxTspec, sizeof(tCCXTspecInfo));
+                vos_mem_set(&ccxTspec, sizeof(tCCXTspecInfo), 0);
+                vos_mem_copy(pBuf, &ccxTspec, sizeof(tCCXTspecInfo));
                 pBuf += sizeof(tCCXTspecInfo);
             }
         }
@@ -12306,13 +12951,13 @@
          )
         {
             dwTmp = pal_cpu_to_be32(TRUE);
-            palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool));
             pBuf += sizeof(tAniBool);
         }
         else
         {
             dwTmp = pal_cpu_to_be32(FALSE);
-            palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool));
             pBuf += sizeof(tAniBool);
         }
 #endif
@@ -12321,13 +12966,13 @@
         {
             //legacy fast roaming enabled
             dwTmp = pal_cpu_to_be32(TRUE);
-            palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool));
             pBuf += sizeof(tAniBool);
         }
         else
         {
             dwTmp = pal_cpu_to_be32(FALSE);
-            palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tAniBool) );
+            vos_mem_copy(pBuf, &dwTmp, sizeof(tAniBool));
             pBuf += sizeof(tAniBool);
         }
 #endif
@@ -12345,9 +12990,9 @@
         }
 
         //HT Config
-        palCopyMemory(pMac->hHdd, pBuf, &pSession->htConfig,
-                      sizeof(tSirHTConfig));
-        pBuf += sizeof(tSirHTConfig);
+		  vos_mem_copy(pBuf, &pSession->htConfig,
+				  sizeof(tSirHTConfig));
+		  pBuf += sizeof(tSirHTConfig);
 #ifdef WLAN_FEATURE_11AC
         // txBFIniFeatureEnabled
         *pBuf = (tANI_U8)pMac->roam.configParam.txBFEnable;
@@ -12382,9 +13027,13 @@
         *pBuf = (tANI_U8)pMac->roam.configParam.htSmps;
         pBuf++;
 
+        *pBuf = (tANI_U8)pMac->roam.configParam.isAmsduSupportInAMPDU;
+        pBuf++;
+
         //BssDesc
         csrPrepareJoinReassocReqBuffer( pMac, pBssDescription, pBuf,
                 (tANI_U8)pProfile->uapsd_mask);
+
         status = palSendMBMessage(pMac->hHdd, pMsg );
         if(!HAL_STATUS_SUCCESS(status))
         {
@@ -12420,9 +13069,13 @@
     if (!CSR_IS_SESSION_VALID( pMac, sessionId ))
         return eHAL_STATUS_FAILURE;
     do {
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof( tSirSmeDisassocReq ));
+        pMsg = vos_mem_malloc(sizeof(tSirSmeDisassocReq));
+        if (NULL == pMsg)
+              status = eHAL_STATUS_FAILURE;
+        else
+              status = eHAL_STATUS_SUCCESS;
         if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, sizeof( tSirSmeDisassocReq ));
+        vos_mem_set(pMsg, sizeof( tSirSmeDisassocReq ), 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_DISASSOC_REQ);
         pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeDisassocReq ));
         pBuf = &pMsg->sessionId;
@@ -12432,47 +13085,54 @@
         *pBuf = 0;
         *( pBuf + 1 ) = 0;
         pBuf += sizeof(tANI_U16);
-
+     
         if ( (pSession->pCurRoamProfile != NULL) &&
              ((CSR_IS_INFRA_AP(pSession->pCurRoamProfile)) ||
               (CSR_IS_WDS_AP(pSession->pCurRoamProfile))) )
         {
             // Set the bssid address before sending the message to LIM
-            status = palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, pSession->selfMacAddr, sizeof( tSirMacAddr ) );
+            vos_mem_copy((tSirMacAddr *)pBuf, pSession->selfMacAddr,
+                         sizeof( tSirMacAddr ));
+            status = eHAL_STATUS_SUCCESS;
             pBuf = pBuf + sizeof ( tSirMacAddr );
             // Set the peer MAC address before sending the message to LIM
-            status = palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, bssId, sizeof( tSirMacAddr ) ); //perMacAddr is passed as bssId for softAP
+            vos_mem_copy((tSirMacAddr *)pBuf, bssId, sizeof( tSirMacAddr ));
+            //perMacAddr is passed as bssId for softAP
+            status = eHAL_STATUS_SUCCESS;
             pBuf = pBuf + sizeof ( tSirMacAddr );
         }
         else
         {
             // Set the peer MAC address before sending the message to LIM
-            status = palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, bssId, sizeof( tSirMacAddr ) );
+            vos_mem_copy((tSirMacAddr *)pBuf, bssId, sizeof( tSirMacAddr ));
+            status = eHAL_STATUS_SUCCESS;
             pBuf = pBuf + sizeof ( tSirMacAddr );
-            status = palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, bssId, sizeof( pMsg->bssId ) );
+            vos_mem_copy((tSirMacAddr *)pBuf, bssId, sizeof( pMsg->bssId ));
+            status = eHAL_STATUS_SUCCESS;
             pBuf = pBuf + sizeof ( tSirMacAddr );
         }
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
         }
         // reasonCode
         wTmp = pal_cpu_to_be16(reasonCode);
-        status = palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof(tANI_U16) );
+        vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
+        status = eHAL_STATUS_SUCCESS;
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
         }
         pBuf += sizeof(tANI_U16);
-        /* The state will be DISASSOC_HANDOFF only when we are doing handoff.
+        /* The state will be DISASSOC_HANDOFF only when we are doing handoff. 
                     Here we should not send the disassoc over the air to the AP */
         if ( CSR_IS_ROAM_SUBSTATE_DISASSOC_HO(pMac, sessionId)
 #ifdef WLAN_FEATURE_VOWIFI_11R
                 && csrRoamIs11rAssoc(pMac)
 #endif
-           )
+           )            
         {
             *pBuf = CSR_DONT_SEND_DISASSOC_OVER_THE_AIR;  /* Set DoNotSendOverTheAir flag to 1 only for handoff case */
         }
@@ -12488,9 +13148,13 @@
     tANI_U8 *pBuf;
     do
     {
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof( tSirSmeTkipCntrMeasReq ));
+        pMsg = vos_mem_malloc(sizeof( tSirSmeTkipCntrMeasReq ));
+        if ( NULL == pMsg )
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
         if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, sizeof( tSirSmeTkipCntrMeasReq ));
+        vos_mem_set(pMsg, sizeof( tSirSmeTkipCntrMeasReq ), 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_TKIP_CNTR_MEAS_REQ);
         pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeTkipCntrMeasReq ));
         pBuf = &pMsg->sessionId;
@@ -12501,13 +13165,14 @@
         *( pBuf + 1 ) = 0;
         pBuf += sizeof(tANI_U16);
         // bssid
-        status = palCopyMemory( pMac->hHdd, pMsg->bssId, bssId, sizeof( tSirMacAddr ) );
+        vos_mem_copy(pMsg->bssId, bssId, sizeof( tSirMacAddr ));
+        status = eHAL_STATUS_SUCCESS;
         pBuf = pBuf + sizeof ( tSirMacAddr );
         // bEnable
         *pBuf = (tANI_BOOLEAN)bEnable;
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
         }
         status = palSendMBMessage( pMac->hHdd, pMsg );
@@ -12526,30 +13191,34 @@
     tANI_U32 dwTmp;
     do
     {
-        status = palAllocateMemory( pMac->hHdd, (void **)&pMsg, sizeof( tSirSmeGetAssocSTAsReq ) );
+        pMsg = vos_mem_malloc(sizeof( tSirSmeGetAssocSTAsReq ));
+        if ( NULL == pMsg )
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
         if (!HAL_STATUS_SUCCESS(status)) break;
-        palZeroMemory( pMac->hHdd, pMsg, sizeof( tSirSmeGetAssocSTAsReq ) );
+        vos_mem_set(pMsg, sizeof( tSirSmeGetAssocSTAsReq ), 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_GET_ASSOC_STAS_REQ);
         pBuf = (tANI_U8 *)&pMsg->bssId;
         wTmpBuf = pBuf;
         // bssId
-        palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, bssId, sizeof(tSirMacAddr) );
+        vos_mem_copy((tSirMacAddr *)pBuf, bssId, sizeof(tSirMacAddr));
         pBuf += sizeof(tSirMacAddr);
-        // modId
+        // modId 
         dwTmp = pal_cpu_to_be16((tANI_U16)modId);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U16));
+        vos_mem_copy(pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U16));
         pBuf += sizeof(tANI_U16);
         // pUsrContext
         dwTmp = pal_cpu_to_be32((tANI_U32)pUsrContext);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
+        vos_mem_copy(pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
         // pfnSapEventCallback
         dwTmp = pal_cpu_to_be32((tANI_U32)pfnSapEventCallback);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
+        vos_mem_copy(pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
         // pAssocStasBuf
         dwTmp = pal_cpu_to_be32((tANI_U32)pAssocStasBuf);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
+        vos_mem_copy(pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
         pMsg->length = pal_cpu_to_be16((tANI_U16)(sizeof(tANI_U32 ) + (pBuf - wTmpBuf)));//msg_header + msg
         status = palSendMBMessage( pMac->hHdd, pMsg );
@@ -12566,25 +13235,31 @@
     tANI_U32 dwTmp;
     do
         {
-        status = palAllocateMemory( pMac->hHdd, (void **)&pMsg, sizeof(tSirSmeGetWPSPBCSessionsReq) );
+        pMsg = vos_mem_malloc(sizeof(tSirSmeGetWPSPBCSessionsReq));
+        if ( NULL == pMsg )
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
         if (!HAL_STATUS_SUCCESS(status)) break;
-        palZeroMemory( pMac->hHdd, pMsg, sizeof( tSirSmeGetWPSPBCSessionsReq ) );
+        vos_mem_set(pMsg, sizeof( tSirSmeGetWPSPBCSessionsReq ), 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_GET_WPSPBC_SESSION_REQ);
         pBuf = (tANI_U8 *)&pMsg->pUsrContext;
+        VOS_ASSERT(pBuf);
+
         wTmpBuf = pBuf;
         // pUsrContext
         dwTmp = pal_cpu_to_be32((tANI_U32)pUsrContext);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
+        vos_mem_copy(pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
         // pSapEventCallback
         dwTmp = pal_cpu_to_be32((tANI_U32)pfnSapEventCallback);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
+        vos_mem_copy(pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
         // bssId
-        palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, bssId, sizeof(tSirMacAddr) );
+        vos_mem_copy((tSirMacAddr *)pBuf, bssId, sizeof(tSirMacAddr));
         pBuf += sizeof(tSirMacAddr);
         // MAC Address of STA in WPS session
-        palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, pRemoveMac.bytes, sizeof(v_MACADDR_t));
+        vos_mem_copy((tSirMacAddr *)pBuf, pRemoveMac.bytes, sizeof(v_MACADDR_t));
         pBuf += sizeof(v_MACADDR_t);
         pMsg->length = pal_cpu_to_be16((tANI_U16)(sizeof(tANI_U32 ) + (pBuf - wTmpBuf)));//msg_header + msg
         status = palSendMBMessage( pMac->hHdd, pMsg );
@@ -12613,22 +13288,27 @@
     pMac->roam.roamSession[sessionId].bssParams.updatebeaconInterval =  eANI_BOOLEAN_FALSE;
 
      /* Create the message and send to lim */
-     len = sizeof(tSirChangeBIParams);
-     status = palAllocateMemory( pMac->hHdd, (void **)&pMsg, len );
+     len = sizeof(tSirChangeBIParams); 
+     pMsg = vos_mem_malloc(len);
+     if ( NULL == pMsg )
+        status = eHAL_STATUS_FAILURE;
+     else
+        status = eHAL_STATUS_SUCCESS;
      if(HAL_STATUS_SUCCESS(status))
      {
-         palZeroMemory(pMac->hHdd, pMsg, sizeof(tSirChangeBIParams) );
+         vos_mem_set(pMsg, sizeof(tSirChangeBIParams), 0);
          pMsg->messageType     = eWNI_SME_CHNG_MCC_BEACON_INTERVAL;
          pMsg->length          = len;
 
         // bssId
-        palCopyMemory( pMac->hHdd, (tSirMacAddr *)pMsg->bssId, &pSession->selfMacAddr, sizeof(tSirMacAddr) );
+        vos_mem_copy((tSirMacAddr *)pMsg->bssId, &pSession->selfMacAddr,
+                     sizeof(tSirMacAddr));
         smsLog( pMac, LOG1, FL("CSR Attempting to change BI for Bssid= %02x-%02x-%02x-%02x-%02x-%02x "),
                   pMsg->bssId[ 0 ], pMsg->bssId[ 1 ], pMsg->bssId[ 2 ],
                   pMsg->bssId[ 3 ], pMsg->bssId[ 4 ], pMsg->bssId[ 5 ] );
         pMsg->sessionId       = sessionId;
         smsLog(pMac, LOG1, FL("  session %d BeaconInterval %d"), sessionId, pMac->roam.roamSession[sessionId].bssParams.beaconInterval);
-        pMsg->beaconInterval = pMac->roam.roamSession[sessionId].bssParams.beaconInterval;
+        pMsg->beaconInterval = pMac->roam.roamSession[sessionId].bssParams.beaconInterval; 
         status = palSendMBMessage(pMac->hHdd, pMsg);
     }
      return status;
@@ -12644,50 +13324,59 @@
     if (!CSR_IS_SESSION_VALID( pMac, sessionId ))
         return eHAL_STATUS_FAILURE;
     do {
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof( tSirSmeDeauthReq ));
+        pMsg = vos_mem_malloc(sizeof( tSirSmeDeauthReq ));
+        if ( NULL == pMsg )
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
         if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, sizeof( tSirSmeDeauthReq ));
+        vos_mem_set(pMsg, sizeof( tSirSmeDeauthReq ), 0);
                 pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_DEAUTH_REQ);
                 pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeDeauthReq ));
         //sessionId
         pBuf = &pMsg->sessionId;
         *pBuf++ = (tANI_U8)sessionId;
-
+        
         //tansactionId
         *pBuf = 0;
         *(pBuf + 1 ) = 0;
         pBuf += sizeof(tANI_U16);
         if ((pSession->pCurRoamProfile != NULL)  && (
-             (CSR_IS_INFRA_AP(pSession->pCurRoamProfile)) ||
-             (CSR_IS_WDS_AP(pSession->pCurRoamProfile)))){
+             (CSR_IS_INFRA_AP(pSession->pCurRoamProfile)) || 
+             (CSR_IS_WDS_AP(pSession->pCurRoamProfile)))){ 
             // Set the BSSID before sending the message to LIM
-            status = palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, pSession->selfMacAddr, sizeof( pMsg->peerMacAddr ) );
+            vos_mem_copy( (tSirMacAddr *)pBuf, pSession->selfMacAddr,
+                           sizeof( pMsg->peerMacAddr ) );
+            status = eHAL_STATUS_SUCCESS;
             pBuf =  pBuf + sizeof(tSirMacAddr);
         }
         else
         {
             // Set the BSSID before sending the message to LIM
-            status = palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, bssId, sizeof( pMsg->peerMacAddr ) );
+            vos_mem_copy( (tSirMacAddr *)pBuf, bssId, sizeof( pMsg->peerMacAddr ) );
+            status = eHAL_STATUS_SUCCESS;
             pBuf =  pBuf + sizeof(tSirMacAddr);
         }
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
-        }
+        }     
                 // Set the peer MAC address before sending the message to LIM
-        status = palCopyMemory( pMac->hHdd, (tSirMacAddr *) pBuf, bssId, sizeof( pMsg->peerMacAddr ) );
+        vos_mem_copy( (tSirMacAddr *) pBuf, bssId, sizeof( pMsg->peerMacAddr ) );
+        status = eHAL_STATUS_SUCCESS;
         pBuf =  pBuf + sizeof(tSirMacAddr);
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
-        }
+        }     
         wTmp = pal_cpu_to_be16(reasonCode);
-        status = palCopyMemory( pMac->hHdd, pBuf, &wTmp,sizeof( tANI_U16 ) );
+        vos_mem_copy( pBuf, &wTmp,sizeof( tANI_U16 ) );
+        status = eHAL_STATUS_SUCCESS;
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
         }
         status = palSendMBMessage( pMac->hHdd, pMsg );
@@ -12700,23 +13389,30 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSirSmeDisassocCnf *pMsg;
     do {
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof( tSirSmeDisassocCnf ));
+        pMsg = vos_mem_malloc(sizeof( tSirSmeDisassocCnf ));
+        if ( NULL == pMsg )
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
         if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, sizeof( tSirSmeDisassocCnf ));
+        vos_mem_set(pMsg, sizeof( tSirSmeDisassocCnf), 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_DISASSOC_CNF);
         pMsg->statusCode = (tSirResultCodes)pal_cpu_to_be32(eSIR_SME_SUCCESS);
         pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeDisassocCnf ));
-        status = palCopyMemory(pMac->hHdd, pMsg->peerMacAddr, pDisassocInd->peerMacAddr, sizeof(pMsg->peerMacAddr));
+        vos_mem_copy(pMsg->peerMacAddr, pDisassocInd->peerMacAddr,
+                     sizeof(pMsg->peerMacAddr));
+        status = eHAL_STATUS_SUCCESS;
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
         }
-//To test reconn
-        status = palCopyMemory(pMac->hHdd, pMsg->bssId, pDisassocInd->bssId, sizeof(pMsg->peerMacAddr));
+//To test reconn        
+        vos_mem_copy(pMsg->bssId, pDisassocInd->bssId, sizeof(pMsg->peerMacAddr));
+        status = eHAL_STATUS_SUCCESS;
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
         }
 //To test reconn ends
@@ -12730,22 +13426,29 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSirSmeDeauthCnf *pMsg;
     do {
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof( tSirSmeDeauthCnf ));
+        pMsg = vos_mem_malloc(sizeof( tSirSmeDeauthCnf ));
+        if ( NULL == pMsg )
+                status = eHAL_STATUS_FAILURE;
+        else
+                status = eHAL_STATUS_SUCCESS;
         if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, sizeof( tSirSmeDeauthCnf ));
+        vos_mem_set(pMsg, sizeof( tSirSmeDeauthCnf ), 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_DEAUTH_CNF);
         pMsg->statusCode = (tSirResultCodes)pal_cpu_to_be32(eSIR_SME_SUCCESS);
         pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeDeauthCnf ));
-        status = palCopyMemory(pMac->hHdd, pMsg->bssId, pDeauthInd->bssId, sizeof(pMsg->bssId));
+        vos_mem_copy(pMsg->bssId, pDeauthInd->bssId, sizeof(pMsg->bssId));
+        status = eHAL_STATUS_SUCCESS;
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
         }
-        status = palCopyMemory(pMac->hHdd, pMsg->peerMacAddr, pDeauthInd->peerMacAddr, sizeof(pMsg->peerMacAddr));
+        vos_mem_copy(pMsg->peerMacAddr, pDeauthInd->peerMacAddr,
+                     sizeof(pMsg->peerMacAddr));
+        status = eHAL_STATUS_SUCCESS;
         if(!HAL_STATUS_SUCCESS(status))
         {
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
             break;
         }
         status = palSendMBMessage( pMac->hHdd, pMsg );
@@ -12760,9 +13463,13 @@
     tSirResultCodes statusCode;
     tANI_U16 wTmp;
     do {
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof( tSirSmeAssocCnf ));
+        pMsg = vos_mem_malloc(sizeof( tSirSmeAssocCnf ));
+        if ( NULL == pMsg )
+            status = eHAL_STATUS_FAILURE;
+        else
+            status = eHAL_STATUS_SUCCESS;
         if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, sizeof( tSirSmeAssocCnf ));
+        vos_mem_set(pMsg, sizeof( tSirSmeAssocCnf ), 0);
                 pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_ASSOC_CNF);
                 pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeAssocCnf ));
         pBuf = (tANI_U8 *)&pMsg->statusCode;
@@ -12770,20 +13477,24 @@
             statusCode = (tSirResultCodes)pal_cpu_to_be32(eSIR_SME_SUCCESS);
         else
             statusCode = (tSirResultCodes)pal_cpu_to_be32(eSIR_SME_ASSOC_REFUSED);
-        palCopyMemory( pMac->hHdd, pBuf, &statusCode, sizeof(tSirResultCodes) );
+        vos_mem_copy(pBuf, &statusCode, sizeof(tSirResultCodes));
         pBuf += sizeof(tSirResultCodes);
         // bssId
-        status = palCopyMemory(pMac->hHdd, (tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
+        vos_mem_copy((tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
+        status = eHAL_STATUS_SUCCESS;
         pBuf += sizeof (tSirMacAddr);
         // peerMacAddr
-        status = palCopyMemory(pMac->hHdd, (tSirMacAddr *)pBuf, pAssocInd->peerMacAddr, sizeof(tSirMacAddr));
+        vos_mem_copy((tSirMacAddr *)pBuf, pAssocInd->peerMacAddr,
+                      sizeof(tSirMacAddr));
+        status = eHAL_STATUS_SUCCESS;
         pBuf += sizeof (tSirMacAddr);
         // aid
         wTmp = pal_cpu_to_be16(pAssocInd->aid);
-        palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof(tANI_U16) );
+        vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
         pBuf += sizeof (tANI_U16);
         // alternateBssId
-        status = palCopyMemory(pMac->hHdd, (tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
+        vos_mem_copy((tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
+        status = eHAL_STATUS_SUCCESS;
         pBuf += sizeof (tSirMacAddr);
         // alternateChannelId
         *pBuf = 11;
@@ -12796,21 +13507,20 @@
     } while( 0 );
     return( status );
 }
-eHalStatus csrSendAssocIndToUpperLayerCnfMsg(   tpAniSirGlobal pMac,
-                                                tpSirSmeAssocInd pAssocInd,
-                                                eHalStatus Halstatus,
+eHalStatus csrSendAssocIndToUpperLayerCnfMsg(   tpAniSirGlobal pMac, 
+                                                tpSirSmeAssocInd pAssocInd, 
+                                                eHalStatus Halstatus, 
                                                 tANI_U8 sessionId)
 {
     tSirMsgQ            msgQ;
-    eHalStatus status = eHAL_STATUS_SUCCESS;
     tSirSmeAssocIndToUpperLayerCnf *pMsg;
     tANI_U8 *pBuf;
     tSirResultCodes statusCode;
     tANI_U16 wTmp;
     do {
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof( tSirSmeAssocIndToUpperLayerCnf ));
-        if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, sizeof( tSirSmeAssocIndToUpperLayerCnf ));
+        pMsg = vos_mem_malloc(sizeof( tSirSmeAssocIndToUpperLayerCnf ));
+        if ( NULL == pMsg ) return eHAL_STATUS_FAILURE;
+        vos_mem_set(pMsg, sizeof( tSirSmeAssocIndToUpperLayerCnf ), 0);
 
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_UPPER_LAYER_ASSOC_CNF);
         pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeAssocIndToUpperLayerCnf ));
@@ -12822,33 +13532,34 @@
             statusCode = (tSirResultCodes)pal_cpu_to_be32(eSIR_SME_SUCCESS);
         else
             statusCode = (tSirResultCodes)pal_cpu_to_be32(eSIR_SME_ASSOC_REFUSED);
-        palCopyMemory( pMac->hHdd, pBuf, &statusCode, sizeof(tSirResultCodes) );
+        vos_mem_copy(pBuf, &statusCode, sizeof(tSirResultCodes)) ;
         pBuf += sizeof(tSirResultCodes);
         // bssId
-        status = palCopyMemory(pMac->hHdd, (tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
+        vos_mem_copy((tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
         pBuf += sizeof (tSirMacAddr);
         // peerMacAddr
-        status = palCopyMemory(pMac->hHdd, (tSirMacAddr *)pBuf, pAssocInd->peerMacAddr, sizeof(tSirMacAddr));
+        vos_mem_copy((tSirMacAddr *)pBuf, pAssocInd->peerMacAddr,
+                      sizeof(tSirMacAddr));
         pBuf += sizeof (tSirMacAddr);
         // StaId
         wTmp = pal_cpu_to_be16(pAssocInd->staId);
-        palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof(tANI_U16) );
+        vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
         pBuf += sizeof (tANI_U16);
         // alternateBssId
-        status = palCopyMemory(pMac->hHdd, (tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
+        vos_mem_copy((tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
         pBuf += sizeof (tSirMacAddr);
         // alternateChannelId
         *pBuf = 11;
         pBuf += sizeof (tANI_U8);
-        // Instead of copying roam Info, we just copy only WmmEnabled , RsnIE information
+        // Instead of copying roam Info, we just copy only WmmEnabled, RsnIE information
         //Wmm
         *pBuf = pAssocInd->wmmEnabledSta;
         pBuf += sizeof (tANI_U8);
         //RSN IE
-        status = palCopyMemory(pMac->hHdd, (tSirRSNie *)pBuf, &pAssocInd->rsnIE, sizeof(tSirRSNie));
+        vos_mem_copy((tSirRSNie *)pBuf, &pAssocInd->rsnIE, sizeof(tSirRSNie));
         pBuf += sizeof (tSirRSNie);
         //Additional IE
-        status = palCopyMemory(pMac->hHdd, (void *)pBuf, &pAssocInd->addIE, sizeof(tSirAddie));
+        vos_mem_copy((void *)pBuf, &pAssocInd->addIE, sizeof(tSirAddie));
         pBuf += sizeof (tSirAddie);
         //reassocReq
         *pBuf = pAssocInd->reassocReq;
@@ -12858,13 +13569,13 @@
         msgQ.bodyval = 0;
         SysProcessMmhMsg(pMac, &msgQ);
     } while( 0 );
-    return( status );
+    return( eHAL_STATUS_SUCCESS );
 }
 
-eHalStatus csrSendMBSetContextReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId ,
-            tSirMacAddr peerMacAddr, tANI_U8 numKeys, tAniEdType edType,
+eHalStatus csrSendMBSetContextReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId,
+            tSirMacAddr peerMacAddr, tANI_U8 numKeys, tAniEdType edType, 
             tANI_BOOLEAN fUnicast, tAniKeyDirection aniKeyDirection,
-            tANI_U8 keyId, tANI_U8 keyLength, tANI_U8 *pKey, tANI_U8 paeRole,
+            tANI_U8 keyId, tANI_U8 keyLength, tANI_U8 *pKey, tANI_U8 paeRole, 
             tANI_U8 *pKeyRsc )
 {
     tSirSmeSetContextReq *pMsg;
@@ -12877,16 +13588,16 @@
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
     do {
         if( ( 1 != numKeys ) && ( 0 != numKeys ) ) break;
-        // all of these fields appear in every SET_CONTEXT message.  Below we'll add in the size for each
+        // all of these fields appear in every SET_CONTEXT message.  Below we'll add in the size for each 
         // key set. Since we only support upto one key, we always allocate memory for 1 key
         msgLen  = sizeof( tANI_U16) + sizeof( tANI_U16 ) + sizeof( tSirMacAddr ) +
                   sizeof( tSirMacAddr ) + 1 + sizeof(tANI_U16) +
                   sizeof( pMsg->keyMaterial.length ) + sizeof( pMsg->keyMaterial.edType ) + sizeof( pMsg->keyMaterial.numKeys ) +
                   ( sizeof( pMsg->keyMaterial.key ) );
-
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-        if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, msgLen);
+                     
+        pMsg = vos_mem_malloc(msgLen);
+        if ( NULL == pMsg ) return eHAL_STATUS_FAILURE;
+        vos_mem_set(pMsg, msgLen, 0);
                 pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_SETCONTEXT_REQ);
                 pMsg->length = pal_cpu_to_be16(msgLen);
         //sessionId
@@ -12898,14 +13609,13 @@
         *(pBuf + 1) = 0;
         pBuf += sizeof(tANI_U16);
         // peerMacAddr
-        palCopyMemory( pMac->hHdd, pBuf,
-             (tANI_U8 *)peerMacAddr, sizeof(tSirMacAddr) );
+        vos_mem_copy(pBuf, (tANI_U8 *)peerMacAddr, sizeof(tSirMacAddr));
 
         pBuf += sizeof(tSirMacAddr);
 
         // bssId
-        palCopyMemory( pMac->hHdd, pBuf,
-            (tANI_U8 *)&pSession->connectedProfile.bssid, sizeof(tSirMacAddr) );
+        vos_mem_copy(pBuf, (tANI_U8 *)&pSession->connectedProfile.bssid,
+                     sizeof(tSirMacAddr));
 
         pBuf += sizeof(tSirMacAddr);
 
@@ -12913,16 +13623,16 @@
                 // Set the pMsg->keyMaterial.length field (this length is defined as all data that follows the edType field
                 // in the tSirKeyMaterial keyMaterial; field).
                 //
-                // !!NOTE:  This keyMaterial.length contains the length of a MAX size key, though the keyLength can be
+                // !!NOTE:  This keyMaterial.length contains the length of a MAX size key, though the keyLength can be 
                 // shorter than this max size.  Is LIM interpreting this ok ?
                 p = pal_set_U16( p, pal_cpu_to_be16((tANI_U16)( sizeof( pMsg->keyMaterial.numKeys ) + ( numKeys * sizeof( pMsg->keyMaterial.key ) ) )) );
                 // set pMsg->keyMaterial.edType
         tmpEdType = (tAniEdType)pal_cpu_to_be32(edType);
-        palCopyMemory( pMac->hHdd, p, (tANI_U8 *)&tmpEdType, sizeof(tAniEdType) );
+        vos_mem_copy(p, (tANI_U8 *)&tmpEdType, sizeof(tAniEdType));
         p += sizeof( pMsg->keyMaterial.edType );
         // set the pMsg->keyMaterial.numKeys field
         *p = numKeys;
-        p += sizeof( pMsg->keyMaterial.numKeys );
+        p += sizeof( pMsg->keyMaterial.numKeys );   
         // set pSirKey->keyId = keyId;
         *p = keyId;
         p += sizeof( pMsg->keyMaterial.key[ 0 ].keyId );
@@ -12931,19 +13641,19 @@
         p += sizeof( pMsg->keyMaterial.key[ 0 ].unicast );
                 // set pSirKey->keyDirection = aniKeyDirection;
         tmpDirection = (tAniKeyDirection)pal_cpu_to_be32(aniKeyDirection);
-        palCopyMemory( pMac->hHdd, p, (tANI_U8 *)&tmpDirection, sizeof(tAniKeyDirection) );
+        vos_mem_copy(p, (tANI_U8 *)&tmpDirection, sizeof(tAniKeyDirection));
         p += sizeof(tAniKeyDirection);
         //    pSirKey->keyRsc = ;;
-        palCopyMemory( pMac->hHdd, p, pKeyRsc, CSR_MAX_RSC_LEN );
+        vos_mem_copy(p, pKeyRsc, CSR_MAX_RSC_LEN);
         p += sizeof( pMsg->keyMaterial.key[ 0 ].keyRsc );
                 // set pSirKey->paeRole
                 *p = paeRole;   // 0 is Supplicant
                 p++;
                 // set pSirKey->keyLength = keyLength;
                 p = pal_set_U16( p, pal_cpu_to_be16(keyLength) );
-        if ( keyLength && pKey )
-        {
-            palCopyMemory( pMac->hHdd, p, pKey, keyLength );
+        if ( keyLength && pKey ) 
+        {   
+            vos_mem_copy(p, pKey, keyLength);
             if(keyLength == 16)
             {
                 smsLog(pMac, LOG1, "  SME Set keyIdx (%d) encType(%d) key = %02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X",
@@ -12957,7 +13667,7 @@
     return( status );
 }
 
-eHalStatus csrSendMBStartBssReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, eCsrRoamBssType bssType,
+eHalStatus csrSendMBStartBssReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, eCsrRoamBssType bssType, 
                                     tCsrRoamStartBssParams *pParam, tSirBssDescription *pBssDesc )
 {
     eHalStatus status;
@@ -12976,14 +13686,14 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     do {
         pSession->joinFailStatusCode.statusCode = eSIR_SME_SUCCESS;
         pSession->joinFailStatusCode.reasonCode = 0;
         msgLen = sizeof(tSirSmeStartBssReq);
-        status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-        if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, msgLen);
+        pMsg = vos_mem_malloc(msgLen);
+        if ( NULL == pMsg ) return eHAL_STATUS_FAILURE;
+        vos_mem_set(pMsg, msgLen, 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_START_BSS_REQ);
         pBuf = &pMsg->sessionId;
         wTmpBuf = pBuf;
@@ -12994,11 +13704,11 @@
         *pBuf = 0;
         *(pBuf + 1) = 0;
         pBuf += sizeof(tANI_U16);
-        // bssid
-        palCopyMemory( pMac->hHdd, pBuf, pParam->bssid, sizeof(tSirMacAddr) );
+        // bssid 
+        vos_mem_copy(pBuf, pParam->bssid, sizeof(tSirMacAddr));
         pBuf += sizeof(tSirMacAddr);
         // selfMacAddr
-        palCopyMemory( pMac->hHdd, pBuf, pSession->selfMacAddr, sizeof(tSirMacAddr) );
+        vos_mem_copy(pBuf, pSession->selfMacAddr, sizeof(tSirMacAddr));
         pBuf += sizeof(tSirMacAddr);
         // beaconInterval
         if( pBssDesc && pBssDesc->beaconInterval )
@@ -13016,28 +13726,28 @@
         if(csrIsconcurrentsessionValid (pMac, sessionId,
                                    pParam->bssPersona)
                                    == eHAL_STATUS_SUCCESS )
-        {
+        {    
            csrValidateMCCBeaconInterval(pMac, pParam->operationChn, &wTmp, sessionId,
                                       pParam->bssPersona);
-           //Update the beacon Interval
+           //Update the beacon Interval 
            pParam->beaconInterval = wTmp;
         }
         else
         {
             smsLog( pMac,LOGE, FL("****Start BSS failed persona already exists***"));
             status = eHAL_STATUS_FAILURE;
-            palFreeMemory( pMac->hHdd, pMsg );
+            vos_mem_free(pMsg);
             return status;
         }
 
-        palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof( tANI_U16 ) );
+        vos_mem_copy(pBuf, &wTmp, sizeof( tANI_U16 ));
         pBuf += sizeof(tANI_U16);
         // dot11mode
         *pBuf = (tANI_U8)csrTranslateToWNICfgDot11Mode( pMac, pParam->uCfgDot11Mode );
         pBuf += 1;
         // bssType
         dwTmp = pal_cpu_to_be32( csrTranslateBsstypeToMacType( bssType ) );
-        palCopyMemory( pMac->hHdd, pBuf, &dwTmp, sizeof(tSirBssType) );
+        vos_mem_copy(pBuf, &dwTmp, sizeof(tSirBssType));
         pBuf += sizeof(tSirBssType);
         // ssId
         if( pParam->ssId.length )
@@ -13045,27 +13755,27 @@
             // ssId len
             *pBuf = pParam->ssId.length;
             pBuf++;
-            palCopyMemory( pMac->hHdd, pBuf, pParam->ssId.ssId, pParam->ssId.length );
+            vos_mem_copy(pBuf, pParam->ssId.ssId, pParam->ssId.length);
             pBuf += pParam->ssId.length;
         }
         else
         {
             *pBuf = 0;
-            pBuf++;
+            pBuf++;        
         }
         // set the channel Id
         *pBuf = pParam->operationChn;
         pBuf++;
         //What should we really do for the cbmode.
         cbMode = (ePhyChanBondState)pal_cpu_to_be32(pParam->cbMode);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&cbMode, sizeof(ePhyChanBondState) );
+        vos_mem_copy(pBuf, (tANI_U8 *)&cbMode, sizeof(ePhyChanBondState));
         pBuf += sizeof(ePhyChanBondState);
 
         // Set privacy
         *pBuf = pParam->privacy;
         pBuf++;
-
-        //Set Uapsd
+ 
+        //Set Uapsd 
         *pBuf = pParam->ApUapsdEnable;
         pBuf++;
         //Set SSID hidden
@@ -13073,7 +13783,7 @@
         pBuf++;
         *pBuf = (tANI_U8)pParam->fwdWPSPBCProbeReq;
         pBuf++;
-
+        
         //Ht protection Enable/Disable
         *pBuf = (tANI_U8)pParam->protEnabled;
         pBuf++;
@@ -13082,70 +13792,69 @@
         pBuf++;
         //set cfg related to protection
         wTmp = pal_cpu_to_be16( pParam->ht_protection );
-        palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof( tANI_U16 ) );
+        vos_mem_copy(pBuf, &wTmp, sizeof( tANI_U16 ));
         pBuf += sizeof(tANI_U16);
         // Set Auth type
         authType = pal_cpu_to_be32(pParam->authType);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&authType, sizeof(tANI_U32));
+        vos_mem_copy(pBuf, (tANI_U8 *)&authType, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
         // Set DTIM
         dwTmp = pal_cpu_to_be32(pParam->dtimPeriod);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
+        vos_mem_copy(pBuf, (tANI_U8 *)&dwTmp, sizeof(tANI_U32));
         pBuf += sizeof(tANI_U32);
         // Set wps_state
         *pBuf = pParam->wps_state;
         pBuf++;
-
-	// set isCoalesingInIBSSAllowed
+        // set isCoalesingInIBSSAllowed
         *pBuf = pMac->isCoalesingInIBSSAllowed;
         pBuf++;
-
         //Persona
         *pBuf = (tANI_U8)pParam->bssPersona;
         pBuf++;
-
+        
         //txLdpcIniFeatureEnabled
         *pBuf = (tANI_U8)(tANI_U8)pMac->roam.configParam.txLdpcEnable;
         pBuf++;
 
-
         // set RSN IE
         if( pParam->nRSNIELength > sizeof(pMsg->rsnIE.rsnIEdata) )
         {
             status = eHAL_STATUS_INVALID_PARAMETER;
-            palFreeMemory( pMac->hHdd, pMsg );
+            vos_mem_free(pMsg);
             break;
         }
         wTmp = pal_cpu_to_be16( pParam->nRSNIELength );
-        palCopyMemory( pMac->hHdd, pBuf, &wTmp, sizeof(tANI_U16) );
+        vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
         pBuf += sizeof(tANI_U16);
         if( wTmp )
         {
             wTmp = pParam->nRSNIELength;
-            palCopyMemory( pMac->hHdd, pBuf, pParam->pRSNIE, wTmp );
+            vos_mem_copy(pBuf, pParam->pRSNIE, wTmp);
             pBuf += wTmp;
         }
         nwType = (tSirNwType)pal_cpu_to_be32(pParam->sirNwType);
-        palCopyMemory( pMac->hHdd, pBuf, (tANI_U8 *)&nwType, sizeof(tSirNwType) );
+        vos_mem_copy(pBuf, (tANI_U8 *)&nwType, sizeof(tSirNwType));
         pBuf += sizeof(tSirNwType);
         *pBuf = pParam->operationalRateSet.numRates; //tSirMacRateSet->numRates
         pBuf++;
-        palCopyMemory( pMac->hHdd, pBuf, pParam->operationalRateSet.rate, pParam->operationalRateSet.numRates );
+        vos_mem_copy(pBuf, pParam->operationalRateSet.rate,
+                     pParam->operationalRateSet.numRates );
         pBuf += pParam->operationalRateSet.numRates ;
         *pBuf++ = pParam->extendedRateSet.numRates;
         if(0 != pParam->extendedRateSet.numRates)
         {
-            palCopyMemory( pMac->hHdd, pBuf, pParam->extendedRateSet.rate, pParam->extendedRateSet.numRates );
+            vos_mem_copy(pBuf, pParam->extendedRateSet.rate,
+                         pParam->extendedRateSet.numRates);
             pBuf += pParam->extendedRateSet.numRates;
         }
 
         //HT Config
-        palCopyMemory(pMac->hHdd, pBuf, &pSession->htConfig,
-                      sizeof(tSirHTConfig));
-        pBuf += sizeof(tSirHTConfig);
+		  vos_mem_copy(pBuf, &pSession->htConfig,
+				  sizeof(tSirHTConfig));
+		  pBuf += sizeof(tSirHTConfig);
         msgLen = (tANI_U16)(sizeof(tANI_U32 ) + (pBuf - wTmpBuf)); //msg_header + msg
         pMsg->length = pal_cpu_to_be16(msgLen);
-
+        
         status = palSendMBMessage(pMac->hHdd, pMsg);
     } while( 0 );
   return( status );
@@ -13164,11 +13873,11 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-
+    
     do {
-        status = palAllocateMemory(pMac, (void **)&pMsg, sizeof(tSirSmeStopBssReq));
-        if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, sizeof( tSirSmeStopBssReq ));
+        pMsg = vos_mem_malloc(sizeof(tSirSmeStopBssReq));
+        if ( NULL == pMsg ) return eHAL_STATUS_FAILURE;
+        vos_mem_set(pMsg, sizeof( tSirSmeStopBssReq ), 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_STOP_BSS_REQ);
         pBuf = &pMsg->sessionId;
         //sessionId
@@ -13180,24 +13889,26 @@
         //reason code
         *pBuf  = 0;
         pBuf += sizeof(tSirResultCodes);
-        // bssid
+        // bssid 
         // if BSSType is WDS sta, use selfmacAddr as bssid, else use bssid in connectedProfile
         if( CSR_IS_CONN_WDS_STA(&pSession->connectedProfile) )
         {
-            palCopyMemory( pMac->hHdd, pBuf,(tANI_U8 *)&pSession->selfMacAddr,  sizeof(tSirMacAddr) );
+            vos_mem_copy(pBuf, (tANI_U8 *)&pSession->selfMacAddr,
+                         sizeof(tSirMacAddr));
         }
         else
         {
-            palCopyMemory( pMac->hHdd, pBuf,(tANI_U8 *)&pSession->connectedProfile.bssid,  sizeof(tSirMacAddr) );
+            vos_mem_copy(pBuf, (tANI_U8 *)&pSession->connectedProfile.bssid,
+                         sizeof(tSirMacAddr));
         }
        pBuf += sizeof(tSirMacAddr);
        msgLen = sizeof(tANI_U16) + sizeof(tANI_U16) + 1 + sizeof(tANI_U16) + sizeof(tSirResultCodes) + sizeof(tSirMacAddr);
        pMsg->length =  pal_cpu_to_be16(msgLen);
        status =  palSendMBMessage( pMac->hHdd, pMsg );
-#if 0
-        status = palAllocateMemory(pMac, (void **)&pMsg, sizeof(tSirSmeStopBssReq));
-        if ( !HAL_STATUS_SUCCESS(status) ) break;
-        palZeroMemory(pMac->hHdd, pMsg, sizeof( tSirSmeStopBssReq ));
+#if 0            
+        pMsg = vos_mem_malloc(sizeof(tSirSmeStopBssReq));
+        if ( NULL == pMsg ) return eHAL_STATUS_FAILURE;
+        vos_mem_set(pMsg, sizeof( tSirSmeStopBssReq ), 0);
                 pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_STOP_BSS_REQ);
                 pMsg->reasonCode = 0;
         // bssid
@@ -13210,17 +13921,17 @@
         {
             pbBssid = (tANI_U8 *)&pSession->connectedProfile.bssid;
         }
-        palCopyMemory( pMac->hHdd, &pMsg->bssId, pbBssid, sizeof(tSirMacAddr) );
+        vos_mem_copy(&pMsg->bssId, pbBssid, sizeof(tSirMacAddr));
         pMsg->transactionId = 0;
         pMsg->sessionId = (tANI_U8)sessionId;
                 pMsg->length = pal_cpu_to_be16((tANI_U16)sizeof( tSirSmeStopBssReq ));
                 status = palSendMBMessage( pMac->hHdd, pMsg );
-#endif
+#endif                
         } while( 0 );
     return( status );
 }
 
-eHalStatus csrReassoc(tpAniSirGlobal pMac, tANI_U32 sessionId,
+eHalStatus csrReassoc(tpAniSirGlobal pMac, tANI_U32 sessionId, 
                       tCsrRoamModifyProfileFields *pModProfileFields,
                       tANI_U32 *pRoamId, v_BOOL_t fForce)
 {
@@ -13228,9 +13939,9 @@
    tANI_U32 roamId = 0;
    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
    if((csrIsConnStateConnected(pMac, sessionId)) &&
-      (fForce || (!palEqualMemory(pMac->hHdd, &pModProfileFields,
-                       &pSession->connectedProfile.modifyProfileFields,
-                       sizeof(tCsrRoamModifyProfileFields)))) )
+      (fForce || (!vos_mem_compare( &pModProfileFields,
+                  &pSession->connectedProfile.modifyProfileFields,
+                  sizeof(tCsrRoamModifyProfileFields)))) )
    {
       roamId = GET_NEXT_ROAM_ID(&pMac->roam);
       if(pRoamId)
@@ -13238,8 +13949,8 @@
          *pRoamId = roamId;
       }
 
-      status = csrRoamIssueReassoc(pMac, sessionId, NULL, pModProfileFields,
-                                   eCsrSmeIssuedReassocToSameAP, roamId,
+      status = csrRoamIssueReassoc(pMac, sessionId, NULL, pModProfileFields, 
+                                   eCsrSmeIssuedReassocToSameAP, roamId, 
                                    eANI_BOOLEAN_FALSE);
    }
    return status;
@@ -13248,7 +13959,7 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tCsrRoamInfo roamInfo;
-    palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+    vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
     status = csrRoamCallCallback(pMac, sessionId, &roamInfo, 0,
                             eCSR_ROAM_SESSION_OPENED, eCSR_ROAM_RESULT_NONE);
     return (status);
@@ -13303,25 +14014,31 @@
    } while(0);
    return status;
 }
-eHalStatus csrSendMBAddSelfStaReqMsg( tpAniSirGlobal pMac, tSirMacAddr macAddr,
-                 tANI_U32 type, tANI_U32 subType, tANI_U8 sessionId)
+eHalStatus csrSendMBAddSelfStaReqMsg( tpAniSirGlobal pMac,
+                                      tAddStaForSessionCmd *pAddStaReq,
+                                      tANI_U8 sessionId)
 {
    tSirSmeAddStaSelfReq *pMsg;
    tANI_U16 msgLen;
    eHalStatus status = eHAL_STATUS_FAILURE;
    do {
       msgLen  = sizeof(tSirSmeAddStaSelfReq);
-      status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-      if ( !HAL_STATUS_SUCCESS(status) ) break;
-      palZeroMemory(pMac->hHdd, pMsg, msgLen);
+      pMsg = vos_mem_malloc(msgLen);
+      if ( NULL == pMsg ) break;
+      vos_mem_set(pMsg, msgLen, 0);
       pMsg->mesgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_ADD_STA_SELF_REQ);
       pMsg->mesgLen = pal_cpu_to_be16(msgLen);
-      pMsg->type = type;
-      pMsg->subType = subType;
-      pMsg->sessionId = sessionId;
       // self station address
-      palCopyMemory( pMac->hHdd, (tANI_U8 *)pMsg->selfMacAddr, (tANI_U8 *)macAddr, sizeof(tSirMacAddr) );
-        smsLog( pMac, LOG1, FL("selfMac=%02x, %02x, %02x, %02x, %02x, %02x"),
+      vos_mem_copy((tANI_U8 *)pMsg->selfMacAddr,
+                      (tANI_U8 *)&pAddStaReq->selfMacAddr, sizeof(tSirMacAddr));
+
+      pMsg->currDeviceMode = pAddStaReq->currDeviceMode;
+      pMsg->type = pAddStaReq->type;
+      pMsg->subType = pAddStaReq->subType;
+      pMsg->sessionId = sessionId;
+	printk("session id - %d, AddSta session - %d\n", sessionId, pAddStaReq->sessionId);
+
+      smsLog( pMac, LOG1, FL("selfMac=%02x, %02x, %02x, %02x, %02x, %02x"),
             pMsg->selfMacAddr[0],
             pMsg->selfMacAddr[1],
             pMsg->selfMacAddr[2],
@@ -13332,8 +14049,9 @@
    } while( 0 );
    return( status );
 }
-eHalStatus csrIssueAddStaForSessionReq(tpAniSirGlobal pMac, tANI_U32 sessionId, tSirMacAddr sessionMacAddr,
-                tANI_U32 type, tANI_U32 subType)
+eHalStatus csrIssueAddStaForSessionReq(tpAniSirGlobal pMac, tANI_U32 sessionId,
+                                       tSirMacAddr sessionMacAddr,
+                                       tANI_U32 type, tANI_U32 subType)
 {
    eHalStatus status = eHAL_STATUS_SUCCESS;
    tSmeCmd *pCommand;
@@ -13346,7 +14064,9 @@
    {
       pCommand->command = eSmeCommandAddStaSession;
       pCommand->sessionId = (tANI_U8)sessionId;
-      palCopyMemory( pMac->hHdd, pCommand->u.addStaSessionCmd.selfMacAddr, sessionMacAddr, sizeof( tSirMacAddr ) );
+      vos_mem_copy(pCommand->u.addStaSessionCmd.selfMacAddr, sessionMacAddr,
+                   sizeof( tSirMacAddr ) );
+      pCommand->u.addStaSessionCmd.currDeviceMode = pMac->sme.currDeviceMode;
       pCommand->u.addStaSessionCmd.type = type;
       pCommand->u.addStaSessionCmd.subType = subType;
       status = csrQueueSmeCommand(pMac, pCommand, TRUE);
@@ -13360,15 +14080,15 @@
 }
 eHalStatus csrProcessAddStaSessionCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand )
 {
-   return csrSendMBAddSelfStaReqMsg( pMac,
-         pCommand->u.addStaSessionCmd.selfMacAddr,
-         pCommand->u.addStaSessionCmd.type,
-         pCommand->u.addStaSessionCmd.subType,
+   return csrSendMBAddSelfStaReqMsg(pMac,
+         &pCommand->u.addStaSessionCmd,
          pCommand->sessionId);
 }
-eHalStatus csrRoamOpenSession( tpAniSirGlobal pMac, csrRoamCompleteCallback callback, void *pContext,
-                          tANI_U8 *pSelfMacAddr, tANI_U8 *pbSessionId,
-                          tANI_U32 type, tANI_U32 subType )
+eHalStatus csrRoamOpenSession(tpAniSirGlobal pMac,
+                              csrRoamCompleteCallback callback,
+                              void *pContext,
+                              tANI_U8 *pSelfMacAddr, tANI_U8 *pbSessionId,
+                              tANI_U32 type, tANI_U32 subType )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tANI_U32 i, value = 0;
@@ -13389,8 +14109,16 @@
             pSession->sessionId = (tANI_U8)i;
                 pSession->callback = callback;
             pSession->pContext = pContext;
-            palCopyMemory( pMac->hHdd, &pSession->selfMacAddr, pSelfMacAddr, sizeof(tCsrBssid) );
+            vos_mem_copy(&pSession->selfMacAddr, pSelfMacAddr, sizeof(tCsrBssid));
             *pbSessionId = (tANI_U8)i;
+            status = vos_timer_init(&pSession->hTimerRoaming, VOS_TIMER_TYPE_SW,
+                                    csrRoamRoamingTimerHandler,
+                                    &pSession->roamingTimerInfo);
+            if (!HAL_STATUS_SUCCESS(status))
+            {
+                smsLog(pMac, LOGE, FL("cannot allocate memory for Roaming timer"));
+                break;
+            }
             /* get the HT capability info*/
             status = ccmCfgGetInt(pMac, WNI_CFG_HT_CAP_INFO, &value);
             if (!HAL_STATUS_SUCCESS(status)) {
@@ -13400,32 +14128,16 @@
                 break;
             }
 
-            status = palTimerAlloc(pMac->hHdd, &pSession->hTimerRoaming, csrRoamRoamingTimerHandler,
-                                    &pSession->roamingTimerInfo);
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-                smsLog(pMac, LOGE, FL("cannot allocate memory for Roaming timer"));
-                break;
-            }
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
-            status = palTimerAlloc(pMac->hHdd, &pSession->hTimerJoinRetry, csrRoamJoinRetryTimerHandler,
+            status = vos_timer_init(&pSession->hTimerJoinRetry, VOS_TIMER_TYPE_SW,
+                                    csrRoamJoinRetryTimerHandler,
                                     &pSession->joinRetryTimerInfo);
-            if(!HAL_STATUS_SUCCESS(status))
+            if (!HAL_STATUS_SUCCESS(status))
             {
                 smsLog(pMac, LOGE, FL("cannot allocate memory for joinretry timer"));
                 break;
             }
 #endif
-            pSession->ibssJoinTimerInfo.pMac = pMac;
-            pSession->ibssJoinTimerInfo.sessionId = CSR_SESSION_ID_INVALID;
-            status = palTimerAlloc(pMac->hHdd, &pSession->hTimerIbssJoining, csrRoamIbssJoinTimerHandler,
-                                    &pSession->ibssJoinTimerInfo);
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-                smsLog(pMac, LOGE, FL("cannot allocate memory for IbssJoining timer"));
-                break;
-            }
-
             uHTCapabilityInfo.nCfgValue16 = 0xFFFF & value;
             pSession->htConfig.ht_rx_ldpc =
                                        uHTCapabilityInfo.htCapInfo.advCodingCap;
@@ -13470,7 +14182,7 @@
             csrCleanupSession(pMac, sessionId);
             if(pCommand->u.delStaSessionCmd.callback)
             {
-
+                 
                 status = sme_ReleaseGlobalLock( &pMac->sme );
                 if ( HAL_STATUS_SUCCESS( status ) )
                 {
@@ -13486,8 +14198,8 @@
                 else {
                     smsLog(pMac, LOGE, "%s: Failed to Release Lock", __func__);
                 }
-            }
-
+            } 
+   
             //Remove this command out of the active list
             if(csrLLRemoveEntry(&pMac->sme.smeCmdActiveList, pEntry, LL_ACCESS_LOCK))
             {
@@ -13522,15 +14234,17 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    do {
       msgLen  = sizeof(tSirSmeDelStaSelfReq);
-      status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-      if ( !HAL_STATUS_SUCCESS(status) ) break;
-
-      palZeroMemory(pMac->hHdd, pMsg, msgLen);
+      pMsg = vos_mem_malloc(msgLen);
+      if (NULL == pMsg)
+			return eHAL_STATUS_FAILURE;
+      vos_mem_set(pMsg, msgLen, 0);
+   
       pMsg->mesgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_DEL_STA_SELF_REQ);
       pMsg->mesgLen = pal_cpu_to_be16(msgLen);
       pMsg->sessionId = sessionId;
       // self station address
-      palCopyMemory( pMac->hHdd, (tANI_U8 *)pMsg->selfMacAddr, (tANI_U8 *)macAddr, sizeof(tSirMacAddr) );
+      vos_mem_copy((tANI_U8 *)pMsg->selfMacAddr, (tANI_U8 *)macAddr,
+                   sizeof(tSirMacAddr));
       status = palSendMBMessage(pMac->hHdd, pMsg);
    } while( 0 );
    return( status );
@@ -13553,7 +14267,8 @@
       pCommand->sessionId = (tANI_U8)sessionId;
       pCommand->u.delStaSessionCmd.callback = callback;
       pCommand->u.delStaSessionCmd.pContext = pContext;
-      palCopyMemory( pMac->hHdd, pCommand->u.delStaSessionCmd.selfMacAddr, sessionMacAddr, sizeof( tSirMacAddr ) );
+      vos_mem_copy(pCommand->u.delStaSessionCmd.selfMacAddr, sessionMacAddr,
+                   sizeof( tSirMacAddr ));
       status = csrQueueSmeCommand(pMac, pCommand, TRUE);
       if( !HAL_STATUS_SUCCESS( status ) )
       {
@@ -13565,7 +14280,7 @@
 }
 eHalStatus csrProcessDelStaSessionCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand )
 {
-   return csrSendMBDelSelfStaReqMsg( pMac,
+   return csrSendMBDelSelfStaReqMsg( pMac, 
          pCommand->u.delStaSessionCmd.selfMacAddr,
          (tANI_U8)pCommand->sessionId);
 }
@@ -13616,24 +14331,24 @@
         csrFreeConnectBssDesc(pMac, sessionId);
         csrRoamFreeConnectProfile( pMac, &pSession->connectedProfile );
         csrRoamFreeConnectedInfo ( pMac, &pSession->connectedInfo);
-        palTimerFree(pMac->hHdd, pSession->hTimerRoaming);
+        vos_timer_destroy(&pSession->hTimerRoaming);
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
-        palTimerFree(pMac->hHdd, pSession->hTimerJoinRetry);
+        vos_timer_destroy(&pSession->hTimerJoinRetry);
 #endif
-        palTimerFree(pMac->hHdd, pSession->hTimerIbssJoining);
         purgeSmeSessionCmdList(pMac, sessionId, &pMac->sme.smeCmdPendingList);
         if (pMac->fScanOffload)
         {
             purgeSmeSessionCmdList(pMac, sessionId,
                     &pMac->sme.smeScanCmdPendingList);
         }
+
         purgeCsrSessionCmdList(pMac, sessionId);
         csrInitSession(pMac, sessionId);
     }
 }
 
 eHalStatus csrRoamCloseSession( tpAniSirGlobal pMac, tANI_U32 sessionId,
-                                tANI_BOOLEAN fSync,
+                                tANI_BOOLEAN fSync, 
                                 csrRoamSessionCloseCallback callback,
                                 void *pContext )
 {
@@ -13646,7 +14361,7 @@
             csrCleanupSession(pMac, sessionId);
         }
         else
-        {
+        { 
             purgeSmeSessionCmdList(pMac, sessionId,
                     &pMac->sme.smeCmdPendingList);
             if (pMac->fScanOffload)
@@ -13675,12 +14390,11 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-
+    
     pSession->sessionActive = eANI_BOOLEAN_FALSE;
     pSession->sessionId = CSR_SESSION_ID_INVALID;
     pSession->callback = NULL;
     pSession->pContext = NULL;
-    pSession->ibss_join_pending = FALSE;
     pSession->connectState = eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED;
     // TODO : Confirm pMac->roam.fReadyForPowerSave = eANI_BOOLEAN_FALSE;
     csrFreeRoamProfile( pMac, sessionId );
@@ -13688,44 +14402,44 @@
     csrRoamFreeConnectedInfo( pMac, &pSession->connectedInfo );
     csrFreeConnectBssDesc(pMac, sessionId);
     csrScanEnable(pMac);
-    palZeroMemory( pMac->hHdd, &pSession->selfMacAddr, sizeof(tCsrBssid) );
-    if(pSession->pWpaRsnReqIE)
+    vos_mem_set(&pSession->selfMacAddr, sizeof(tCsrBssid), 0);
+    if (pSession->pWpaRsnReqIE)
     {
-        palFreeMemory(pMac->hHdd, pSession->pWpaRsnReqIE);
+        vos_mem_free(pSession->pWpaRsnReqIE);
         pSession->pWpaRsnReqIE = NULL;
     }
     pSession->nWpaRsnReqIeLength = 0;
-    if(pSession->pWpaRsnRspIE)
+    if (pSession->pWpaRsnRspIE)
     {
-        palFreeMemory(pMac->hHdd, pSession->pWpaRsnRspIE);
+        vos_mem_free(pSession->pWpaRsnRspIE);
         pSession->pWpaRsnRspIE = NULL;
     }
     pSession->nWpaRsnRspIeLength = 0;
 #ifdef FEATURE_WLAN_WAPI
-    if(pSession->pWapiReqIE)
+    if (pSession->pWapiReqIE)
     {
-        palFreeMemory(pMac->hHdd, pSession->pWapiReqIE);
+        vos_mem_free(pSession->pWapiReqIE);
         pSession->pWapiReqIE = NULL;
     }
     pSession->nWapiReqIeLength = 0;
-    if(pSession->pWapiRspIE)
+    if (pSession->pWapiRspIE)
     {
-        palFreeMemory(pMac->hHdd, pSession->pWapiRspIE);
+        vos_mem_free(pSession->pWapiRspIE);
         pSession->pWapiRspIE = NULL;
     }
     pSession->nWapiRspIeLength = 0;
 #endif /* FEATURE_WLAN_WAPI */
-    if(pSession->pAddIEScan)
+    if (pSession->pAddIEScan)
     {
-        palFreeMemory(pMac->hHdd, pSession->pAddIEScan);
+        vos_mem_free(pSession->pAddIEScan);
         pSession->pAddIEScan = NULL;
     }
     pSession->nAddIEScanLength = 0;
-    if(pSession->pAddIEAssoc)
+    if (pSession->pAddIEAssoc)
     {
-        palFreeMemory(pMac->hHdd, pSession->pAddIEAssoc);
+        vos_mem_free(pSession->pAddIEAssoc);
         pSession->pAddIEAssoc = NULL;
-}
+    }
     pSession->nAddIEAssocLength = 0;
 }
 
@@ -13749,7 +14463,7 @@
     return( status );
 }
 
-//This function assumes that we only support one IBSS session. We cannot use BSSID to identify
+//This function assumes that we only support one IBSS session. We cannot use BSSID to identify 
 //session because for IBSS, the bssid changes.
 static tANI_U32 csrFindIbssSession( tpAniSirGlobal pMac )
 {
@@ -13772,20 +14486,20 @@
 }
 static void csrRoamLinkUp(tpAniSirGlobal pMac, tCsrBssid bssid)
 {
-   /* Update the current BSS info in ho control block based on connected
+   /* Update the current BSS info in ho control block based on connected 
       profile info from pmac global structure                              */
-
+   
    smsLog(pMac, LOGW, " csrRoamLinkUp: WLAN link UP with AP= %02x-%02x-%02x-%02x-%02x-%02x",
           bssid[ 0 ], bssid[ 1 ], bssid[ 2 ],
           bssid[ 3 ], bssid[ 4 ], bssid[ 5 ] );
    /* Check for user misconfig of RSSI trigger threshold                  */
    pMac->roam.configParam.vccRssiThreshold =
-      ( 0 == pMac->roam.configParam.vccRssiThreshold ) ?
+      ( 0 == pMac->roam.configParam.vccRssiThreshold ) ? 
       CSR_VCC_RSSI_THRESHOLD : pMac->roam.configParam.vccRssiThreshold;
    pMac->roam.vccLinkQuality = eCSR_ROAM_LINK_QUAL_POOR_IND;
     /* Check for user misconfig of UL MAC Loss trigger threshold           */
    pMac->roam.configParam.vccUlMacLossThreshold =
-      ( 0 == pMac->roam.configParam.vccUlMacLossThreshold ) ?
+      ( 0 == pMac->roam.configParam.vccUlMacLossThreshold ) ? 
       CSR_VCC_UL_MAC_LOSS_THRESHOLD : pMac->roam.configParam.vccUlMacLossThreshold;
 #if   defined WLAN_FEATURE_NEIGHBOR_ROAMING
     {
@@ -13806,7 +14520,7 @@
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return;
     }
-
+    
    //Only to handle the case for Handover on infra link
    if( eCSR_BSS_TYPE_INFRASTRUCTURE != pSession->connectedProfile.BSSType )
    {
@@ -13816,7 +14530,12 @@
     * Incase of station mode, immediately stop data transmission whenever
     * link down is detected.
     */
-   if (csrRoamIsStaMode(pMac, sessionId)) {
+   if (csrRoamIsStaMode(pMac, sessionId)
+       && !CSR_IS_ROAM_SUBSTATE_DISASSOC_HO(pMac, sessionId)
+#ifdef WLAN_FEATURE_VOWIFI_11R
+       && !csrRoamIs11rAssoc(pMac)
+#endif
+       ) {
         smsLog(pMac, LOG1, FL("Inform Link lost for session %d"), sessionId);
         csrRoamCallCallback(pMac, sessionId, NULL, 0, eCSR_ROAM_LOSTLINK,
                             eCSR_ROAM_RESULT_LOSTLINK);
@@ -13829,10 +14548,10 @@
    csrNeighborRoamIndicateDisconnect(pMac, sessionId);
 #endif
 
-    //Remove this code once SLM_Sessionization is supported
+    //Remove this code once SLM_Sessionization is supported 
     //BMPS_WORKAROUND_NOT_NEEDED
-    if(!IS_FEATURE_SUPPORTED_BY_FW(SLM_SESSIONIZATION) &&
-        csrIsInfraApStarted( pMac ) &&
+    if(!IS_FEATURE_SUPPORTED_BY_FW(SLM_SESSIONIZATION) && 
+        csrIsInfraApStarted( pMac ) &&  
         pMac->roam.configParam.doBMPSWorkaround)
    {
        pMac->roam.configParam.doBMPSWorkaround = 0;
@@ -13869,9 +14588,9 @@
       if(pMac->roam.tlStatsReqInfo.periodicity)
       {
          //start timer
-         status = palTimerStart(pMac->hHdd, pMac->roam.tlStatsReqInfo.hTlStatsTimer,
-                                pMac->roam.tlStatsReqInfo.periodicity * PAL_TIMER_TO_MS_UNIT, eANI_BOOLEAN_FALSE);
-         if(!HAL_STATUS_SUCCESS(status))
+         status = vos_timer_start(&pMac->roam.tlStatsReqInfo.hTlStatsTimer,
+                                pMac->roam.tlStatsReqInfo.periodicity);
+         if (!HAL_STATUS_SUCCESS(status))
          {
             smsLog(pMac, LOGE, FL("csrRoamTlStatsTimerHandler:cannot start TlStatsTimer timer"));
             return;
@@ -13890,7 +14609,7 @@
    pPeStatsReqListEntry->timerRunning = FALSE;
    if( pPeStatsReqListEntry->timerStopFailed == TRUE )
    {
-      // If we entered here, meaning the timer could not be successfully
+      // If we entered here, meaning the timer could not be successfully 
       // stopped in csrRoamRemoveEntryFromPeStatsReqList(). So do it here.
 
       /* Destroy the timer */
@@ -13901,14 +14620,14 @@
       }
 
       // Free the entry
-      palFreeMemory(pMac->hHdd, pPeStatsReqListEntry);
+      vos_mem_free(pPeStatsReqListEntry);
       pPeStatsReqListEntry = NULL;
    }
    else
    {
       if(!pPeStatsReqListEntry->rspPending)
       {
-         status = csrSendMBStatsReqMsg(pMac, pPeStatsReqListEntry->statsMask & ~(1 << eCsrGlobalClassDStats),
+         status = csrSendMBStatsReqMsg(pMac, pPeStatsReqListEntry->statsMask & ~(1 << eCsrGlobalClassDStats), 
                                        pPeStatsReqListEntry->staId);
          if(!HAL_STATUS_SUCCESS(status))
          {
@@ -13921,7 +14640,7 @@
       }
 
       //send down a req
-      if(pPeStatsReqListEntry->periodicity &&
+      if(pPeStatsReqListEntry->periodicity && 
          (VOS_TIMER_STATE_STOPPED == vos_timer_getCurrentState(&pPeStatsReqListEntry->hPeStatsTimer)))
       {
          pmcQueryPowerState(pMac, &powerState, NULL, NULL);
@@ -13941,7 +14660,7 @@
          }
          //start timer
          vosStatus = vos_timer_start( &pPeStatsReqListEntry->hPeStatsTimer, pPeStatsReqListEntry->periodicity );
-         if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
+         if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) ) 
          {
             smsLog(pMac, LOGE, FL("csrRoamPeStatsTimerHandler:cannot start hPeStatsTimer timer"));
             return;
@@ -13961,16 +14680,16 @@
        // TODO Stats fix for multisession
        //start the timer
        vosStatus = vos_timer_start( &pStaEntry->timer, pStaEntry->periodicity );
-
-       if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
+   
+       if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) ) 
        {
           smsLog(pStaEntry->pMac, LOGE, FL("csrGetStatistics:cannot start StatsClient timer"));
        }
-#endif
+#endif       
    }
 #if 0
    //send up the stats report
-   csrRoamReportStatistics(pStaEntry->pMac, pStaEntry->statsMask, pStaEntry->callback,
+   csrRoamReportStatistics(pStaEntry->pMac, pStaEntry->statsMask, pStaEntry->callback, 
                            pStaEntry->staId, pStaEntry->pContext);
 #endif
 }
@@ -13981,18 +14700,18 @@
 {
    tAniGetPEStatsReq *pMsg;
    eHalStatus status = eHAL_STATUS_SUCCESS;
-   status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof(tAniGetPEStatsReq));
-   if ( !HAL_STATUS_SUCCESS(status) )
+   pMsg = vos_mem_malloc(sizeof(tAniGetPEStatsReq));
+   if ( NULL == pMsg )
    {
       smsLog(pMac, LOG1, " csrSendMBStatsReqMsg: failed to allocate mem for stats req ");
-      return status;
+      return eHAL_STATUS_FAILURE;
    }
    // need to initiate a stats request to PE
    pMsg->msgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_GET_STATISTICS_REQ);
    pMsg->msgLen = (tANI_U16)sizeof(tAniGetPEStatsReq);
    pMsg->staId = staId;
    pMsg->statsMask = statsMask;
-   status = palSendMBMessage(pMac->hHdd, pMsg );
+   status = palSendMBMessage(pMac->hHdd, pMsg );    
    if(!HAL_STATUS_SUCCESS(status))
    {
       smsLog(pMac, LOG1, " csrSendMBStatsReqMsg: failed to send down the stats req ");
@@ -14011,8 +14730,9 @@
    tANI_U8 *pStats = NULL;
    tANI_U32   length = 0;
    v_PVOID_t  pvosGCtx;
-   v_S7_t     rssi = 0;
-   tANI_U32   *pRssi = NULL;
+   v_S7_t     rssi = 0, snr = 0;
+   tANI_U32   *pRssi = NULL, *pSnr = NULL;
+   tANI_U32   linkCapacity;
    pSmeStatsRsp = (tAniGetPEStatsRsp *)pSirMsg;
    if(pSmeStatsRsp->rc)
    {
@@ -14021,8 +14741,8 @@
    }
    tempMask = pSmeStatsRsp->statsMask;
    pStats = ((tANI_U8 *)&pSmeStatsRsp->statsMask) + sizeof(pSmeStatsRsp->statsMask);
-   /* subtract all statistics from this length, and after processing the entire
-    * 'stat' part of the message, if the length is not zero, then rssi is piggy packed
+   /* subtract all statistics from this length, and after processing the entire 
+    * 'stat' part of the message, if the length is not zero, then rssi is piggy packed 
     * in this 'stats' message.
     */
    length = pSmeStatsRsp->msgLen - sizeof(tAniGetPEStatsRsp);
@@ -14035,45 +14755,29 @@
          {
          case eCsrSummaryStats:
             smsLog( pMac, LOG2, FL("csrRoamStatsRspProcessor:summary stats"));
-            status = palCopyMemory(pMac->hHdd, (tANI_U8 *)&pMac->roam.summaryStatsInfo,
-                                   pStats, sizeof(tCsrSummaryStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOGW, FL("csrRoamStatsRspProcessor:failed to copy summary stats"));
-            }
+            vos_mem_copy((tANI_U8 *)&pMac->roam.summaryStatsInfo,
+                         pStats, sizeof(tCsrSummaryStatsInfo));
             pStats += sizeof(tCsrSummaryStatsInfo);
             length -= sizeof(tCsrSummaryStatsInfo);
             break;
          case eCsrGlobalClassAStats:
             smsLog( pMac, LOG2, FL("csrRoamStatsRspProcessor:ClassA stats"));
-            status = palCopyMemory(pMac->hHdd, (tANI_U8 *)&pMac->roam.classAStatsInfo,
-                                   pStats, sizeof(tCsrGlobalClassAStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOGW, FL("csrRoamStatsRspProcessor:failed to copy ClassA stats"));
-            }
+            vos_mem_copy((tANI_U8 *)&pMac->roam.classAStatsInfo,
+                         pStats, sizeof(tCsrGlobalClassAStatsInfo));
             pStats += sizeof(tCsrGlobalClassAStatsInfo);
             length -= sizeof(tCsrGlobalClassAStatsInfo);
             break;
          case eCsrGlobalClassBStats:
             smsLog( pMac, LOG2, FL("csrRoamStatsRspProcessor:ClassB stats"));
-            status = palCopyMemory(pMac->hHdd, (tANI_U8 *)&pMac->roam.classBStatsInfo,
-                                   pStats, sizeof(tCsrGlobalClassBStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOGW, FL("csrRoamStatsRspProcessor:failed to copy ClassB stats"));
-            }
+            vos_mem_copy((tANI_U8 *)&pMac->roam.classBStatsInfo,
+                         pStats, sizeof(tCsrGlobalClassBStatsInfo));
             pStats += sizeof(tCsrGlobalClassBStatsInfo);
             length -= sizeof(tCsrGlobalClassBStatsInfo);
             break;
          case eCsrGlobalClassCStats:
             smsLog( pMac, LOG2, FL("csrRoamStatsRspProcessor:ClassC stats"));
-            status = palCopyMemory(pMac->hHdd, (tANI_U8 *)&pMac->roam.classCStatsInfo,
-                                   pStats, sizeof(tCsrGlobalClassCStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOGW, FL("csrRoamStatsRspProcessor:failed to copy ClassC stats"));
-            }
+            vos_mem_copy((tANI_U8 *)&pMac->roam.classCStatsInfo,
+                        pStats, sizeof(tCsrGlobalClassCStatsInfo));
             pStats += sizeof(tCsrGlobalClassCStatsInfo);
             length -= sizeof(tCsrGlobalClassCStatsInfo);
             break;
@@ -14081,8 +14785,8 @@
             smsLog( pMac, LOG2, FL("csrRoamStatsRspProcessor:PerSta stats"));
             if( CSR_MAX_STA > pSmeStatsRsp->staId )
             {
-               status = palCopyMemory(pMac->hHdd, (tANI_U8 *)&pMac->roam.perStaStatsInfo[pSmeStatsRsp->staId],
-                                      pStats, sizeof(tCsrPerStaStatsInfo));
+               vos_mem_copy((tANI_U8 *)&pMac->roam.perStaStatsInfo[pSmeStatsRsp->staId],
+                            pStats, sizeof(tCsrPerStaStatsInfo));
             }
             else
             {
@@ -14110,21 +14814,49 @@
    {
        pRssi = (tANI_U32*)pStats;
        rssi = (v_S7_t)*pRssi;
+       pStats += sizeof(tANI_U32);
+       length -= sizeof(tANI_U32);
    }
    else
    {
        /* If riva is not sending rssi, continue to use the hack */
        rssi = RSSI_HACK_BMPS;
    }
+
    WDA_UpdateRssiBmps(pvosGCtx, pSmeStatsRsp->staId, rssi);
-post_update:
-   //make sure to update the pe stats req list
+
+   if (length != 0)
+   {
+       linkCapacity = *(tANI_U32*)pStats;
+       pStats += sizeof(tANI_U32);
+       length -= sizeof(tANI_U32);
+   }
+   else
+   {
+       linkCapacity = 0;
+   }
+
+   WDA_UpdateLinkCapacity(pvosGCtx, pSmeStatsRsp->staId, linkCapacity);
+
+   if (length != 0)
+   {
+       pSnr = (tANI_U32*)pStats;
+       snr = (v_S7_t)*pSnr;
+   }
+   else
+   {
+       snr = SNR_HACK_BMPS;
+   }
+
+   WDA_UpdateSnrBmps(pvosGCtx, pSmeStatsRsp->staId, snr);
+post_update:   
+   //make sure to update the pe stats req list 
    pEntry = csrRoamFindInPeStatsReqList(pMac, pSmeStatsRsp->statsMask);
    if(pEntry)
       {
       pPeStaEntry = GET_BASE_ADDR( pEntry, tCsrPeStatsReqInfo, link );
       pPeStaEntry->rspPending = FALSE;
-
+   
    }
    //check the one timer cases
    pEntry = csrRoamCheckClientReqList(pMac, pSmeStatsRsp->statsMask);
@@ -14134,7 +14866,7 @@
       if(pTempStaEntry->timerExpired)
       {
          //send up the stats report
-         csrRoamReportStatistics(pMac, pTempStaEntry->statsMask, pTempStaEntry->callback,
+         csrRoamReportStatistics(pMac, pTempStaEntry->statsMask, pTempStaEntry->callback, 
                                  pTempStaEntry->staId, pTempStaEntry->pContext);
          //also remove from the client list
          csrRoamRemoveStatListEntry(pMac, pEntry);
@@ -14182,7 +14914,7 @@
    while( pEntry )
    {
       pTempStaEntry = GET_BASE_ADDR( pEntry, tCsrStatsClientReqInfo, link );
-      if((pTempStaEntry->requesterId == pStaEntry->requesterId) &&
+      if((pTempStaEntry->requesterId == pStaEntry->requesterId) && 
          (pTempStaEntry->statsMask == pStaEntry->statsMask))
       {
          smsLog(pMac, LOG3, "csrRoamChecknUpdateClientReqList: match found");
@@ -14223,7 +14955,7 @@
    return pEntry;
 }
 eHalStatus csrRoamRegisterLinkQualityIndCallback(tpAniSirGlobal pMac,
-                                                 csrRoamLinkQualityIndCallback   callback,
+                                                 csrRoamLinkQualityIndCallback   callback,  
                                                  void                           *pContext)
 {
    pMac->roam.linkQualityIndInfo.callback = callback;
@@ -14249,7 +14981,7 @@
      Link quality is currently binary based on OBIWAN recommended triggers
      Check for a change in link quality and notify client if necessary
    -------------------------------------------------------------------------*/
-   ul_mac_loss_trigger_threshold =
+   ul_mac_loss_trigger_threshold = 
       pMac->roam.configParam.vccUlMacLossThreshold;
    VOS_ASSERT( ul_mac_loss_trigger_threshold != 0 );
    smsLog(pMac, LOGW, "csrRoamVccTrigger: UL_MAC_LOSS_THRESHOLD is %d",
@@ -14269,13 +15001,13 @@
    if(newVccLinkQuality != pMac->roam.vccLinkQuality)
    {
       smsLog(pMac, LOGW, "csrRoamVccTrigger: link quality changed: trigger necessary");
-      if(NULL != pMac->roam.linkQualityIndInfo.callback)
+      if(NULL != pMac->roam.linkQualityIndInfo.callback) 
       {
          smsLog(pMac, LOGW, "csrRoamVccTrigger: link quality indication %d",
                 newVccLinkQuality );
-
+         
          /* we now invoke the callback once to notify client of initial value   */
-         pMac->roam.linkQualityIndInfo.callback( newVccLinkQuality,
+         pMac->roam.linkQualityIndInfo.callback( newVccLinkQuality, 
                                                  pMac->roam.linkQualityIndInfo.context );
          //event: EVENT_WLAN_VCC
       }
@@ -14283,8 +15015,8 @@
    pMac->roam.vccLinkQuality = newVccLinkQuality;
 
 }
-VOS_STATUS csrRoamVccTriggerRssiIndCallback(tHalHandle hHal,
-                                            v_U8_t  rssiNotification,
+VOS_STATUS csrRoamVccTriggerRssiIndCallback(tHalHandle hHal, 
+                                            v_U8_t  rssiNotification, 
                                             void * context)
 {
    tpAniSirGlobal pMac = PMAC_STRUCT( context );
@@ -14317,19 +15049,19 @@
    {
       smsLog(pMac, LOGW, "csrRoamVccTriggerRssiIndCallback: unknown rssi notification %d", rssiNotification);
       //Set to this so the code below won't do anything
-      newVccLinkQuality = pMac->roam.vccLinkQuality;
+      newVccLinkQuality = pMac->roam.vccLinkQuality;    
       VOS_ASSERT(0);
    }
 
    if(newVccLinkQuality != pMac->roam.vccLinkQuality)
    {
       smsLog(pMac, LOGW, "csrRoamVccTriggerRssiIndCallback: link quality changed: trigger necessary");
-      if(NULL != pMac->roam.linkQualityIndInfo.callback)
+      if(NULL != pMac->roam.linkQualityIndInfo.callback) 
       {
          smsLog(pMac, LOGW, "csrRoamVccTriggerRssiIndCallback: link quality indication %d",
                 newVccLinkQuality);
         /* we now invoke the callback once to notify client of initial value   */
-        pMac->roam.linkQualityIndInfo.callback( newVccLinkQuality,
+        pMac->roam.linkQualityIndInfo.callback( newVccLinkQuality, 
                                                 pMac->roam.linkQualityIndInfo.context );
          //event: EVENT_WLAN_VCC
       }
@@ -14342,20 +15074,19 @@
                                                      tCsrStatsClientReqInfo *pStaEntry)
 {
    tCsrStatsClientReqInfo *pNewStaEntry = NULL;
-   eHalStatus  status;
-   //if same entity requested for same set of stats with different periodicity &
+   //if same entity requested for same set of stats with different periodicity & 
    // callback update it
    if(NULL == csrRoamChecknUpdateClientReqList(pMac, pStaEntry, TRUE))
    {
-
-      status = palAllocateMemory(pMac->hHdd, (void **)&pNewStaEntry, sizeof(tCsrStatsClientReqInfo));
-      if (!HAL_STATUS_SUCCESS(status))
+   
+      pNewStaEntry = vos_mem_malloc(sizeof(tCsrStatsClientReqInfo));
+      if (NULL == pNewStaEntry)
       {
          smsLog(pMac, LOGW, "csrRoamInsertEntryIntoList: couldn't allocate memory for the "
                 "entry");
          return NULL;
       }
-
+   
       pNewStaEntry->callback = pStaEntry->callback;
       pNewStaEntry->pContext = pStaEntry->pContext;
       pNewStaEntry->periodicity = pStaEntry->periodicity;
@@ -14365,7 +15096,7 @@
       pNewStaEntry->pMac = pStaEntry->pMac;
       pNewStaEntry->staId = pStaEntry->staId;
       pNewStaEntry->timerExpired = pStaEntry->timerExpired;
-
+      
       csrLLInsertTail( pStaList, &pNewStaEntry->link, LL_ACCESS_LOCK  );
    }
    return pNewStaEntry;
@@ -14376,15 +15107,14 @@
                                                            tCsrPeStatsReqInfo *pStaEntry)
 {
    tCsrPeStatsReqInfo *pNewStaEntry = NULL;
-   eHalStatus  status;
-   status = palAllocateMemory(pMac->hHdd, (void **)&pNewStaEntry, sizeof(tCsrPeStatsReqInfo));
-   if (!HAL_STATUS_SUCCESS(status))
+   pNewStaEntry = vos_mem_malloc(sizeof(tCsrPeStatsReqInfo));
+   if (NULL == pNewStaEntry)
    {
       smsLog(pMac, LOGW, "csrRoamInsertEntryIntoPeStatsReqList: couldn't allocate memory for the "
                   "entry");
       return NULL;
    }
-
+   
    pNewStaEntry->hPeStatsTimer = pStaEntry->hPeStatsTimer;
    pNewStaEntry->numClient = pStaEntry->numClient;
    pNewStaEntry->periodicity = pStaEntry->periodicity;
@@ -14393,25 +15123,25 @@
    pNewStaEntry->staId = pStaEntry->staId;
    pNewStaEntry->timerRunning = pStaEntry->timerRunning;
    pNewStaEntry->rspPending = pStaEntry->rspPending;
-
+   
    csrLLInsertTail( pStaList, &pNewStaEntry->link, LL_ACCESS_LOCK  );
    return pNewStaEntry;
 }
-eHalStatus csrGetRssi(tpAniSirGlobal pMac,
-                            tCsrRssiCallback callback,
+eHalStatus csrGetRssi(tpAniSirGlobal pMac, 
+                            tCsrRssiCallback callback, 
                             tANI_U8 staId, tCsrBssid bssId, void *pContext, void* pVosContext)
-{
+{  
    eHalStatus status = eHAL_STATUS_SUCCESS;
    vos_msg_t  msg;
    tANI_U32 sessionId;
 
    tAniGetRssiReq *pMsg;
    smsLog(pMac, LOG2, FL("called"));
-   status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof(tAniGetRssiReq));
-   if ( !HAL_STATUS_SUCCESS(status) )
+   pMsg = vos_mem_malloc(sizeof(tAniGetRssiReq));
+   if ( NULL == pMsg )
    {
       smsLog(pMac, LOGE, " csrGetRssi: failed to allocate mem for req ");
-      return status;
+      return eHAL_STATUS_FAILURE;
    }
    csrRoamGetSessionIdFromBSSID(pMac, (tCsrBssid *)bssId, &sessionId);
 
@@ -14428,13 +15158,56 @@
    if(VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MQ_ID_SME, &msg))
    {
        smsLog(pMac, LOGE, " csrGetRssi failed to post msg to self ");
-       palFreeMemory(pMac->hHdd, (void *)pMsg);
+       vos_mem_free((void *)pMsg);
        status = eHAL_STATUS_FAILURE;
    }
    smsLog(pMac, LOG2, FL("returned"));
    return status;
 }
 
+eHalStatus csrGetSnr(tpAniSirGlobal pMac,
+                     tCsrSnrCallback callback,
+                     tANI_U8 staId, tCsrBssid bssId,
+                     void *pContext)
+{
+   eHalStatus status = eHAL_STATUS_SUCCESS;
+   vos_msg_t  msg;
+   tANI_U32 sessionId;
+
+   tAniGetSnrReq *pMsg;
+
+   smsLog(pMac, LOG2, FL("called"));
+
+   pMsg =(tAniGetSnrReq *)vos_mem_malloc(sizeof(tAniGetSnrReq));
+   if (NULL == pMsg )
+   {
+      smsLog(pMac, LOGE, "%s: failed to allocate mem for req",__func__);
+      return status;
+   }
+
+   csrRoamGetSessionIdFromBSSID(pMac, (tCsrBssid *)bssId, &sessionId);
+
+   pMsg->msgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_GET_SNR_REQ);
+   pMsg->msgLen = (tANI_U16)sizeof(tAniGetSnrReq);
+   pMsg->sessionId = sessionId;
+   pMsg->staId = staId;
+   pMsg->snrCallback = callback;
+   pMsg->pDevContext = pContext;
+   msg.type = eWNI_SME_GET_SNR_REQ;
+   msg.bodyptr = pMsg;
+   msg.reserved = 0;
+
+   if (VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MQ_ID_SME, &msg))
+   {
+       smsLog(pMac, LOGE, "%s failed to post msg to self", __func__);
+       vos_mem_free((v_VOID_t *)pMsg);
+       status = eHAL_STATUS_FAILURE;
+   }
+
+   smsLog(pMac, LOG2, FL("returned"));
+   return status;
+}
+
 #if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
 eHalStatus csrGetRoamRssi(tpAniSirGlobal pMac,
                             tCsrRssiCallback callback,
@@ -14443,11 +15216,11 @@
    eHalStatus status = eHAL_STATUS_SUCCESS;
    tAniGetRssiReq *pMsg;
 
-   status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof(tAniGetRssiReq));
-   if ( !HAL_STATUS_SUCCESS(status) )
+   pMsg = vos_mem_malloc(sizeof(tAniGetRssiReq));
+   if ( NULL == pMsg )
    {
       smsLog(pMac, LOGE, " csrGetRoamRssi: failed to allocate mem for req");
-      return status;
+      return eHAL_STATUS_FAILURE;
    }
    // need to initiate a stats request to PE
    pMsg->msgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_GET_ROAM_RSSI_REQ);
@@ -14467,15 +15240,74 @@
 }
 #endif
 
-eHalStatus csrGetStatistics(tpAniSirGlobal pMac, eCsrStatsRequesterType requesterId,
-                            tANI_U32 statsMask,
-                            tCsrStatsCallback callback,
-                            tANI_U32 periodicity, tANI_BOOLEAN cache,
-                            tANI_U8 staId, void *pContext)
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+eHalStatus csrGetTsmStats(tpAniSirGlobal pMac,
+                          tCsrTsmStatsCallback callback,
+                          tANI_U8 staId,
+                          tCsrBssid bssId,
+                          void *pContext,
+                          void* pVosContext,
+                          tANI_U8 tid)
 {
+   eHalStatus          status = eHAL_STATUS_SUCCESS;
+   tAniGetTsmStatsReq *pMsg = NULL;
+   pMsg = vos_mem_malloc(sizeof(tAniGetTsmStatsReq));
+   if (!pMsg)
+   {
+      smsLog(pMac, LOGE, "csrGetTsmStats: failed to allocate mem for req");
+      return status;
+   }
+   // need to initiate a stats request to PE
+   pMsg->msgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_GET_TSM_STATS_REQ);
+   pMsg->msgLen = (tANI_U16)sizeof(tAniGetTsmStatsReq);
+   pMsg->staId = staId;
+   pMsg->tid = tid;
+   vos_mem_copy(pMsg->bssId, bssId, sizeof(tSirMacAddr));
+   pMsg->tsmStatsCallback = callback;
+   pMsg->pDevContext = pContext;
+   pMsg->pVosContext = pVosContext;
+   status = palSendMBMessage(pMac->hHdd, pMsg );
+   if(!HAL_STATUS_SUCCESS(status))
+   {
+      smsLog(pMac, LOG1, " csrGetTsmStats: failed to send down the rssi req");
+      //pMsg is freed by palSendMBMessage
+      status = eHAL_STATUS_FAILURE;
+   }
+   return status;
+}
+#endif  /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
+
+/* ---------------------------------------------------------------------------
+    \fn csrGetTLSTAState
+    \helper function to get teh TL STA State whenever the function is called.
+
+    \param staId - The staID to be passed to the TL
+            to get the relevant TL STA State
+    \return the state as tANI_U16
+  ---------------------------------------------------------------------------*/
+tANI_U16 csrGetTLSTAState(tpAniSirGlobal pMac, tANI_U8 staId)
+{
+   WLANTL_STAStateType tlSTAState;
+   tlSTAState = WLANTL_STA_INIT;
+
+   //request TL for STA State
+   if ( !VOS_IS_STATUS_SUCCESS(WLANTL_GetSTAState(pMac->roam.gVosContext, staId, &tlSTAState)) )
+   {
+      smsLog(pMac, LOGE, FL("csrGetTLSTAState:couldn't get the STA state from TL"));
+   }
+
+   return tlSTAState;
+}
+
+eHalStatus csrGetStatistics(tpAniSirGlobal pMac, eCsrStatsRequesterType requesterId, 
+                            tANI_U32 statsMask, 
+                            tCsrStatsCallback callback, 
+                            tANI_U32 periodicity, tANI_BOOLEAN cache, 
+                            tANI_U8 staId, void *pContext)
+{  
    tCsrStatsClientReqInfo staEntry;
    tCsrStatsClientReqInfo *pStaEntry = NULL;
-   tCsrPeStatsReqInfo *pPeStaEntry = NULL;
+   tCsrPeStatsReqInfo *pPeStaEntry = NULL; 
    tListElem *pEntry = NULL;
    tANI_BOOLEAN found = FALSE;
    eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -14522,14 +15354,14 @@
             }
          }
 
-         //check if we need to stop the tl stats timer too
+         //check if we need to stop the tl stats timer too 
          pMac->roam.tlStatsReqInfo.numClient--;
          if(!pMac->roam.tlStatsReqInfo.numClient)
          {
             if(pMac->roam.tlStatsReqInfo.timerRunning)
             {
-               status = palTimerStop(pMac->hHdd, pMac->roam.tlStatsReqInfo.hTlStatsTimer);
-               if(!HAL_STATUS_SUCCESS(status))
+               status = vos_timer_stop(&pMac->roam.tlStatsReqInfo.hTlStatsTimer);
+               if (!HAL_STATUS_SUCCESS(status))
                {
                   smsLog(pMac, LOGE, FL("csrGetStatistics:cannot stop TlStatsTimer timer"));
                   return eHAL_STATUS_FAILURE;
@@ -14539,7 +15371,7 @@
             pMac->roam.tlStatsReqInfo.timerRunning = FALSE;
          }
          vos_timer_stop( &pStaEntry->timer );
-         // Destroy the vos timer...
+         // Destroy the vos timer...      
          vosStatus = vos_timer_destroy( &pStaEntry->timer );
          if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
          {
@@ -14550,7 +15382,7 @@
          return eHAL_STATUS_SUCCESS;
       }
    }
-
+   
    if(cache && !periodicity)
    {
       //return the cached stats
@@ -14566,18 +15398,18 @@
       staEntry.staId = staId;
       staEntry.pMac = pMac;
       staEntry.timerExpired = FALSE;
-
-
+   
+   
       //if periodic report requested with non cached result from PE/TL
       if(periodicity)
       {
-
+      
          //if looking for stats from PE
          if(statsMask & ~(1 << eCsrGlobalClassDStats))
          {
-
+         
             //check if same request made already & waiting for rsp
-            pPeStaEntry = csrRoamCheckPeStatsReqList(pMac, statsMask & ~(1 << eCsrGlobalClassDStats),
+            pPeStaEntry = csrRoamCheckPeStatsReqList(pMac, statsMask & ~(1 << eCsrGlobalClassDStats), 
                                                periodicity, &found, staId);
             if(!pPeStaEntry)
             {
@@ -14588,7 +15420,7 @@
             {
                staEntry.pPeStaEntry = pPeStaEntry;
             }
-
+               
          }
          //request stats from TL rightaway if requested by client, update tlStatsReqInfo if needed
          if(statsMask & (1 << eCsrGlobalClassDStats))
@@ -14599,11 +15431,11 @@
             }
             else
             {
-
+            
                //update periodicity
                if(pMac->roam.tlStatsReqInfo.periodicity)
                {
-                  pMac->roam.tlStatsReqInfo.periodicity =
+                  pMac->roam.tlStatsReqInfo.periodicity = 
                      CSR_ROAM_MIN(periodicity, pMac->roam.tlStatsReqInfo.periodicity);
                }
                else
@@ -14614,11 +15446,11 @@
                {
                   pMac->roam.tlStatsReqInfo.periodicity = CSR_MIN_TL_STAT_QUERY_PERIOD;
                }
-
+               
                if(!pMac->roam.tlStatsReqInfo.timerRunning)
                {
                   pTlStats = (WLANTL_TRANSFER_STA_TYPE *)vos_mem_malloc(sizeof(WLANTL_TRANSFER_STA_TYPE));
-                  if(NULL != pTlStats)
+                  if (NULL != pTlStats)
                   {
                      //req TL for class D stats
                      if(WLANTL_GetStatistics(pMac->roam.gVosContext, pTlStats, staId))
@@ -14641,9 +15473,9 @@
                   if(pMac->roam.tlStatsReqInfo.periodicity)
                   {
                      //start timer
-                     status = palTimerStart(pMac->hHdd, pMac->roam.tlStatsReqInfo.hTlStatsTimer,
-                                            pMac->roam.tlStatsReqInfo.periodicity * PAL_TIMER_TO_MS_UNIT, eANI_BOOLEAN_FALSE);
-                     if(!HAL_STATUS_SUCCESS(status))
+                     status = vos_timer_start(&pMac->roam.tlStatsReqInfo.hTlStatsTimer,
+                                            pMac->roam.tlStatsReqInfo.periodicity);
+                     if (!HAL_STATUS_SUCCESS(status))
                      {
                         smsLog(pMac, LOGE, FL("csrGetStatistics:cannot start TlStatsTimer timer"));
                         return eHAL_STATUS_FAILURE;
@@ -14654,7 +15486,7 @@
             }
             pMac->roam.tlStatsReqInfo.numClient++;
          }
-
+   
          insertInClientList = TRUE;
       }
       //if one time report requested with non cached result from PE/TL
@@ -14676,7 +15508,7 @@
          if(statsMask & (1 << eCsrGlobalClassDStats))
          {
             pTlStats = (WLANTL_TRANSFER_STA_TYPE *)vos_mem_malloc(sizeof(WLANTL_TRANSFER_STA_TYPE));
-            if(NULL != pTlStats)
+            if (NULL != pTlStats)
             {
                //req TL for class D stats
                if(!VOS_IS_STATUS_SUCCESS(WLANTL_GetStatistics(pMac->roam.gVosContext, pTlStats, staId)))
@@ -14697,7 +15529,7 @@
             }
 
          }
-         //if looking for stats from TL only
+         //if looking for stats from TL only 
          if(!insertInClientList)
          {
             //return the stats
@@ -14706,7 +15538,7 @@
       }
       if(insertInClientList)
       {
-         pStaEntry = csrRoamInsertEntryIntoList(pMac, &pMac->roam.statsClientReqList, &staEntry);
+         pStaEntry = csrRoamInsertEntryIntoList(pMac, &pMac->roam.statsClientReqList, &staEntry); 
          if(!pStaEntry)
          {
             //msg
@@ -14717,7 +15549,7 @@
          //Init & start timer if needed
          if(periodicity)
          {
-            vosStatus = vos_timer_init( &pStaEntry->timer, VOS_TIMER_TYPE_SW,
+            vosStatus = vos_timer_init( &pStaEntry->timer, VOS_TIMER_TYPE_SW, 
                                         csrRoamStatsClientTimerHandler, pStaEntry );
             if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
             {
@@ -14725,7 +15557,7 @@
                return eHAL_STATUS_FAILURE;
             }
             vosStatus = vos_timer_start( &pStaEntry->timer, periodicity );
-            if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
+            if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) ) 
             {
                smsLog(pMac, LOGE, FL("csrGetStatistics:cannot start StatsClient timer"));
                return eHAL_STATUS_FAILURE;
@@ -14758,18 +15590,14 @@
         pMacHdr->fc.subType = subType;
 
         /* Prepare Address 1 */
-        palCopyMemory( pMac->hHdd,
-                        (tANI_U8 *) pMacHdr->da,
-                        (tANI_U8 *) peerAddr,
-                        sizeof( tSirMacAddr ));
+        vos_mem_copy((tANI_U8 *) pMacHdr->da, (tANI_U8 *) peerAddr,
+                      sizeof( tSirMacAddr ));
 
         sirCopyMacAddr(pMacHdr->sa,selfMacAddr);
 
         /* Prepare Address 3 */
-        palCopyMemory( pMac->hHdd,
-                        (tANI_U8 *) pMacHdr->bssId,
-                        (tANI_U8 *) peerAddr,
-                        sizeof( tSirMacAddr ));
+        vos_mem_copy((tANI_U8 *) pMacHdr->bssId, (tANI_U8 *) peerAddr,
+                     sizeof( tSirMacAddr ));
         return statusCode;
 } /*** csrRoamScanOffloadPopulateMacHeader() ***/
 
@@ -14790,7 +15618,7 @@
         /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
 
 
-        palZeroMemory( pMac->hHdd, ( tANI_U8* )&pr, sizeof( pr ) );
+        vos_mem_set(( tANI_U8* )&pr, sizeof( pr ), 0);
 
         PopulateDot11fSuppRates( pMac, nChannelNum, &pr.SuppRates,NULL);
 
@@ -14833,11 +15661,11 @@
         nBytes = nPayload + sizeof( tSirMacMgmtHdr );
 
         /* Prepare outgoing frame*/
-        palZeroMemory( pMac->hHdd, pFrame, nBytes );
+        vos_mem_set(pFrame, nBytes , 0);
 
 
         nSirStatus = csrRoamScanOffloadPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
-                        SIR_MAC_MGMT_PROBE_REQ, bssId ,selfMacAddr);
+                        SIR_MAC_MGMT_PROBE_REQ, bssId,selfMacAddr);
 
         if ( eSIR_SUCCESS != nSirStatus )
         {
@@ -14860,7 +15688,8 @@
         else if ( DOT11F_WARNED( nStatus ) )
         {
                 VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                                "There were warnings while packing a Probe Request (0x%08x).\n" );
+                          "There were warnings while packing a Probe Request (0x%08x).\n",
+                          nStatus );
         }
 
         *pusLen = nPayload + sizeof(tSirMacMgmtHdr);
@@ -14873,17 +15702,26 @@
    tSirRoamOffloadScanReq *pRequestBuf;
    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
    tCsrRoamSession *pSession;
-   tANI_U8 i,num_channels = 0, ucDot11Mode;
+   tANI_U8 i,j,num_channels = 0, ucDot11Mode;
    tANI_U8 *ChannelList = NULL;
    tANI_U32 sessionId;
    eHalStatus status = eHAL_STATUS_SUCCESS;
    tpCsrChannelInfo    currChannelListInfo;
+   tANI_U32 host_channels = 0;
+   tANI_U8 ChannelCacheStr[128] = {0};
    currChannelListInfo = &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo;
 
-   if (0 == pMac->roam.configParam.isRoamOffloadScanEnabled)
+   if (0 == csrRoamIsRoamOffloadScanEnabled(pMac))
    {
+      smsLog( pMac, LOGE,"isRoamOffloadScanEnabled not set");
       return eHAL_STATUS_FAILURE;
    }
+
+   if ((VOS_TRUE == bRoamScanOffloadStarted) && (ROAM_SCAN_OFFLOAD_START == command))
+   {
+        smsLog( pMac, LOGE,"Roam Scan Offload is already started");
+        return eHAL_STATUS_FAILURE;
+   }
    status = csrRoamGetSessionIdFromBSSID(pMac,
                             (tCsrBssid *)pNeighborRoamInfo->currAPbssid,
                                         &sessionId);
@@ -14914,14 +15752,15 @@
            return eHAL_STATUS_FAILED_ALLOC;
    }
 
-    vos_mem_zero(pRequestBuf,sizeof(tSirRoamOffloadScanReq));
+    vos_mem_zero(pRequestBuf, sizeof(tSirRoamOffloadScanReq));
     /* If command is STOP, then pass down ScanOffloadEnabled as Zero.This will handle the case of
      * host driver reloads, but Riva still up and running*/
     if(command == ROAM_SCAN_OFFLOAD_STOP)
        pRequestBuf->RoamScanOffloadEnabled = 0;
     else
        pRequestBuf->RoamScanOffloadEnabled = pMac->roam.configParam.isRoamOffloadScanEnabled;
-    vos_mem_copy(pRequestBuf->ConnectedNetwork.currAPbssid, pNeighborRoamInfo->currAPbssid,
+    vos_mem_copy(pRequestBuf->ConnectedNetwork.currAPbssid,
+                 pNeighborRoamInfo->currAPbssid,
                  sizeof(tCsrBssid));
     pRequestBuf->ConnectedNetwork.ssId.length =
             pMac->roam.roamSession[sessionId].connectedProfile.SSID.length;
@@ -14950,6 +15789,9 @@
             pNeighborRoamInfo->cfgParams.maxChannelScanTime;
     pRequestBuf->EmptyRefreshScanPeriod =
             pNeighborRoamInfo->cfgParams.emptyScanRefreshPeriod;
+    /* MAWC feature */
+    pRequestBuf->MAWCEnabled =
+            pMac->roam.configParam.MAWCEnabled;
 #ifdef FEATURE_WLAN_CCX
     pRequestBuf->IsCCXEnabled = pMac->roam.configParam.isCcxIniFeatureEnabled;
 #endif
@@ -15009,53 +15851,68 @@
       /* If CCX is enabled, and a neighbor Report is received,then
        * Ignore the INI Channels or the Occupied Channel List. Consider
        * the channels in the neighbor list sent by the CCX AP.*/
-      if (currChannelListInfo->numOfChannels != 0)
-      {
-         ChannelList = currChannelListInfo->ChannelList;
-         for (i=0;i<currChannelListInfo->numOfChannels;i++)
-         {
-          if(!CSR_IS_CHANNEL_DFS(*ChannelList) && *ChannelList)
+       if (currChannelListInfo->numOfChannels != 0)
+       {
+          ChannelList = currChannelListInfo->ChannelList;
+          for (i=0;i<currChannelListInfo->numOfChannels;i++)
           {
-           pRequestBuf->ConnectedNetwork.ChannelCache[num_channels++] = *ChannelList;
+           if(!CSR_IS_CHANNEL_DFS(*ChannelList) && *ChannelList)
+           {
+            pRequestBuf->ConnectedNetwork.ChannelCache[num_channels++] = *ChannelList;
+           }
+           ChannelList++;
           }
-          ChannelList++;
-         }
-         pRequestBuf->ConnectedNetwork.ChannelCount = num_channels;
-         pRequestBuf->ChannelCacheType = CHANNEL_LIST_STATIC;
-      }
-    }
+          pRequestBuf->ConnectedNetwork.ChannelCount = num_channels;
+          pRequestBuf->ChannelCacheType = CHANNEL_LIST_DYNAMIC_UPDATE;
+       }
+     }
 #endif
+    for (i = 0, j = 0; i < pRequestBuf->ConnectedNetwork.ChannelCount; i++)
+    {
+            j += snprintf(ChannelCacheStr + j, sizeof(ChannelCacheStr) - j," %d",
+                          pRequestBuf->ConnectedNetwork.ChannelCache[i]);
+    }
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+              "ChnlCacheType:%d, No of Chnls:%d,Channels: %s",
+              pRequestBuf->ChannelCacheType,
+              pRequestBuf->ConnectedNetwork.ChannelCount,
+              ChannelCacheStr);
     num_channels = 0;
     ChannelList = NULL;
 
     /* Maintain the Valid Channels List*/
-    if (0 == strncmp(pMac->scan.countryCodeCurrent, "KR", 2))
+    host_channels = sizeof(pMac->roam.validChannelList);
+    if (HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac, pMac->roam.validChannelList, &host_channels)))
     {
-       ChannelList = pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.ChannelList;
-       for(i=0; i<pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.numOfChannels; i++)
-          {
-            if(!CSR_IS_CHANNEL_DFS(*ChannelList) && *ChannelList)
-              {
-                 pRequestBuf->ValidChannelList[num_channels++] = *ChannelList;
-              }
-                 ChannelList++;
-          }
-          pRequestBuf->ValidChannelCount = num_channels;
-    } else {
-       ChannelList = pMac->roam.validChannelList;
-       for(i=0; i<pMac->roam.numValidChannels; i++)
-          {
-            if(!CSR_IS_CHANNEL_DFS(*ChannelList) && *ChannelList)
-              {
-                 pRequestBuf->ValidChannelList[num_channels++] = *ChannelList;
-              }
-                 ChannelList++;
-          }
-          pRequestBuf->ValidChannelCount = num_channels;
+        ChannelList = pMac->roam.validChannelList;
+        pMac->roam.numValidChannels = host_channels;
     }
-    pRequestBuf->MDID.mdiePresent = pMac->roam.roamSession[sessionId].connectedProfile.MDID.mdiePresent;
-    pRequestBuf->MDID.mobilityDomain = pMac->roam.roamSession[sessionId].connectedProfile.MDID.mobilityDomain;
+    else
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+              "%s:Failed to get the valid channel list", __func__);
+        vos_mem_free(pRequestBuf);
+        return eHAL_STATUS_FAILURE;
+    }
+    for(i=0; i<pMac->roam.numValidChannels; i++)
+    {
+        if(!CSR_IS_CHANNEL_DFS(*ChannelList) && *ChannelList)
+        {
+            pRequestBuf->ValidChannelList[num_channels++] = *ChannelList;
+        }
+        ChannelList++;
+    }
+    pRequestBuf->ValidChannelCount = num_channels;
+
+    pRequestBuf->MDID.mdiePresent =
+            pMac->roam.roamSession[sessionId].connectedProfile.MDID.mdiePresent;
+    pRequestBuf->MDID.mobilityDomain =
+            pMac->roam.roamSession[sessionId].connectedProfile.MDID.mobilityDomain;
     pRequestBuf->sessionId = sessionId;
+    pRequestBuf->nProbes = pMac->roam.configParam.nProbes;
+
+    pRequestBuf->HomeAwayTime = pMac->roam.configParam.nRoamScanHomeAwayTime;
+
    /*Prepare a probe request for 2.4GHz band and one for 5GHz band*/
     ucDot11Mode = (tANI_U8) csrTranslateToWNICfgDot11Mode(pMac,
                                                            csrFindBestPhyMode( pMac, pMac->roam.configParam.phyMode ));
@@ -15068,22 +15925,45 @@
                                              pRequestBuf->p5GProbeTemplate,
                                              &pRequestBuf->us5GProbeTemplateLen,
                                              pSession);
-   msg.type     = WDA_START_ROAM_CANDIDATE_LOOKUP_REQ;
+   msg.type     = WDA_ROAM_SCAN_OFFLOAD_REQ;
    msg.reserved = 0;
    msg.bodyptr  = pRequestBuf;
    if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
    {
-           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s: Not able to post WDA_START_ROAM_CANDIDATE_LOOKUP_REQ message to WDA", __func__);
-           vos_mem_free(pRequestBuf);
-           return eHAL_STATUS_FAILURE;
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s: Not able to post WDA_ROAM_SCAN_OFFLOAD_REQ message to WDA", __func__);
+       vos_mem_free(pRequestBuf);
+       return eHAL_STATUS_FAILURE;
    }
+   else
+   {
+        if (ROAM_SCAN_OFFLOAD_START == command)
+            bRoamScanOffloadStarted = VOS_TRUE;
+        else if (ROAM_SCAN_OFFLOAD_STOP == command)
+            bRoamScanOffloadStarted = VOS_FALSE;
+    }
 
    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG, "Roam Scan Offload Command %d, Reason %d", command, reason);
    return status;
 }
+
+eHalStatus csrRoamOffloadScanRspHdlr(tpAniSirGlobal pMac, tANI_U8 reason)
+{
+    switch(reason)
+    {
+        case 0:
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG, "Rsp for Roam Scan Offload with failure status");
+            break;
+        case REASON_OS_REQUESTED_ROAMING_NOW:
+            csrNeighborRoamProceedWithHandoffReq(pMac);
+            break;
+        default:
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "Rsp for Roam Scan Offload with reason %d", reason);
+    }
+    return eHAL_STATUS_SUCCESS;
+}
 #endif
 
-tCsrPeStatsReqInfo * csrRoamCheckPeStatsReqList(tpAniSirGlobal pMac, tANI_U32  statsMask,
+tCsrPeStatsReqInfo * csrRoamCheckPeStatsReqList(tpAniSirGlobal pMac, tANI_U32  statsMask, 
                                                 tANI_U32 periodicity, tANI_BOOLEAN *pFound, tANI_U8 staId)
 {
    tANI_BOOLEAN found = FALSE;
@@ -15094,14 +15974,14 @@
    VOS_STATUS vosStatus;
    tPmcPowerState powerState;
    *pFound = FALSE;
-
+      
    pStaEntry = csrRoamFindInPeStatsReqList(pMac, statsMask);
    if(pStaEntry)
    {
       pTempStaEntry = GET_BASE_ADDR( pStaEntry, tCsrPeStatsReqInfo, link );
       if(pTempStaEntry->periodicity)
       {
-         pTempStaEntry->periodicity =
+         pTempStaEntry->periodicity = 
             CSR_ROAM_MIN(periodicity, pTempStaEntry->periodicity);
       }
       else
@@ -15113,7 +15993,7 @@
    }
    else
    {
-      palZeroMemory(pMac->hHdd, &staEntry, sizeof(tCsrPeStatsReqInfo));
+      vos_mem_set(&staEntry, sizeof(tCsrPeStatsReqInfo), 0);
       staEntry.numClient = 1;
       staEntry.periodicity = periodicity;
       staEntry.pMac = pMac;
@@ -15121,7 +16001,7 @@
       staEntry.staId = staId;
       staEntry.statsMask = statsMask;
       staEntry.timerRunning = FALSE;
-      pTempStaEntry = csrRoamInsertEntryIntoPeStatsReqList(pMac, &pMac->roam.peStatsReqList, &staEntry);
+      pTempStaEntry = csrRoamInsertEntryIntoPeStatsReqList(pMac, &pMac->roam.peStatsReqList, &staEntry); 
       if(!pTempStaEntry)
       {
          //msg
@@ -15147,7 +16027,7 @@
    if(!pTempStaEntry->timerRunning)
    {
       //send down a req in case of one time req, for periodic ones wait for timer to expire
-      if(!pTempStaEntry->rspPending &&
+      if(!pTempStaEntry->rspPending && 
          !pTempStaEntry->periodicity)
       {
          status = csrSendMBStatsReqMsg(pMac, statsMask & ~(1 << eCsrGlobalClassDStats), staId);
@@ -15164,8 +16044,8 @@
       {
          if(!found)
          {
-
-            vosStatus = vos_timer_init( &pTempStaEntry->hPeStatsTimer, VOS_TIMER_TYPE_SW,
+            
+            vosStatus = vos_timer_init( &pTempStaEntry->hPeStatsTimer, VOS_TIMER_TYPE_SW, 
                                         csrRoamPeStatsTimerHandler, pTempStaEntry );
             if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
             {
@@ -15176,7 +16056,7 @@
          //start timer
          smsLog(pMac, LOG1, "csrRoamCheckPeStatsReqList:peStatsTimer period %d", pTempStaEntry->periodicity);
          vosStatus = vos_timer_start( &pTempStaEntry->hPeStatsTimer, pTempStaEntry->periodicity );
-         if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
+         if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) ) 
          {
             smsLog(pMac, LOGE, FL("csrRoamCheckPeStatsReqList:cannot start hPeStatsTimer timer"));
             return NULL;
@@ -15197,7 +16077,7 @@
     {
         if(csrLLRemoveEntry(&pMac->roam.statsClientReqList, pEntry, LL_ACCESS_LOCK))
         {
-            palFreeMemory(pMac->hHdd, GET_BASE_ADDR( pEntry, tCsrStatsClientReqInfo, link ));
+            vos_mem_free(GET_BASE_ADDR( pEntry, tCsrStatsClientReqInfo, link ));
             }
         }
     }
@@ -15223,11 +16103,11 @@
          if(pTempStaEntry->timerRunning)
          {
             vosStatus = vos_timer_stop( &pTempStaEntry->hPeStatsTimer );
-            /* If we are not able to stop the timer here, just remove
-             * the entry from the linked list. Destroy the timer object
+            /* If we are not able to stop the timer here, just remove 
+             * the entry from the linked list. Destroy the timer object 
              * and free the memory in the timer CB
              */
-            if( vosStatus == VOS_STATUS_SUCCESS )
+            if ( vosStatus == VOS_STATUS_SUCCESS )
             {
                /* the timer is successfully stopped */
                pTempStaEntry->timerRunning = FALSE;
@@ -15241,18 +16121,18 @@
             }
             else
             {
-               // the timer could not be stopped. Hence destroy and free the
+               // the timer could not be stopped. Hence destroy and free the 
                // memory for the PE stat entry in the timer CB.
                pTempStaEntry->timerStopFailed = TRUE;
             }
-         }
+         } 
 
          if(csrLLRemoveEntry(&pMac->roam.peStatsReqList, pEntry, LL_ACCESS_LOCK))
          {
             // Only free the memory if we could stop the timer successfully
             if(!pTempStaEntry->timerStopFailed)
             {
-               palFreeMemory(pMac->hHdd, pTempStaEntry);
+                vos_mem_free(pTempStaEntry);
                pTempStaEntry = NULL;
             }
             break;
@@ -15288,14 +16168,13 @@
 
 }
 
-void csrRoamReportStatistics(tpAniSirGlobal pMac, tANI_U32 statsMask,
+void csrRoamReportStatistics(tpAniSirGlobal pMac, tANI_U32 statsMask, 
                              tCsrStatsCallback callback, tANI_U8 staId, void *pContext)
 {
    tANI_U8 stats[500];
    tANI_U8 *pStats = NULL;
    tANI_U32 tempMask = 0;
    tANI_U8 counter = 0;
-   eHalStatus status = eHAL_STATUS_FAILURE;
    if(!callback)
    {
       smsLog(pMac, LOGE, FL("csrRoamReportStatistics:cannot report callback NULL"));
@@ -15317,62 +16196,38 @@
          {
          case eCsrSummaryStats:
             smsLog( pMac, LOG2, FL("csrRoamReportStatistics:summary stats"));
-            status = palCopyMemory(pMac->hHdd, pStats, (tANI_U8 *)&pMac->roam.summaryStatsInfo,
-                                   sizeof(tCsrSummaryStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOG1, FL("csrRoamReportStatistics:failed to copy summary stats"));
-            }
+            vos_mem_copy( pStats, (tANI_U8 *)&pMac->roam.summaryStatsInfo,
+                         sizeof(tCsrSummaryStatsInfo));
             pStats += sizeof(tCsrSummaryStatsInfo);
             break;
          case eCsrGlobalClassAStats:
             smsLog( pMac, LOG2, FL("csrRoamReportStatistics:ClassA stats"));
-            status = palCopyMemory(pMac->hHdd, pStats, (tANI_U8 *)&pMac->roam.classAStatsInfo,
-                                   sizeof(tCsrGlobalClassAStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOG1, FL("csrRoamReportStatistics:failed to copy ClassA stats"));
-            }
+            vos_mem_copy( pStats, (tANI_U8 *)&pMac->roam.classAStatsInfo,
+                         sizeof(tCsrGlobalClassAStatsInfo));
             pStats += sizeof(tCsrGlobalClassAStatsInfo);
             break;
          case eCsrGlobalClassBStats:
             smsLog( pMac, LOG2, FL("csrRoamReportStatistics:ClassB stats"));
-            status = palCopyMemory(pMac->hHdd, pStats, (tANI_U8 *)&pMac->roam.classBStatsInfo,
-                                   sizeof(tCsrGlobalClassBStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOG1, FL("csrRoamReportStatistics:failed to copy ClassB stats"));
-            }
+            vos_mem_copy( pStats, (tANI_U8 *)&pMac->roam.classBStatsInfo,
+                         sizeof(tCsrGlobalClassBStatsInfo));
             pStats += sizeof(tCsrGlobalClassBStatsInfo);
             break;
          case eCsrGlobalClassCStats:
             smsLog( pMac, LOG2, FL("csrRoamReportStatistics:ClassC stats"));
-            status = palCopyMemory(pMac->hHdd, pStats, (tANI_U8 *)&pMac->roam.classCStatsInfo,
-                                   sizeof(tCsrGlobalClassCStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOG1, FL("csrRoamReportStatistics:failed to copy ClassC stats"));
-            }
+            vos_mem_copy( pStats, (tANI_U8 *)&pMac->roam.classCStatsInfo,
+                         sizeof(tCsrGlobalClassCStatsInfo));
             pStats += sizeof(tCsrGlobalClassCStatsInfo);
             break;
          case eCsrGlobalClassDStats:
             smsLog( pMac, LOG2, FL("csrRoamReportStatistics:ClassD stats"));
-            status = palCopyMemory(pMac->hHdd, pStats, (tANI_U8 *)&pMac->roam.classDStatsInfo,
-                                   sizeof(tCsrGlobalClassDStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOG1, FL("csrRoamReportStatistics:failed to copy ClassD stats"));
-            }
+            vos_mem_copy( pStats, (tANI_U8 *)&pMac->roam.classDStatsInfo,
+                          sizeof(tCsrGlobalClassDStatsInfo));
             pStats += sizeof(tCsrGlobalClassDStatsInfo);
             break;
          case eCsrPerStaStats:
             smsLog( pMac, LOG2, FL("csrRoamReportStatistics:PerSta stats"));
-            status = palCopyMemory(pMac->hHdd, pStats, (tANI_U8 *)&pMac->roam.perStaStatsInfo[staId],
-                                   sizeof(tCsrPerStaStatsInfo));
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog( pMac, LOG1, FL("csrRoamReportStatistics:failed to copy PerSta stats"));
-            }
+            vos_mem_copy( pStats, (tANI_U8 *)&pMac->roam.perStaStatsInfo[staId],
+                         sizeof(tCsrPerStaStatsInfo));
             pStats += sizeof(tCsrPerStaStatsInfo);
             break;
          default:
@@ -15407,7 +16262,7 @@
       {
          pTempStaEntry = GET_BASE_ADDR( pPrevEntry, tCsrStatsClientReqInfo, link );
          //send up the stats report
-         csrRoamReportStatistics(pMac, pTempStaEntry->statsMask, pTempStaEntry->callback,
+         csrRoamReportStatistics(pMac, pTempStaEntry->statsMask, pTempStaEntry->callback, 
                                  pTempStaEntry->staId, pTempStaEntry->pContext);
          csrRoamRemoveStatListEntry(pMac, pPrevEntry);
       }
@@ -15421,14 +16276,14 @@
             csrRoamRemoveEntryFromPeStatsReqList(pMac, pTempStaEntry->pPeStaEntry);
          }
       }
-      //check if we need to stop the tl stats timer too
+      //check if we need to stop the tl stats timer too 
       pMac->roam.tlStatsReqInfo.numClient--;
       if(!pMac->roam.tlStatsReqInfo.numClient)
       {
          if(pMac->roam.tlStatsReqInfo.timerRunning)
          {
-            status = palTimerStop(pMac->hHdd, pMac->roam.tlStatsReqInfo.hTlStatsTimer);
-            if(!HAL_STATUS_SUCCESS(status))
+            status = vos_timer_stop(&pMac->roam.tlStatsReqInfo.hTlStatsTimer);
+            if (!HAL_STATUS_SUCCESS(status))
             {
                smsLog(pMac, LOGE, FL("csrRoamDeregStatisticsReq:cannot stop TlStatsTimer timer"));
                //we will continue
@@ -15440,19 +16295,19 @@
       if (pTempStaEntry->periodicity)
       {
           //While creating StaEntry in csrGetStatistics,
-          //Initializing and starting timer only when periodicity is set.
+          //Initializing and starting timer only when periodicity is set. 
           //So Stop and Destroy timer only when periodicity is set.
-
+          
           vos_timer_stop( &pTempStaEntry->timer );
-          // Destroy the vos timer...
+          // Destroy the vos timer...      
           vosStatus = vos_timer_destroy( &pTempStaEntry->timer );
           if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
           {
               smsLog(pMac, LOGE, FL("csrRoamDeregStatisticsReq:failed to destroy Client req timer"));
           }
       }
-
-
+      
+      
       pPrevEntry = pEntry;
       pEntry = csrLLNext( &pMac->roam.statsClientReqList, pEntry, LL_ACCESS_NOLOCK );
    }
@@ -15461,15 +16316,15 @@
    {
       pTempStaEntry = GET_BASE_ADDR( pPrevEntry, tCsrStatsClientReqInfo, link );
       //send up the stats report
-      csrRoamReportStatistics(pMac, pTempStaEntry->statsMask, pTempStaEntry->callback,
+      csrRoamReportStatistics(pMac, pTempStaEntry->statsMask, pTempStaEntry->callback, 
                                  pTempStaEntry->staId, pTempStaEntry->pContext);
       csrRoamRemoveStatListEntry(pMac, pPrevEntry);
    }
    return status;
-
+   
 }
 
-eHalStatus csrIsFullPowerNeeded( tpAniSirGlobal pMac, tSmeCmd *pCommand,
+eHalStatus csrIsFullPowerNeeded( tpAniSirGlobal pMac, tSmeCmd *pCommand, 
                                    tRequestFullPowerReason *pReason,
                                    tANI_BOOLEAN *pfNeedPower )
 {
@@ -15561,12 +16416,12 @@
 #if 0
                                                 // TODO : Session Specific info pConnectBssDesc
                         if( csrIsBssIdEqual( pMac, &pScanResult->Result.BssDescriptor, pMac->roam.pConnectBssDesc ) &&
-                            csrIsSsidEqual( pMac, pMac->roam.pConnectBssDesc,
+                            csrIsSsidEqual( pMac, pMac->roam.pConnectBssDesc, 
                                             &pScanResult->Result.BssDescriptor, (tDot11fBeaconIEs *)( pScanResult->Result.pvIes ) ) )
                         {
                             // Check to see if the Auth type has changed in the Profile.  If so, we don't want to Reassociate
-                            // with Authenticating first.  To force this, stop the current association (Disassociate) and
-                            // then re 'Join' the AP, wihch will force an Authentication (with the new Auth type) followed by
+                            // with Authenticating first.  To force this, stop the current association (Disassociate) and 
+                            // then re 'Join' the AP, wihch will force an Authentication (with the new Auth type) followed by 
                             // a new Association.
                             if(csrIsSameProfile(pMac, &pMac->roam.connectedProfile, pProfile))
                             {
@@ -15598,7 +16453,7 @@
 #ifdef FEATURE_WLAN_TDLS
         else if( eSmeCommandTdlsAddPeer == pCommand->command )
         {
-            //TDLS link is getting established. need full power
+            //TDLS link is getting established. need full power 
             fNeedFullPower = eANI_BOOLEAN_TRUE;
             reason = eSME_FULL_PWR_NEEDED_BY_TDLS_PEER_SETUP;
         }
@@ -15889,7 +16744,7 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSirUpdateAPWPSIEsReq *pMsg;
     tANI_U8 *pBuf = NULL, *wTmpBuf = NULL;
-
+    
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
     if (NULL == pSession)
     {
@@ -15899,24 +16754,27 @@
 
     do
     {
-        status = palAllocateMemory( pMac->hHdd, (void **)&pMsg, sizeof(tSirUpdateAPWPSIEsReq) );
-        if (!HAL_STATUS_SUCCESS(status)) break;
-        palZeroMemory( pMac->hHdd, pMsg, sizeof(tSirUpdateAPWPSIEsReq) );
+        pMsg = vos_mem_malloc(sizeof(tSirUpdateAPWPSIEsReq));
+        if ( NULL == pMsg ) return eHAL_STATUS_FAILURE;
+        vos_mem_set(pMsg, sizeof(tSirUpdateAPWPSIEsReq), 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_UPDATE_APWPSIE_REQ);
 
         pBuf = (tANI_U8 *)&pMsg->transactionId;
+        VOS_ASSERT(pBuf);
+
         wTmpBuf = pBuf;
         // transactionId
         *pBuf = 0;
         *( pBuf + 1 ) = 0;
         pBuf += sizeof(tANI_U16);
         // bssId
-        palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, &pSession->selfMacAddr, sizeof(tSirMacAddr) );
+        vos_mem_copy((tSirMacAddr *)pBuf, &pSession->selfMacAddr,
+                     sizeof(tSirMacAddr) );
         pBuf += sizeof(tSirMacAddr);
         //sessionId
         *pBuf++ = (tANI_U8)sessionId;
         // APWPSIEs
-        palCopyMemory( pMac->hHdd, (tSirAPWPSIEs *)pBuf, pAPWPSIES, sizeof(tSirAPWPSIEs));
+        vos_mem_copy((tSirAPWPSIEs *)pBuf, pAPWPSIES, sizeof(tSirAPWPSIEs));
         pBuf += sizeof(tSirAPWPSIEs);
         pMsg->length = pal_cpu_to_be16((tANI_U16)(sizeof(tANI_U32) + (pBuf - wTmpBuf))); //msg_header + msg
         status = palSendMBMessage(pMac->hHdd, pMsg);
@@ -15936,9 +16794,9 @@
     }
     do
     {
-        status = palAllocateMemory( pMac->hHdd, (void **)&pMsg, sizeof(tSirUpdateAPWPARSNIEsReq) );
-        if (!HAL_STATUS_SUCCESS(status)) break;
-        palZeroMemory( pMac->hHdd, pMsg, sizeof( tSirUpdateAPWPARSNIEsReq ) );
+        pMsg = vos_mem_malloc(sizeof(tSirUpdateAPWPARSNIEsReq));
+        if ( NULL == pMsg ) return eHAL_STATUS_FAILURE;
+        vos_mem_set(pMsg, sizeof( tSirUpdateAPWPARSNIEsReq ), 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_SET_APWPARSNIEs_REQ);
         pBuf = (tANI_U8 *)&pMsg->transactionId;
         wTmpBuf = pBuf;
@@ -15946,15 +16804,17 @@
         *pBuf = 0;
         *( pBuf + 1 ) = 0;
         pBuf += sizeof(tANI_U16);
+        VOS_ASSERT(pBuf);
 
         // bssId
-        palCopyMemory( pMac->hHdd, (tSirMacAddr *)pBuf, &pSession->selfMacAddr, sizeof(tSirMacAddr) );
+        vos_mem_copy((tSirMacAddr *)pBuf, &pSession->selfMacAddr,
+                     sizeof(tSirMacAddr));
         pBuf += sizeof(tSirMacAddr);
         // sessionId
         *pBuf++ = (tANI_U8)sessionId;
-
+    
         // APWPARSNIEs
-        palCopyMemory( pMac->hHdd, (tSirRSNie *)pBuf, pAPSirRSNie, sizeof(tSirRSNie));
+        vos_mem_copy((tSirRSNie *)pBuf, pAPSirRSNie, sizeof(tSirRSNie));
         pBuf += sizeof(tSirRSNie);
         pMsg->length = pal_cpu_to_be16((tANI_U16)(sizeof(tANI_U32 ) + (pBuf - wTmpBuf))); //msg_header + msg
     status = palSendMBMessage(pMac->hHdd, pMsg);
@@ -15972,7 +16832,7 @@
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
     auth_req_len = sizeof(tSirFTPreAuthReq);
     pftPreAuthReq = (tpSirFTPreAuthReq)vos_mem_malloc(auth_req_len);
-    if (pftPreAuthReq == NULL)
+    if (NULL == pftPreAuthReq)
     {
         smsLog(pMac, LOGE, FL("Memory allocation for FT Preauth request failed"));
         return eHAL_STATUS_RESOURCES;
@@ -15988,31 +16848,33 @@
 
     pftPreAuthReq->preAuthchannelNum = pBssDescription->channelId;
 
-    palCopyMemory(pMac->hHdd, (void *)&pftPreAuthReq->currbssId, (void *)pSession->connectedProfile.bssid, sizeof(tSirMacAddr));
-    palCopyMemory(pMac->hHdd, (void *)&pftPreAuthReq->preAuthbssId, (void *)pBssDescription->bssId, sizeof(tSirMacAddr));
+    vos_mem_copy((void *)&pftPreAuthReq->currbssId,
+                 (void *)pSession->connectedProfile.bssid, sizeof(tSirMacAddr));
+    vos_mem_copy((void *)&pftPreAuthReq->preAuthbssId,
+                 (void *)pBssDescription->bssId, sizeof(tSirMacAddr));
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
-    if (csrRoamIs11rAssoc(pMac) &&
+    if (csrRoamIs11rAssoc(pMac) && 
           (pMac->roam.roamSession[sessionId].connectedProfile.AuthType != eCSR_AUTH_TYPE_OPEN_SYSTEM))
     {
         pftPreAuthReq->ft_ies_length = (tANI_U16)pMac->ft.ftSmeContext.auth_ft_ies_length;
-        palCopyMemory(pMac->hHdd, pftPreAuthReq->ft_ies, pMac->ft.ftSmeContext.auth_ft_ies,
-                                pMac->ft.ftSmeContext.auth_ft_ies_length);
+        vos_mem_copy(pftPreAuthReq->ft_ies, pMac->ft.ftSmeContext.auth_ft_ies,
+                     pMac->ft.ftSmeContext.auth_ft_ies_length);
     }
     else
 #endif
     {
-        pftPreAuthReq->ft_ies_length = 0;
+        pftPreAuthReq->ft_ies_length = 0; 
     }
     vos_mem_copy(pftPreAuthReq->pbssDescription, pBssDescription,
                  sizeof(pBssDescription->length) + pBssDescription->length);
-    pftPreAuthReq->length = pal_cpu_to_be16(auth_req_len);
+    pftPreAuthReq->length = pal_cpu_to_be16(auth_req_len); 
     return palSendMBMessage(pMac->hHdd, pftPreAuthReq);
 }
 /*--------------------------------------------------------------------------
- * This will receive and process the FT Pre Auth Rsp from the current
- * associated ap.
- *
+ * This will receive and process the FT Pre Auth Rsp from the current 
+ * associated ap. 
+ * 
  * This will invoke the hdd call back. This is so that hdd can now
  * send the FTIEs from the Auth Rsp (Auth Seq 2) to the supplicant.
   ------------------------------------------------------------------------*/
@@ -16020,7 +16882,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus  status = eHAL_STATUS_SUCCESS;
-#ifdef FEATURE_WLAN_LFR
+#if defined(FEATURE_WLAN_LFR) || defined(FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_CCX_UPLOAD)
     tCsrRoamInfo roamInfo;
 #endif
 
@@ -16044,31 +16906,48 @@
     pMac->ft.ftSmeContext.FTState = eFT_AUTH_COMPLETE;
     // Indicate SME QoS module the completion of Preauth success. This will trigger the creation of RIC IEs
     pMac->ft.ftSmeContext.psavedFTPreAuthRsp = pFTPreAuthRsp;
-    sme_QosCsrEventInd(pMac, pMac->ft.ftSmeContext.smeSessionId, SME_QOS_CSR_PREAUTH_SUCCESS_IND, NULL);
-    /* Start the pre-auth reassoc interval timer with a period of 400ms. When this expires,
+    /* No need to notify qos module if this is a non 11r roam*/
+    if (csrRoamIs11rAssoc(pMac))
+    {
+        sme_QosCsrEventInd(pMac, pMac->ft.ftSmeContext.smeSessionId, SME_QOS_CSR_PREAUTH_SUCCESS_IND, NULL);
+    }
+    /* Start the pre-auth reassoc interval timer with a period of 400ms. When this expires, 
      * actual transition from the current to handoff AP is triggered */
-    status = palTimerStart(pMac->hHdd, pMac->ft.ftSmeContext.preAuthReassocIntvlTimer,
-                                                            60 * PAL_TIMER_TO_MS_UNIT,
-                                                            eANI_BOOLEAN_FALSE);
+    status = vos_timer_start(&pMac->ft.ftSmeContext.preAuthReassocIntvlTimer,
+                                                            60);
     if (eHAL_STATUS_SUCCESS != status)
     {
         smsLog(pMac, LOGE, FL("Preauth reassoc interval timer start failed to start with status %d"), status);
         return;
     }
     // Save the received response
-    palCopyMemory(pMac->hHdd, (void *)&pMac->ft.ftSmeContext.preAuthbssId, (void *)pFTPreAuthRsp->preAuthbssId, sizeof(tCsrBssid));
+    vos_mem_copy((void *)&pMac->ft.ftSmeContext.preAuthbssId,
+                 (void *)pFTPreAuthRsp->preAuthbssId, sizeof(tCsrBssid));
     if (csrRoamIs11rAssoc(pMac))
-       csrRoamCallCallback(pMac, pFTPreAuthRsp->smeSessionId, NULL, 0,
+       csrRoamCallCallback(pMac, pFTPreAuthRsp->smeSessionId, NULL, 0, 
                         eCSR_ROAM_FT_RESPONSE, eCSR_ROAM_RESULT_NONE);
 
-    // Currently we dont do anything special for CCX connection.
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+    if (csrRoamIsCCXAssoc(pMac))
+    {
+        /* read TSF */
+        csrRoamReadTSF(pMac, (tANI_U8 *)roamInfo.timestamp);
+        // Save the bssid from the received response
+        vos_mem_copy((void *)&roamInfo.bssid,
+                     (void *)pFTPreAuthRsp->preAuthbssId, sizeof(tCsrBssid));
+        csrRoamCallCallback(pMac, pFTPreAuthRsp->smeSessionId, &roamInfo,
+                            0, eCSR_ROAM_CCKM_PREAUTH_NOTIFY, 0);
+    }
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
+
 #ifdef FEATURE_WLAN_LFR
-    // If Legacy Fast Roaming is enabled, signal the supplicant
+    // If Legacy Fast Roaming is enabled, signal the supplicant  
     // So he can send us a PMK-ID for this candidate AP.
     if (csrRoamIsFastRoamEnabled(pMac, CSR_SESSION_ID_INVALID))
     {
-        // Save the bssid from the received response
-        palCopyMemory(pMac->hHdd, (void *)&roamInfo.bssid, (void *)pFTPreAuthRsp->preAuthbssId, sizeof(tCsrBssid));
+        // Save the bssid from the received response 
+        vos_mem_copy((void *)&roamInfo.bssid,
+                     (void *)pFTPreAuthRsp->preAuthbssId, sizeof(tCsrBssid));
         csrRoamCallCallback(pMac, pFTPreAuthRsp->smeSessionId, &roamInfo, 0, eCSR_ROAM_PMK_NOTIFY, 0);
     }
 
@@ -16085,7 +16964,7 @@
     tpAniSirGlobal pMac = pInfo->pMac;
     tANI_U32 sessionId = pInfo->sessionId;
     tCsrRoamSession *pSession;
-
+    
     if( CSR_IS_SESSION_VALID(pMac, sessionId) )
     {
         smsLog( pMac, LOGE, FL( "  retrying the last roam profile on session %d" ), sessionId );
@@ -16103,15 +16982,15 @@
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-
+    
     if(pSession->pCurRoamProfile && pSession->maxRetryCount)
     {
         smsLog(pMac, LOGE, FL(" call sessionId %d retry count %d left"), sessionId, pSession->maxRetryCount);
         pSession->maxRetryCount--;
         pSession->joinRetryTimerInfo.pMac = pMac;
         pSession->joinRetryTimerInfo.sessionId = (tANI_U8)sessionId;
-        status = palTimerStart(pMac->hHdd, pSession->hTimerJoinRetry, interval, eANI_BOOLEAN_FALSE);
-        if(!HAL_STATUS_SUCCESS(status))
+        status = vos_timer_start(&pSession->hTimerJoinRetry, interval/PAL_TIMER_TO_MS_UNIT);
+        if (!HAL_STATUS_SUCCESS(status))
         {
             smsLog(pMac, LOGE, FL(" fail to start timer status %s"), status);
         }
@@ -16121,7 +17000,7 @@
         smsLog(pMac, LOGE, FL(" not to start timer due to no profile or reach mac ret (%d)"),
                pSession->maxRetryCount);
     }
-
+    
     return (status);
 }
 eHalStatus csrRoamStopJoinRetryTimer(tpAniSirGlobal pMac, tANI_U32 sessionId)
@@ -16129,9 +17008,9 @@
     smsLog(pMac, LOGE, " csrRoamStopJoinRetryTimer");
     if( CSR_IS_SESSION_VALID(pMac, sessionId) )
     {
-        return (palTimerStop(pMac->hHdd, pMac->roam.roamSession[sessionId].hTimerJoinRetry));
+        return (vos_timer_stop(&pMac->roam.roamSession[sessionId].hTimerJoinRetry));
     }
-
+    
     return eHAL_STATUS_SUCCESS;
 }
 #endif
@@ -16171,16 +17050,13 @@
    /* read the country code from NV and use it */
    if ( VOS_IS_STATUS_SUCCESS(vosStatus) )
    {
-      palCopyMemory( pMac->hHdd, pCountry,
-            nvTables.defaultCountryTable.countryCode,
-            WNI_CFG_COUNTRY_CODE_LEN );
+      vos_mem_copy(pCountry, nvTables.defaultCountryTable.countryCode,
+                   WNI_CFG_COUNTRY_CODE_LEN);
       return status;
    }
    else
    {
-      palCopyMemory( pMac->hHdd, pCountry,
-            "XXX",
-            WNI_CFG_COUNTRY_CODE_LEN );
+      vos_mem_copy(pCountry, "XXX", WNI_CFG_COUNTRY_CODE_LEN);
       status = eHAL_STATUS_FAILURE;
       return status;
    }
@@ -16188,9 +17064,7 @@
 
 eHalStatus csrGetCurrentCountryCode(tpAniSirGlobal pMac, tANI_U8 *pCountry)
 {
-   palCopyMemory( pMac->hHdd, pCountry,
-         pMac->scan.countryCode11d,
-         WNI_CFG_COUNTRY_CODE_LEN );
+   vos_mem_copy(pCountry, pMac->scan.countryCode11d, WNI_CFG_COUNTRY_CODE_LEN);
    return eHAL_STATUS_SUCCESS;
 }
 
@@ -16206,23 +17080,19 @@
        return eHAL_STATUS_FAILURE;
    }
 
-   status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof(tSirSetTxPowerReq));
-   if (HAL_STATUS_SUCCESS(status))
+   pMsg = vos_mem_malloc(sizeof(tSirSetTxPowerReq));
+   if ( NULL == pMsg ) return eHAL_STATUS_FAILURE;
+   vos_mem_set((void *)pMsg, sizeof(tSirSetTxPowerReq), 0);
+   pMsg->messageType     = eWNI_SME_SET_TX_POWER_REQ;
+   pMsg->length          = sizeof(tSirSetTxPowerReq);
+   pMsg->mwPower         = mW;
+   vos_mem_copy((tSirMacAddr *)pMsg->bssId, &pSession->selfMacAddr,
+                sizeof(tSirMacAddr));
+   status = palSendMBMessage(pMac->hHdd, pMsg);
+   if (!HAL_STATUS_SUCCESS(status))
    {
-       palZeroMemory(pMac->hHdd, (void *)pMsg, sizeof(tSirSetTxPowerReq));
-       pMsg->messageType     = eWNI_SME_SET_TX_POWER_REQ;
-       pMsg->length          = sizeof(tSirSetTxPowerReq);
-       pMsg->mwPower         = mW;
-       palCopyMemory( pMac->hHdd,
-             (tSirMacAddr *)pMsg->bssId,
-             &pSession->selfMacAddr,
-             sizeof(tSirMacAddr) );
-       status = palSendMBMessage(pMac->hHdd, pMsg);
-       if (!HAL_STATUS_SUCCESS(status))
-       {
-           smsLog(pMac, LOGE, FL(" csr set TX Power Post MSG Fail %d "), status);
-           //pMsg is freed by palSendMBMessage
-       }
+       smsLog(pMac, LOGE, FL(" csr set TX Power Post MSG Fail %d "), status);
+       //pMsg is freed by palSendMBMessage
    }
    return status;
 }
@@ -16266,3 +17136,161 @@
 
   return eANI_BOOLEAN_FALSE;
 }
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+eHalStatus csrHandoffRequest(tpAniSirGlobal pMac,
+                             tCsrHandoffRequest *pHandoffInfo)
+{
+   eHalStatus status = eHAL_STATUS_SUCCESS;
+   vos_msg_t  msg;
+
+   tAniHandoffReq *pMsg;
+   pMsg = vos_mem_malloc(sizeof(tAniHandoffReq));
+   if ( NULL == pMsg )
+   {
+      smsLog(pMac, LOGE, " csrHandoffRequest: failed to allocate mem for req ");
+      return eHAL_STATUS_FAILURE;
+   }
+   pMsg->msgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_HANDOFF_REQ);
+   pMsg->msgLen = (tANI_U16)sizeof(tAniHandoffReq);
+   pMsg->sessionId = pMac->roam.neighborRoamInfo.csrSessionId;
+   pMsg->channel = pHandoffInfo->channel;
+   vos_mem_copy(pMsg->bssid,
+                       pHandoffInfo->bssid,
+                       6);
+   msg.type = eWNI_SME_HANDOFF_REQ;
+   msg.bodyptr = pMsg;
+   msg.reserved = 0;
+   if(VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MQ_ID_SME, &msg))
+   {
+       smsLog(pMac, LOGE, " csrHandoffRequest failed to post msg to self ");
+       vos_mem_free((void *)pMsg);
+       status = eHAL_STATUS_FAILURE;
+   }
+   return status;
+}
+#endif /* WLAN_FEATURE_ROAM_SCAN_OFFLOAD */
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+eHalStatus csrEnableRMC(tpAniSirGlobal pMac, tANI_U32 sessionId)
+{
+   tSirSetRMCReq *pMsg = NULL;
+   eHalStatus status = eHAL_STATUS_SUCCESS;
+   tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
+
+   if (!pSession)
+   {
+       smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+       return eHAL_STATUS_FAILURE;
+   }
+
+   pMsg = vos_mem_malloc(sizeof(tSirSetRMCReq));
+   if (NULL == pMsg)
+   {
+       vos_mem_set((void *)pMsg, sizeof(tSirSetRMCReq), 0);
+       pMsg->msgType = eWNI_SME_ENABLE_RMC_REQ;
+       pMsg->msgLen  = sizeof(tSirSetRMCReq);
+       vos_mem_copy((v_U8_t *)pMsg->mcastTransmitter,
+                    &pSession->selfMacAddr, sizeof(tSirMacAddr));
+
+       status = palSendMBMessage(pMac->hHdd, pMsg);
+       if (!HAL_STATUS_SUCCESS(status))
+       {
+           smsLog(pMac, LOGE, FL(" csr enable RMC Post MSG Fail %d "), status);
+           //pMsg is freed by palSendMBMessage
+       }
+   }
+   return status;
+}
+
+eHalStatus csrDisableRMC(tpAniSirGlobal pMac, tANI_U32 sessionId)
+{
+   tSirSetRMCReq *pMsg = NULL;
+   eHalStatus status = eHAL_STATUS_SUCCESS;
+   tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
+
+   if (!pSession)
+   {
+       smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+       return eHAL_STATUS_FAILURE;
+   }
+
+   pMsg = vos_mem_malloc(sizeof(tSirSetRMCReq));
+   if (NULL == pMsg)
+   {
+       vos_mem_set((void *)pMsg, sizeof(tSirSetRMCReq), 0);
+       pMsg->msgType = eWNI_SME_DISABLE_RMC_REQ;
+       pMsg->msgLen  = sizeof(tSirSetRMCReq);
+       vos_mem_copy((v_U8_t *)pMsg->mcastTransmitter,
+                    &pSession->selfMacAddr, sizeof(tSirMacAddr));
+
+       status = palSendMBMessage(pMac->hHdd, pMsg);
+       if (!HAL_STATUS_SUCCESS(status))
+       {
+           smsLog(pMac, LOGE, FL(" csr disable RMC Post MSG Fail %d "), status);
+           //pMsg is freed by palSendMBMessage
+       }
+   }
+   return status;
+}
+
+#endif /* defined WLAN_FEATURE_RELIABLE_MCAST */
+
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+/* ---------------------------------------------------------------------------
+    \fn csrSetCCKMIe
+    \brief  This function stores the CCKM IE passed by the supplicant
+    in a place holder data structure and this IE will be packed inside
+    reassociation request
+    \param  pMac - pMac global structure
+    \param  sessionId - Current session id
+    \param  pCckmIe - pointer to CCKM IE data
+    \param  ccKmIeLen - length of the CCKM IE
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+VOS_STATUS csrSetCCKMIe(tpAniSirGlobal pMac, const tANI_U8 sessionId,
+                            const tANI_U8 *pCckmIe,
+                            const tANI_U8 ccKmIeLen)
+{
+    eHalStatus       status = eHAL_STATUS_SUCCESS;
+    tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
+    if (!pSession)
+    {
+        smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+        return eHAL_STATUS_FAILURE;
+    }
+    vos_mem_copy(pSession->suppCckmIeInfo.cckmIe, pCckmIe,
+                 ccKmIeLen);
+    pSession->suppCckmIeInfo.cckmIeLen = ccKmIeLen;
+    return status;
+}
+/* ---------------------------------------------------------------------------
+    \fn csrRoamReadTSF
+    \brief  This function reads the TSF; and also add the time elapsed since
+    last beacon or probe response reception from the hand off AP to arrive at
+    the latest TSF value.
+    \param  pMac - pMac global structure
+    \param  pTimestamp - output TSF timestamp
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+VOS_STATUS csrRoamReadTSF(tpAniSirGlobal pMac, tANI_U8 *pTimestamp)
+{
+    eHalStatus              status     = eHAL_STATUS_SUCCESS;
+    tCsrNeighborRoamBSSInfo handoffNode;
+    tANI_U32                timer_diff = 0;
+    tANI_U32                timeStamp[2];
+    tpSirBssDescription     pBssDescription = NULL;
+    csrNeighborRoamGetHandoffAPInfo(pMac, &handoffNode);
+    pBssDescription = handoffNode.pBssDescription;
+    // Get the time diff in milli seconds
+    timer_diff = vos_timer_get_system_time() - pBssDescription->scanSysTimeMsec;
+    // Convert msec to micro sec timer
+    timer_diff = (tANI_U32)(timer_diff * SYSTEM_TIME_MSEC_TO_USEC);
+    timeStamp[0] = pBssDescription->timeStamp[0];
+    timeStamp[1] = pBssDescription->timeStamp[1];
+    UpdateCCKMTSF(&(timeStamp[0]), &(timeStamp[1]), &timer_diff);
+    vos_mem_copy(pTimestamp, (void *) &timeStamp[0],
+                 sizeof (tANI_U32) * 2);
+    return status;
+}
+#endif /*FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index 479c1e8..6c6303a 100644
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -53,13 +53,16 @@
 #include "wlan_qct_wda.h"
 
 #define CSR_VALIDATE_LIST  //This portion of code need to be removed once the issue is resolved.
+#define MIN_CHN_TIME_TO_FIND_GO 100
+#define MAX_CHN_TIME_TO_FIND_GO 100
+#define DIRECT_SSID_LEN 7
 
 #ifdef CSR_VALIDATE_LIST
 tDblLinkList *g_pchannelPowerInfoList24 = NULL, * g_pchannelPowerInfoList5 = NULL;
 tpAniSirGlobal g_pMac;
 #endif
 
-/* Purpose of HIDDEN_TIMER
+/* Purpose of HIDDEN_TIMER 
 ** When we remove hidden ssid from the profile i.e., forget the SSID via GUI that SSID shouldn't see in the profile
 ** For above requirement we used timer limit, logic is explained below
 ** Timer value is initialsed to current time  when it receives corresponding probe response of hidden SSID (The probe request is
@@ -67,22 +70,22 @@
 ** for broadcast probe request, during update SSID with saved SSID we will diff current time with saved SSID time if it is greater than 1 min
 ** then we are not updating with old one
 */
-
-#define HIDDEN_TIMER (1*60*1000)
+                                                                     
+#define HIDDEN_TIMER (1*60*1000)                                                                     
 #define CSR_SCAN_RESULT_RSSI_WEIGHT     80 // must be less than 100, represent the persentage of new RSSI
-
+                                                                     
 /*---------------------------------------------------------------------------
   PER filter constant fraction: it is a %
----------------------------------------------------------------------------*/
+---------------------------------------------------------------------------*/  
 #define CSR_SCAN_PER_FILTER_FRAC 100
-
+                                                                     
 /*---------------------------------------------------------------------------
   RSSI filter constant fraction: it is a %
----------------------------------------------------------------------------*/
+---------------------------------------------------------------------------*/  
 #define CSR_SCAN_RSSI_FILTER_FRAC 100
 
 /*---------------------------------------------------------------------------
-Convert RSSI into overall score: Since RSSI is in -dBm values, and the
+Convert RSSI into overall score: Since RSSI is in -dBm values, and the 
 overall needs to be weighted inversely (where greater value means better
 system), we convert.
 RSSI *cannot* be more than 0xFF or less than 0 for meaningful WLAN operation
@@ -95,7 +98,7 @@
 #define CSR_SCAN_OVERALL_SCORE( rssi )                          \
     (( rssi < CSR_SCAN_MAX_SCORE_VAL )                          \
      ? (CSR_SCAN_MAX_SCORE_VAL-rssi) : CSR_SCAN_MIN_SCORE_VAL)
-
+                                                                     
 
 #define CSR_SCAN_IS_OVER_BSS_LIMIT(pMac)  \
    ( (pMac)->scan.nBssLimit <= (csrLLCount(&(pMac)->scan.scanResultList)) )
@@ -103,7 +106,9 @@
 /* Maximum number of channels per country can be ignored */
 #define MAX_CHANNELS_IGNORE 10
 
-#define MAX_COUNTRY_IGNORE 3
+#define MAX_COUNTRY_IGNORE 5
+
+#define THIRTY_PERCENT(x)  (x*30/100);
 
 /*struct to hold the ignored channel list based on country */
 typedef struct sCsrIgnoreChannels
@@ -113,11 +118,17 @@
     tANI_U16 channelCount;
 }tCsrIgnoreChannels;
 
+#ifndef CONFIG_ENABLE_LINUX_REG
 static tCsrIgnoreChannels countryIgnoreList[MAX_COUNTRY_IGNORE] = {
     { {'U','A'}, { 136, 140}, 2},
     { {'T','W'}, { 36, 40, 44, 48, 52}, 5},
-    { {'I','D'}, { 165}, 1 }
+    { {'I','D'}, { 165}, 1 },
+    { {'A','U'}, { 120, 124, 128}, 3 },
+    { {'A','R'}, { 120, 124, 128}, 3 }
     };
+#else
+static tCsrIgnoreChannels countryIgnoreList[MAX_COUNTRY_IGNORE] = { };
+#endif //CONFIG_ENABLE_LINUX_REG
 
 //*** This is temporary work around. It need to call CCM api to get to CFG later
 /// Get string parameter value
@@ -141,8 +152,8 @@
 eHalStatus csrSetCfgBackgroundScanPeriod(tpAniSirGlobal pMac, tANI_U32 bgPeriod);
 eHalStatus csrProcessSetBGScanParam(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 void csrReleaseScanCommand(tpAniSirGlobal pMac, tSmeCmd *pCommand, eCsrScanStatus scanStatus);
-static tANI_BOOLEAN csrScanValidateScanResult( tpAniSirGlobal pMac, tANI_U8 *pChannels,
-                                               tANI_U8 numChn, tSirBssDescription *pBssDesc,
+static tANI_BOOLEAN csrScanValidateScanResult( tpAniSirGlobal pMac, tANI_U8 *pChannels, 
+                                               tANI_U8 numChn, tSirBssDescription *pBssDesc, 
                                                tDot11fBeaconIEs **ppIes );
 eHalStatus csrSetBGScanChannelList( tpAniSirGlobal pMac, tANI_U8 *pAdjustChannels, tANI_U8 NumAdjustChannels);
 void csrReleaseCmdSingle(tpAniSirGlobal pMac, tSmeCmd *pCommand);
@@ -176,9 +187,9 @@
 {
     if( NULL != pResult->Result.pvIes )
     {
-        palFreeMemory( pMac->hHdd, pResult->Result.pvIes );
+        vos_mem_free(pResult->Result.pvIes);
     }
-    palFreeMemory(pMac->hHdd, pResult);
+    vos_mem_free(pResult);
 }
 
 
@@ -187,17 +198,17 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tListElem *pEntry;
     tCsrScanResult *pBssDesc;
-
+    
     csrLLLock(pList);
-
+    
     while((pEntry = csrLLRemoveHead(pList, LL_ACCESS_NOLOCK)) != NULL)
     {
         pBssDesc = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
         csrFreeScanResultEntry( pMac, pBssDesc );
     }
-
-    csrLLUnlock(pList);
-
+    
+    csrLLUnlock(pList);   
+     
     return (status);
 }
 
@@ -217,7 +228,7 @@
         //check 2.4 list
         tListElem *pElem, *pHead;
         int count;
-
+        
         count = (int)(g_pchannelPowerInfoList24->Count);
         pHead = &g_pchannelPowerInfoList24->ListHead;
         pElem = pHead->next;
@@ -234,10 +245,10 @@
                 }
                 else
                 {
-                    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL,
+                    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL, 
                          " %d Detect 1 list(0x%X) error Head(0x%X) next(0x%X) Count %d, dest(0x%X) src(0x%X) numBytes(%d)",
-                         idx, (unsigned int)g_pchannelPowerInfoList24, (unsigned int)pHead,
-                        (unsigned int)(pHead->next), (int)g_pchannelPowerInfoList24->Count,
+                         idx, (unsigned int)g_pchannelPowerInfoList24, (unsigned int)pHead, 
+                        (unsigned int)(pHead->next), (int)g_pchannelPowerInfoList24->Count, 
                         (unsigned int)dest, (unsigned int)src, (int)num);
                     VOS_ASSERT(0);
                     ii = 0;
@@ -248,9 +259,9 @@
         else
         {
             //Bad list
-            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL, " %d Detect list(0x%X) error Head(0x%X) next(0x%X) Count %d, dest(0x%X) src(0x%X) numBytes(%d)",
-                idx, (unsigned int)g_pchannelPowerInfoList24, (unsigned int)pHead,
-                (unsigned int)(pHead->next), (int)g_pchannelPowerInfoList24->Count,
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL, " %d Detect list(0x%X) error Head(0x%X) next(0x%X) Count %d, dest(0x%X) src(0x%X) numBytes(%d)", 
+                idx, (unsigned int)g_pchannelPowerInfoList24, (unsigned int)pHead, 
+                (unsigned int)(pHead->next), (int)g_pchannelPowerInfoList24->Count, 
                 (unsigned int)dest, (unsigned int)src, (int)num);
             VOS_ASSERT(0);
             ii = 0;
@@ -274,7 +285,7 @@
 eHalStatus csrScanOpen( tpAniSirGlobal pMac )
 {
     eHalStatus status;
-
+    
     do
     {
         csrLLOpen(pMac->hHdd, &pMac->scan.scanResultList);
@@ -291,41 +302,41 @@
 #endif
         pMac->scan.fFullScanIssued = eANI_BOOLEAN_FALSE;
         pMac->scan.nBssLimit = CSR_MAX_BSS_SUPPORT;
-        status = palTimerAlloc(pMac->hHdd, &pMac->scan.hTimerGetResult, csrScanGetResultTimerHandler, pMac);
-        if(!HAL_STATUS_SUCCESS(status))
+        status = vos_timer_init(&pMac->scan.hTimerGetResult, VOS_TIMER_TYPE_SW, csrScanGetResultTimerHandler, pMac);
+        if (!HAL_STATUS_SUCCESS(status))
         {
             smsLog(pMac, LOGE, FL("cannot allocate memory for getResult timer"));
             break;
         }
 #ifdef WLAN_AP_STA_CONCURRENCY
-        status = palTimerAlloc(pMac->hHdd, &pMac->scan.hTimerStaApConcTimer, csrStaApConcTimerHandler, pMac);
-        if(!HAL_STATUS_SUCCESS(status))
+        status = vos_timer_init(&pMac->scan.hTimerStaApConcTimer, VOS_TIMER_TYPE_SW, csrStaApConcTimerHandler, pMac);
+        if (!HAL_STATUS_SUCCESS(status))
         {
             smsLog(pMac, LOGE, FL("cannot allocate memory for hTimerStaApConcTimer timer"));
             break;
         }
-#endif
-        status = palTimerAlloc(pMac->hHdd, &pMac->scan.hTimerIdleScan, csrScanIdleScanTimerHandler, pMac);
-        if(!HAL_STATUS_SUCCESS(status))
+#endif        
+        status = vos_timer_init(&pMac->scan.hTimerIdleScan, VOS_TIMER_TYPE_SW, csrScanIdleScanTimerHandler, pMac);
+        if (!HAL_STATUS_SUCCESS(status))
         {
             smsLog(pMac, LOGE, FL("cannot allocate memory for idleScan timer"));
             break;
         }
-        status = palTimerAlloc(pMac->hHdd, &pMac->scan.hTimerResultAging, csrScanResultAgingTimerHandler, pMac);
-        if(!HAL_STATUS_SUCCESS(status))
+        status = vos_timer_init(&pMac->scan.hTimerResultAging, VOS_TIMER_TYPE_SW, csrScanResultAgingTimerHandler, pMac);
+        if (!HAL_STATUS_SUCCESS(status))
         {
             smsLog(pMac, LOGE, FL("cannot allocate memory for ResultAging timer"));
             break;
         }
-        status = palTimerAlloc(pMac->hHdd, &pMac->scan.hTimerResultCfgAging,
-        csrScanResultCfgAgingTimerHandler, pMac);
-        if(!HAL_STATUS_SUCCESS(status))
+        status = vos_timer_init(&pMac->scan.hTimerResultCfgAging, VOS_TIMER_TYPE_SW,
+                                csrScanResultCfgAgingTimerHandler, pMac);
+        if (!HAL_STATUS_SUCCESS(status))
         {
             smsLog(pMac, LOGE, FL("cannot allocate memory for CFG ResultAging timer"));
             break;
         }
     }while(0);
-
+    
     return (status);
 }
 
@@ -352,45 +363,45 @@
     csrLLClose(&pMac->scan.channelPowerInfoList24);
     csrLLClose(&pMac->scan.channelPowerInfoList5G);
     csrScanDisable(pMac);
-    palTimerFree(pMac->hHdd, pMac->scan.hTimerResultAging);
-    palTimerFree(pMac->hHdd, pMac->scan.hTimerResultCfgAging);
-    palTimerFree(pMac->hHdd, pMac->scan.hTimerGetResult);
+    vos_timer_destroy(&pMac->scan.hTimerResultAging);
+    vos_timer_destroy(&pMac->scan.hTimerResultCfgAging);
+    vos_timer_destroy(&pMac->scan.hTimerGetResult);
 #ifdef WLAN_AP_STA_CONCURRENCY
-    palTimerFree(pMac->hHdd, pMac->scan.hTimerStaApConcTimer);
+    vos_timer_destroy(&pMac->scan.hTimerStaApConcTimer);
 #endif
-    palTimerFree(pMac->hHdd, pMac->scan.hTimerIdleScan);
+    vos_timer_destroy(&pMac->scan.hTimerIdleScan);
     return eHAL_STATUS_SUCCESS;
 }
 
 
 eHalStatus csrScanEnable( tpAniSirGlobal pMac )
 {
-
+    
     pMac->scan.fScanEnable = eANI_BOOLEAN_TRUE;
     pMac->scan.fRestartIdleScan = eANI_BOOLEAN_TRUE;
-
+    
     return eHAL_STATUS_SUCCESS;
 }
 
 
 eHalStatus csrScanDisable( tpAniSirGlobal pMac )
 {
-
+    
     csrScanStopTimers(pMac);
     pMac->scan.fScanEnable = eANI_BOOLEAN_FALSE;
-
+    
     return eHAL_STATUS_SUCCESS;
 }
 
 
-//Set scan timing parameters according to state of other driver sessions
-//No validation of the parameters is performed.
+//Set scan timing parameters according to state of other driver sessions 
+//No validation of the parameters is performed. 
 static void csrSetDefaultScanTiming( tpAniSirGlobal pMac, tSirScanType scanType, tCsrScanRequest *pScanRequest)
 {
 #ifdef WLAN_AP_STA_CONCURRENCY
     if(csrIsAnySessionConnected(pMac))
     {
-        //If multi-session, use the appropriate default scan times
+        //If multi-session, use the appropriate default scan times 
         if(scanType == eSIR_ACTIVE_SCAN)
         {
             pScanRequest->maxChnTime = pMac->roam.configParam.nActiveMaxChnTimeConc;
@@ -401,11 +412,11 @@
             pScanRequest->maxChnTime = pMac->roam.configParam.nPassiveMaxChnTimeConc;
             pScanRequest->minChnTime = pMac->roam.configParam.nPassiveMinChnTimeConc;
         }
-	pScanRequest->maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
-	pScanRequest->minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
+        pScanRequest->maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
+        pScanRequest->minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
 
         pScanRequest->restTime = pMac->roam.configParam.nRestTimeConc;
-
+        
         //Return so that fields set above will not be overwritten.
         return;
     }
@@ -424,8 +435,8 @@
         pScanRequest->maxChnTime = pMac->roam.configParam.nPassiveMaxChnTime;
         pScanRequest->minChnTime = pMac->roam.configParam.nPassiveMinChnTime;
     }
-	pScanRequest->maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
-	pScanRequest->minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
+        pScanRequest->maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
+        pScanRequest->minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
 
 #ifdef WLAN_AP_STA_CONCURRENCY
     //No rest time if no sessions are connected.
@@ -434,7 +445,7 @@
 }
 
 #ifdef WLAN_AP_STA_CONCURRENCY
-//Return SUCCESS is the command is queued, else returns eHAL_STATUS_FAILURE
+//Return SUCCESS is the command is queued, else returns eHAL_STATUS_FAILURE 
 eHalStatus csrQueueScanRequest( tpAniSirGlobal pMac, tSmeCmd *pScanCmd )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -442,7 +453,7 @@
     tANI_BOOLEAN fNoCmdPending;
     tSmeCmd *pQueueScanCmd=NULL;
     tSmeCmd *pSendScanCmd=NULL;
-
+    tANI_U8  nNumChanCombinedConc = 0;
     if (NULL == pScanCmd)
     {
         smsLog (pMac, LOGE, FL("Scan Req cmd is NULL"));
@@ -451,17 +462,27 @@
     /* split scan if any one of the following:
      * - STA session is connected and the scan is not a P2P search
      * - any P2P session is connected
-     * Do not split scans if no concurrent infra connections are
+     * Do not split scans if no concurrent infra connections are 
      * active and if the scan is a BG scan triggered by LFR (OR)
      * any scan if LFR is in the middle of a BG scan. Splitting
      * the scan is delaying the time it takes for LFR to find
      * candidates and resulting in disconnects.
      */
-    if ( (csrIsStaSessionConnected(pMac) &&
+
+    if(csrIsStaSessionConnected(pMac) &&
+       !csrIsP2pSessionConnected(pMac))
+    {
+      nNumChanCombinedConc = pMac->roam.configParam.nNumStaChanCombinedConc;
+    }
+    else if(csrIsP2pSessionConnected(pMac))
+    {
+      nNumChanCombinedConc = pMac->roam.configParam.nNumP2PChanCombinedConc;
+    }
+    if ( (csrIsStaSessionConnected(pMac) && 
 #ifdef FEATURE_WLAN_LFR
          (csrIsConcurrentInfraConnected(pMac) ||
           ((pScanCmd->u.scanCmd.reason != eCsrScanBgScan) &&
-           (pMac->roam.neighborRoamInfo.neighborRoamState !=
+           (pMac->roam.neighborRoamInfo.neighborRoamState != 
             eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN))) &&
 #endif
          (pScanCmd->u.scanCmd.u.scanRequest.p2pSearch != 1)) ||
@@ -478,18 +499,19 @@
 
             numChn = pMac->scan.baseChannels.numChannels;
 
-            status = palAllocateMemory( pMac->hHdd, (void **)&pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList, numChn );
-            if( !HAL_STATUS_SUCCESS( status ) )
+            pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = vos_mem_malloc(numChn);
+            if ( NULL == pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList  )
             {
                 smsLog( pMac, LOGE, FL(" Failed to get memory for channel list ") );
                 return eHAL_STATUS_FAILURE;
             }
             bMemAlloc = eANI_BOOLEAN_TRUE;
-            status = palCopyMemory( pMac->hHdd, pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList,
-                    pMac->scan.baseChannels.channelList, numChn );
+            vos_mem_copy(pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList,
+                         pMac->scan.baseChannels.channelList, numChn);
+            status = eHAL_STATUS_SUCCESS;
             if( !HAL_STATUS_SUCCESS( status ) )
             {
-                palFreeMemory( pMac->hHdd, pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList );
+                vos_mem_free(pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList);
                 pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = NULL;
                 smsLog( pMac, LOGE, FL(" Failed to copy memory to channel list ") );
                 return eHAL_STATUS_FAILURE;
@@ -499,16 +521,16 @@
 
         //Whenever we get a scan request with multiple channels we break it up into 2 requests
         //First request  for first channel to scan and second request to scan remaining channels
-        if (numChn > pMac->roam.configParam.nNumChanCombinedConc)
+        if ( numChn > nNumChanCombinedConc)
         {
-            palZeroMemory(pMac->hHdd, &scanReq, sizeof(tCsrScanRequest));
+            vos_mem_set(&scanReq, sizeof(tCsrScanRequest), 0);
 
             pQueueScanCmd = csrGetCommandBuffer(pMac); //optimize this to use 2 command buffer only
             if (!pQueueScanCmd)
             {
                 if (bMemAlloc)
                 {
-                    palFreeMemory( pMac->hHdd, pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList );
+                    vos_mem_free(pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList);
                     pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = NULL;
 
                 }
@@ -528,25 +550,28 @@
             /* Now modify the elements of local var scan request required to be modified for split scan */
             if(scanReq.ChannelInfo.ChannelList != NULL)
             {
-                palFreeMemory(pMac->hHdd, scanReq.ChannelInfo.ChannelList);
+                vos_mem_free(scanReq.ChannelInfo.ChannelList);
                 scanReq.ChannelInfo.ChannelList = NULL;
             }
 
-            pChnInfo->numOfChannels = pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels - pMac->roam.configParam.nNumChanCombinedConc;
+            pChnInfo->numOfChannels = pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels - nNumChanCombinedConc;
 
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_WARN,
                     FL(" &channelToScan %p pScanCmd(%p) pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList(%p)numChn(%d)"),
                     &channelToScan[0], pScanCmd,
                     pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList, numChn);
 
-            palCopyMemory(pMac->hHdd, &channelToScan[0], &pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[pMac->roam.configParam.nNumChanCombinedConc],
-                    pChnInfo->numOfChannels * sizeof(tANI_U8));
+            vos_mem_copy(&channelToScan[0],
+                     &pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[
+                     nNumChanCombinedConc],
+                     pChnInfo->numOfChannels * sizeof(tANI_U8));
 
             pChnInfo->ChannelList = &channelToScan[0];
 
             scanReq.BSSType = eCSR_BSS_TYPE_ANY;
             //Modify callers parameters in case of concurrency
-            scanReq.scanType = eSIR_ACTIVE_SCAN;
+            if (!pScanCmd->u.scanCmd.u.scanRequest.bcnRptReqScan)
+                scanReq.scanType = eSIR_ACTIVE_SCAN;
             //Use concurrency values for min/maxChnTime.
             //We know csrIsAnySessionConnected(pMac) returns TRUE here
             csrSetDefaultScanTiming(pMac, scanReq.scanType, &scanReq);
@@ -557,13 +582,13 @@
             {
                 if (bMemAlloc)
                 {
-                    palFreeMemory( pMac->hHdd, pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList );
+                    vos_mem_free(pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList);
                     pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = NULL;
 
                 }
                 if( scanReq.pIEField != NULL)
                 {
-                    palFreeMemory(pMac->hHdd, scanReq.pIEField);
+                    vos_mem_free(scanReq.pIEField);
                     scanReq.pIEField = NULL;
                 }
                 smsLog( pMac, LOGE, FL(" Failed to get copy csrScanRequest = %d"), status );
@@ -576,9 +601,10 @@
 
             /* setup the command to scan 2 channels */
             pSendScanCmd = pScanCmd;
-            pSendScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = pMac->roam.configParam.nNumChanCombinedConc;
+            pSendScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = nNumChanCombinedConc;
             pSendScanCmd->u.scanCmd.u.scanRequest.BSSType = eCSR_BSS_TYPE_ANY;
-            pSendScanCmd->u.scanCmd.u.scanRequest.scanType = eSIR_ACTIVE_SCAN;
+            if (!pSendScanCmd->u.scanCmd.u.scanRequest.bcnRptReqScan)
+                pSendScanCmd->u.scanCmd.u.scanRequest.scanType = eSIR_ACTIVE_SCAN;
             //Use concurrency values for min/maxChnTime.
             //We know csrIsAnySessionConnected(pMac) returns TRUE here
             csrSetDefaultScanTiming(pMac, pSendScanCmd->u.scanCmd.u.scanRequest.scanType, &pSendScanCmd->u.scanCmd.u.scanRequest);
@@ -586,7 +612,8 @@
         } else {
             pSendScanCmd = pScanCmd;
             pSendScanCmd->u.scanCmd.u.scanRequest.BSSType = eCSR_BSS_TYPE_ANY;
-            pSendScanCmd->u.scanCmd.u.scanRequest.scanType = eSIR_ACTIVE_SCAN;
+            if (!pSendScanCmd->u.scanCmd.u.scanRequest.bcnRptReqScan)
+                pSendScanCmd->u.scanCmd.u.scanRequest.scanType = eSIR_ACTIVE_SCAN;
             //Use concurrency values for min/maxChnTime.
             //We know csrIsAnySessionConnected(pMac) returns TRUE here
             csrSetDefaultScanTiming(pMac, pSendScanCmd->u.scanCmd.u.scanRequest.scanType, &pSendScanCmd->u.scanCmd.u.scanRequest);
@@ -600,12 +627,12 @@
         if( fNoCmdPending )
         {
             if (pQueueScanCmd != NULL)
-            {
+            {            
                 csrLLInsertTail( &pMac->scan.scanCmdPendingList, &pQueueScanCmd->Link, LL_ACCESS_LOCK );
             }
 
             if (pSendScanCmd != NULL)
-            {
+            {            
                 return csrQueueSmeCommand(pMac, pSendScanCmd, eANI_BOOLEAN_FALSE);
             }
         }
@@ -626,7 +653,7 @@
     {  //No concurrency case
         smsLog( pMac, LOG2, FL("Queuing scan command (reason=%d, roamState=%d"
                 " numOfChannels=%d)"),
-                pScanCmd->u.scanCmd.reason,
+                pScanCmd->u.scanCmd.reason, 
                 pMac->roam.neighborRoamInfo.neighborRoamState,
                 pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels);
         return csrQueueSmeCommand(pMac, pScanCmd, eANI_BOOLEAN_FALSE);
@@ -638,14 +665,14 @@
 
 /* ---------------------------------------------------------------------------
     \fn csrScan2GOnyRequest
-    \brief This function will update the scan request with only
+    \brief This function will update the scan request with only 
            2.4GHz valid channel list.
     \param pMac
     \param pScanCmd
     \param pScanRequest
     \return None
   -------------------------------------------------------------------------------*/
-static void csrScan2GOnyRequest(tpAniSirGlobal pMac,tSmeCmd *pScanCmd,
+static void csrScan2GOnyRequest(tpAniSirGlobal pMac,tSmeCmd *pScanCmd, 
                                 tCsrScanRequest *pScanRequest)
 {
     tANI_U8 index, channelId, channelListSize = 0;
@@ -655,10 +682,10 @@
     VOS_ASSERT(pScanCmd && pScanRequest);
     /* To silence the KW tool null check is added */
     if((pScanCmd == NULL) || (pScanRequest == NULL))
-    {
+    { 
         smsLog( pMac, LOGE, FL(" pScanCmd or pScanRequest is NULL "));
         return;
-    }
+    }    
 
     if (pScanCmd->u.scanCmd.scanID ||
        (eCSR_SCAN_REQUEST_FULL_SCAN != pScanRequest->requestType))
@@ -678,20 +705,37 @@
     pScanRequest->ChannelInfo.ChannelList = validchannelList;
 }
 
-eHalStatus csrScanRequest(tpAniSirGlobal pMac, tANI_U16 sessionId,
-              tCsrScanRequest *pScanRequest, tANI_U32 *pScanRequestID,
+eHalStatus csrScanRequest(tpAniSirGlobal pMac, tANI_U16 sessionId, 
+              tCsrScanRequest *pScanRequest, tANI_U32 *pScanRequestID, 
               csrScanCompleteCallback callback, void *pContext)
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tSmeCmd *pScanCmd = NULL;
     eCsrConnectState ConnectState;
-
+    
     if(pScanRequest == NULL)
     {
         smsLog( pMac, LOGE, FL(" pScanRequest is NULL"));
         VOS_ASSERT(0);
     }
 
+    /* During group formation, the P2P client scans for GO with the specific SSID.
+     * There will be chances of GO switching to other channels because of scan or
+     * to STA channel in case of STA+GO MCC scenario. So to increase the possibility
+     * of client to find the GO, the dwell time of scan is increased to 100ms.
+     */
+    if(pScanRequest->p2pSearch)
+    {
+        //If the scan request is for specific SSId the length of SSID will be
+        //greater than 7 as SSID for p2p search contains "DIRECT-")
+        if(pScanRequest->SSIDs.SSIDList->SSID.length > DIRECT_SSID_LEN)
+        {
+            smsLog( pMac, LOG1, FL(" Increase the Dwell time to 100ms."));
+            pScanRequest->maxChnTime = MAX_CHN_TIME_TO_FIND_GO;
+            pScanRequest->minChnTime = MIN_CHN_TIME_TO_FIND_GO;
+        }
+    }
+
     do
     {
         if(pMac->scan.fScanEnable)
@@ -699,8 +743,8 @@
             pScanCmd = csrGetCommandBuffer(pMac);
             if(pScanCmd)
             {
-                palZeroMemory(pMac->hHdd, &pScanCmd->u.scanCmd, sizeof(tScanCmd));
-                pScanCmd->command = eSmeCommandScan;
+                vos_mem_set(&pScanCmd->u.scanCmd, sizeof(tScanCmd), 0);
+                pScanCmd->command = eSmeCommandScan; 
                 pScanCmd->sessionId = sessionId;
                 pScanCmd->u.scanCmd.callback = callback;
                 pScanCmd->u.scanCmd.pContext = pContext;
@@ -745,11 +789,21 @@
                     if(csrIsAnySessionConnected(pMac))
                     {
                         pScanRequest->restTime = pMac->roam.configParam.nRestTimeConc;
+                        if(pScanRequest->scanType == eSIR_ACTIVE_SCAN)
+                        {
+                            pScanRequest->maxChnTime = pMac->roam.configParam.nActiveMaxChnTimeConc;
+                            pScanRequest->minChnTime = pMac->roam.configParam.nActiveMinChnTimeConc;
+                        }
+                        else
+                        {
+                            pScanRequest->maxChnTime = pMac->roam.configParam.nPassiveMaxChnTimeConc;
+                            pScanRequest->minChnTime = pMac->roam.configParam.nPassiveMinChnTimeConc;
+                        }
                     }
                 }
 #endif
                  /*For Standalone wlan : channel time will remain the same.
-                   For BTC with A2DP up: Channel time = Channel time * 2 , if station is not already associated.
+                   For BTC with A2DP up: Channel time = Channel time * 2, if station is not already associated.
                    This has been done to provide a larger scan window for faster connection during btc.Else Scan is seen
                    to take a long time.
                    For BTC with A2DP up: Channel time will not be doubled, if station is already associated.
@@ -762,26 +816,26 @@
                 {
                     pScanRequest->maxChnTime = pScanRequest->maxChnTime << 1;
                     pScanRequest->minChnTime = pScanRequest->minChnTime << 1;
-                }
+                }  
 
-		pScanRequest->maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
-		pScanRequest->minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
+                pScanRequest->maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
+                pScanRequest->minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
                 //Need to make the following atomic
                 pScanCmd->u.scanCmd.scanID = pMac->scan.nextScanID++; //let it wrap around
-
+                
                 if(pScanRequestID)
                 {
-                    *pScanRequestID = pScanCmd->u.scanCmd.scanID;
+                    *pScanRequestID = pScanCmd->u.scanCmd.scanID; 
                 }
 
-                // If it is the first scan request from HDD, CSR checks if it is for 11d.
-                // If it is not, CSR will save the scan request in the pending cmd queue
+                // If it is the first scan request from HDD, CSR checks if it is for 11d. 
+                // If it is not, CSR will save the scan request in the pending cmd queue 
                 // & issue an 11d scan request to PE.
                 if (((0 == pScanCmd->u.scanCmd.scanID)
                    && (eCSR_SCAN_REQUEST_11D_SCAN != pScanRequest->requestType))
 #ifdef SOFTAP_CHANNEL_RANGE
                    && (eCSR_SCAN_SOFTAP_CHANNEL_RANGE != pScanRequest->requestType)
-#endif
+#endif                   
                    && (eANI_BOOLEAN_FALSE == pMac->scan.fEnableBypass11d)
                    )
                 {
@@ -789,24 +843,23 @@
                     tCsrScanRequest scanReq;
                     tCsrChannelInfo *pChnInfo = &scanReq.ChannelInfo;
 
-                    palZeroMemory(pMac->hHdd, &scanReq, sizeof(tCsrScanRequest));
+                    vos_mem_set(&scanReq, sizeof(tCsrScanRequest), 0);
 
                     p11dScanCmd = csrGetCommandBuffer(pMac);
                     if (p11dScanCmd)
                     {
                         tANI_U32 numChn = pMac->scan.baseChannels.numChannels;
 
-                        palZeroMemory(pMac->hHdd, &p11dScanCmd->u.scanCmd, sizeof(tScanCmd));
-                        status = palAllocateMemory( pMac->hHdd, (void **)&pChnInfo->ChannelList, numChn );
+                        vos_mem_set(&p11dScanCmd->u.scanCmd, sizeof(tScanCmd), 0);
+                        pChnInfo->ChannelList = vos_mem_malloc(numChn);
+                        if ( NULL == pChnInfo->ChannelList )
+                            return eHAL_STATUS_FAILURE;
+                        vos_mem_copy(pChnInfo->ChannelList,
+                                     pMac->scan.baseChannels.channelList, numChn);
+                        status = eHAL_STATUS_SUCCESS;
                         if ( !HAL_STATUS_SUCCESS( status ) )
                         {
-                            break;
-                        }
-                        status = palCopyMemory( pMac->hHdd, pChnInfo->ChannelList,
-                                    pMac->scan.baseChannels.channelList, numChn );
-                        if ( !HAL_STATUS_SUCCESS( status ) )
-                        {
-                            palFreeMemory( pMac->hHdd, pChnInfo->ChannelList );
+                            vos_mem_free(pChnInfo->ChannelList);
                             pChnInfo->ChannelList = NULL;
                             break;
                         }
@@ -814,12 +867,18 @@
                         p11dScanCmd->command = eSmeCommandScan;
                         p11dScanCmd->u.scanCmd.callback = NULL;
                         p11dScanCmd->u.scanCmd.pContext = NULL;
-                        p11dScanCmd->u.scanCmd.scanID = pMac->scan.nextScanID++;
+                        p11dScanCmd->u.scanCmd.scanID = pMac->scan.nextScanID++;                
                         scanReq.BSSType = eCSR_BSS_TYPE_ANY;
 
                         if ( csrIs11dSupported(pMac) )
                         {
-                            scanReq.scanType = eSIR_PASSIVE_SCAN;
+                            scanReq.bcnRptReqScan = pScanRequest->bcnRptReqScan;
+                            if (pScanRequest->bcnRptReqScan)
+                                scanReq.scanType = pScanRequest->scanType ?
+                                                   eSIR_PASSIVE_SCAN :
+                                                   pScanRequest->scanType;
+                            else
+                                scanReq.scanType = eSIR_PASSIVE_SCAN;
                             scanReq.requestType = eCSR_SCAN_REQUEST_11D_SCAN;
                             p11dScanCmd->u.scanCmd.reason = eCsrScan11d1;
                             scanReq.maxChnTime = pMac->roam.configParam.nPassiveMaxChnTime;
@@ -827,19 +886,23 @@
                         }
                         else
                         {
-                            scanReq.scanType = eSIR_ACTIVE_SCAN;
+                            scanReq.bcnRptReqScan = pScanRequest->bcnRptReqScan;
+                            if (pScanRequest->bcnRptReqScan)
+                                scanReq.scanType = pScanRequest->scanType;
+                            else
+                                scanReq.scanType = eSIR_ACTIVE_SCAN;
                             scanReq.requestType = eCSR_SCAN_IDLE_MODE_SCAN;
                             p11dScanCmd->u.scanCmd.reason = eCsrScanIdleScan;
                             scanReq.maxChnTime = pMac->roam.configParam.nActiveMaxChnTime;
                             scanReq.minChnTime = pMac->roam.configParam.nActiveMinChnTime;
 
-			    scanReq.maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
-			    scanReq.minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
+                            scanReq.maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
+                            scanReq.minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
                         }
 
                         status = csrScanCopyRequest(pMac, &p11dScanCmd->u.scanCmd.u.scanRequest, &scanReq);
                         //Free the channel list
-                        palFreeMemory( pMac->hHdd, pChnInfo->ChannelList );
+                        vos_mem_free(pChnInfo->ChannelList);
                         pChnInfo->ChannelList = NULL;
 
                         if (HAL_STATUS_SUCCESS(status))
@@ -853,14 +916,14 @@
                                                             eANI_BOOLEAN_FALSE);
 #else
                             status = csrQueueSmeCommand(pMac, p11dScanCmd, eANI_BOOLEAN_FALSE);
-#endif
+#endif                   
                             if( !HAL_STATUS_SUCCESS( status ) )
                             {
                                 smsLog( pMac, LOGE, FL(" fail to send message status = %d"), status );
                                 break;
                             }
                         }
-                        else
+                        else 
                         {
                             break;
                         }
@@ -892,7 +955,7 @@
                         status = csrQueueSmeCommand(pMac, pScanCmd,
                                                     eANI_BOOLEAN_FALSE);
 #else
-                    status = csrQueueSmeCommand(pMac, pScanCmd, eANI_BOOLEAN_FALSE);
+                    status = csrQueueSmeCommand(pMac, pScanCmd, eANI_BOOLEAN_FALSE);                   
 #endif
                     if( !HAL_STATUS_SUCCESS( status ) )
                     {
@@ -900,13 +963,13 @@
                         break;
                     }
                 }
-                else
+                else 
                 {
                     smsLog( pMac, LOGE, FL(" fail to copy request status = %d"), status );
                     break;
                 }
             }
-            else
+            else 
             {
                 smsLog( pMac, LOGE, FL(" pScanCmd is NULL"));
                 break;
@@ -932,14 +995,14 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSmeCmd *pScanCmd;
-
+    
     if(pMac->scan.fScanEnable)
     {
         pScanCmd = csrGetCommandBuffer(pMac);
         if(pScanCmd)
         {
             pScanCmd->command = eSmeCommandScan;
-            palZeroMemory(pMac->hHdd, &pScanCmd->u.scanCmd, sizeof(tScanCmd));
+            vos_mem_set(&pScanCmd->u.scanCmd, sizeof(tScanCmd), 0);
             pScanCmd->u.scanCmd.callback = NULL;
             pScanCmd->u.scanCmd.pContext = NULL;
             pScanCmd->u.scanCmd.reason = eCsrScanGetResult;
@@ -952,14 +1015,14 @@
                 csrReleaseCommandScan(pMac, pScanCmd);
             }
         }
-        else
+        else 
         {
             //log error
             smsLog(pMac, LOGE, FL("can not obtain a common buffer"));
             status = eHAL_STATUS_RESOURCES;
         }
     }
-
+    
     return (status);
 }
 
@@ -977,7 +1040,7 @@
         {
             pScanCmd->command = eSmeCommandScan;
             pScanCmd->sessionId = sessionId;
-            palZeroMemory(pMac->hHdd, &pScanCmd->u.scanCmd, sizeof(tScanCmd));
+            vos_mem_set(&pScanCmd->u.scanCmd, sizeof(tScanCmd), 0);
             pScanCmd->u.scanCmd.callback = callback;
             pScanCmd->u.scanCmd.pContext = pContext;
             pScanCmd->u.scanCmd.reason = eCsrScanGetLfrResult;
@@ -1008,7 +1071,7 @@
     tANI_U32 scanId;
     tCsrScanRequest scanReq;
 
-    palZeroMemory(pMac->hHdd, &scanReq, sizeof(tCsrScanRequest));
+    vos_mem_set(&scanReq, sizeof(tCsrScanRequest), 0);
     scanReq.BSSType = eCSR_BSS_TYPE_ANY;
     scanReq.scanType = eSIR_ACTIVE_SCAN;
     scanReq.requestType = reqType;
@@ -1016,9 +1079,9 @@
     scanReq.minChnTime = pMac->roam.configParam.nActiveMinChnTime;
     scanReq.maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
     scanReq.minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
-    //Scan with invalid sessionId.
+    //Scan with invalid sessionId. 
     //This results in SME using the first available session to scan.
-    status = csrScanRequest(pMac, CSR_SESSION_ID_INVALID, &scanReq,
+    status = csrScanRequest(pMac, CSR_SESSION_ID_INVALID, &scanReq, 
                             &scanId, NULL, NULL);
 
     return (status);
@@ -1053,10 +1116,14 @@
             break;
         }
         //Here is the profile we need to connect to
-        status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
-        if(!HAL_STATUS_SUCCESS(status))
+        pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+        if ( NULL == pScanFilter)
+                status = eHAL_STATUS_FAILURE;
+        else
+                status = eHAL_STATUS_SUCCESS;
+        if (!HAL_STATUS_SUCCESS(status))
             break;
-        palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
+        vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
         if(NULL == pSession->pCurRoamProfile)
         {
             pScanFilter->EncryptionType.numEntries = 1;
@@ -1065,10 +1132,14 @@
         else
         {
             //We have to make a copy of pCurRoamProfile because it will be free inside csrRoamIssueConnect
-            status = palAllocateMemory(pMac->hHdd, (void **)&pProfile, sizeof(tCsrRoamProfile));
-            if(!HAL_STATUS_SUCCESS(status))
-                break;
-            palZeroMemory(pMac->hHdd, pProfile, sizeof(tCsrRoamProfile));
+            pProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+            if ( NULL == pProfile )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+            if (!HAL_STATUS_SUCCESS(status))
+                  break;
+            vos_mem_set(pProfile, sizeof(tCsrRoamProfile), 0);
             status = csrRoamCopyProfile(pMac, pProfile, pSession->pCurRoamProfile);
             if(!HAL_STATUS_SUCCESS(status))
                 break;
@@ -1085,7 +1156,7 @@
                     //we want to put the last connected BSS to the very beginning, if possible
                     csrMoveBssToHeadFromBSSID(pMac, &pSession->connectedProfile.bssid, hBSSList);
                 }
-                status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, reason,
+                status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, reason, 
                                                 roamId, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_TRUE);
                 if(!HAL_STATUS_SUCCESS(status))
                 {
@@ -1098,12 +1169,12 @@
     {
         //we need to free memory for filter if profile exists
         csrFreeScanFilter(pMac, pScanFilter);
-        palFreeMemory(pMac->hHdd, pScanFilter);
+        vos_mem_free(pScanFilter);
     }
     if(NULL != pProfile)
     {
         csrReleaseProfile(pMac, pProfile);
-        palFreeMemory(pMac->hHdd, (void *)pProfile);
+        vos_mem_free(pProfile);
     }
 
     return (status);
@@ -1115,14 +1186,14 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSmeCmd *pScanCmd;
-
+    
     if(pMac->scan.fScanEnable)
     {
         pScanCmd = csrGetCommandBuffer(pMac);
         if(pScanCmd)
         {
             pScanCmd->command = eSmeCommandScan;
-            palZeroMemory(pMac->hHdd, &pScanCmd->u.scanCmd, sizeof(tScanCmd));
+            vos_mem_set(&pScanCmd->u.scanCmd, sizeof(tScanCmd), 0);
             pScanCmd->u.scanCmd.callback = callback;
             pScanCmd->u.scanCmd.pContext = pContext;
             pScanCmd->u.scanCmd.reason = eCsrScanGetScanChnInfo;
@@ -1136,14 +1207,14 @@
                 csrReleaseCommandScan(pMac, pScanCmd);
             }
         }
-        else
+        else 
         {
             //log error
             smsLog(pMac, LOGE, FL("can not obtain a common buffer"));
             status = eHAL_STATUS_RESOURCES;
         }
     }
-
+    
     return (status);
 }
 
@@ -1173,7 +1244,7 @@
             //try lostlink scan2
             status = csrScanRequestLostLink2(pMac, sessionId);
         }
-        else if(!pSession->pCurRoamProfile->ChannelInfo.ChannelList ||
+        else if(!pSession->pCurRoamProfile->ChannelInfo.ChannelList || 
                 pSession->pCurRoamProfile->ChannelInfo.ChannelList[0] == 0)
         {
             //go straight to lostlink scan3
@@ -1194,7 +1265,7 @@
         status = csrScanRequestLostLink3(pMac, sessionId);
     }
 
-    return (status);
+    return (status);    
 }
 
 
@@ -1215,7 +1286,7 @@
     {
         csrScanStartIdleScan(pMac);
     }
-    else if(!pSession->pCurRoamProfile || !pSession->pCurRoamProfile->ChannelInfo.ChannelList ||
+    else if(!pSession->pCurRoamProfile || !pSession->pCurRoamProfile->ChannelInfo.ChannelList || 
                 pSession->pCurRoamProfile->ChannelInfo.ChannelList[0] == 0)
     {
         //try lostlink scan3
@@ -1230,7 +1301,7 @@
         }
     }
 
-    return (status);
+    return (status);    
 }
 
 
@@ -1245,8 +1316,8 @@
         //we are done with lostlink
         csrScanStartIdleScan(pMac);
     }
-
-    return (status);
+    
+    return (status);    
 }
 
 
@@ -1279,7 +1350,7 @@
             status = eHAL_STATUS_RESOURCES;
             break;
         }
-        palZeroMemory(pMac->hHdd, &pCommand->u.scanCmd, sizeof(tScanCmd));
+        vos_mem_set(&pCommand->u.scanCmd, sizeof(tScanCmd), 0);
         pCommand->command = eSmeCommandScan;
         pCommand->sessionId = (tANI_U8)sessionId;
         pCommand->u.scanCmd.reason = eCsrScanLostLink1;
@@ -1292,14 +1363,18 @@
         pCommand->u.scanCmd.u.scanRequest.scanType = eSIR_ACTIVE_SCAN;
         if(pSession->connectedProfile.SSID.length)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList, sizeof(tCsrSSIDInfo));
+            pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList = vos_mem_malloc(sizeof(tCsrSSIDInfo));
+            if ( NULL == pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
             pCommand->u.scanCmd.u.scanRequest.SSIDs.numOfSSIDs = 1;
-            palCopyMemory(pMac->hHdd, &pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList[0].SSID,
-                                &pSession->connectedProfile.SSID, sizeof(tSirMacSSid));
+            vos_mem_copy(&pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList[0].SSID,
+                         &pSession->connectedProfile.SSID, sizeof(tSirMacSSid));
         }
         else
         {
@@ -1307,12 +1382,16 @@
         }
         if(pSession->pCurRoamProfile)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
+            pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+            if ( NULL == pScanFilter )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
-            palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
+            vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
             status = csrRoamPrepareFilterFromProfile(pMac, pSession->pCurRoamProfile, pScanFilter);
             if(!HAL_STATUS_SUCCESS(status))
             {
@@ -1323,8 +1402,12 @@
             if(HAL_STATUS_SUCCESS((csrScanGetResult(pMac, pScanFilter, &hBSSList))) && hBSSList)
             {
                 tANI_U8 i, nChn = 0;
-                status = palAllocateMemory(pMac->hHdd, (void **)&pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList,
-                            WNI_CFG_VALID_CHANNEL_LIST_LEN);
+                pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList =
+                               vos_mem_malloc(WNI_CFG_VALID_CHANNEL_LIST_LEN);
+                if ( NULL == pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList )
+                        status = eHAL_STATUS_FAILURE;
+                else
+                        status = eHAL_STATUS_SUCCESS;
                 if(!HAL_STATUS_SUCCESS(status))
                 {
                     break;
@@ -1334,7 +1417,7 @@
                 {
                     for(i = 0; i < nChn; i++)
                     {
-                        if(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[i] ==
+                        if(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[i] == 
                                         pScanResult->BssDescriptor.channelId)
                         {
                             break;
@@ -1350,7 +1433,7 @@
                 {
                     for(i = 0; i < nChn; i++)
                     {
-                        if(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[i] ==
+                        if(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[i] == 
                                         pSession->connectedProfile.operationChannel)
                         {
                             break;
@@ -1367,22 +1450,25 @@
             {
                 if(csrRoamIsChannelValid(pMac, pSession->connectedProfile.operationChannel))
                 {
-                    status = palAllocateMemory(pMac->hHdd, (void **)&pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList,
-                                1);
+                    pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = vos_mem_malloc(1);
+                    if ( NULL == pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList )
+                        status = eHAL_STATUS_FAILURE;
+                    else
+                        status = eHAL_STATUS_SUCCESS;
                     //just try the last connected channel
                     if(HAL_STATUS_SUCCESS(status))
                     {
                         pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[0] = pSession->connectedProfile.operationChannel;
                         pCommand->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = 1;
                     }
-                    else
+                    else 
                     {
                         break;
                     }
                 }
             }
         }
-        palCopyMemory(pMac->hHdd, &pCommand->u.scanCmd.u.scanRequest.bssid, bAddr, sizeof(tCsrBssid));
+        vos_mem_copy(&pCommand->u.scanCmd.u.scanRequest.bssid, bAddr, sizeof(tCsrBssid));
         status = csrQueueSmeCommand(pMac, pCommand, eANI_BOOLEAN_FALSE);
         if( !HAL_STATUS_SUCCESS( status ) )
         {
@@ -1403,7 +1489,7 @@
     if(pScanFilter)
     {
         csrFreeScanFilter(pMac, pScanFilter);
-        palFreeMemory(pMac->hHdd, pScanFilter);
+        vos_mem_free(pScanFilter);
     }
     if(hBSSList)
     {
@@ -1441,7 +1527,7 @@
             status = eHAL_STATUS_RESOURCES;
             break;
         }
-        palZeroMemory(pMac->hHdd, &pCommand->u.scanCmd, sizeof(tScanCmd));
+        vos_mem_set(&pCommand->u.scanCmd, sizeof(tScanCmd), 0);
         pCommand->command = eSmeCommandScan;
         pCommand->sessionId = (tANI_U8)sessionId;
         pCommand->u.scanCmd.reason = eCsrScanLostLink2;
@@ -1454,12 +1540,16 @@
         pCommand->u.scanCmd.u.scanRequest.scanType = eSIR_ACTIVE_SCAN;
         if(pSession->pCurRoamProfile)
         {
-            status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
-            if(!HAL_STATUS_SUCCESS(status))
+            pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+            if ( NULL == pScanFilter )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+            if (!HAL_STATUS_SUCCESS(status))
             {
                 break;
             }
-            palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
+            vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
             status = csrRoamPrepareFilterFromProfile(pMac, pSession->pCurRoamProfile, pScanFilter);
             if(!HAL_STATUS_SUCCESS(status))
             {
@@ -1473,9 +1563,13 @@
             if(hBSSList)
             {
                 tANI_U8 i, nChn = 0;
-                status = palAllocateMemory(pMac->hHdd, (void **)&pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList,
-                            WNI_CFG_VALID_CHANNEL_LIST_LEN);
-                if(!HAL_STATUS_SUCCESS(status))
+                pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList =
+                                   vos_mem_malloc(WNI_CFG_VALID_CHANNEL_LIST_LEN);
+                if ( NULL == pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList )
+                        status = eHAL_STATUS_FAILURE;
+                else
+                        status = eHAL_STATUS_SUCCESS;
+                if (!HAL_STATUS_SUCCESS(status))
                 {
                     break;
                 }
@@ -1484,7 +1578,7 @@
                 {
                     for(i = 0; i < nChn; i++)
                     {
-                        if(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[i] ==
+                        if(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[i] == 
                                         pScanResult->BssDescriptor.channelId)
                         {
                             break;
@@ -1498,7 +1592,7 @@
                 pCommand->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = nChn;
             }
         }
-        palCopyMemory(pMac->hHdd, &pCommand->u.scanCmd.u.scanRequest.bssid, bAddr, sizeof(tCsrBssid));
+        vos_mem_copy(&pCommand->u.scanCmd.u.scanRequest.bssid, bAddr, sizeof(tCsrBssid));
         //Put to the head in pending queue
         status = csrQueueSmeCommand(pMac, pCommand, eANI_BOOLEAN_TRUE);
         if( !HAL_STATUS_SUCCESS( status ) )
@@ -1520,7 +1614,7 @@
     if(pScanFilter)
     {
         csrFreeScanFilter(pMac, pScanFilter);
-        palFreeMemory(pMac->hHdd, pScanFilter);
+        vos_mem_free(pScanFilter);
     }
     if(hBSSList)
     {
@@ -1547,7 +1641,7 @@
             status = eHAL_STATUS_RESOURCES;
             break;
         }
-        palZeroMemory(pMac->hHdd, &pCommand->u.scanCmd, sizeof(tScanCmd));
+        vos_mem_set(&pCommand->u.scanCmd, sizeof(tScanCmd), 0);
         pCommand->command = eSmeCommandScan;
         pCommand->sessionId = (tANI_U8)sessionId;
         pCommand->u.scanCmd.reason = eCsrScanLostLink3;
@@ -1558,7 +1652,7 @@
         pCommand->u.scanCmd.u.scanRequest.maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
         pCommand->u.scanCmd.u.scanRequest.minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
         pCommand->u.scanCmd.u.scanRequest.scanType = eSIR_ACTIVE_SCAN;
-        palCopyMemory(pMac->hHdd, &pCommand->u.scanCmd.u.scanRequest.bssid, bAddr, sizeof(tCsrBssid));
+        vos_mem_copy(&pCommand->u.scanCmd.u.scanRequest.bssid, bAddr, sizeof(tCsrBssid));
         //Put to the head of pending queue
         status = csrQueueSmeCommand(pMac, pCommand, eANI_BOOLEAN_TRUE);
         if( !HAL_STATUS_SUCCESS( status ) )
@@ -1596,6 +1690,19 @@
 #endif
     do
     {
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+        //if this scan is for LFR
+        if(pMac->roam.neighborRoamInfo.uOsRequestedHandoff)
+        {
+            //notify LFR state m/c
+            if(eHAL_STATUS_SUCCESS != csrNeighborRoamSssidScanDone(pMac, eHAL_STATUS_SUCCESS))
+            {
+                csrNeighborRoamStartLfrScan(pMac);
+            }
+            status = eHAL_STATUS_SUCCESS;
+            break;
+        }
+#endif
         //If there is roam command waiting, ignore this roam because the newer roam command is the one to execute
         if(csrIsRoamCommandWaitingForSession(pMac, sessionId))
         {
@@ -1604,17 +1711,21 @@
         }
         if(pProfile == NULL)
             break;
-        status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
-        if(!HAL_STATUS_SUCCESS(status))
+        pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+        if ( NULL == pScanFilter )
+                status = eHAL_STATUS_FAILURE;
+        else
+                status = eHAL_STATUS_SUCCESS;
+        if (!HAL_STATUS_SUCCESS(status))
             break;
-        palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
+        vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
         status = csrRoamPrepareFilterFromProfile(pMac, pProfile, pScanFilter);
         if(!HAL_STATUS_SUCCESS(status))
             break;
         status = csrScanGetResult(pMac, pScanFilter, &hBSSList);
         if(!HAL_STATUS_SUCCESS(status))
             break;
-        status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, eCsrHddIssued,
+        status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, eCsrHddIssued, 
                                     pCommand->u.scanCmd.roamId, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_TRUE);
         if(!HAL_STATUS_SUCCESS(status))
         {
@@ -1641,21 +1752,20 @@
         {
             //Save the roma profile so we can retry
             csrFreeRoamProfile( pMac, sessionId );
-            if (HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd,
-                                  (void **)&pSession->pCurRoamProfile,
-                                  sizeof(tCsrRoamProfile))))
+            pSession->pCurRoamProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+            if ( NULL != pSession->pCurRoamProfile )
             {
-                palZeroMemory(pMac->hHdd, pSession->pCurRoamProfile, sizeof(tCsrRoamProfile));
+                vos_mem_set(pSession->pCurRoamProfilee, sizeof(tCsrRoamProfile), 0);
                 csrRoamCopyProfile(pMac, pSession->pCurRoamProfile, pProfile);
             }
             csrRoamStartJoinRetryTimer(pMac, sessionId, CSR_JOIN_RETRY_TIMEOUT_PERIOD);
         }
 #endif
     }
-    if(pScanFilter)
+    if (pScanFilter)
     {
         csrFreeScanFilter(pMac, pScanFilter);
-        palFreeMemory(pMac->hHdd, pScanFilter);
+        vos_mem_free(pScanFilter);
     }
 
     return (status);
@@ -1668,7 +1778,18 @@
     tANI_U32 sessionId = pCommand->sessionId;
     tCsrRoamProfile *pProfile = pCommand->u.scanCmd.pToRoamProfile;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    //if this scan is for LFR
+    if(pMac->roam.neighborRoamInfo.uOsRequestedHandoff)
+    {
+        //notify LFR state m/c
+        if(eHAL_STATUS_SUCCESS != csrNeighborRoamSssidScanDone(pMac, eHAL_STATUS_FAILURE))
+        {
+            csrNeighborRoamStartLfrScan(pMac);
+        }
+        return eHAL_STATUS_SUCCESS;
+    }
+#endif
     if(!pSession)
     {
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
@@ -1679,8 +1800,9 @@
     if(pCommand->u.scanCmd.u.scanRequest.SSIDs.numOfSSIDs == 1)
     {
         char str[36];
-        palCopyMemory(pMac->hHdd, str, pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList[0].SSID.ssId,
-            pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList[0].SSID.length);
+        vos_mem_copy(str,
+                     pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList[0].SSID.ssId,
+                     pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList[0].SSID.length);
         str[pCommand->u.scanCmd.u.scanRequest.SSIDs.SSIDList[0].SSID.length] = 0;
         smsLog(pMac, LOGW, FL(" SSID = %s"), str);
     }
@@ -1688,7 +1810,7 @@
     //Check whether it is for start ibss. No need to do anything if it is a JOIN request
     if(pProfile && CSR_IS_START_IBSS(pProfile))
     {
-        status = csrRoamIssueConnect(pMac, sessionId, pProfile, NULL, eCsrHddIssued,
+        status = csrRoamIssueConnect(pMac, sessionId, pProfile, NULL, eCsrHddIssued, 
                                         pCommand->u.scanCmd.roamId, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_TRUE);
         if(!HAL_STATUS_SUCCESS(status))
         {
@@ -1696,7 +1818,7 @@
             csrRoamCallCallback(pMac, sessionId, NULL, pCommand->u.scanCmd.roamId, eCSR_ROAM_FAILED, eCSR_ROAM_RESULT_FAILURE);
         }
     }
-    else
+    else 
     {
         eCsrRoamResult roamResult = eCSR_ROAM_RESULT_FAILURE;
 
@@ -1711,11 +1833,11 @@
             if(pSession->bRefAssocStartCnt > 0)
             {
                 tCsrRoamInfo *pRoamInfo = NULL, roamInfo;
-                palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+                vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
                 pRoamInfo = &roamInfo;
                 if(pCommand->u.roamCmd.pRoamBssEntry)
                 {
-                    tCsrScanResult *pScanResult =
+                    tCsrScanResult *pScanResult = 
                                 GET_BASE_ADDR(pCommand->u.roamCmd.pRoamBssEntry,
                                 tCsrScanResult, Link);
                     roamInfo.pBssDesc = &pScanResult->Result.BssDescriptor;
@@ -1741,11 +1863,10 @@
             {
                 //Save the roma profile so we can retry
                 csrFreeRoamProfile( pMac, sessionId );
-                if (HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd,
-                                      (void **)&pSession->pCurRoamProfile,
-                                      sizeof(tCsrRoamProfile))))
+                pSession->pCurRoamProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+                if ( NULL != pSession->pCurRoamProfile )
                 {
-                    palZeroMemory(pMac->hHdd, pSession->pCurRoamProfile, sizeof(tCsrRoamProfile));
+                    vos_mem_set(pSession->pCurRoamProfile, sizeof(tCsrRoamProfile), 0);
                     csrRoamCopyProfile(pMac, pSession->pCurRoamProfile, pProfile);
                 }
                 csrRoamStartJoinRetryTimer(pMac, sessionId, CSR_JOIN_RETRY_TIMEOUT_PERIOD);
@@ -1776,12 +1897,16 @@
     do
     {
         //Here is the profile we need to connect to
-        status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
-        if(!HAL_STATUS_SUCCESS(status))
+        pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+        if ( NULL == pScanFilter )
+                status = eHAL_STATUS_FAILURE;
+        else
+                status = eHAL_STATUS_SUCCESS;
+        if (!HAL_STATUS_SUCCESS(status))
             break;
-        palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
-        if(NULL == pSession) break;
-        if(NULL == pSession->pCurRoamProfile)
+        vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
+        if (NULL == pSession) break;
+        if (NULL == pSession->pCurRoamProfile)
         {
             pScanFilter->EncryptionType.numEntries = 1;
             pScanFilter->EncryptionType.encryptionType[0] = eCSR_ENCRYPT_TYPE_NONE;
@@ -1789,7 +1914,11 @@
         else
         {
             //We have to make a copy of pCurRoamProfile because it will be free inside csrRoamIssueConnect
-            status = palAllocateMemory(pMac->hHdd, (void **)&pProfile, sizeof(tCsrRoamProfile));
+            pProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+            if ( NULL == pProfile )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             if(!HAL_STATUS_SUCCESS(status))
                 break;
             status = csrRoamCopyProfile(pMac, pProfile, pSession->pCurRoamProfile);
@@ -1805,7 +1934,7 @@
             {
                 //we want to put the last connected BSS to the very beginning, if possible
                 csrMoveBssToHeadFromBSSID(pMac, &pSession->connectedProfile.bssid, hBSSList);
-                status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList,
+                status = csrRoamIssueConnect(pMac, sessionId, pProfile, hBSSList, 
                                             eCsrCapsChange, 0, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_TRUE);
                 if(!HAL_STATUS_SUCCESS(status))
                 {
@@ -1829,12 +1958,12 @@
     if(pScanFilter)
     {
         csrFreeScanFilter(pMac, pScanFilter);
-        palFreeMemory(pMac->hHdd, pScanFilter);
+        vos_mem_free(pScanFilter);
     }
     if(NULL != pProfile)
     {
         csrReleaseProfile(pMac, pProfile);
-        palFreeMemory(pMac->hHdd, pProfile);
+        vos_mem_free(pProfile);
     }
 
     return (status);
@@ -1846,12 +1975,12 @@
 {
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
     tScanResultList *pScanList = (tScanResultList *)hScanList;
-
+     
     if(pScanList)
     {
         status = csrLLScanPurgeResult(pMac, &pScanList->List);
         csrLLClose(&pScanList->List);
-        palFreeMemory(pMac->hHdd, pScanList);
+        vos_mem_free(pScanList);
     }
     return (status);
 }
@@ -1889,7 +2018,8 @@
         }
     }
 #endif
-    if( pIes )
+    /* if strict select 5GHz is non-zero then ignore the capability checking */
+    if (pIes && !CSR_IS_SELECT_5GHZ_MARGIN(pMac))
     {
         //We only care about 11N capability
         if(pIes->HTCaps.present)
@@ -1940,12 +2070,12 @@
 }
 
 
-#ifdef FEATURE_WLAN_LFR
+#ifdef FEATURE_WLAN_LFR 
 //Add the channel to the occupiedChannels array
 static void csrScanAddToOccupiedChannels(
-        tpAniSirGlobal pMac,
-        tCsrScanResult *pResult,
-        tCsrChannel *pOccupiedChannels,
+        tpAniSirGlobal pMac, 
+        tCsrScanResult *pResult, 
+        tCsrChannel *pOccupiedChannels, 
         tDot11fBeaconIEs *pIes)
 {
     eHalStatus status;
@@ -1958,15 +2088,15 @@
     if (!csrIsChannelPresentInList(pOccupiedChannelList, numOccupiedChannels, channel)
         && csrNeighborRoamConnectedProfileMatch(pMac, pResult, pIes))
     {
-        status = csrAddToChannelListFront(pOccupiedChannelList, numOccupiedChannels, channel);
+        status = csrAddToChannelListFront(pOccupiedChannelList, numOccupiedChannels, channel); 
         if(HAL_STATUS_SUCCESS(status))
-        {
+        { 
             pOccupiedChannels->numChannels++;
             smsLog(pMac, LOG2, FL("%s: added channel %d to the list (count=%d)"),
               __func__, channel, pOccupiedChannels->numChannels);
-            if (pOccupiedChannels->numChannels > CSR_BG_SCAN_OCCUPIED_CHANNEL_LIST_LEN)
-                pOccupiedChannels->numChannels = CSR_BG_SCAN_OCCUPIED_CHANNEL_LIST_LEN;
-        }
+            if (pOccupiedChannels->numChannels > CSR_BG_SCAN_OCCUPIED_CHANNEL_LIST_LEN) 
+                pOccupiedChannels->numChannels = CSR_BG_SCAN_OCCUPIED_CHANNEL_LIST_LEN; 
+        } 
     }
 }
 #endif
@@ -1975,17 +2105,17 @@
 //pIes can not be NULL
 static void csrScanAddResult(tpAniSirGlobal pMac, tCsrScanResult *pResult, tDot11fBeaconIEs *pIes)
 {
-#ifdef FEATURE_WLAN_LFR
+#ifdef FEATURE_WLAN_LFR 
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
 #endif
 
     pResult->preferValue = csrGetBssPreferValue(pMac, (int)pResult->Result.BssDescriptor.rssi);
     pResult->capValue = csrGetBssCapValue(pMac, &pResult->Result.BssDescriptor, pIes);
     csrLLInsertTail( &pMac->scan.scanResultList, &pResult->Link, LL_ACCESS_LOCK );
-#ifdef FEATURE_WLAN_LFR
+#ifdef FEATURE_WLAN_LFR 
     if(0 == pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels)
     {
-        /* Build the occupied channel list, only if "gNeighborScanChannelList" is
+        /* Build the occupied channel list, only if "gNeighborScanChannelList" is 
            NOT set in the cfg.ini file */
         csrScanAddToOccupiedChannels(pMac, pResult, &pMac->scan.occupiedChannels, pIes);
     }
@@ -2005,21 +2135,108 @@
     eCsrAuthType auth = eCSR_AUTH_TYPE_OPEN_SYSTEM;
     tDot11fBeaconIEs *pIes, *pNewIes;
     tANI_BOOLEAN fMatch;
-
+    tANI_U16 i = 0;
+    
     if(phResult)
     {
         *phResult = CSR_INVALID_SCANRESULT_HANDLE;
     }
-    status = palAllocateMemory(pMac->hHdd, (void **)&pRetList, sizeof(tScanResultList));
-    if(HAL_STATUS_SUCCESS(status))
+
+    if (pMac->roam.configParam.nSelect5GHzMargin)
     {
-        palZeroMemory(pMac->hHdd, pRetList, sizeof(tScanResultList));
+        pMac->scan.inScanResultBestAPRssi = -128;
+        csrLLLock(&pMac->scan.scanResultList);
+
+        /* Find out the best AP Rssi going thru the scan results */
+        pEntry = csrLLPeekHead(&pMac->scan.scanResultList, LL_ACCESS_NOLOCK);
+        while ( NULL != pEntry)
+        {
+            pBssDesc = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
+            fMatch = FALSE;
+
+            if (pFilter)
+            for(i = 0; i < pFilter->SSIDs.numOfSSIDs; i++)
+            {
+                fMatch = csrIsSsidMatch( pMac, pFilter->SSIDs.SSIDList[i].SSID.ssId, pFilter->SSIDs.SSIDList[i].SSID.length,
+                                        pBssDesc->Result.ssId.ssId,
+                                        pBssDesc->Result.ssId.length, eANI_BOOLEAN_TRUE );
+                if (fMatch)
+                {
+                    pIes = (tDot11fBeaconIEs *)( pBssDesc->Result.pvIes );
+
+                    //At this time, pBssDescription->Result.pvIes may be NULL
+                    if( !pIes && (!HAL_STATUS_SUCCESS(csrGetParsedBssDescriptionIEs(pMac,
+                                  &pBssDesc->Result.BssDescriptor, &pIes))) )
+                    {
+                        continue;
+                    }
+
+                    smsLog(pMac, LOG1, FL("SSID Matched"));
+                    fMatch = csrIsSecurityMatch( pMac, &pFilter->authType, &pFilter->EncryptionType, &pFilter->mcEncryptionType,
+                                 &pBssDesc->Result.BssDescriptor, pIes, NULL, NULL, NULL );
+                    if ((pBssDesc->Result.pvIes == NULL) && pIes)
+                        vos_mem_free(pIes);
+
+                    if (fMatch)
+                        smsLog(pMac, LOG1, FL(" Security Matched"));
+                }
+            }
+
+            if (fMatch && (pBssDesc->Result.BssDescriptor.rssi > pMac->scan.inScanResultBestAPRssi))
+            {
+                smsLog(pMac, LOG1, FL("Best AP Rssi changed from %d to %d"),
+                                       pMac->scan.inScanResultBestAPRssi,
+                                       pBssDesc->Result.BssDescriptor.rssi);
+                pMac->scan.inScanResultBestAPRssi = pBssDesc->Result.BssDescriptor.rssi;
+            }
+            pEntry = csrLLNext(&pMac->scan.scanResultList, pEntry, LL_ACCESS_NOLOCK);
+        }
+
+        if ( -128 != pMac->scan.inScanResultBestAPRssi)
+        {
+            smsLog(pMac, LOG1, FL("Best AP Rssi is %d"), pMac->scan.inScanResultBestAPRssi);
+            /* Modify Rssi category based on best AP Rssi */
+            csrAssignRssiForCategory(pMac, pMac->scan.inScanResultBestAPRssi, pMac->roam.configParam.bCatRssiOffset);
+            pEntry = csrLLPeekHead(&pMac->scan.scanResultList, LL_ACCESS_NOLOCK);
+            while ( NULL != pEntry)
+            {
+                pBssDesc = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
+
+                /* re-assign preference value based on modified rssi bucket */
+                pBssDesc->preferValue = csrGetBssPreferValue(pMac, (int)pBssDesc->Result.BssDescriptor.rssi);
+
+                smsLog(pMac, LOG2, FL("BSSID(%02X:%02X:%02X:%02X:%02X:%02X) Rssi(%d) Chnl(%d) PrefVal(%lu) SSID=%.*s"),
+                 pBssDesc->Result.BssDescriptor.bssId[0],
+                 pBssDesc->Result.BssDescriptor.bssId[1],
+                 pBssDesc->Result.BssDescriptor.bssId[2],
+                 pBssDesc->Result.BssDescriptor.bssId[3],
+                 pBssDesc->Result.BssDescriptor.bssId[4],
+                 pBssDesc->Result.BssDescriptor.bssId[5],
+                 pBssDesc->Result.BssDescriptor.rssi,
+                 pBssDesc->Result.BssDescriptor.channelId,
+                 pBssDesc->preferValue,
+                 pBssDesc->Result.ssId.length, pBssDesc->Result.ssId.ssId);
+
+                pEntry = csrLLNext(&pMac->scan.scanResultList, pEntry, LL_ACCESS_NOLOCK);
+            }
+        }
+
+        csrLLUnlock(&pMac->scan.scanResultList);
+    }
+
+    pRetList = vos_mem_malloc(sizeof(tScanResultList));
+    if ( NULL == pRetList )
+        status = eHAL_STATUS_FAILURE;
+    else
+    {
+        status = eHAL_STATUS_SUCCESS;
+        vos_mem_set(pRetList, sizeof(tScanResultList), 0);
         csrLLOpen(pMac->hHdd, &pRetList->List);
         pRetList->pCurEntry = NULL;
-
+        
         csrLLLock(&pMac->scan.scanResultList);
         pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_NOLOCK );
-        while( pEntry )
+        while( pEntry ) 
         {
             pBssDesc = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
             pIes = (tDot11fBeaconIEs *)( pBssDesc->Result.pvIes );
@@ -2047,10 +2264,14 @@
                             //The pIes is allocated by someone else. make a copy
                             //Only to save parsed IEs if caller provides a filter. Most likely the caller
                             //is using to for association, hence save the parsed IEs
-                            status = palAllocateMemory(pMac->hHdd, (void **)&pNewIes, sizeof(tDot11fBeaconIEs));
-                            if( HAL_STATUS_SUCCESS( status ) )
+                            pNewIes = vos_mem_malloc(sizeof(tDot11fBeaconIEs));
+                            if ( NULL == pNewIes )
+                                status = eHAL_STATUS_FAILURE;
+                            else
+                                status = eHAL_STATUS_SUCCESS;
+                            if ( HAL_STATUS_SUCCESS( status ) )
                             {
-                                palCopyMemory( pMac->hHdd, pNewIes, pIes, sizeof( tDot11fBeaconIEs ) );
+                                vos_mem_copy(pNewIes, pIes, sizeof( tDot11fBeaconIEs ));
                             }
                             else
                             {
@@ -2058,7 +2279,7 @@
                                 //Need to free memory allocated by csrMatchBSS
                                 if( !pBssDesc->Result.pvIes )
                                 {
-                                    palFreeMemory(pMac->hHdd, pIes);
+                                    vos_mem_free(pIes);
                                 }
                                 break;
                             }
@@ -2066,7 +2287,7 @@
                     }//fMatch
                     else if( !pBssDesc->Result.pvIes )
                     {
-                        palFreeMemory(pMac->hHdd, pIes);
+                        vos_mem_free(pIes);
                     }
                 }
             }
@@ -2074,17 +2295,21 @@
             {
                 bssLen = pBssDesc->Result.BssDescriptor.length + sizeof(pBssDesc->Result.BssDescriptor.length);
                 allocLen = sizeof( tCsrScanResult ) + bssLen;
-                status = palAllocateMemory(pMac->hHdd, (void **)&pResult, allocLen);
+                pResult = vos_mem_malloc(allocLen);
+                if ( NULL == pResult )
+                        status = eHAL_STATUS_FAILURE;
+                else
+                        status = eHAL_STATUS_SUCCESS;
                 if(!HAL_STATUS_SUCCESS(status))
                 {
                     smsLog(pMac, LOGE, FL("  fail to allocate memory for scan result, len=%d"), allocLen);
                     if(pNewIes)
                     {
-                        palFreeMemory(pMac->hHdd, pNewIes);
+                        vos_mem_free(pNewIes);
                     }
                     break;
                 }
-                palZeroMemory(pMac->hHdd, pResult, allocLen);
+                vos_mem_set(pResult, allocLen, 0);
                 pResult->capValue = pBssDesc->capValue;
                 pResult->preferValue = pBssDesc->preferValue;
                 pResult->ucEncryptionType = uc;
@@ -2095,17 +2320,8 @@
                 //save the pIes for later use
                 pResult->Result.pvIes = pNewIes;
                 //save bss description
-                status = palCopyMemory(pMac->hHdd, &pResult->Result.BssDescriptor, &pBssDesc->Result.BssDescriptor, bssLen);
-                if(!HAL_STATUS_SUCCESS(status))
-                {
-                    smsLog(pMac, LOGE, FL("  fail to copy memory for scan result"));
-                    palFreeMemory(pMac->hHdd, pResult);
-                    if(pNewIes)
-                    {
-                        palFreeMemory(pMac->hHdd, pNewIes);
-                    }
-                    break;
-                }
+                vos_mem_copy(&pResult->Result.BssDescriptor,
+                             &pBssDesc->Result.BssDescriptor, bssLen);
                 //No need to lock pRetList because it is locally allocated and no outside can access it at this time
                 if(csrLLIsListEmpty(&pRetList->List, LL_ACCESS_NOLOCK))
                 {
@@ -2116,7 +2332,7 @@
                     //To sort the list
                     tListElem *pTmpEntry;
                     tCsrScanResult *pTmpResult;
-
+                    
                     pTmpEntry = csrLLPeekHead(&pRetList->List, LL_ACCESS_NOLOCK);
                     while(pTmpEntry)
                     {
@@ -2141,9 +2357,9 @@
             pEntry = csrLLNext( &pMac->scan.scanResultList, pEntry, LL_ACCESS_NOLOCK );
         }//while
         csrLLUnlock(&pMac->scan.scanResultList);
-
+        
         smsLog(pMac, LOG2, FL("return %d BSS"), csrLLCount(&pRetList->List));
-
+        
         if( !HAL_STATUS_SUCCESS(status) || (phResult == NULL) )
         {
             //Fail or No one wants the result.
@@ -2155,7 +2371,7 @@
             {
                 //We are here meaning the there is no match
                 csrLLClose(&pRetList->List);
-                palFreeMemory(pMac->hHdd, pRetList);
+                vos_mem_free(pRetList);
                 status = eHAL_STATUS_E_NULL_VALUE;
             }
             else if(phResult)
@@ -2164,7 +2380,7 @@
             }
         }
     }//Allocated pRetList
-
+    
     return (status);
 }
 
@@ -2175,9 +2391,9 @@
  * we are unable to recover from
  * csrRoamRoamingStateDisassocRspProcessor.
  * If it is needed to remove this routine,
- * first ensure that we recover gracefully from
- * csrRoamRoamingStateDisassocRspProcessor if
- * csrScanGetResult returns with a failure because
+ * first ensure that we recover gracefully from 
+ * csrRoamRoamingStateDisassocRspProcessor if 
+ * csrScanGetResult returns with a failure because 
  * of not being able to find the roaming BSS.
  */
 tANI_U8 csrScanFlushDenied(tpAniSirGlobal pMac)
@@ -2217,7 +2433,7 @@
     while( pEntry != NULL)
     {
         pBssDesc = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
-        if( flushP2P == vos_mem_compare( pBssDesc->Result.ssId.ssId,
+        if( flushP2P == vos_mem_compare( pBssDesc->Result.ssId.ssId, 
                                          "DIRECT-", 7) )
         {
             pFreeElem = pEntry;
@@ -2312,7 +2528,7 @@
     while( pEntry )
     {
         pBssDesc = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
-        pTempEntry = csrLLNext( &pMac->scan.scanResultList, pEntry,
+        pTempEntry = csrLLNext( &pMac->scan.scanResultList, pEntry, 
                                                             LL_ACCESS_LOCK );
         if(csrCheck11dChannel(pBssDesc->Result.BssDescriptor.channelId,
                                               pMac->roam.validChannelList, len))
@@ -2338,62 +2554,58 @@
     tANI_U32 count = 0;
     tListElem *pEntry;
     tANI_U32 bssLen, allocLen;
-
+    
     if(phResult)
     {
         *phResult = CSR_INVALID_SCANRESULT_HANDLE;
     }
-    status = palAllocateMemory(pMac->hHdd, (void **)&pRetList, sizeof(tScanResultList));
-    if(HAL_STATUS_SUCCESS(status))
+    pRetList = vos_mem_malloc(sizeof(tScanResultList));
+    if ( NULL == pRetList )
+        status = eHAL_STATUS_FAILURE;
+    else
     {
-        palZeroMemory(pMac->hHdd, pRetList, sizeof(tScanResultList));
+        vos_mem_set(pRetList, sizeof(tScanResultList), 0);
         csrLLOpen(pMac->hHdd, &pRetList->List);
         pRetList->pCurEntry = NULL;
         csrLLLock(&pMac->scan.scanResultList);
         csrLLLock(&pInList->List);
-
+        
         pEntry = csrLLPeekHead( &pInList->List, LL_ACCESS_NOLOCK );
-        while( pEntry )
+        while( pEntry ) 
         {
             pScanResult = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
             bssLen = pScanResult->Result.BssDescriptor.length + sizeof(pScanResult->Result.BssDescriptor.length);
             allocLen = sizeof( tCsrScanResult ) + bssLen;
-            status = palAllocateMemory(pMac->hHdd, (void **)&pResult, allocLen);
-            if(!HAL_STATUS_SUCCESS(status))
+            pResult = vos_mem_malloc(allocLen);
+            if ( NULL == pResult )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+            if (!HAL_STATUS_SUCCESS(status))
             {
                 csrScanResultPurge(pMac, (tScanResultHandle *)pRetList);
                 count = 0;
                 break;
             }
-            palZeroMemory(pMac->hHdd, pResult, allocLen);
-            status = palCopyMemory(pMac->hHdd, &pResult->Result.BssDescriptor, &pScanResult->Result.BssDescriptor, bssLen);
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-                csrScanResultPurge(pMac, (tScanResultHandle *)pRetList);
-                count = 0;
-                break;
-            }
+            vos_mem_set(pResult, allocLen , 0);
+            vos_mem_copy(&pResult->Result.BssDescriptor, &pScanResult->Result.BssDescriptor, bssLen);
             if( pScanResult->Result.pvIes )
             {
-                status = palAllocateMemory(pMac->hHdd, (void **)&pResult->Result.pvIes, sizeof( tDot11fBeaconIEs ));
-                if(!HAL_STATUS_SUCCESS(status))
+                pResult->Result.pvIes = vos_mem_malloc(sizeof( tDot11fBeaconIEs ));
+                if ( NULL == pResult->Result.pvIes )
+                        status = eHAL_STATUS_FAILURE;
+                else
+                        status = eHAL_STATUS_SUCCESS;
+                if (!HAL_STATUS_SUCCESS(status))
                 {
                     //Free the memory we allocate above first
-                    palFreeMemory( pMac->hHdd, pResult );
+                    vos_mem_free(pResult);
                     csrScanResultPurge(pMac, (tScanResultHandle *)pRetList);
                     count = 0;
                     break;
                 }
-                status = palCopyMemory(pMac->hHdd, pResult->Result.pvIes,
-                                pScanResult->Result.pvIes, sizeof( tDot11fBeaconIEs ));
-                if(!HAL_STATUS_SUCCESS(status))
-                {
-                    //Free the memory we allocate above first
-                    palFreeMemory( pMac->hHdd, pResult );
-                    csrScanResultPurge(pMac, (tScanResultHandle *)pRetList);
-                    count = 0;
-                    break;
-                }
+                vos_mem_copy(pResult->Result.pvIes, pScanResult->Result.pvIes,
+                             sizeof( tDot11fBeaconIEs ));
             }
             csrLLInsertTail(&pRetList->List, &pResult->Link, LL_ACCESS_LOCK);
             count++;
@@ -2401,13 +2613,13 @@
         }//while
         csrLLUnlock(&pInList->List);
         csrLLUnlock(&pMac->scan.scanResultList);
-
+        
         if(HAL_STATUS_SUCCESS(status))
         {
             if(0 == count)
             {
                 csrLLClose(&pRetList->List);
-                palFreeMemory(pMac->hHdd, pRetList);
+                vos_mem_free(pRetList);
                 status = eHAL_STATUS_E_NULL_VALUE;
             }
             else if(phResult)
@@ -2416,12 +2628,12 @@
             }
         }
     }//Allocated pRetList
-
+    
     return (status);
 }
 
 
-
+ 
 eHalStatus csrScanningStateMsgProcessor( tpAniSirGlobal pMac, void *pMsgBuf )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -2433,7 +2645,7 @@
     }
     else
     {
-        if(pMsg->type == eWNI_SME_UPPER_LAYER_ASSOC_CNF)
+        if(pMsg->type == eWNI_SME_UPPER_LAYER_ASSOC_CNF) 
         {
             tCsrRoamSession  *pSession;
             tSirSmeAssocIndToUpperLayerCnf *pUpperLayerAssocCnf;
@@ -2442,7 +2654,7 @@
             tANI_U32 sessionId;
             eHalStatus status;
             smsLog( pMac, LOG1, FL("Scanning : ASSOCIATION confirmation can be given to upper layer "));
-            palZeroMemory(pMac->hHdd, &roamInfo, sizeof(tCsrRoamInfo));
+            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
             pRoamInfo = &roamInfo;
             pUpperLayerAssocCnf = (tSirSmeAssocIndToUpperLayerCnf *)pMsgBuf;
             status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pUpperLayerAssocCnf->bssId, &sessionId );
@@ -2454,15 +2666,15 @@
                 return eHAL_STATUS_FAILURE;
             }
 
-            pRoamInfo->statusCode = eSIR_SME_SUCCESS; //send the status code as Success
+            pRoamInfo->statusCode = eSIR_SME_SUCCESS; //send the status code as Success 
             pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
             pRoamInfo->staId = (tANI_U8)pUpperLayerAssocCnf->aid;
             pRoamInfo->rsnIELen = (tANI_U8)pUpperLayerAssocCnf->rsnIE.length;
             pRoamInfo->prsnIE = pUpperLayerAssocCnf->rsnIE.rsnIEdata;
             pRoamInfo->addIELen = (tANI_U8)pUpperLayerAssocCnf->addIE.length;
-            pRoamInfo->paddIE = pUpperLayerAssocCnf->addIE.addIEdata;
-            palCopyMemory(pMac->hHdd, pRoamInfo->peerMac, pUpperLayerAssocCnf->peerMacAddr, sizeof(tSirMacAddr));
-            palCopyMemory(pMac->hHdd, &pRoamInfo->bssid, pUpperLayerAssocCnf->bssId, sizeof(tCsrBssid));
+            pRoamInfo->paddIE = pUpperLayerAssocCnf->addIE.addIEdata;           
+            vos_mem_copy(pRoamInfo->peerMac, pUpperLayerAssocCnf->peerMacAddr, sizeof(tSirMacAddr));
+            vos_mem_copy(&pRoamInfo->bssid, pUpperLayerAssocCnf->bssId, sizeof(tCsrBssid));
             pRoamInfo->wmmEnabledSta = pUpperLayerAssocCnf->wmmEnabledSta;
             if(CSR_IS_INFRA_AP(pRoamInfo->u.pConnectedProfile) )
             {
@@ -2509,7 +2721,7 @@
        (0 == pNewBssDescr->WscIeLen))
     {
         idx = 0;
-        len = pOldBssDescr->length - sizeof(tSirBssDescription) +
+        len = pOldBssDescr->length - sizeof(tSirBssDescription) + 
                 sizeof(tANI_U16) + sizeof(tANI_U32) - DOT11F_IE_WSCPROBERES_MIN_LEN - 2;
         pbIe = (tANI_U8 *)pOldBssDescr->ieFields;
         //Save WPS IE if it exists
@@ -2522,8 +2734,7 @@
                 //Founrd it
                 if((DOT11F_IE_WSCPROBERES_MAX_LEN - 2) >= pbIe[1])
                 {
-                    palCopyMemory(pMac->hHdd, pNewBssDescr->WscIeProbeRsp,
-                                   pbIe, pbIe[1] + 2);
+                    vos_mem_copy(pNewBssDescr->WscIeProbeRsp, pbIe, pbIe[1] + 2);
                     pNewBssDescr->WscIeLen = pbIe[1] + 2;
                 }
                 break;
@@ -2538,7 +2749,7 @@
 
 //pIes may be NULL
 tANI_BOOLEAN csrRemoveDupBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pSirBssDescr,
-                                         tDot11fBeaconIEs *pIes, tAniSSID *pSsid , v_TIME_t *timer )
+                                         tDot11fBeaconIEs *pIes, tAniSSID *pSsid, v_TIME_t *timer, tANI_BOOLEAN fForced )
 {
     tListElem *pEntry;
 
@@ -2550,14 +2761,14 @@
     // results for this Bss.  In that case, remove the 'old' Bss description from the linked list.
     pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_LOCK );
 
-    while( pEntry )
+    while( pEntry ) 
     {
         pBssDesc = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
 
         // we have a duplicate scan results only when BSSID, SSID, Channel and NetworkType
         // matches
-        if ( csrIsDuplicateBssDescription( pMac, &pBssDesc->Result.BssDescriptor,
-                                                        pSirBssDescr, pIes ) )
+        if ( csrIsDuplicateBssDescription( pMac, &pBssDesc->Result.BssDescriptor, 
+                                                        pSirBssDescr, pIes, fForced ) )
         {
             pSirBssDescr->rssi = (tANI_S8)( (((tANI_S32)pSirBssDescr->rssi * CSR_SCAN_RESULT_RSSI_WEIGHT ) +
                                              ((tANI_S32)pBssDesc->Result.BssDescriptor.rssi * (100 - CSR_SCAN_RESULT_RSSI_WEIGHT) )) / 100 );
@@ -2569,7 +2780,7 @@
                 *pSsid = pBssDesc->Result.ssId;
                 *timer = pBssDesc->Result.timer;
                 csrCheckNSaveWscIe(pMac, pSirBssDescr, &pBssDesc->Result.BssDescriptor);
-
+                
                 csrFreeScanResultEntry( pMac, pBssDesc );
             }
             else
@@ -2614,35 +2825,34 @@
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
                 {
                     WLAN_VOS_DIAG_EVENT_DEF(secEvent, vos_event_wlan_security_payload_type);
-                    palZeroMemory(pMac->hHdd, &secEvent, sizeof(vos_event_wlan_security_payload_type));
+                    vos_mem_set(&secEvent, sizeof(vos_event_wlan_security_payload_type), 0);
                     secEvent.eventId = WLAN_SECURITY_EVENT_PMKID_CANDIDATE_FOUND;
-                    secEvent.encryptionModeMulticast =
+                    secEvent.encryptionModeMulticast = 
                         (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.mcEncryptionType);
-                    secEvent.encryptionModeUnicast =
+                    secEvent.encryptionModeUnicast = 
                         (v_U8_t)diagEncTypeFromCSRType(pSession->connectedProfile.EncryptionType);
-                    palCopyMemory( pMac->hHdd, secEvent.bssid, pSession->connectedProfile.bssid, 6 );
-                    secEvent.authMode =
+                    vos_mem_copy(secEvent.bssid, pSession->connectedProfile.bssid, 6);
+                    secEvent.authMode = 
                         (v_U8_t)diagAuthTypeFromCSRType(pSession->connectedProfile.AuthType);
                     WLAN_VOS_DIAG_EVENT_REPORT(&secEvent, EVENT_WLAN_SECURITY);
                 }
 #endif//#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
 
                 // if yes, then add to PMKIDCandidateList
-                status = palCopyMemory(pMac->hHdd, pSession->PmkidCandidateInfo[pSession->NumPmkidCandidate].BSSID,
-                                            pBssDesc->bssId, WNI_CFG_BSSID_LEN);
-
-                if( HAL_STATUS_SUCCESS( status ) )
+                vos_mem_copy(pSession->PmkidCandidateInfo[pSession->NumPmkidCandidate].BSSID,
+                             pBssDesc->bssId, WNI_CFG_BSSID_LEN);
+                // Bit 0 offirst byte - PreAuthentication Capability
+                if ( (pIes->RSN.RSN_Cap[0] >> 0) & 0x1 )
                 {
-                    if ( (pIes->RSN.RSN_Cap[0] >> 0) & 0x1 ) // Bit 0 offirst byte - PreAuthentication Capability
-                    {
-                        pSession->PmkidCandidateInfo[pSession->NumPmkidCandidate].preAuthSupported = eANI_BOOLEAN_TRUE;
-                    }
-                    else
-                    {
-                        pSession->PmkidCandidateInfo[pSession->NumPmkidCandidate].preAuthSupported = eANI_BOOLEAN_FALSE;
-                    }
-                    pSession->NumPmkidCandidate++;
+                    pSession->PmkidCandidateInfo[pSession->NumPmkidCandidate].preAuthSupported
+                                                                          = eANI_BOOLEAN_TRUE;
                 }
+                else
+                {
+                    pSession->PmkidCandidateInfo[pSession->NumPmkidCandidate].preAuthSupported
+                                                                          = eANI_BOOLEAN_FALSE;
+                }
+                pSession->NumPmkidCandidate++;
             }
             else
             {
@@ -2656,7 +2866,7 @@
 
 //This function checks whether new AP is found for the current connected profile
 //If it is found, it return the sessionId, else it return invalid sessionID
-tANI_U32 csrProcessBSSDescForPMKIDList(tpAniSirGlobal pMac,
+tANI_U32 csrProcessBSSDescForPMKIDList(tpAniSirGlobal pMac, 
                                            tSirBssDescription *pBssDesc,
                                            tDot11fBeaconIEs *pIes)
 {
@@ -2671,7 +2881,7 @@
             if( CSR_IS_SESSION_VALID( pMac, i ) )
             {
                 pSession = CSR_GET_SESSION( pMac, i );
-                if( csrIsConnStateConnectedInfra( pMac, i ) &&
+                if( csrIsConnStateConnectedInfra( pMac, i ) && 
                     ( eCSR_AUTH_TYPE_RSN == pSession->connectedProfile.AuthType ) )
                 {
                     if(csrMatchBSSToConnectProfile(pMac, &pSession->connectedProfile, pBssDesc, pIesLocal))
@@ -2688,7 +2898,7 @@
         }
         if( !pIes )
         {
-            palFreeMemory(pMac->hHdd, pIesLocal);
+            vos_mem_free(pIesLocal);
         }
     }
 
@@ -2708,7 +2918,8 @@
         return eHAL_STATUS_FAILURE;
     }
 
-    smsLog(pMac, LOGW, "csrAddBKIDCandidateList called pMac->scan.NumBkidCandidate = %d", pSession->NumBkidCandidate);
+    smsLog(pMac, LOGW, "csrAddBKIDCandidateList called pMac->scan.NumBkidCandidate = %d",
+                                             pSession->NumBkidCandidate);
     if( pIes )
     {
         // check if this is a WAPI BSS
@@ -2719,21 +2930,19 @@
             {
 
                 // if yes, then add to BKIDCandidateList
-                status = palCopyMemory(pMac->hHdd, pSession->BkidCandidateInfo[pSession->NumBkidCandidate].BSSID,
-                                            pBssDesc->bssId, WNI_CFG_BSSID_LEN);
-
-                if( HAL_STATUS_SUCCESS( status ) )
+                vos_mem_copy(pSession->BkidCandidateInfo[pSession->NumBkidCandidate].BSSID,
+                             pBssDesc->bssId, WNI_CFG_BSSID_LEN);
+                if ( pIes->WAPI.preauth )
                 {
-                    if ( pIes->WAPI.preauth )
-                    {
-                        pSession->BkidCandidateInfo[pSession->NumBkidCandidate].preAuthSupported = eANI_BOOLEAN_TRUE;
-                    }
-                    else
-                    {
-                        pSession->BkidCandidateInfo[pSession->NumBkidCandidate].preAuthSupported = eANI_BOOLEAN_FALSE;
-                    }
-                    pSession->NumBkidCandidate++;
+                    pSession->BkidCandidateInfo[pSession->NumBkidCandidate].preAuthSupported
+                                                                         = eANI_BOOLEAN_TRUE;
                 }
+                else
+                {
+                    pSession->BkidCandidateInfo[pSession->NumBkidCandidate].preAuthSupported
+                                                                        = eANI_BOOLEAN_FALSE;
+                }
+                pSession->NumBkidCandidate++;
             }
             else
             {
@@ -2762,7 +2971,7 @@
             if( CSR_IS_SESSION_VALID( pMac, sessionId) )
             {
                 pSession = CSR_GET_SESSION( pMac, sessionId );
-                if( csrIsConnStateConnectedInfra( pMac, sessionId ) &&
+                if( csrIsConnStateConnectedInfra( pMac, sessionId ) && 
                     eCSR_AUTH_TYPE_WAPI_WAI_CERTIFICATE == pSession->connectedProfile.AuthType)
                 {
                     if(csrMatchBSSToConnectProfile(pMac, &pSession->connectedProfile,pBssDesc, pIesLocal))
@@ -2778,7 +2987,7 @@
         }
         if(!pIes)
         {
-            palFreeMemory(pMac->hHdd, pIesLocal);
+            vos_mem_free(pIesLocal);
         }
 
     }
@@ -2791,8 +3000,11 @@
 static void csrMoveTempScanResultsToMainList( tpAniSirGlobal pMac, tANI_U8 reason )
 {
     tListElem *pEntry;
+    tListElem *pEntryTemp;
+    tListElem  *pNext;
     tCsrScanResult *pBssDescription;
     tANI_S8         cand_Bss_rssi;
+    tANI_S8         rssi_of_current_country;
     tANI_BOOLEAN    fDupBss;
 #ifdef FEATURE_WLAN_WAPI
     tANI_BOOLEAN fNewWapiBSSForCurConnection = eANI_BOOLEAN_FALSE;
@@ -2801,9 +3013,11 @@
     tANI_U32 sessionId = CSR_SESSION_ID_INVALID;
     tAniSSID tmpSsid;
     v_TIME_t timer=0;
+    tCsrBssid bssid_temp =  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
     tmpSsid.length = 0;
     cand_Bss_rssi = -128; // RSSI coming from PE is -ve
+    rssi_of_current_country = -128;
 
     // remove the BSS descriptions from temporary list
     while( ( pEntry = csrLLRemoveTail( &pMac->scan.tempScanResults, LL_ACCESS_LOCK ) ) != NULL)
@@ -2825,7 +3039,7 @@
             csrFreeScanResultEntry(pMac, pBssDescription);
             continue;
         }
-        fDupBss = csrRemoveDupBssDescription( pMac, &pBssDescription->Result.BssDescriptor, pIesLocal, &tmpSsid , &timer );
+        fDupBss = csrRemoveDupBssDescription( pMac, &pBssDescription->Result.BssDescriptor, pIesLocal, &tmpSsid, &timer, FALSE );
         //Check whether we have reach out limit, but don't lose the LFR candidates came from FW
         if( CSR_SCAN_IS_OVER_BSS_LIMIT(pMac)
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
@@ -2838,7 +3052,7 @@
             //Free the resources
             if( (pBssDescription->Result.pvIes == NULL) && pIesLocal )
             {
-                palFreeMemory(pMac->hHdd, pIesLocal);
+                vos_mem_free(pIesLocal);
             }
             csrFreeScanResultEntry(pMac, pBssDescription);
             //Continue because there may be duplicated BSS
@@ -2848,11 +3062,11 @@
         if ( !fDupBss )
         {
             //Found a new BSS
-            sessionId = csrProcessBSSDescForPMKIDList(pMac,
+            sessionId = csrProcessBSSDescForPMKIDList(pMac, 
                              &pBssDescription->Result.BssDescriptor, pIesLocal);
             if( CSR_SESSION_ID_INVALID != sessionId)
             {
-                csrRoamCallCallback(pMac, sessionId, NULL, 0,
+                csrRoamCallCallback(pMac, sessionId, NULL, 0, 
                            eCSR_ROAM_SCAN_FOUND_NEW_BSS, eCSR_ROAM_RESULT_NONE);
             }
         }
@@ -2861,11 +3075,11 @@
             //Check if the new one has SSID it it, if not, use the older SSID if it exists.
             if( (0 == pBssDescription->Result.ssId.length) && tmpSsid.length )
             {
-                //New BSS has a hidden SSID and old one has the SSID. Keep the SSID only
+                //New BSS has a hidden SSID and old one has the SSID. Keep the SSID only 
                 //if diff of saved SSID time and current time is less than 1 min to avoid
                 //side effect of saving SSID with old one is that if AP changes its SSID while remain
-                //hidden, we may never see it and also to address the requirement of
-                //When we remove hidden ssid from the profile i.e., forget the SSID via
+                //hidden, we may never see it and also to address the requirement of 
+                //When we remove hidden ssid from the profile i.e., forget the SSID via 
                 // GUI that SSID shouldn't see in the profile
                 if( (vos_timer_get_system_time() - timer) <= HIDDEN_TIMER)
                 {
@@ -2875,36 +3089,127 @@
             }
         }
 
-        //Tush: find a good AP for 11d info
-        if( csrIs11dSupported( pMac ) )
+        //Find a good AP for 11d info
+        if ( csrIs11dSupported( pMac ) )
         {
-            if(cand_Bss_rssi < pBssDescription->Result.BssDescriptor.rssi)
+            if (cand_Bss_rssi < pBssDescription->Result.BssDescriptor.rssi)
             {
                 // check if country information element is present
-                if(pIesLocal->Country.present)
+                if (pIesLocal->Country.present)
                 {
                     cand_Bss_rssi = pBssDescription->Result.BssDescriptor.rssi;
-                    // learn country information
-                    csrLearnCountryInformation( pMac, &pBssDescription->Result.BssDescriptor,
-                             pIesLocal, eANI_BOOLEAN_FALSE );
+                    smsLog(pMac, LOGW, FL("11d AP Bssid " MAC_ADDRESS_STR
+                                    " chan= %d, rssi = -%d, countryCode %c%c"),
+                                    MAC_ADDR_ARRAY( pBssDescription->Result.BssDescriptor.bssId),
+                                    pBssDescription->Result.BssDescriptor.channelId,
+                                    pBssDescription->Result.BssDescriptor.rssi * (-1),
+                                    pIesLocal->Country.country[0],pIesLocal->Country.country[1] );
+                   //Getting BSSID for best AP in scan result.
+                    vos_mem_copy(bssid_temp,
+                            pBssDescription->Result.BssDescriptor.bssId, sizeof(tSirMacAddr));
+
                 }
 
             }
         }
+        //get current rssi for BSS from which country code is acquired.
+        if ( csrIs11dSupported(pMac) && (csrIsMacAddressEqual(pMac,
+                               &pMac->scan.currentCountryBssid,
+                              &pBssDescription->Result.BssDescriptor.bssId) ))
+        {
+            smsLog(pMac, LOGW, FL("Information about current country Bssid "
+                               MAC_ADDRESS_STR
+                              " chan= %d, rssi = -%d, countryCode %c%c"),
+                               MAC_ADDR_ARRAY( pBssDescription->Result.BssDescriptor.bssId),
+                               pBssDescription->Result.BssDescriptor.channelId,
+                               pBssDescription->Result.BssDescriptor.rssi * (-1),
+                               pIesLocal->Country.country[0],pIesLocal->Country.country[1] );
+            rssi_of_current_country =  pBssDescription->Result.BssDescriptor.rssi ;
+        }
 
 
+        
         // append to main list
         csrScanAddResult(pMac, pBssDescription, pIesLocal);
-        if( (pBssDescription->Result.pvIes == NULL) && pIesLocal )
+        if ( (pBssDescription->Result.pvIes == NULL) && pIesLocal )
         {
-            palFreeMemory(pMac->hHdd, pIesLocal);
+            vos_mem_free(pIesLocal);
         }
     }
 
-    //Tush: If we can find the current 11d info in any of the scan results, or
+    //we don't need to update CC while connected to an AP which is advertising CC already
+    if (csrIs11dSupported(pMac))
+    {
+        tANI_U32 i;
+        tCsrRoamSession *pSession;
+
+        for (i = 0; i < CSR_ROAM_SESSION_MAX; i++ )
+        {
+            if (CSR_IS_SESSION_VALID( pMac, i ) )
+            {
+                pSession = CSR_GET_SESSION( pMac, i );
+                if (csrIsConnStateConnected(pMac, i))
+                {
+                    if (csrIsBssidMatch(pMac, (tCsrBssid *)&pMac->scan.currentCountryBssid,
+                                        &pSession->connectedProfile.bssid))
+                    {
+                        smsLog(pMac, LOGW, FL("No need for updating CC, we will"
+                                              "continue with current AP's CC"));
+                        goto end;
+                    }
+                }
+            }
+        }
+
+        // Calculating 30% of current rssi is an idea for not to change
+        // country code so freq.
+        if (rssi_of_current_country != -128)
+        {
+            rssi_of_current_country = rssi_of_current_country
+                                         - THIRTY_PERCENT(rssi_of_current_country);
+        }
+        //if new candidate AP has 30% better RSSI or this is the first time or
+        //AP aged out of CSR cache or we are in world CC now
+        if ((rssi_of_current_country <= cand_Bss_rssi )  || (rssi_of_current_country  == -128)
+           ||( '0' == pMac->scan.countryCode11d[ 0 ] && '0' == pMac->scan.countryCode11d[ 1 ] ))
+        {
+            csrLLLock(&pMac->scan.scanResultList);
+            pEntryTemp = csrLLPeekHead(&pMac->scan.scanResultList, LL_ACCESS_NOLOCK);
+            while ( NULL != pEntryTemp)
+            {
+                pNext = csrLLNext(&pMac->scan.scanResultList, pEntryTemp,
+                                              LL_ACCESS_NOLOCK);
+                pBssDescription = GET_BASE_ADDR( pEntryTemp, tCsrScanResult, Link );
+                pIesLocal = (tDot11fBeaconIEs *)( pBssDescription->Result.pvIes );
+                // Need to traverse whole scan list to get description for best 11d AP.
+                if (csrIsMacAddressEqual(pMac, (tCsrBssid *)&bssid_temp,
+                             (tCsrBssid *) pBssDescription->Result.BssDescriptor.bssId))
+                {
+                    // Best AP should be passed to update reg domain.
+                    csrLearnCountryInformation( pMac, &pBssDescription->Result.BssDescriptor,
+                                 pIesLocal, eANI_BOOLEAN_TRUE );
+                     //this check is to avoid the case of invalid CC set via 11d
+                     //In that case we move to world CC & we are open to any new
+                     //valid CC we can get during scan
+                     if(( '0' != pMac->scan.countryCode11d[ 0 ] && '0' != pMac->scan.countryCode11d[ 1 ] ))
+                     {
+                         vos_mem_copy(pMac->scan.currentCountryBssid,
+                                         bssid_temp, sizeof(tSirMacAddr));
+                     }
+                    break;
+                }
+                pEntryTemp = pNext;
+            }
+            csrLLUnlock(&pMac->scan.scanResultList);
+        }
+    }
+
+
+end:
+    //If we can find the current 11d info in any of the scan results, or
     // a good enough AP with the 11d info from the scan results then no need to
     // get into ambiguous state
-    if(pMac->scan.fAmbiguous11dInfoFound)
+    if(pMac->scan.fAmbiguous11dInfoFound) 
     {
       if((pMac->scan.fCurrent11dInfoMatch) || (cand_Bss_rssi != -128))
       {
@@ -2930,7 +3235,6 @@
     tCsrScanResult *pCsrBssDescription = NULL;
     tANI_U32 cbBSSDesc;
     tANI_U32 cbAllocated;
-    eHalStatus halStatus;
 
     // figure out how big the BSS description is (the BSSDesc->length does NOT
     // include the size of the length field itself).
@@ -2938,12 +3242,12 @@
 
     cbAllocated = sizeof( tCsrScanResult ) + cbBSSDesc;
 
-    halStatus = palAllocateMemory( pMac->hHdd, (void **)&pCsrBssDescription, cbAllocated );
-    if ( HAL_STATUS_SUCCESS(halStatus) )
+    pCsrBssDescription = vos_mem_malloc(cbAllocated);
+    if ( NULL != pCsrBssDescription )
     {
-        palZeroMemory( pMac->hHdd, pCsrBssDescription, cbAllocated );
+        vos_mem_set(pCsrBssDescription, cbAllocated, 0);
         pCsrBssDescription->AgingCount = (tANI_S32)pMac->roam.configParam.agingCount;
-        palCopyMemory(pMac->hHdd, &pCsrBssDescription->Result.BssDescriptor, pBSSDescription, cbBSSDesc );
+        vos_mem_copy(&pCsrBssDescription->Result.BssDescriptor, pBSSDescription, cbBSSDesc);
 #if defined(VOSS_ENSBALED)
         VOS_ASSERT( pCsrBssDescription->Result.pvIes == NULL );
 #endif
@@ -2954,9 +3258,9 @@
 }
 
 // Append a Bss Description...
-tCsrScanResult *csrScanAppendBssDescription( tpAniSirGlobal pMac,
-                                             tSirBssDescription *pSirBssDescription,
-                                             tDot11fBeaconIEs *pIes )
+tCsrScanResult *csrScanAppendBssDescription( tpAniSirGlobal pMac, 
+                                             tSirBssDescription *pSirBssDescription, 
+                                             tDot11fBeaconIEs *pIes, tANI_BOOLEAN fForced )
 {
     tCsrScanResult *pCsrBssDescription = NULL;
     tAniSSID tmpSsid;
@@ -2964,7 +3268,7 @@
     int result;
 
     tmpSsid.length = 0;
-    result = csrRemoveDupBssDescription( pMac, pSirBssDescription, pIes, &tmpSsid, &timer );
+    result = csrRemoveDupBssDescription( pMac, pSirBssDescription, pIes, &tmpSsid, &timer, fForced );
     pCsrBssDescription = csrScanSaveBssDescription( pMac, pSirBssDescription, pIes );
     if (result && (pCsrBssDescription != NULL))
     {
@@ -2978,7 +3282,7 @@
             //When we remove hidden ssid from the profile i.e., forget the SSID via
             // GUI that SSID shouldn't see in the profile
             if((vos_timer_get_system_time()-timer) <= HIDDEN_TIMER)
-            {
+            { 
               pCsrBssDescription->Result.ssId = tmpSsid;
               pCsrBssDescription->Result.timer = timer;
             }
@@ -2996,14 +3300,14 @@
     tCsrChannelPowerInfo *pChannelSet;
     tListElem *pEntry;
 
-    csrLLLock(pChannelList);
+    csrLLLock(pChannelList); 
     // Remove the channel sets from the learned list and put them in the free list
     while( ( pEntry = csrLLRemoveHead( pChannelList, LL_ACCESS_NOLOCK ) ) != NULL)
     {
         pChannelSet = GET_BASE_ADDR( pEntry, tCsrChannelPowerInfo, link );
         if( pChannelSet )
         {
-            palFreeMemory( pMac->hHdd, pChannelSet );
+            vos_mem_free(pChannelSet);
         }
     }
     csrLLUnlock(pChannelList);
@@ -3012,7 +3316,7 @@
 
 
 /*
- * Save the channelList into the ultimate storage as the final stage of channel
+ * Save the channelList into the ultimate storage as the final stage of channel 
  * Input: pCountryInfo -- the country code (e.g. "USI"), channel list, and power limit are all stored inside this data structure
  */
 eHalStatus csrSaveToChannelPower2G_5G( tpAniSirGlobal pMac, tANI_U32 tableSize, tSirMacChanInfo *channelTable )
@@ -3022,16 +3326,15 @@
     tCsrChannelPowerInfo *pChannelSet;
     tANI_BOOLEAN f2GHzInfoFound = FALSE;
     tANI_BOOLEAN f2GListPurged = FALSE, f5GListPurged = FALSE;
-    eHalStatus halStatus;
 
     pChannelInfo = channelTable;
     // atleast 3 bytes have to be remaining  -- from "countryString"
     while ( i-- )
     {
-        halStatus = palAllocateMemory( pMac->hHdd, (void **)&pChannelSet, sizeof(tCsrChannelPowerInfo) );
-        if ( eHAL_STATUS_SUCCESS == halStatus )
+        pChannelSet = vos_mem_malloc(sizeof(tCsrChannelPowerInfo));
+        if ( NULL != pChannelSet )
         {
-            palZeroMemory(pMac->hHdd, pChannelSet, sizeof(tCsrChannelPowerInfo));
+            vos_mem_set(pChannelSet, sizeof(tCsrChannelPowerInfo), 0);
             pChannelSet->firstChannel = pChannelInfo->firstChanNum;
             pChannelSet->numChannels = pChannelInfo->numChannels;
 
@@ -3053,7 +3356,7 @@
             {
                 smsLog( pMac, LOGW, FL("Invalid Channel %d Present in Country IE"),
                         pChannelSet->firstChannel);
-                palFreeMemory(pMac->hHdd, pChannelSet);
+                vos_mem_free(pChannelSet);
                 return eHAL_STATUS_FAILURE;
             }
 
@@ -3076,7 +3379,7 @@
                 else {
                     smsLog( pMac, LOGW, FL("Adding 11B/G channels in 11A mode -- First Channel is %d"),
                                 pChannelSet->firstChannel);
-                    palFreeMemory(pMac->hHdd, pChannelSet);
+                      vos_mem_free(pChannelSet);
                 }
             }
             else
@@ -3097,7 +3400,7 @@
                 else {
                     smsLog( pMac, LOGW, FL("Adding 11A channels in B/G mode -- First Channel is %d"),
                                 pChannelSet->firstChannel);
-                    palFreeMemory(pMac->hHdd, pChannelSet);
+                    vos_mem_free(pChannelSet);
                 }
             }
         }
@@ -3108,7 +3411,21 @@
     return eHAL_STATUS_SUCCESS;
 }
 
+static  void csrClearDfsChannelList( tpAniSirGlobal pMac )
+{
+    tSirMbMsg *pMsg;
+    tANI_U16 msgLen;
 
+    msgLen = (tANI_U16)(sizeof( tSirMbMsg ));
+    pMsg = vos_mem_malloc(msgLen);
+    if ( NULL != pMsg )
+    {
+       vos_mem_set((void *)pMsg, msgLen, 0);
+       pMsg->type = pal_cpu_to_be16((tANI_U16)eWNI_SME_CLEAR_DFS_CHANNEL_LIST);
+       pMsg->msgLen = pal_cpu_to_be16(msgLen);
+       palSendMBMessage(pMac->hHdd, pMsg);
+    }
+}
 
 void csrApplyPower2Current( tpAniSirGlobal pMac )
 {
@@ -3139,7 +3456,7 @@
             }
         }
         tempNumChannels = CSR_MIN(pChannelList->numChannels, WNI_CFG_VALID_CHANNEL_LIST_LEN);
-        /* If user doesn't want to scan the DFS channels lets trim them from
+        /* If user doesn't want to scan the DFS channels lets trim them from 
         the valid channel list*/
         for(i=0; i < tempNumChannels; i++)
         {
@@ -3179,6 +3496,8 @@
         // extend scan capability
         //  build a scan list based on the channel list : channel# + active/passive scan
         csrSetCfgScanControlList(pMac, countryCode, &ChannelList);
+        /*Send msg to Lim to clear DFS channel list */
+        csrClearDfsChannelList(pMac);
 #ifdef FEATURE_WLAN_SCAN_PNO
         if (updateRiva)
         {
@@ -3192,7 +3511,7 @@
     {
         smsLog( pMac, LOGE, FL("  11D channel list is empty"));
     }
-    csrApplyPower2Current( pMac );     // Store the channel+power info in the global place: Cfg
+    csrApplyPower2Current( pMac );     // Store the channel+power info in the global place: Cfg 
     csrSetCfgCountryCode(pMac, countryCode);
 }
 
@@ -3211,12 +3530,13 @@
         if(p11dLog)
         {
             p11dLog->eventId = WLAN_80211D_EVENT_RESET;
-            palCopyMemory(pMac->hHdd, p11dLog->countryCode, pMac->scan.countryCodeCurrent, 3);
+            vos_mem_copy(p11dLog->countryCode, pMac->scan.countryCodeCurrent, 3);
             p11dLog->numChannel = pMac->scan.base20MHzChannels.numChannels;
             if(p11dLog->numChannel <= VOS_LOG_MAX_NUM_CHANNEL)
             {
-                palCopyMemory(pMac->hHdd, p11dLog->Channels, pMac->scan.base20MHzChannels.channelList,
-                                p11dLog->numChannel);
+                vos_mem_copy(p11dLog->Channels,
+                             pMac->scan.base20MHzChannels.channelList,
+                             p11dLog->numChannel);
                 for (Index=0; Index < pMac->scan.base20MHzChannels.numChannels; Index++)
                 {
                     p11dLog->TxPwr[Index] = CSR_ROAM_MIN( pMac->scan.defaultPowerTable[Index].pwr, pMac->roam.configParam.nTxPowerCap );
@@ -3239,12 +3559,6 @@
     }
 #endif //#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
 
-        // switch to passive scans only when 11d is enabled
-        if( csrIs11dSupported( pMac ) )
-        {
-            pMac->scan.curScanType = eSIR_PASSIVE_SCAN;
-        }
-
         csrPruneChannelListForMode(pMac, &pMac->scan.baseChannels);
         csrPruneChannelListForMode(pMac, &pMac->scan.base20MHzChannels);
 
@@ -3253,7 +3567,7 @@
         // ... and apply the channel list, power settings, and the country code.
         csrApplyChannelPowerCountryInfo( pMac, &pMac->scan.base20MHzChannels, pMac->scan.countryCodeCurrent, updateRiva );
         // clear the 11d channel list
-        palZeroMemory( pMac->hHdd, &pMac->scan.channels11d, sizeof(pMac->scan.channels11d) );
+        vos_mem_set(&pMac->scan.channels11d, sizeof(pMac->scan.channels11d), 0);
         pMac->scan.f11dInfoReset = eANI_BOOLEAN_TRUE;
         pMac->scan.f11dInfoApplied = eANI_BOOLEAN_FALSE;
     }
@@ -3268,7 +3582,8 @@
     tANI_BOOLEAN fRestart = eANI_BOOLEAN_FALSE;
 
     //Use the Country code and domain from EEPROM
-    palCopyMemory(pMac->hHdd, pMac->scan.countryCodeCurrent, pMac->scan.countryCodeDefault, WNI_CFG_COUNTRY_CODE_LEN);
+    vos_mem_copy(pMac->scan.countryCodeCurrent, pMac->scan.countryCodeDefault,
+                 WNI_CFG_COUNTRY_CODE_LEN);
     csrSetRegulatoryDomain(pMac, pMac->scan.domainIdCurrent, &fRestart);
     if( ((eANI_BOOLEAN_FALSE == fRestart) || (pfRestartNeeded == NULL) )
           && !csrIsInfraConnected(pMac))
@@ -3292,7 +3607,7 @@
 
     if(pCountry)
     {
-        status = csrGetRegulatoryDomainForCountry(pMac, pCountry, &domainId);
+        status = csrGetRegulatoryDomainForCountry(pMac, pCountry, &domainId, COUNTRY_USER);
         if(HAL_STATUS_SUCCESS(status))
         {
             status = csrSetRegulatoryDomain(pMac, domainId, pfRestartNeeded);
@@ -3300,7 +3615,7 @@
             {
                 //We don't need to check the pMac->roam.configParam.fEnforceDefaultDomain flag here,
                 //csrSetRegulatoryDomain will fail if the country doesn't fit our domain criteria.
-                palCopyMemory(pMac->hHdd, pMac->scan.countryCodeCurrent, pCountry, WNI_CFG_COUNTRY_CODE_LEN);
+                vos_mem_copy(pMac->scan.countryCodeCurrent, pCountry, WNI_CFG_COUNTRY_CODE_LEN);
                 if((pfRestartNeeded == NULL) || !(*pfRestartNeeded))
                 {
                     //Simply set it to cfg. If we need to restart, restart will apply it to the CFG
@@ -3368,7 +3683,9 @@
         {
             // ambiguous info found
             //Restore te default domain as well
-            if(HAL_STATUS_SUCCESS(csrGetRegulatoryDomainForCountry( pMac, pMac->scan.countryCodeCurrent, &domainId )))
+            if(HAL_STATUS_SUCCESS(csrGetRegulatoryDomainForCountry(
+                                         pMac, pMac->scan.countryCodeCurrent,
+                                         &domainId, COUNTRY_QUERY)))
             {
                 pMac->scan.domainIdCurrent = domainId;
             }
@@ -3381,7 +3698,9 @@
             break;
         }
         if ( pMac->scan.f11dInfoApplied && !fForce ) break;
-        if(HAL_STATUS_SUCCESS(csrGetRegulatoryDomainForCountry( pMac, pMac->scan.countryCode11d, &domainId )))
+        if(HAL_STATUS_SUCCESS(csrGetRegulatoryDomainForCountry(
+                                        pMac, pMac->scan.countryCode11d,
+                                        &domainId, COUNTRY_QUERY)))
         {
             //Check whether we need to enforce default domain
             if( ( !pMac->roam.configParam.fEnforceDefaultDomain ) ||
@@ -3398,12 +3717,13 @@
                     if(p11dLog)
                     {
                         p11dLog->eventId = WLAN_80211D_EVENT_COUNTRY_SET;
-                        palCopyMemory(pMac->hHdd, p11dLog->countryCode, pMac->scan.countryCode11d, 3);
+                        vos_mem_copy(p11dLog->countryCode, pMac->scan.countryCode11d, 3);
                         p11dLog->numChannel = pMac->scan.channels11d.numChannels;
                         if(p11dLog->numChannel <= VOS_LOG_MAX_NUM_CHANNEL)
                         {
-                            palCopyMemory(pMac->hHdd, p11dLog->Channels, pMac->scan.channels11d.channelList,
-                                            p11dLog->numChannel);
+                            vos_mem_copy(p11dLog->Channels,
+                                         pMac->scan.channels11d.channelList,
+                                         p11dLog->numChannel);
                             csrGetChannelPowerInfo(pMac, &pMac->scan.channelPowerInfoList24,
                                                     &nChnInfo, chnPwrInfo);
                             nTmp = nChnInfo;
@@ -3440,21 +3760,18 @@
 #endif //#ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
                 if(pMac->scan.domainIdCurrent != domainId)
                 {
-                   /* Regulatory Domain Changed, Purge Only scan result
-                    * which does not have channel number belong to 11d
-                    * channel list
-                    * */
                    smsLog(pMac, LOGW, FL("Domain Changed Old %d, new %d"),
                                       pMac->scan.domainIdCurrent, domainId);
-                   csrScanFilter11dResult(pMac);
+                   status = WDA_SetRegDomain(pMac, domainId, eSIR_TRUE);
                 }
-                status = WDA_SetRegDomain(pMac, domainId);
                 if (status != eHAL_STATUS_SUCCESS)
                 {
                     smsLog( pMac, LOGE, FL("  fail to set regId %d"), domainId );
                 }
                 pMac->scan.domainIdCurrent = domainId;
+#ifndef CONFIG_ENABLE_LINUX_REG
                 csrApplyChannelPowerCountryInfo( pMac, &pMac->scan.channels11d, pMac->scan.countryCode11d, eANI_BOOLEAN_TRUE );
+#endif
                 // switch to active scans using this new channel list
                 pMac->scan.curScanType = eSIR_ACTIVE_SCAN;
                 pMac->scan.f11dInfoApplied = eANI_BOOLEAN_TRUE;
@@ -3474,6 +3791,8 @@
 {
     tANI_BOOLEAN fCountryStringChanged = FALSE, fUnknownCountryCode = FALSE;
     tANI_U32 i;
+    v_REGDOMAIN_t regd;
+    tANI_BOOLEAN fCountryNotPresentInDriver = FALSE;
 
     // convert to UPPER here so we are assured the strings are always in upper case.
     for( i = 0; i < 3; i++ )
@@ -3486,7 +3805,10 @@
     // country code (which is US).  We've also seen some NETGEAR AP's that have "XX " as the country code
     // with valid 2.4 GHz US channel information.  If we cannot find the country code advertised in the
     // 11d information element, let's default to US.
-    if ( !HAL_STATUS_SUCCESS(csrGetRegulatoryDomainForCountry( pMac, pCountryCode, NULL ) ) )
+    if ( !HAL_STATUS_SUCCESS(csrGetRegulatoryDomainForCountry(pMac,
+                                                      pCountryCode,
+                                                      &regd,
+                                                      COUNTRY_QUERY) ) )
     {
         // Check the enforcement first
         if( pMac->roam.configParam.fEnforceDefaultDomain || pMac->roam.configParam.fEnforceCountryCodeMatch )
@@ -3495,10 +3817,16 @@
         }
         else
         {
-            pCountryCode[ 0 ] = 'U';
-            pCountryCode[ 1 ] = 'S';
+            fCountryNotPresentInDriver = TRUE;
         }
     }
+    //right now, even if we don't find the CC in driver we set to world. Making
+    //sure countryCode11d doesn't get updated with the invalid CC, instead
+    //reflect the world CC
+    else if (REGDOMAIN_WORLD == regd)
+    {
+        fCountryNotPresentInDriver = TRUE;
+    }
 
     // We've seen some of the AP's improperly put a 0 for the third character of the country code.
     // spec says valid charcters are 'O' (for outdoor), 'I' for Indoor, or ' ' (space; for either).
@@ -3510,15 +3838,24 @@
 
     if( !fUnknownCountryCode )
     {
-        fCountryStringChanged = (!palEqualMemory( pMac->hHdd,
-              pMac->scan.countryCode11d, pCountryCode, 2));
+        fCountryStringChanged = (!vos_mem_compare(pMac->scan.countryCode11d, pCountryCode, 2));
 
 
         if(( 0 == pMac->scan.countryCode11d[ 0 ] && 0 == pMac->scan.countryCode11d[ 1 ] )
              || (fForce))
         {
-            // this is the first .11d information
-            palCopyMemory( pMac->hHdd, pMac->scan.countryCode11d, pCountryCode, sizeof( pMac->scan.countryCode11d ) );
+            if (!fCountryNotPresentInDriver)
+            {
+                // this is the first .11d information
+                vos_mem_copy(pMac->scan.countryCode11d, pCountryCode,
+                         sizeof( pMac->scan.countryCode11d ));
+
+            }
+            else
+            {
+                pMac->scan.countryCode11d[0] = '0';
+                pMac->scan.countryCode11d[1] = '0';
+            }
         }
     }
 
@@ -3536,9 +3873,10 @@
     maxChannelIndex = ( pMac->scan.base20MHzChannels.numChannels < WNI_CFG_VALID_CHANNEL_LIST_LEN ) ?
                       pMac->scan.base20MHzChannels.numChannels : WNI_CFG_VALID_CHANNEL_LIST_LEN ;
 
-    if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pChanInfo, sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN)))
+    pChanInfo = vos_mem_malloc(sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN);
+    if ( NULL != pChanInfo )
     {
-        palZeroMemory(pMac->hHdd, pChanInfo, sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN);
+        vos_mem_set(pChanInfo, sizeof(tSirMacChanInfo) * WNI_CFG_VALID_CHANNEL_LIST_LEN, 0);
         pChanInfoStart = pChanInfo;
         for (Index=0; Index < maxChannelIndex; Index++)
         {
@@ -3561,7 +3899,7 @@
         {
             csrSaveToChannelPower2G_5G( pMac, count * sizeof(tSirMacChanInfo), pChanInfoStart );
         }
-        palFreeMemory(pMac->hHdd, pChanInfoStart);
+        vos_mem_free(pChanInfoStart);
     }
 }
 
@@ -3570,7 +3908,7 @@
 {
     tANI_BOOLEAN fPopulate5GBand = FALSE;
 
-    do
+    do 
     {
         // if this is not a dual band product, then we don't need to set the opposite
         // band info.  We only work in one band so no need to look in the other band.
@@ -3579,12 +3917,14 @@
         if ( CSR_IS_CHANNEL_5GHZ( pMac->scan.channelOf11dInfo ) )
         {
             // and the 2.4 band is empty, then populate the 2.4 channel info
+            if ( !csrLLIsListEmpty( &pMac->scan.channelPowerInfoList24, LL_ACCESS_LOCK ) ) break;
             fPopulate5GBand = FALSE;
         }
         else
         {
             // else, we found channel info in the 2.4 GHz band.  If the 5.0 band is empty
             // set the 5.0 band info from the 2.4 country code.
+            if ( !csrLLIsListEmpty( &pMac->scan.channelPowerInfoList5G, LL_ACCESS_LOCK ) ) break;
             fPopulate5GBand = TRUE;
         }
         csrSaveChannelPowerForBand( pMac, fPopulate5GBand );
@@ -3648,7 +3988,7 @@
 
 
 //bSize -- specify the buffer size of pChannelList
-void csrConstructCurrentValidChannelList( tpAniSirGlobal pMac, tDblLinkList *pChannelSetList,
+void csrConstructCurrentValidChannelList( tpAniSirGlobal pMac, tDblLinkList *pChannelSetList, 
                                             tANI_U8 *pChannelList, tANI_U8 bSize, tANI_U8 *pNumChannels )
 {
     tListElem *pEntry;
@@ -3679,7 +4019,6 @@
 tANI_BOOLEAN csrLearnCountryInformation( tpAniSirGlobal pMac, tSirBssDescription *pSirBssDesc,
                                          tDot11fBeaconIEs *pIes, tANI_BOOLEAN fForce)
 {
-    tANI_U8 Num2GChannels, bMaxNumChn;
     eHalStatus status;
     tANI_BOOLEAN fRet = eANI_BOOLEAN_FALSE;
     v_REGDOMAIN_t domainId;
@@ -3720,7 +4059,7 @@
                     {
                         tCsrScanResultFilter filter;
 
-                        palZeroMemory(pMac->hHdd, &filter, sizeof(tCsrScanResultFilter));
+                        vos_mem_set(&filter, sizeof(tCsrScanResultFilter), 0);
                         status = csrRoamPrepareFilterFromProfile(pMac, pSession->pCurRoamProfile, &filter);
                         if(HAL_STATUS_SUCCESS(status))
                         {
@@ -3730,7 +4069,7 @@
                             if(fMatch)
                             {
                                 smsLog(pMac, LOGW, "   Matching roam profile BSSID %02X-%02X-%02X-%02X-%02X-%02X causing ambiguous domain info",
-                                    pSirBssDesc->bssId[0], pSirBssDesc->bssId[1], pSirBssDesc->bssId[2],
+                                    pSirBssDesc->bssId[0], pSirBssDesc->bssId[1], pSirBssDesc->bssId[2], 
                                     pSirBssDesc->bssId[3], pSirBssDesc->bssId[4], pSirBssDesc->bssId[5]);
                                 pMac->scan.fAmbiguous11dInfoFound = eANI_BOOLEAN_TRUE;
                                 break;
@@ -3739,7 +4078,7 @@
                     }
                     else if( csrIsConnStateConnected(pMac, i))
                     {
-                        //Reach here only when the currention is base on no profile.
+                        //Reach here only when the currention is base on no profile. 
                         //User doesn't give profile and just connect to anything.
                         if(csrMatchBSSToConnectProfile(pMac, &pSession->connectedProfile, pSirBssDesc, pIesLocal))
                         {
@@ -3748,7 +4087,7 @@
                                 pSirBssDesc->bssId[3], pSirBssDesc->bssId[4], pSirBssDesc->bssId[5]);
                             //Tush
                             pMac->scan.fAmbiguous11dInfoFound = eANI_BOOLEAN_TRUE;
-                            if(csrIsBssidMatch(pMac, (tCsrBssid *)&pSirBssDesc->bssId,
+                            if(csrIsBssidMatch(pMac, (tCsrBssid *)&pSirBssDesc->bssId, 
                                                 &pSession->connectedProfile.bssid))
                             {
                                 //AP changed the 11d info on the fly, modify cfg
@@ -3760,24 +4099,29 @@
                     }
                 } //valid session
             } //for
-            if ( i == CSR_ROAM_SESSION_MAX )
+            if ( i == CSR_ROAM_SESSION_MAX ) 
             {
                 //Check whether we can use this country's 11d information
                 if( !pMac->roam.configParam.fEnforceDefaultDomain )
                 {
                     pMac->scan.fAmbiguous11dInfoFound = eANI_BOOLEAN_TRUE;
                 }
-                else
+                else 
                 {
                     VOS_ASSERT( pMac->scan.domainIdCurrent == pMac->scan.domainIdDefault );
-                    if( HAL_STATUS_SUCCESS(csrGetRegulatoryDomainForCountry(
-                                pMac, pIesLocal->Country.country, &domainId )) &&
+                    if( HAL_STATUS_SUCCESS(csrGetRegulatoryDomainForCountry( 
+                                pMac, pIesLocal->Country.country, &domainId,
+                                COUNTRY_QUERY)) &&
                                 ( domainId == pMac->scan.domainIdCurrent ) )
                     {
                         //Two countries in the same domain
                     }
                 }
             }
+#ifdef CONFIG_ENABLE_LINUX_REG
+            csrGetRegulatoryDomainForCountry(pMac, pIesLocal->Country.country,
+                                             &domainId, COUNTRY_IE);
+#endif
         }
         else //Tush
         {
@@ -3799,58 +4143,74 @@
             }
         }
         smsLog(pMac, LOG3, FL("  %d sets each one is %d"), pIesLocal->Country.num_triplets, sizeof(tSirMacChanInfo));
-        // save the channel/power information from the Channel IE.
-        //sizeof(tSirMacChanInfo) has to be 3
-        if (eHAL_STATUS_SUCCESS != csrSaveToChannelPower2G_5G( pMac, pIesLocal->Country.num_triplets * sizeof(tSirMacChanInfo),
-                    (tSirMacChanInfo *)(&pIesLocal->Country.triplets[0]) ))
-        {
-            fRet = eANI_BOOLEAN_FALSE;
-            return fRet;
-        }
 
         // set the indicator of the channel where the country IE was found...
         pMac->scan.channelOf11dInfo = pSirBssDesc->channelId;
-        csrGetRegulatoryDomainForCountry(pMac, pIesLocal->Country.country, &domainId );
+#ifndef CONFIG_ENABLE_LINUX_REG
+        status = csrGetRegulatoryDomainForCountry(pMac,
+                       pIesLocal->Country.country, &domainId, COUNTRY_IE);
+        if ( status != eHAL_STATUS_SUCCESS )
+        {
+            smsLog( pMac, LOGE, FL("  fail to get regId %d"), domainId );
+            fRet = eANI_BOOLEAN_FALSE;
+            break;
+        }
         // Checking for Domain Id change
         if ( domainId != pMac->scan.domainIdCurrent )
         {
-            tSirMacChanInfo* pMacChnSet = (tSirMacChanInfo *)(&pIesLocal->Country.triplets[0]);
-            WDA_SetRegDomain(pMac, domainId);
-            // Check weather AP provided the 2.4GHZ list or 5GHZ list
-            if(CSR_IS_CHANNEL_24GHZ(pMacChnSet[0].firstChanNum))
+            vos_mem_copy(pMac->scan.countryCode11d,
+                                  pIesLocal->Country.country,
+                                  sizeof( pMac->scan.countryCode11d ) );
+            /* Set Current Country code and Current Regulatory domain */
+            status = csrSetRegulatoryDomain(pMac, domainId, NULL);
+            if (eHAL_STATUS_SUCCESS != status)
             {
-                // AP Provided the 2.4 Channels, Update the 5GHz channels from nv.bin
-                csrGet5GChannels(pMac );
+                smsLog(pMac, LOGE, "Set Reg Domain Fail %d", status);
+                fRet = eANI_BOOLEAN_FALSE;
+                break;
             }
-            else
-            {
-                // AP Provided the 5G Channels, Update the 2.4GHZ channel list from nv.bin
-                csrGet24GChannels(pMac );
-            }
-        }
-        // Populate both band channel lists based on what we found in the country information...
-        csrSetOppositeBandChannelInfo( pMac );
-        bMaxNumChn = WNI_CFG_VALID_CHANNEL_LIST_LEN;
-        // construct 2GHz channel list first
-        csrConstructCurrentValidChannelList( pMac, &pMac->scan.channelPowerInfoList24, pMac->scan.channels11d.channelList,
-                                                bMaxNumChn, &Num2GChannels );
-        // construct 5GHz channel list now
-        if(bMaxNumChn > Num2GChannels)
-        {
-            csrConstructCurrentValidChannelList( pMac, &pMac->scan.channelPowerInfoList5G, pMac->scan.channels11d.channelList + Num2GChannels,
-                                                 bMaxNumChn - Num2GChannels,
-                                                 &pMac->scan.channels11d.numChannels );
-        }
+            //csrSetRegulatoryDomain will fail if the country doesn't fit our domain criteria.
+            vos_mem_copy(pMac->scan.countryCodeCurrent,
+                            pIesLocal->Country.country, WNI_CFG_COUNTRY_CODE_LEN);
+            //Simply set it to cfg.
+            csrSetCfgCountryCode(pMac, pIesLocal->Country.country);
 
-        pMac->scan.channels11d.numChannels += Num2GChannels;
+            /* overwrite the defualt country code */
+            vos_mem_copy(pMac->scan.countryCodeDefault,
+                                      pMac->scan.countryCodeCurrent,
+                                      WNI_CFG_COUNTRY_CODE_LEN);
+            /* Set Current RegDomain */
+            status = WDA_SetRegDomain(pMac, domainId, eSIR_TRUE);
+            if ( status != eHAL_STATUS_SUCCESS )
+            {
+                smsLog( pMac, LOGE, FL("  fail to Set regId %d"), domainId );
+                fRet = eANI_BOOLEAN_FALSE;
+                break;
+            }
+             /* set to default domain ID */
+            pMac->scan.domainIdCurrent = domainId;
+            /* get the channels based on new cc */
+            status = csrInitGetChannels( pMac );
+
+            if ( status != eHAL_STATUS_SUCCESS )
+            {
+                smsLog( pMac, LOGE, FL("  fail to get Channels "));
+                fRet = eANI_BOOLEAN_FALSE;
+                break;
+            }
+
+            /* reset info based on new cc, and we are done */
+            csrResetCountryInformation(pMac, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_TRUE);
+        }
+#endif
         fRet = eANI_BOOLEAN_TRUE;
 
     } while( 0 );
-
+    
     if( !pIes && pIesLocal )
     {
         //locally allocated
-        palFreeMemory(pMac->hHdd, pIesLocal);
+        vos_mem_free(pIesLocal);
     }
 
     return( fRet );
@@ -3888,7 +4248,7 @@
     case eCsrScanAbortBgScan:
         if(pCommand->u.scanCmd.u.bgScanRequest.ChannelInfo.ChannelList)
         {
-            palFreeMemory(pMac->hHdd, pCommand->u.scanCmd.u.bgScanRequest.ChannelInfo.ChannelList);
+            vos_mem_free(pCommand->u.scanCmd.u.bgScanRequest.ChannelInfo.ChannelList);
             pCommand->u.scanCmd.u.bgScanRequest.ChannelInfo.ChannelList = NULL;
         }
         break;
@@ -3904,9 +4264,9 @@
     if(pCommand->u.scanCmd.pToRoamProfile)
     {
         csrReleaseProfile(pMac, pCommand->u.scanCmd.pToRoamProfile);
-        palFreeMemory(pMac->hHdd, pCommand->u.scanCmd.pToRoamProfile);
+        vos_mem_free(pCommand->u.scanCmd.pToRoamProfile);
     }
-    palZeroMemory(pMac->hHdd, &pCommand->u.scanCmd, sizeof(tScanCmd));
+    vos_mem_set(&pCommand->u.scanCmd, sizeof(tScanCmd), 0);
 }
 
 
@@ -3964,7 +4324,7 @@
 eCsrScanCompleteNextCommand csrScanGetNextCommandState( tpAniSirGlobal pMac, tSmeCmd *pCommand, tANI_BOOLEAN fSuccess )
 {
     eCsrScanCompleteNextCommand NextCommand = eCsrNextScanNothing;
-
+    
     switch( pCommand->u.scanCmd.reason )
     {
         case eCsrScan11d1:
@@ -3972,7 +4332,7 @@
             break;
         case eCsrScan11d2:
             NextCommand = (fSuccess) ? eCsrNext11dScan2Success : eCsrNext11dScan2Failure;
-            break;
+            break;    
         case eCsrScan11dDone:
             NextCommand = eCsrNext11dScanComplete;
             break;
@@ -4006,7 +4366,7 @@
 tANI_BOOLEAN csrHandleScan11d1Failure(tpAniSirGlobal pMac, tSmeCmd *pCommand)
 {
     tANI_BOOLEAN fRet = eANI_BOOLEAN_TRUE;
-
+    
     //Apply back the default setting and passively scan one more time.
     csrResetCountryInformation(pMac, eANI_BOOLEAN_FALSE, eANI_BOOLEAN_TRUE);
     pCommand->u.scanCmd.reason = eCsrScan11d2;
@@ -4014,7 +4374,7 @@
     {
         fRet = eANI_BOOLEAN_FALSE;
     }
-
+    
     return (fRet);
 }
 
@@ -4024,21 +4384,24 @@
     tANI_BOOLEAN fRet = eANI_BOOLEAN_TRUE;
     tANI_U8 *pChannels;
     tANI_U8 cChannels;
-
-    if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pChannels, WNI_CFG_VALID_CHANNEL_LIST_LEN)))
+    
+    pChannels = vos_mem_malloc(WNI_CFG_VALID_CHANNEL_LIST_LEN);
+    if ( NULL != pChannels )
     {
-        palZeroMemory(pMac->hHdd, pChannels, WNI_CFG_VALID_CHANNEL_LIST_LEN);
+        vos_mem_set(pChannels, WNI_CFG_VALID_CHANNEL_LIST_LEN, 0);
         if ( csrGetRemainingChannelsFor11dScan( pMac, pChannels, &cChannels ) )
         {
             pCommand->u.scanCmd.reason = eCsrScan11dDone;
             if(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList)
             {
-                palFreeMemory(pMac->hHdd, pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList);
+                vos_mem_free(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList);
                 pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = NULL;
             }
-            if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList, cChannels)))
+            pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = vos_mem_malloc(cChannels);
+            if ( NULL != pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList )
             {
-                palCopyMemory(pMac->hHdd, pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList, pChannels, cChannels);
+                vos_mem_copy(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList,
+                             pChannels, cChannels);
                 pCommand->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = cChannels;
                 pCommand->u.scanCmd.u.scanRequest.requestType = eCSR_SCAN_REQUEST_FULL_SCAN;
                 pCommand->u.scanCmd.u.scanRequest.scanType = eSIR_ACTIVE_SCAN;
@@ -4049,9 +4412,9 @@
                 }
             }
         }
-        palFreeMemory(pMac->hHdd, pChannels);
+        vos_mem_free(pChannels);
     }
-
+    
     return (fRet);
 }
 
@@ -4076,7 +4439,7 @@
         // If the head of the queue is Active and it is a SCAN command, remove
         // and put this on the Free queue.
         if ( eSmeCommandScan == pCommand->command )
-        {
+        {     
             tANI_U32 sessionId = pCommand->sessionId;
 
             if(eSIR_SME_SUCCESS != pScanRsp->statusCode)
@@ -4102,7 +4465,7 @@
                 WLAN_VOS_DIAG_LOG_ALLOC(pScanLog, vos_log_scan_pkt_type, LOG_WLAN_SCAN_C);
                 if(pScanLog)
                 {
-                    if(eCsrScanBgScan == pCommand->u.scanCmd.reason ||
+                    if(eCsrScanBgScan == pCommand->u.scanCmd.reason || 
                         eCsrScanProbeBss == pCommand->u.scanCmd.reason ||
                         eCsrScanSetBGScanParam == pCommand->u.scanCmd.reason)
                     {
@@ -4132,13 +4495,14 @@
                                         smsLog(pMac, LOGE, FL(" fail to parse IEs"));
                                         break;
                                     }
-                                    palCopyMemory(pMac->hHdd, pScanLog->bssid[n], pScanResult->BssDescriptor.bssId, 6);
+                                    vos_mem_copy(pScanLog->bssid[n],
+                                                 pScanResult->BssDescriptor.bssId, 6);
                                     if(pIes && pIes->SSID.present && VOS_LOG_MAX_SSID_SIZE >= pIes->SSID.num_ssid)
                                     {
-                                        palCopyMemory(pMac->hHdd, pScanLog->ssid[n],
-                                                pIes->SSID.ssid, pIes->SSID.num_ssid);
+                                        vos_mem_copy(pScanLog->ssid[n],
+                                                     pIes->SSID.ssid, pIes->SSID.num_ssid);
                                     }
-                                    palFreeMemory(pMac->hHdd, pIes);
+                                    vos_mem_free(pIes);
                                     n++;
                                 }
                                 c++;
@@ -4176,7 +4540,7 @@
                 if(fRemoveCommand)
                 {
                     NextCommand = eCsrNext11dScanComplete;
-                }
+                } 
                 break;
             case eCsrNextLostLinkScan1Success:
                 if(!HAL_STATUS_SUCCESS(csrIssueRoamAfterLostlinkScan(pMac, sessionId, eCsrLostLink1)))
@@ -4204,7 +4568,7 @@
                 break;
             case eCsrNextLostLinkScan3Failed:
                 csrScanHandleFailedLostlink3(pMac, sessionId);
-                break;
+                break;    
             case eCsrNexteScanForSsidSuccess:
                 csrScanHandleSearchForSSID(pMac, pCommand);
                 break;
@@ -4233,13 +4597,13 @@
         smsLog( pMac, LOGW, FL("Scan Completion called but NO commands are ACTIVE ..."));
         fRemoveCommand = eANI_BOOLEAN_FALSE;
     }
-
+   
     return( fRemoveCommand );
 }
 
 
 
-static void csrScanRemoveDupBssDescriptionFromInterimList( tpAniSirGlobal pMac,
+static void csrScanRemoveDupBssDescriptionFromInterimList( tpAniSirGlobal pMac, 
                                                            tSirBssDescription *pSirBssDescr,
                                                            tDot11fBeaconIEs *pIes)
 {
@@ -4250,15 +4614,15 @@
     // matches the BssID of the BssDescription passed in, then these must be duplicate scan
     // results for this Bss.  In that case, remove the 'old' Bss description from the linked list.
     pEntry = csrLLPeekHead( &pMac->scan.tempScanResults, LL_ACCESS_LOCK );
-    while( pEntry )
+    while( pEntry ) 
     {
         pCsrBssDescription = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
 
         // we have a duplicate scan results only when BSSID, SSID, Channel and NetworkType
         // matches
 
-        if ( csrIsDuplicateBssDescription( pMac, &pCsrBssDescription->Result.BssDescriptor,
-                                             pSirBssDescr, pIes ) )
+        if ( csrIsDuplicateBssDescription( pMac, &pCsrBssDescription->Result.BssDescriptor, 
+                                             pSirBssDescr, pIes, FALSE ) )
         {
             pSirBssDescr->rssi = (tANI_S8)( (((tANI_S32)pSirBssDescr->rssi * CSR_SCAN_RESULT_RSSI_WEIGHT ) +
                                     ((tANI_S32)pCsrBssDescription->Result.BssDescriptor.rssi * (100 - CSR_SCAN_RESULT_RSSI_WEIGHT) )) / 100 );
@@ -4270,7 +4634,7 @@
                 // we need to free the memory associated with this node
                 csrFreeScanResultEntry( pMac, pCsrBssDescription );
             }
-
+            
             // If we found a match, we can stop looking through the list.
             break;
         }
@@ -4283,27 +4647,26 @@
 
 //Caller allocated memory pfNewBssForConn to return whether new candidate for
 //current connection is found. Cannot be NULL
-tCsrScanResult *csrScanSaveBssDescriptionToInterimList( tpAniSirGlobal pMac,
+tCsrScanResult *csrScanSaveBssDescriptionToInterimList( tpAniSirGlobal pMac, 
                                                         tSirBssDescription *pBSSDescription,
                                                         tDot11fBeaconIEs *pIes)
 {
     tCsrScanResult *pCsrBssDescription = NULL;
     tANI_U32 cbBSSDesc;
     tANI_U32 cbAllocated;
-    eHalStatus halStatus;
-
+    
     // figure out how big the BSS description is (the BSSDesc->length does NOT
     // include the size of the length field itself).
     cbBSSDesc = pBSSDescription->length + sizeof( pBSSDescription->length );
 
     cbAllocated = sizeof( tCsrScanResult ) + cbBSSDesc;
 
-    halStatus = palAllocateMemory( pMac->hHdd, (void **)&pCsrBssDescription, cbAllocated );
-    if ( HAL_STATUS_SUCCESS(halStatus) )
+    pCsrBssDescription = vos_mem_malloc(cbAllocated);
+    if ( NULL != pCsrBssDescription )
     {
-        palZeroMemory(pMac->hHdd, pCsrBssDescription, cbAllocated);
+        vos_mem_set(pCsrBssDescription, cbAllocated, 0);
         pCsrBssDescription->AgingCount = (tANI_S32)pMac->roam.configParam.agingCount;
-        palCopyMemory(pMac->hHdd, &pCsrBssDescription->Result.BssDescriptor, pBSSDescription, cbBSSDesc );
+        vos_mem_copy(&pCsrBssDescription->Result.BssDescriptor, pBSSDescription, cbBSSDesc );
         //Save SSID separately for later use
         if( pIes->SSID.present && !csrIsNULLSSID(pIes->SSID.ssid, pIes->SSID.num_ssid) )
         {
@@ -4316,8 +4679,7 @@
             }
             pCsrBssDescription->Result.ssId.length = len;
             pCsrBssDescription->Result.timer = vos_timer_get_system_time();
-            palCopyMemory(pMac->hHdd, pCsrBssDescription->Result.ssId.ssId,
-                pIes->SSID.ssid, len );
+            vos_mem_copy(pCsrBssDescription->Result.ssId.ssId, pIes->SSID.ssid, len);
         }
         csrLLInsertTail( &pMac->scan.tempScanResults, &pCsrBssDescription->Link, LL_ACCESS_LOCK );
     }
@@ -4326,10 +4688,10 @@
 }
 
 
+    
 
-
-tANI_BOOLEAN csrIsDuplicateBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pSirBssDesc1,
-                                           tSirBssDescription *pSirBssDesc2, tDot11fBeaconIEs *pIes2 )
+tANI_BOOLEAN csrIsDuplicateBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pSirBssDesc1, 
+                                           tSirBssDescription *pSirBssDesc2, tDot11fBeaconIEs *pIes2, tANI_BOOLEAN fForced )
 {
     tANI_BOOLEAN fMatch = FALSE;
     tSirMacCapabilityInfo *pCap1, *pCap2;
@@ -4340,9 +4702,9 @@
     pCap2 = (tSirMacCapabilityInfo *)&pSirBssDesc2->capabilityInfo;
     if(pCap1->ess == pCap2->ess)
     {
-        if (pCap1->ess &&
+        if (pCap1->ess && 
                 csrIsMacAddressEqual( pMac, (tCsrBssid *)pSirBssDesc1->bssId, (tCsrBssid *)pSirBssDesc2->bssId)&&
-                (pSirBssDesc1->channelId == pSirBssDesc2->channelId))
+            (fForced || (pSirBssDesc1->channelId == pSirBssDesc2->channelId)))
         {
             fMatch = TRUE;
             // Check for SSID match, if exists
@@ -4361,9 +4723,9 @@
                 }
                 if(pIes1->SSID.present && pIesTemp->SSID.present)
                 {
-                    fMatch = csrIsSsidMatch(pMac, pIes1->SSID.ssid, pIes1->SSID.num_ssid,
+                    fMatch = csrIsSsidMatch(pMac, pIes1->SSID.ssid, pIes1->SSID.num_ssid, 
                                             pIesTemp->SSID.ssid, pIesTemp->SSID.num_ssid, eANI_BOOLEAN_TRUE);
-                }
+                } 
             }while(0);
 
         }
@@ -4386,13 +4748,13 @@
                 //Same channel cannot have same SSID for different IBSS
                 if(pIes1->SSID.present && pIesTemp->SSID.present)
                 {
-                    fMatch = csrIsSsidMatch(pMac, pIes1->SSID.ssid, pIes1->SSID.num_ssid,
+                    fMatch = csrIsSsidMatch(pMac, pIes1->SSID.ssid, pIes1->SSID.num_ssid, 
                                             pIesTemp->SSID.ssid, pIesTemp->SSID.num_ssid, eANI_BOOLEAN_TRUE);
                 }
             }while(0);
         }
         /* In case of P2P devices, ess and ibss will be set to zero */
-        else if (!pCap1->ess &&
+        else if (!pCap1->ess && 
                 csrIsMacAddressEqual( pMac, (tCsrBssid *)pSirBssDesc1->bssId, (tCsrBssid *)pSirBssDesc2->bssId))
         {
             fMatch = TRUE;
@@ -4401,13 +4763,13 @@
 
     if(pIes1)
     {
-        palFreeMemory(pMac->hHdd, pIes1);
+        vos_mem_free(pIes1);
     }
-
+    
     if( (NULL == pIes2) && pIesTemp )
     {
         //locally allocated
-        palFreeMemory(pMac->hHdd, pIesTemp);
+        vos_mem_free(pIesTemp);
     }
 
     return( fMatch );
@@ -4421,7 +4783,7 @@
 
 
 //to check whether the BSS matches the dot11Mode
-static tANI_BOOLEAN csrScanIsBssAllowed(tpAniSirGlobal pMac, tSirBssDescription *pBssDesc,
+static tANI_BOOLEAN csrScanIsBssAllowed(tpAniSirGlobal pMac, tSirBssDescription *pBssDesc, 
                                         tDot11fBeaconIEs *pIes)
 {
     tANI_BOOLEAN fAllowed = eANI_BOOLEAN_FALSE;
@@ -4475,8 +4837,8 @@
 
 
 //Return pIes to caller for future use when returning TRUE.
-static tANI_BOOLEAN csrScanValidateScanResult( tpAniSirGlobal pMac, tANI_U8 *pChannels,
-                                               tANI_U8 numChn, tSirBssDescription *pBssDesc,
+static tANI_BOOLEAN csrScanValidateScanResult( tpAniSirGlobal pMac, tANI_U8 *pChannels, 
+                                               tANI_U8 numChn, tSirBssDescription *pBssDesc, 
                                                tDot11fBeaconIEs **ppIes )
 {
     tANI_BOOLEAN fValidChannel = FALSE;
@@ -4486,11 +4848,11 @@
     for( index = 0; index < numChn; index++ )
     {
         // This check relies on the fact that a single BSS description is returned in each
-        // ScanRsp call, which is the way LIM implemented the scan req/rsp funtions.  We changed
-        // to this model when we ran with a large number of APs.  If this were to change, then
-        // this check would have to mess with removing the bssDescription from somewhere in an
+        // ScanRsp call, which is the way LIM implemented the scan req/rsp funtions.  We changed 
+        // to this model when we ran with a large number of APs.  If this were to change, then 
+        // this check would have to mess with removing the bssDescription from somewhere in an 
         // arbitrary index in the bssDescription array.
-        if ( pChannels[ index ] == pBssDesc->channelId )
+        if ( pChannels[ index ] == pBssDesc->channelId ) 
         {
            fValidChannel = TRUE;
            break;
@@ -4508,7 +4870,7 @@
             }
             else
             {
-                palFreeMemory( pMac->hHdd, pIes );
+                vos_mem_free(pIes);
             }
         }
         else
@@ -4517,12 +4879,12 @@
         }
     }
 
-    return( fValidChannel );
+    return( fValidChannel );   
 }
 
 
 //Return whether last scan result is received
-static tANI_BOOLEAN csrScanProcessScanResults( tpAniSirGlobal pMac, tSmeCmd *pCommand,
+static tANI_BOOLEAN csrScanProcessScanResults( tpAniSirGlobal pMac, tSmeCmd *pCommand, 
                                                 tSirSmeScanRsp *pScanRsp, tANI_BOOLEAN *pfRemoveCommand )
 {
     tANI_BOOLEAN fRet = eANI_BOOLEAN_FALSE, fRemoveCommand = eANI_BOOLEAN_FALSE;
@@ -4530,7 +4892,7 @@
     tANI_U32 cbParsed;
     tSirBssDescription *pSirBssDescription;
     tANI_U32 cbBssDesc;
-    tANI_U32 cbScanResult = GET_FIELD_OFFSET( tSirSmeScanRsp, bssDescription )
+    tANI_U32 cbScanResult = GET_FIELD_OFFSET( tSirSmeScanRsp, bssDescription ) 
                             + sizeof(tSirBssDescription);    //We need at least one CB
 
     // don't consider the scan rsp to be valid if the status code is Scan Failure.  Scan Failure
@@ -4539,7 +4901,7 @@
     // BssDescriptions....
     do
     {
-        if ( ( cbScanResult <= pScanRsp->length ) &&
+        if ( ( cbScanResult <= pScanRsp->length ) && 
              (( eSIR_SME_SUCCESS == pScanRsp->statusCode ) ||
               ( eSIR_SME_MORE_SCAN_RESULTS_FOLLOW == pScanRsp->statusCode ) ) )
         {
@@ -4575,19 +4937,19 @@
             // let's drop the scan result.
             //
             // The other situation is where the scan request is for a scan on a particular channel set
-            // and the scan result is from a
-
+            // and the scan result is from a 
+            
             // if the NumChannels is 0, then we are supposed to be scanning all channels.  Use the full channel
             // list as the 'valid' channel list.  Otherwise, use the specific channel list in the scan parms
             // as the valid channels.
-            if ( 0 == cChannels )
+            if ( 0 == cChannels ) 
             {
                 tANI_U32 len = sizeof(pMac->roam.validChannelList);
-
+                
                 if (HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac, (tANI_U8 *)pMac->roam.validChannelList, &len)))
                 {
                     pChannelList = pMac->roam.validChannelList;
-                    cChannels = (tANI_U8)len;
+                    cChannels = (tANI_U8)len; 
                 }
                 else
                 {
@@ -4602,7 +4964,7 @@
             pSirBssDescription = pScanRsp->bssDescription;
             while( cbParsed < pScanRsp->length )
             {
-                if ( csrScanValidateScanResult( pMac, pChannelList, cChannels, pSirBssDescription, &pIes ) )
+                if ( csrScanValidateScanResult( pMac, pChannelList, cChannels, pSirBssDescription, &pIes ) ) 
                 {
                     csrScanRemoveDupBssDescriptionFromInterimList(pMac, pSirBssDescription, pIes);
                     csrScanSaveBssDescriptionToInterimList( pMac, pSirBssDescription, pIes );
@@ -4626,7 +4988,7 @@
                         }
                     }
                     //Free the resource
-                    palFreeMemory( pMac->hHdd, pIes );
+                    vos_mem_free(pIes);
                 }
                 // skip over the BSS description to the next one...
                 cbBssDesc = pSirBssDescription->length + sizeof( pSirBssDescription->length );
@@ -4694,12 +5056,12 @@
             /* if active connected sessions present then continue to split scan
              * with specified interval between consecutive scans */
             csrSetDefaultScanTiming(pMac, pCommand->u.scanCmd.u.scanRequest.scanType, &(pCommand->u.scanCmd.u.scanRequest));
-            palTimerStart(pMac->hHdd, pMac->scan.hTimerStaApConcTimer,
-                    pCommand->u.scanCmd.u.scanRequest.restTime * PAL_TIMER_TO_MS_UNIT, eANI_BOOLEAN_FALSE);
+            vos_timer_start(&pMac->scan.hTimerStaApConcTimer,
+                pCommand->u.scanCmd.u.scanRequest.restTime);
         } else {
             /* if no connected sessions present then initiate next scan command immediately */
             /* minimum timer granularity is 10ms */
-            palTimerStart(pMac->hHdd, pMac->scan.hTimerStaApConcTimer, 10 * 1000, eANI_BOOLEAN_FALSE);
+            vos_timer_start(&pMac->scan.hTimerStaApConcTimer, 10);
         }
     }
 #endif
@@ -4710,8 +5072,8 @@
 tANI_BOOLEAN csrScanIsWildCardScan( tpAniSirGlobal pMac, tSmeCmd *pCommand )
 {
     tANI_U8 bssid[WNI_CFG_BSSID_LEN] = {0, 0, 0, 0, 0, 0};
-    tANI_BOOLEAN f = palEqualMemory( pMac->hHdd, pCommand->u.scanCmd.u.scanRequest.bssid,
-        bssid, sizeof(tCsrBssid) );
+    tANI_BOOLEAN f = vos_mem_compare(pCommand->u.scanCmd.u.scanRequest.bssid,
+                                     bssid, sizeof(tCsrBssid));
 
     //It is not a wild card scan if the bssid is not broadcast and the number of SSID is 1.
     return ((tANI_BOOLEAN)( (f || (0xff == pCommand->u.scanCmd.u.scanRequest.bssid[0])) &&
@@ -4751,14 +5113,14 @@
         ieLen = (pSirBssDescription->length + sizeof( pSirBssDescription->length )
                         - GET_FIELD_OFFSET( tSirBssDescription, ieFields ));
 
-        if ( !HAL_STATUS_SUCCESS(palAllocateMemory( pMac->hHdd,
-            (void **)&pScanResult, sizeof(tCsrScanResult) + ieLen)) )
+        pScanResult = vos_mem_malloc(sizeof(tCsrScanResult) + ieLen);
+        if (NULL == pScanResult)
         {
             smsLog(pMac, LOGE, FL(" Fail to allocate memory for frame"));
             return eHAL_STATUS_RESOURCES;
         }
 
-        palZeroMemory( pMac->hHdd, pScanResult, sizeof(tCsrScanResult) + ieLen);
+        vos_mem_set(pScanResult, sizeof(tCsrScanResult) + ieLen, 0);
 
         if (!HAL_STATUS_SUCCESS(csrGetParsedBssDescriptionIEs(pMac,
             pSirBssDescription, (tDot11fBeaconIEs **)&pScanResult->Result.pvIes)))
@@ -4776,9 +5138,8 @@
 
         // Remove duplicate entry
         csrRemoveDupBssDescription( pMac, &pScanResult->Result.BssDescriptor,
-                         (tDot11fBeaconIEs *)pScanResult->Result.pvIes,
-                         &tmpSsid , &timer );
-
+                                    (tDot11fBeaconIEs *)pScanResult->Result.pvIes,
+                                    &tmpSsid , &timer, FALSE );
         //Add to scan cache
         csrScanAddResult(pMac, pScanResult,
                          (tDot11fBeaconIEs *)pScanResult->Result.pvIes);
@@ -4835,7 +5196,7 @@
             case eCsrScanGetScanChnInfo:
                 pScanChnInfo = (tSmeGetScanChnRsp *)pMsgBuf;
                 /*
-                 * status code not available in tSmeGetScanChnRsp, so
+                 * status code not available in tSmeGetScanChnRsp, so 
                  * by default considereing it to be success
                  */
                 scanStatus = eSIR_SME_SUCCESS;
@@ -4904,7 +5265,7 @@
         smsLog( pMac, LOGW, "CSR: Scan Completion called but NO commands are ACTIVE ..." );
         status = eHAL_STATUS_FAILURE;
     }
-
+    
     return (status);
 }
 
@@ -4917,7 +5278,7 @@
     tCsrScanResult *pResult;
     tCsrScanResultInfo *pRet = NULL;
     tScanResultList *pResultList = (tScanResultList *)hScanResult;
-
+    
     if(pResultList)
     {
         csrLLLock(&pResultList->List);
@@ -4930,7 +5291,7 @@
         pResultList->pCurEntry = pEntry;
         csrLLUnlock(&pResultList->List);
     }
-
+    
     return pRet;
 }
 
@@ -4941,7 +5302,7 @@
     tCsrScanResult *pResult = NULL;
     tCsrScanResultInfo *pRet = NULL;
     tScanResultList *pResultList = (tScanResultList *)hScanResult;
-
+    
     if(pResultList)
     {
         csrLLLock(&pResultList->List);
@@ -4961,7 +5322,7 @@
         pResultList->pCurEntry = pEntry;
         csrLLUnlock(&pResultList->List);
     }
-
+    
     return pRet;
 }
 
@@ -4973,7 +5334,7 @@
     tScanResultList *pResultList = (tScanResultList *)hScanResult;
     tCsrScanResult *pResult = NULL;
     tListElem *pEntry = NULL;
-
+   
     if(pResultList && bssid)
     {
         csrLLLock(&pResultList->List);
@@ -4981,7 +5342,7 @@
         while(pEntry)
         {
             pResult = GET_BASE_ADDR(pEntry, tCsrScanResult, Link);
-            if(palEqualMemory(pMac->hHdd, bssid, pResult->Result.BssDescriptor.bssId, sizeof(tCsrBssid)))
+            if (vos_mem_compare(bssid, pResult->Result.BssDescriptor.bssId, sizeof(tCsrBssid)))
             {
                 status = eHAL_STATUS_SUCCESS;
                 csrLLRemoveEntry(&pResultList->List, pEntry, LL_ACCESS_NOLOCK);
@@ -4992,7 +5353,7 @@
         }
         csrLLUnlock(&pResultList->List);
     }
-
+    
     return (status);
 }
 
@@ -5013,8 +5374,8 @@
             pSession = CSR_GET_SESSION( pMac, i );
             //Not to remove the BSS we are connected to.
             if(csrIsConnStateDisconnected(pMac, i) || (NULL == pSession->pConnectBssDesc) ||
-              (!csrIsDuplicateBssDescription(pMac, &pResult->Result.BssDescriptor,
-                                                      pSession->pConnectBssDesc, NULL))
+              (!csrIsDuplicateBssDescription(pMac, &pResult->Result.BssDescriptor, 
+                                             pSession->pConnectBssDesc, NULL, FALSE))
               )
             {
                 smsLog(pMac, LOGW, "Aging out BSS %02X-%02X-%02X-%02X-%02X-%02X Channel %d",
@@ -5059,7 +5420,7 @@
     {
         pChnInfo = &pScanChnInfo->scanChn[i];
         pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_NOLOCK );
-        while( pEntry )
+        while( pEntry ) 
         {
             tmpEntry = csrLLNext(&pMac->scan.scanResultList, pEntry, LL_ACCESS_NOLOCK);
             pResult = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
@@ -5084,7 +5445,7 @@
 }
 
 
-eHalStatus csrSendMBScanReq( tpAniSirGlobal pMac, tANI_U16 sessionId,
+eHalStatus csrSendMBScanReq( tpAniSirGlobal pMac, tANI_U16 sessionId, 
                     tCsrScanRequest *pScanReq, tScanReqParam *pScanReqParam )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -5098,16 +5459,20 @@
     tANI_U8 selfMacAddr[WNI_CFG_BSSID_LEN];
     tANI_U8 *pSelfMac = NULL;
 
-    msgLen = (tANI_U16)(sizeof( tSirSmeScanReq ) - sizeof( pMsg->channelList.channelNumber ) +
+    msgLen = (tANI_U16)(sizeof( tSirSmeScanReq ) - sizeof( pMsg->channelList.channelNumber ) + 
                         ( sizeof( pMsg->channelList.channelNumber ) * pScanReq->ChannelInfo.numOfChannels )) +
                    ( pScanReq->uIEFieldLen ) ;
 
-    status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-    if(HAL_STATUS_SUCCESS(status))
+    pMsg = vos_mem_malloc(msgLen);
+    if ( NULL == pMsg )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
+    if (HAL_STATUS_SUCCESS(status))
     {
         do
         {
-            palZeroMemory(pMac->hHdd, pMsg, msgLen);
+            vos_mem_set(pMsg, msgLen, 0);
             pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_SCAN_REQ);
             pMsg->length = pal_cpu_to_be16(msgLen);
             //ToDO: Fill in session info when we need to do scan base on session.
@@ -5147,7 +5512,7 @@
                 tANI_U32 len = WNI_CFG_BSSID_LEN;
                 pSelfMac = selfMacAddr;
                 status = ccmCfgGetStr( pMac, WNI_CFG_STA_ID, pSelfMac, &len );
-                if( !HAL_STATUS_SUCCESS( status ) ||
+                if( !HAL_STATUS_SUCCESS( status ) || 
                     ( len < WNI_CFG_BSSID_LEN ) )
                 {
                   smsLog( pMac, LOGE, FL(" Can not get self MAC address from CFG status = %d"), status );
@@ -5157,22 +5522,22 @@
                 }
               }
             }
-            palCopyMemory( pMac->hHdd, (tANI_U8 *)pMsg->selfMacAddr, pSelfMac, sizeof(tSirMacAddr) );
+            vos_mem_copy((tANI_U8 *)pMsg->selfMacAddr, pSelfMac, sizeof(tSirMacAddr));
 
             //sirCopyMacAddr
-            palCopyMemory( pMac->hHdd, (tANI_U8 *)pMsg->bssId, (tANI_U8 *)&pScanReq->bssid, sizeof(tSirMacAddr) );
-            if( palEqualMemory( pMac->hHdd, pScanReq->bssid, bssid, sizeof(tCsrBssid) ) )
+            vos_mem_copy((tANI_U8 *)pMsg->bssId, (tANI_U8 *)&pScanReq->bssid, sizeof(tSirMacAddr));
+            if ( vos_mem_compare(pScanReq->bssid, bssid, sizeof(tCsrBssid)))
             {
-                palFillMemory( pMac->hHdd, pMsg->bssId, sizeof(tSirMacAddr), 0xff );
+                vos_mem_set(pMsg->bssId, sizeof(tSirMacAddr), 0xff);
             }
             else
             {
-                palCopyMemory(pMac->hHdd, pMsg->bssId, pScanReq->bssid, WNI_CFG_BSSID_LEN);
+                vos_mem_copy(pMsg->bssId, pScanReq->bssid, WNI_CFG_BSSID_LEN);
             }
             minChnTime = pScanReq->minChnTime;
             maxChnTime = pScanReq->maxChnTime;
 
-            //Verify the scan type first, if the scan is active scan, we need to make sure we
+            //Verify the scan type first, if the scan is active scan, we need to make sure we 
             //are allowed to do so.
             /* if 11d is enabled & we don't see any beacon around, scan type falls
                back to passive. But in BT AMP STA mode we need to send out a
@@ -5184,7 +5549,7 @@
                 scanType = pMac->scan.curScanType;
                 if(eSIR_PASSIVE_SCAN == pMac->scan.curScanType)
                 {
-                    if(minChnTime < pMac->roam.configParam.nPassiveMinChnTime)
+                    if(minChnTime < pMac->roam.configParam.nPassiveMinChnTime) 
                     {
                         minChnTime = pMac->roam.configParam.nPassiveMinChnTime;
                     }
@@ -5202,7 +5567,8 @@
             {
                 for (i = 0; i < pMsg->numSsid; i++)
                 {
-                    palCopyMemory(pMac->hHdd, &pMsg->ssId[i], &pScanReq->SSIDs.SSIDList[i].SSID, sizeof(tSirMacSSid));
+                    vos_mem_copy(&pMsg->ssId[i],
+                                 &pScanReq->SSIDs.SSIDList[i].SSID, sizeof(tSirMacSSid));
                 }
             }
             else
@@ -5233,28 +5599,29 @@
             if(pScanReq->ChannelInfo.numOfChannels)
             {
                 //Assuming the channelNumber is tANI_U8 (1 byte)
-                status = palCopyMemory(pMac->hHdd, pMsg->channelList.channelNumber, pScanReq->ChannelInfo.ChannelList,
-                                        pScanReq->ChannelInfo.numOfChannels);
+                vos_mem_copy(pMsg->channelList.channelNumber,
+                             pScanReq->ChannelInfo.ChannelList,
+                             pScanReq->ChannelInfo.numOfChannels);
             }
 
             pMsg->uIEFieldLen = (tANI_U16) pScanReq->uIEFieldLen;
-            pMsg->uIEFieldOffset = (tANI_U16)(sizeof( tSirSmeScanReq ) - sizeof( pMsg->channelList.channelNumber ) +
+            pMsg->uIEFieldOffset = (tANI_U16)(sizeof( tSirSmeScanReq ) - sizeof( pMsg->channelList.channelNumber ) + 
                   ( sizeof( pMsg->channelList.channelNumber ) * pScanReq->ChannelInfo.numOfChannels )) ;
-            if(pScanReq->uIEFieldLen != 0)
+            if(pScanReq->uIEFieldLen != 0) 
             {
-                palCopyMemory(pMac->hHdd, (tANI_U8 *)pMsg+pMsg->uIEFieldOffset,
-                                    pScanReq->pIEField, pScanReq->uIEFieldLen );
+                vos_mem_copy((tANI_U8 *)pMsg+pMsg->uIEFieldOffset, pScanReq->pIEField,
+                              pScanReq->uIEFieldLen);
             }
             pMsg->p2pSearch = pScanReq->p2pSearch;
 
-            if (pScanReq->requestType == eCSR_SCAN_HO_BG_SCAN)
+            if (pScanReq->requestType == eCSR_SCAN_HO_BG_SCAN) 
             {
                 pMsg->backgroundScanMode = eSIR_ROAMING_SCAN;
-            }
+            } 
 
         }while(0);
         smsLog(pMac, LOG1, FL("domainIdCurrent %d scanType %d bssType %d requestType %d numChannels %d  "),
-               pMac->scan.domainIdCurrent, pMsg->scanType, pMsg->bssType,
+               pMac->scan.domainIdCurrent, pMsg->scanType, pMsg->bssType, 
                pScanReq->requestType, pMsg->channelList.numChannels);
 
         for(i = 0; i < pMsg->channelList.numChannels; i++)
@@ -5266,10 +5633,10 @@
         {
             status = palSendMBMessage(pMac->hHdd, pMsg);
         }
-        else
+        else 
         {
             smsLog( pMac, LOGE, FL(" failed to send down scan req with status = %d"), status );
-            palFreeMemory(pMac->hHdd, pMsg);
+            vos_mem_free(pMsg);
         }
     }//Success allocated memory
     else
@@ -5287,10 +5654,12 @@
     tANI_U16 msgLen;
 
     msgLen = (tANI_U16)(sizeof( tSirSmeScanReq ));
-    status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-    if(HAL_STATUS_SUCCESS(status))
+    pMsg = vos_mem_malloc(msgLen);
+    if ( NULL == pMsg )
+       status = eHAL_STATUS_FAILURE;
+    else
     {
-        palZeroMemory(pMac->hHdd, pMsg, msgLen);
+        vos_mem_set(pMsg, msgLen, 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_SCAN_REQ);
         pMsg->length = pal_cpu_to_be16(msgLen);
         pMsg->sessionId = sessionId;
@@ -5305,7 +5674,7 @@
             smsLog( pMac, LOGE, FL(" failed to send down scan req with status = %d\n"), status );
         }
 
-    }
+    }                             
 
     return( status );
 }
@@ -5316,9 +5685,9 @@
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tScanReqParam scanReq;
-
+    
     do
-    {
+    {    
         /*
          * Don't delete cached results. Rome rssi based scan candidates
          * may land up in scan cache instead of LFR cache.
@@ -5349,14 +5718,14 @@
             WLAN_VOS_DIAG_LOG_ALLOC(pScanLog, vos_log_scan_pkt_type, LOG_WLAN_SCAN_C);
             if(pScanLog)
             {
-                if(eCsrScanBgScan == pCommand->u.scanCmd.reason ||
+                if(eCsrScanBgScan == pCommand->u.scanCmd.reason || 
                     eCsrScanProbeBss == pCommand->u.scanCmd.reason)
                 {
                     pScanLog->eventId = WLAN_SCAN_EVENT_HO_SCAN_REQ;
                 }
                 else
                 {
-                    if( (eSIR_PASSIVE_SCAN != pCommand->u.scanCmd.u.scanRequest.scanType) &&
+                    if( (eSIR_PASSIVE_SCAN != pCommand->u.scanCmd.u.scanRequest.scanType) && 
                         (eSIR_PASSIVE_SCAN != pMac->scan.curScanType) )
                     {
                         pScanLog->eventId = WLAN_SCAN_EVENT_ACTIVE_SCAN_REQ;
@@ -5371,9 +5740,9 @@
                 pScanLog->numChannel = (v_U8_t)pCommand->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels;
                 if(pScanLog->numChannel && (pScanLog->numChannel < VOS_LOG_MAX_NUM_CHANNEL))
                 {
-                    palCopyMemory(pMac->hHdd, pScanLog->channels,
-                                  pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList,
-                                  pScanLog->numChannel);
+                    vos_mem_copy(pScanLog->channels,
+                                 pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList,
+                                 pScanLog->numChannel);
                 }
                 WLAN_VOS_DIAG_LOG_REPORT(pScanLog);
             }
@@ -5384,7 +5753,7 @@
         status = csrSendMBScanReq(pMac, pCommand->sessionId,
                                 &pCommand->u.scanCmd.u.scanRequest, &scanReq);
     }while(0);
-
+    
     return( status );
 }
 
@@ -5393,9 +5762,9 @@
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tScanReqParam scanReq;
-
+    
     do
-    {
+    {    
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
         if (eCsrScanGetLfrResult == pCommand->u.scanCmd.reason)
         {
@@ -5414,7 +5783,7 @@
         }
         status = csrSendMBScanResultReq(pMac, pCommand->sessionId, &scanReq);
     }while(0);
-
+    
     return (status);
 }
 
@@ -5528,13 +5897,13 @@
     default:
         status = csrScanChannels(pMac, pCommand);
         break;
-    }
-
+    }    
+    
     if(!HAL_STATUS_SUCCESS(status))
     {
         csrReleaseScanCommand(pMac, pCommand, eCSR_SCAN_FAILURE);
     }
-
+    
     return (status);
 }
 
@@ -5543,7 +5912,7 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSmeCmd *pCommand = NULL;
-
+    
     if(pScanReq)
     {
         do
@@ -5554,12 +5923,12 @@
                 status = eHAL_STATUS_RESOURCES;
                 break;
             }
-            palZeroMemory(pMac->hHdd, &pCommand->u.scanCmd, sizeof(tScanCmd));
+            vos_mem_set(&pCommand->u.scanCmd, sizeof(tScanCmd), 0);
             pCommand->command = eSmeCommandScan;
             pCommand->u.scanCmd.reason = eCsrScanSetBGScanParam;
             pCommand->u.scanCmd.callback = NULL;
             pCommand->u.scanCmd.pContext = NULL;
-            palCopyMemory(pMac->hHdd, &pCommand->u.scanCmd.u.bgScanRequest, pScanReq, sizeof(tCsrBGScanRequest));
+            vos_mem_copy(&pCommand->u.scanCmd.u.bgScanRequest, pScanReq, sizeof(tCsrBGScanRequest));
             //we have to do the follow
             if(pScanReq->ChannelInfo.numOfChannels == 0)
             {
@@ -5567,28 +5936,27 @@
             }
             else
             {
-                status = palAllocateMemory(pMac->hHdd, (void **)&pCommand->u.scanCmd.u.bgScanRequest.ChannelInfo.ChannelList,
-                                             pScanReq->ChannelInfo.numOfChannels);
-                if(HAL_STATUS_SUCCESS(status))
+                pCommand->u.scanCmd.u.bgScanRequest.ChannelInfo.ChannelList
+                                 = vos_mem_malloc(pScanReq->ChannelInfo.numOfChannels);
+                if ( NULL != pCommand->u.scanCmd.u.bgScanRequest.ChannelInfo.ChannelList )
                 {
-                    palCopyMemory(pMac->hHdd, pCommand->u.scanCmd.u.bgScanRequest.ChannelInfo.ChannelList,
-                                    pScanReq->ChannelInfo.ChannelList, pScanReq->ChannelInfo.numOfChannels);
+                    vos_mem_copy(pCommand->u.scanCmd.u.bgScanRequest.ChannelInfo.ChannelList,
+                                 pScanReq->ChannelInfo.ChannelList,
+                                 pScanReq->ChannelInfo.numOfChannels);
                 }
                 else
                 {
                     smsLog(pMac, LOGE, FL("ran out of memory"));
                     csrReleaseCommandScan(pMac, pCommand);
-                    break;
+                    return eHAL_STATUS_FAILURE;
                 }
             }
 
             //scan req for SSID
             if(pScanReq->SSID.length)
             {
-               palCopyMemory(pMac->hHdd,
-                             pCommand->u.scanCmd.u.bgScanRequest.SSID.ssId,
-                             pScanReq->SSID.ssId,
-                             pScanReq->SSID.length);
+               vos_mem_copy(pCommand->u.scanCmd.u.bgScanRequest.SSID.ssId,
+                            pScanReq->SSID.ssId, pScanReq->SSID.length);
                pCommand->u.scanCmd.u.bgScanRequest.SSID.length = pScanReq->SSID.length;
 
             }
@@ -5606,7 +5974,7 @@
             }
         }while(0);
     }
-
+    
     return (status);
 }
 
@@ -5614,7 +5982,7 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSmeCmd *pCommand = NULL;
-
+    
     do
     {
         pCommand = csrGetCommandBuffer(pMac);
@@ -5623,8 +5991,8 @@
             status = eHAL_STATUS_RESOURCES;
             break;
         }
-        palZeroMemory(pMac->hHdd, &pCommand->u.scanCmd, sizeof(tScanCmd));
-        pCommand->command = eSmeCommandScan;
+        vos_mem_set(&pCommand->u.scanCmd, sizeof(tScanCmd), 0);
+        pCommand->command = eSmeCommandScan; 
         pCommand->u.scanCmd.reason = eCsrScanBGScanAbort;
         pCommand->u.scanCmd.callback = NULL;
         pCommand->u.scanCmd.pContext = NULL;
@@ -5636,17 +6004,17 @@
             break;
         }
     }while(0);
-
+    
     return (status);
 }
 
 
-//This will enable the background scan with the non-zero interval
+//This will enable the background scan with the non-zero interval 
 eHalStatus csrScanBGScanEnable(tpAniSirGlobal pMac)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSmeCmd *pCommand = NULL;
-
+    
     if(pMac->roam.configParam.bgScanInterval)
     {
         do
@@ -5657,8 +6025,8 @@
                 status = eHAL_STATUS_RESOURCES;
                 break;
             }
-            palZeroMemory(pMac->hHdd, &pCommand->u.scanCmd, sizeof(tScanCmd));
-            pCommand->command = eSmeCommandScan;
+            vos_mem_set(&pCommand->u.scanCmd, sizeof(tScanCmd), 0);
+            pCommand->command = eSmeCommandScan; 
             pCommand->u.scanCmd.reason = eCsrScanBGScanEnable;
             pCommand->u.scanCmd.callback = NULL;
             pCommand->u.scanCmd.pContext = NULL;
@@ -5682,7 +6050,7 @@
         smsLog(pMac, LOGE, FL("cannot continue because the bgscan interval is 0"));
         status = eHAL_STATUS_INVALID_PARAMETER;
     }
-
+    
     return (status);
 }
 
@@ -5699,7 +6067,7 @@
         status = csrScanFreeRequest(pMac, pDstReq);
         if(HAL_STATUS_SUCCESS(status))
         {
-            status = palCopyMemory(pMac->hHdd, pDstReq, pSrcReq, sizeof(tCsrScanRequest));
+            vos_mem_copy(pDstReq, pSrcReq, sizeof(tCsrScanRequest));
             /* Re-initialize the pointers to NULL since we did a copy */
             pDstReq->pIEField = NULL;
             pDstReq->ChannelInfo.ChannelList = NULL;
@@ -5711,10 +6079,14 @@
             }
             else
             {
-                status = palAllocateMemory(pMac->hHdd, (void **)&pDstReq->pIEField, pSrcReq->uIEFieldLen);
-                if(HAL_STATUS_SUCCESS(status))
+                pDstReq->pIEField = vos_mem_malloc(pSrcReq->uIEFieldLen);
+                if ( NULL == pDstReq->pIEField )
+                    status = eHAL_STATUS_FAILURE;
+                else
+                    status = eHAL_STATUS_SUCCESS;
+                if (HAL_STATUS_SUCCESS(status))
                 {
-                    palCopyMemory(pMac->hHdd, pDstReq->pIEField, pSrcReq->pIEField, pSrcReq->uIEFieldLen);
+                    vos_mem_copy(pDstReq->pIEField, pSrcReq->pIEField, pSrcReq->uIEFieldLen);
                     pDstReq->uIEFieldLen = pSrcReq->uIEFieldLen;
                 }
                 else
@@ -5731,8 +6103,13 @@
                 }
                 else
                 {
-                    status = palAllocateMemory(pMac->hHdd, (void **)&pDstReq->ChannelInfo.ChannelList,
-                                        pSrcReq->ChannelInfo.numOfChannels * sizeof(*pDstReq->ChannelInfo.ChannelList));
+                    pDstReq->ChannelInfo.ChannelList = vos_mem_malloc(
+                                         pSrcReq->ChannelInfo.numOfChannels
+                                         * sizeof(*pDstReq->ChannelInfo.ChannelList));
+                    if ( NULL == pDstReq->ChannelInfo.ChannelList )
+                        status = eHAL_STATUS_FAILURE;
+                    else
+                        status = eHAL_STATUS_SUCCESS;
                     if(!HAL_STATUS_SUCCESS(status))
                     {
                         pDstReq->ChannelInfo.numOfChannels = 0;
@@ -5757,7 +6134,7 @@
                         for ( index = 0; index < pSrcReq->ChannelInfo.numOfChannels ; index++ )
                         {
                             /* Allow scan on valid channels only.
-                             * If it is p2p scan and valid channel list doesnt contain
+                             * If it is p2p scan and valid channel list doesnt contain 
                              * social channels, enforce scan on social channels because
                              * that is the only way to find p2p peers.
                              * This can happen only if band is set to 5Ghz mode.
@@ -5766,12 +6143,12 @@
                                ((eCSR_SCAN_P2P_DISCOVERY == pSrcReq->requestType) &&
                                 CSR_IS_SOCIAL_CHANNEL(pSrcReq->ChannelInfo.ChannelList[index])))
                             {
-                                if( (pSrcReq->skipDfsChnlInP2pSearch &&
+                                if( (pSrcReq->skipDfsChnlInP2pSearch && 
                                     (NV_CHANNEL_DFS == vos_nv_getChannelEnabledState(pSrcReq->ChannelInfo.ChannelList[index])) )
 #ifdef FEATURE_WLAN_LFR
-                                     /*
+                                     /* 
                                       * If LFR is requesting a contiguous scan
-                                      * (i.e. numOfChannels > 1), then ignore
+                                      * (i.e. numOfChannels > 1), then ignore 
                                       * DFS channels.
                                       * TODO: vos_nv_getChannelEnabledState is returning
                                       * 120, 124 and 128 as non-DFS channels. Hence, the
@@ -5808,7 +6185,7 @@
                              * No valid channels found in the request.
                              * Only perform scan on the channels passed
                              * pSrcReq if it is a eCSR_SCAN_HO_BG_SCAN.
-                             * Passing 0 to LIM will trigger a scan on
+                             * Passing 0 to LIM will trigger a scan on 
                              * all valid channels which is not desirable.
                              */
                             smsLog(pMac, LOGE, "%s: no valid channels found (request=%d)",
@@ -5826,8 +6203,10 @@
                     else
                     {
                         smsLog(pMac, LOGE, "Couldn't get the valid Channel List, keeping requester's list");
-                        palCopyMemory(pMac->hHdd, pDstReq->ChannelInfo.ChannelList, pSrcReq->ChannelInfo.ChannelList,
-                                        pSrcReq->ChannelInfo.numOfChannels * sizeof(*pDstReq->ChannelInfo.ChannelList));
+                        vos_mem_copy(pDstReq->ChannelInfo.ChannelList,
+                                     pSrcReq->ChannelInfo.ChannelList,
+                                     pSrcReq->ChannelInfo.numOfChannels
+                                     * sizeof(*pDstReq->ChannelInfo.ChannelList));
                         pDstReq->ChannelInfo.numOfChannels = pSrcReq->ChannelInfo.numOfChannels;
                     }
                 }//Allocate memory for Channel List
@@ -5839,13 +6218,18 @@
             }
             else
             {
-                status = palAllocateMemory(pMac->hHdd, (void **)&pDstReq->SSIDs.SSIDList,
-                                    pSrcReq->SSIDs.numOfSSIDs * sizeof(*pDstReq->SSIDs.SSIDList));
-                if(HAL_STATUS_SUCCESS(status))
+                pDstReq->SSIDs.SSIDList = vos_mem_malloc(
+                              pSrcReq->SSIDs.numOfSSIDs * sizeof(*pDstReq->SSIDs.SSIDList));
+                if ( NULL == pDstReq->SSIDs.SSIDList )
+                        status = eHAL_STATUS_FAILURE;
+                else
+                        status = eHAL_STATUS_SUCCESS;
+                if (HAL_STATUS_SUCCESS(status))
                 {
                     pDstReq->SSIDs.numOfSSIDs = pSrcReq->SSIDs.numOfSSIDs;
-                    palCopyMemory(pMac->hHdd, pDstReq->SSIDs.SSIDList, pSrcReq->SSIDs.SSIDList,
-                                    pSrcReq->SSIDs.numOfSSIDs * sizeof(*pDstReq->SSIDs.SSIDList));
+                    vos_mem_copy(pDstReq->SSIDs.SSIDList,
+                                 pSrcReq->SSIDs.SSIDList,
+                                 pSrcReq->SSIDs.numOfSSIDs * sizeof(*pDstReq->SSIDs.SSIDList));
                 }
                 else
                 {
@@ -5859,40 +6243,39 @@
 
         }
     }while(0);
-
+    
     if(!HAL_STATUS_SUCCESS(status))
     {
         csrScanFreeRequest(pMac, pDstReq);
     }
-
+    
     return (status);
 }
 
 
 eHalStatus csrScanFreeRequest(tpAniSirGlobal pMac, tCsrScanRequest *pReq)
 {
-    eHalStatus status = eHAL_STATUS_SUCCESS;
-
+    
     if(pReq->ChannelInfo.ChannelList)
     {
-        status = palFreeMemory(pMac->hHdd, pReq->ChannelInfo.ChannelList);
+        vos_mem_free(pReq->ChannelInfo.ChannelList);
         pReq->ChannelInfo.ChannelList = NULL;
     }
     pReq->ChannelInfo.numOfChannels = 0;
     if(pReq->pIEField)
     {
-        status = palFreeMemory(pMac->hHdd, pReq->pIEField);
+        vos_mem_free(pReq->pIEField);
         pReq->pIEField = NULL;
     }
     pReq->uIEFieldLen = 0;
     if(pReq->SSIDs.SSIDList)
     {
-        palFreeMemory(pMac->hHdd, pReq->SSIDs.SSIDList);
+        vos_mem_free(pReq->SSIDs.SSIDList);
         pReq->SSIDs.SSIDList = NULL;
     }
     pReq->SSIDs.numOfSSIDs = 0;
-
-    return (status);
+    
+    return eHAL_STATUS_SUCCESS;
 }
 
 
@@ -5901,7 +6284,7 @@
     if(pCommand->u.scanCmd.callback)
     {
 //        sme_ReleaseGlobalLock( &pMac->sme );
-        pCommand->u.scanCmd.callback(pMac, pCommand->u.scanCmd.pContext, pCommand->u.scanCmd.scanID, scanStatus);
+        pCommand->u.scanCmd.callback(pMac, pCommand->u.scanCmd.pContext, pCommand->u.scanCmd.scanID, scanStatus); 
 //        sme_AcquireGlobalLock( &pMac->sme );
     } else {
         smsLog( pMac, LOG2, "%s:%d - Callback NULL!!!", __func__, __LINE__);
@@ -5925,31 +6308,33 @@
 eHalStatus csrScanStartGetResultTimer(tpAniSirGlobal pMac)
 {
     eHalStatus status;
-
+    
     if(pMac->scan.fScanEnable)
     {
-        status = palTimerStart(pMac->hHdd, pMac->scan.hTimerGetResult, CSR_SCAN_GET_RESULT_INTERVAL, eANI_BOOLEAN_TRUE);
+        status = vos_timer_start(&pMac->scan.hTimerGetResult, CSR_SCAN_GET_RESULT_INTERVAL/PAL_TIMER_TO_MS_UNIT);
     }
     else
     {
         status = eHAL_STATUS_FAILURE;
     }
-
+    
     return (status);
 }
 
 
 eHalStatus csrScanStopGetResultTimer(tpAniSirGlobal pMac)
 {
-    return (palTimerStop(pMac->hHdd, pMac->scan.hTimerGetResult));
+    return (vos_timer_stop(&pMac->scan.hTimerGetResult));
 }
 
 
 void csrScanGetResultTimerHandler(void *pv)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( pv );
-
+    
     csrScanRequestResult(pMac);
+
+    vos_timer_start(&pMac->scan.hTimerGetResult, CSR_SCAN_GET_RESULT_INTERVAL/PAL_TIMER_TO_MS_UNIT);
 }
 
 #ifdef WLAN_AP_STA_CONCURRENCY
@@ -5962,15 +6347,16 @@
     csrLLLock(&pMac->scan.scanCmdPendingList);
 
     if ( NULL != ( pEntry = csrLLPeekHead( &pMac->scan.scanCmdPendingList, LL_ACCESS_NOLOCK) ) )
-    {
+    {    
         tCsrScanRequest scanReq;
         tSmeCmd *pSendScanCmd = NULL;
         tANI_U8 numChn = 0;
+        tANI_U8 nNumChanCombinedConc = 0;
         tANI_U8 i, j;
         tCsrChannelInfo *pChnInfo = &scanReq.ChannelInfo;
         tANI_U8    channelToScan[WNI_CFG_VALID_CHANNEL_LIST_LEN];
         eHalStatus status;
-
+       
         pScanCmd = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
         numChn = pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels;
 
@@ -5983,24 +6369,35 @@
          * any one of the following:
          * - STA session is connected and the scan is not a P2P search
          * - any P2P session is connected
-         * Do not split scans if no concurrent infra connections are
+         * Do not split scans if no concurrent infra connections are 
          * active and if the scan is a BG scan triggered by LFR (OR)
          * any scan if LFR is in the middle of a BG scan. Splitting
          * the scan is delaying the time it takes for LFR to find
          * candidates and resulting in disconnects.
          */
-        if ( (numChn > pMac->roam.configParam.nNumChanCombinedConc) &&
-                ((csrIsStaSessionConnected(pMac) &&
+
+        if((csrIsStaSessionConnected(pMac) &&
+           !csrIsP2pSessionConnected(pMac)))
+        {
+           nNumChanCombinedConc = pMac->roam.configParam.nNumStaChanCombinedConc;
+        }
+        else if(csrIsP2pSessionConnected(pMac))
+        {
+           nNumChanCombinedConc = pMac->roam.configParam.nNumP2PChanCombinedConc;
+        }
+
+        if ( (numChn > nNumChanCombinedConc) &&
+                ((csrIsStaSessionConnected(pMac) && 
 #ifdef FEATURE_WLAN_LFR
                   (csrIsConcurrentInfraConnected(pMac) ||
                    ((pScanCmd->u.scanCmd.reason != eCsrScanBgScan) &&
-                    (pMac->roam.neighborRoamInfo.neighborRoamState !=
+                    (pMac->roam.neighborRoamInfo.neighborRoamState != 
                      eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN))) &&
 #endif
                   (pScanCmd->u.scanCmd.u.scanRequest.p2pSearch != 1)) ||
               (csrIsP2pSessionConnected(pMac))))
         {
-             palZeroMemory(pMac->hHdd, &scanReq, sizeof(tCsrScanRequest));
+             vos_mem_set(&scanReq, sizeof(tCsrScanRequest), 0);
 
              pSendScanCmd = csrGetCommandBuffer(pMac); //optimize this to use 2 command buffer only
              if (!pSendScanCmd)
@@ -6009,7 +6406,7 @@
                  csrLLUnlock(&pMac->scan.scanCmdPendingList);
                  return;
              }
-             pSendScanCmd->command = pScanCmd->command;
+             pSendScanCmd->command = pScanCmd->command; 
              pSendScanCmd->sessionId = pScanCmd->sessionId;
              pSendScanCmd->u.scanCmd.callback = NULL;
              pSendScanCmd->u.scanCmd.pContext = pScanCmd->u.scanCmd.pContext;
@@ -6018,31 +6415,32 @@
 
              /* First copy all the parameters to local variable of scan request */
              csrScanCopyRequest(pMac, &scanReq, &pScanCmd->u.scanCmd.u.scanRequest);
-
+             
              /* Now modify the elements of local var scan request required to be modified for split scan */
              if(scanReq.ChannelInfo.ChannelList != NULL)
              {
-                 palFreeMemory(pMac->hHdd,scanReq.ChannelInfo.ChannelList);
+                 vos_mem_free(scanReq.ChannelInfo.ChannelList);
                  scanReq.ChannelInfo.ChannelList = NULL;
              }
-
-             pChnInfo->numOfChannels = pMac->roam.configParam.nNumChanCombinedConc;
-             palCopyMemory(pMac->hHdd, &channelToScan[0], &pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[0],
-                     pChnInfo->numOfChannels * sizeof(tANI_U8)); //just send one channel
+             
+             pChnInfo->numOfChannels = nNumChanCombinedConc;
+             vos_mem_copy(&channelToScan[0],
+                          &pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[0],
+                          pChnInfo->numOfChannels * sizeof(tANI_U8));//just send one channel
              pChnInfo->ChannelList = &channelToScan[0];
 
-             for (i = 0, j = pMac->roam.configParam.nNumChanCombinedConc; i < (numChn-pMac->roam.configParam.nNumChanCombinedConc); i++, j++)
+             for (i = 0, j = nNumChanCombinedConc; i < (numChn-nNumChanCombinedConc); i++, j++)
              {
-                 pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[i] =
+                 pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[i] = 
                  pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[j]; //Move all the channels one step
              }
-
-             pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = numChn - pMac->roam.configParam.nNumChanCombinedConc; //reduce outstanding # of channels to be scanned
+          
+             pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = numChn - nNumChanCombinedConc; //reduce outstanding # of channels to be scanned
 
              scanReq.BSSType = eCSR_BSS_TYPE_ANY;
              //Modify callers parameters in case of concurrency
              scanReq.scanType = eSIR_ACTIVE_SCAN;
-             //Use concurrency values for min/maxChnTime.
+             //Use concurrency values for min/maxChnTime. 
              //We know csrIsAnySessionConnected(pMac) returns TRUE here
              csrSetDefaultScanTiming(pMac, scanReq.scanType, &scanReq);
 
@@ -6063,29 +6461,29 @@
              /* no active connected session present or numChn == 1
               * scan all remaining channels */
              pSendScanCmd = pScanCmd;
-             //remove this command from pending list
+             //remove this command from pending list 
              if (csrLLRemoveHead( &pMac->scan.scanCmdPendingList, LL_ACCESS_NOLOCK) == NULL)
              { //In case between PeekHead and here, the entry got removed by another thread.
                  smsLog( pMac, LOGE, FL(" Failed to remove entry from scanCmdPendingList"));
              }
-
-        }
+            
+        }               
         csrQueueSmeCommand(pMac, pSendScanCmd, eANI_BOOLEAN_FALSE);
 
     }
 
     csrLLUnlock(&pMac->scan.scanCmdPendingList);
-
+    
 }
 #endif
 
 eHalStatus csrScanStartResultAgingTimer(tpAniSirGlobal pMac)
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
-
+    
     if(pMac->scan.fScanEnable)
     {
-        status = palTimerStart(pMac->hHdd, pMac->scan.hTimerResultAging, CSR_SCAN_RESULT_AGING_INTERVAL, eANI_BOOLEAN_TRUE);
+        status = vos_timer_start(&pMac->scan.hTimerResultAging, CSR_SCAN_RESULT_AGING_INTERVAL/PAL_TIMER_TO_MS_UNIT);
     }
     return (status);
 }
@@ -6096,20 +6494,19 @@
 
     if(pMac->scan.fScanEnable)
     {
-        status = palTimerStart(pMac->hHdd, pMac->scan.hTimerResultCfgAging,
-        CSR_SCAN_RESULT_CFG_AGING_INTERVAL, eANI_BOOLEAN_TRUE);
+        status = vos_timer_start(&pMac->scan.hTimerResultCfgAging, CSR_SCAN_RESULT_CFG_AGING_INTERVAL/PAL_TIMER_TO_MS_UNIT);
     }
     return (status);
 }
 
 eHalStatus csrScanStopResultAgingTimer(tpAniSirGlobal pMac)
 {
-    return (palTimerStop(pMac->hHdd, pMac->scan.hTimerResultAging));
+    return (vos_timer_stop(&pMac->scan.hTimerResultAging));
 }
 
 eHalStatus csrScanStopResultCfgAgingTimer(tpAniSirGlobal pMac)
 {
-    return (palTimerStop(pMac->hHdd, pMac->scan.hTimerResultCfgAging));
+    return (vos_timer_stop(&pMac->scan.hTimerResultCfgAging));
 }
 
 //This function returns the maximum time a BSS is allowed in the scan result.
@@ -6120,7 +6517,7 @@
 //Connected w/o traffic, with PS
 //Connected w/ traffic, no PS -- Not supported
 //Connected w/ traffic, with PS -- Not supported
-//the return unit is in seconds.
+//the return unit is in seconds. 
 tANI_U32 csrScanGetAgeOutTime(tpAniSirGlobal pMac)
 {
     tANI_U32 nRet;
@@ -6180,10 +6577,10 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( pv );
     tANI_BOOLEAN fDisconnected = csrIsAllSessionDisconnected(pMac);
-
+    
     //no scan, no aging
-    if(pMac->scan.fScanEnable &&
-        (((eANI_BOOLEAN_FALSE == fDisconnected) && pMac->roam.configParam.bgScanInterval)
+    if(pMac->scan.fScanEnable && 
+        (((eANI_BOOLEAN_FALSE == fDisconnected) && pMac->roam.configParam.bgScanInterval)    
         || (fDisconnected && (pMac->scan.fCancelIdleScan == eANI_BOOLEAN_FALSE)))
         )
     {
@@ -6194,7 +6591,7 @@
 
         csrLLLock(&pMac->scan.scanResultList);
         pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_NOLOCK );
-        while( pEntry )
+        while( pEntry ) 
         {
             tmpEntry = csrLLNext(&pMac->scan.scanResultList, pEntry, LL_ACCESS_NOLOCK);
             pResult = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
@@ -6207,6 +6604,7 @@
         }
         csrLLUnlock(&pMac->scan.scanResultList);
     }
+    vos_timer_start(&pMac->scan.hTimerResultAging, CSR_SCAN_RESULT_AGING_INTERVAL/PAL_TIMER_TO_MS_UNIT);
 }
 
 static void csrScanResultCfgAgingTimerHandler(void *pv)
@@ -6216,10 +6614,10 @@
     tCsrScanResult *pResult;
     tANI_TIMESTAMP ageOutTime =  pMac->scan.scanResultCfgAgingTime * PAL_TICKS_PER_SECOND;
     tANI_TIMESTAMP curTime = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
-
+  
     csrLLLock(&pMac->scan.scanResultList);
     pEntry = csrLLPeekHead( &pMac->scan.scanResultList, LL_ACCESS_NOLOCK );
-    while( pEntry )
+    while( pEntry ) 
     {
         tmpEntry = csrLLNext(&pMac->scan.scanResultList, pEntry, LL_ACCESS_NOLOCK);
         pResult = GET_BASE_ADDR( pEntry, tCsrScanResult, Link );
@@ -6231,18 +6629,19 @@
         pEntry = tmpEntry;
     }
     csrLLUnlock(&pMac->scan.scanResultList);
+    vos_timer_start(&pMac->scan.hTimerResultCfgAging, CSR_SCAN_RESULT_CFG_AGING_INTERVAL/PAL_TIMER_TO_MS_UNIT);
 }
 
 eHalStatus csrScanStartIdleScanTimer(tpAniSirGlobal pMac, tANI_U32 interval)
 {
     eHalStatus status;
-
+    
     smsLog(pMac, LOG1, " csrScanStartIdleScanTimer");
     if((pMac->scan.fScanEnable) && (eANI_BOOLEAN_FALSE == pMac->scan.fCancelIdleScan) && interval)
     {
         pMac->scan.nIdleScanTimeGap += interval;
-        palTimerStop(pMac->hHdd, pMac->scan.hTimerIdleScan);
-        status = palTimerStart(pMac->hHdd, pMac->scan.hTimerIdleScan, interval, eANI_BOOLEAN_FALSE);
+        vos_timer_stop(&pMac->scan.hTimerIdleScan);
+        status = vos_timer_start(&pMac->scan.hTimerIdleScan, interval/PAL_TIMER_TO_MS_UNIT);
         if( !HAL_STATUS_SUCCESS(status) )
         {
             smsLog(pMac, LOGE, "  Fail to start Idle scan timer. status = %d interval = %d", status, interval);
@@ -6258,14 +6657,14 @@
         }
         status = eHAL_STATUS_FAILURE;
     }
-
+    
     return (status);
 }
 
 
 eHalStatus csrScanStopIdleScanTimer(tpAniSirGlobal pMac)
 {
-    return (palTimerStop(pMac->hHdd, pMac->scan.hTimerIdleScan));
+    return (vos_timer_stop(&pMac->scan.hTimerIdleScan));
 }
 
 
@@ -6290,7 +6689,7 @@
 
     if(eANI_BOOLEAN_FALSE == pMac->scan.fCancelIdleScan)
     {
-        if(pMac->roam.configParam.IsIdleScanEnabled)
+        if(pMac->roam.configParam.IsIdleScanEnabled) 
         {
             if(HAL_STATUS_SUCCESS(status))
             {
@@ -6314,7 +6713,7 @@
         }
         else
         {//we might need another flag to check if CSR needs to request imps at all
-
+       
             tANI_U32 nTime = 0;
 
             pMac->scan.fRestartIdleScan = eANI_BOOLEAN_FALSE;
@@ -6327,7 +6726,7 @@
 }
 
 
-//Param: pTimeInterval -- Caller allocated memory in return, if failed, to specify the nxt time interval for
+//Param: pTimeInterval -- Caller allocated memory in return, if failed, to specify the nxt time interval for 
 //idle scan timer interval
 //Return: Not success -- meaning it cannot start IMPS, caller needs to start a timer for idle scan
 eHalStatus csrScanTriggerIdleScan(tpAniSirGlobal pMac, tANI_U32 *pTimeInterval)
@@ -6371,7 +6770,7 @@
 
         return status;
     }
-    if((pMac->scan.fScanEnable) && (eANI_BOOLEAN_FALSE == pMac->scan.fCancelIdleScan)
+    if((pMac->scan.fScanEnable) && (eANI_BOOLEAN_FALSE == pMac->scan.fCancelIdleScan) 
     /*&& pMac->roam.configParam.impsSleepTime*/)
     {
         //Stop get result timer because idle scan gets scan result out of PE
@@ -6393,7 +6792,7 @@
                     {
                     *pTimeInterval = 0;
                 }
-                    //Set the restart flag to true because that idle scan
+                    //Set the restart flag to true because that idle scan 
                     //can be restarted even though the timer will not be running
                     pMac->scan.fRestartIdleScan = eANI_BOOLEAN_TRUE;
                 }
@@ -6634,11 +7033,11 @@
         pCommand = GET_BASE_ADDR(pEntry, tSmeCmd, Link);
         if (pCommand->u.scanCmd.callback)
         {
-            /* User scan request is pending,
+            /* User scan request is pending, 
                                  * send response with status eCSR_SCAN_ABORT*/
-            pCommand->u.scanCmd.callback(pMac,
-                     pCommand->u.scanCmd.pContext,
-                     pCommand->u.scanCmd.scanID,
+            pCommand->u.scanCmd.callback(pMac, 
+                     pCommand->u.scanCmd.pContext, 
+                     pCommand->u.scanCmd.scanID, 
                      eCSR_SCAN_ABORT);
         }
         csrReleaseCommandScan( pMac, pCommand );
@@ -6716,10 +7115,12 @@
         tANI_U32 nItems = *pNumItems;
 
         *pNumItems = 0;
-        status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
-        if(HAL_STATUS_SUCCESS(status))
+        pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+        if ( NULL == pScanFilter )
+           status = eHAL_STATUS_FAILURE;
+        else
         {
-            palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
+            vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
             //Here is the profile we need to connect to
             status = csrRoamPrepareFilterFromProfile(pMac, pSession->pCurRoamProfile, pScanFilter);
             if(HAL_STATUS_SUCCESS(status))
@@ -6730,20 +7131,20 @@
                     while(((pScanResult = csrScanResultGetNext(pMac, hBSSList)) != NULL) && ( pSession->NumPmkidCandidate < nItems))
                     {
                         //NumPmkidCandidate adds up here
-                        csrProcessBSSDescForPMKIDList(pMac, &pScanResult->BssDescriptor,
+                        csrProcessBSSDescForPMKIDList(pMac, &pScanResult->BssDescriptor, 
                                                       (tDot11fBeaconIEs *)( pScanResult->pvIes ));
                     }
                     if(pSession->NumPmkidCandidate)
                     {
                         *pNumItems = pSession->NumPmkidCandidate;
-                        palCopyMemory(pMac->hHdd, pPmkidList, pSession->PmkidCandidateInfo,
-                                      pSession->NumPmkidCandidate * sizeof(tPmkidCandidateInfo));
+                        vos_mem_copy(pPmkidList, pSession->PmkidCandidateInfo,
+                                     pSession->NumPmkidCandidate * sizeof(tPmkidCandidateInfo));
                     }
                     csrScanResultPurge(pMac, hBSSList);
                 }//Have scan result
                 csrFreeScanFilter(pMac, pScanFilter);
             }
-            palFreeMemory(pMac->hHdd, pScanFilter);
+            vos_mem_free(pScanFilter);
         }
     }
 
@@ -6774,10 +7175,12 @@
         tScanResultHandle hBSSList;
         tANI_U32 nItems = *pNumItems;
         *pNumItems = 0;
-        status = palAllocateMemory(pMac->hHdd, (void **)&pScanFilter, sizeof(tCsrScanResultFilter));
-        if(HAL_STATUS_SUCCESS(status))
+        pScanFilter = vos_mem_malloc(sizeof(tCsrScanResultFilter));
+        if ( NULL == pScanFilter )
+            status = eHAL_STATUS_FAILURE;
+        else
         {
-            palZeroMemory(pMac->hHdd, pScanFilter, sizeof(tCsrScanResultFilter));
+            vos_mem_set(pScanFilter, sizeof(tCsrScanResultFilter), 0);
             //Here is the profile we need to connect to
             status = csrRoamPrepareFilterFromProfile(pMac, pSession->pCurRoamProfile, pScanFilter);
             if(HAL_STATUS_SUCCESS(status))
@@ -6795,12 +7198,12 @@
                     if(pSession->NumBkidCandidate)
                     {
                         *pNumItems = pSession->NumBkidCandidate;
-                        palCopyMemory(pMac->hHdd, pBkidList, pSession->BkidCandidateInfo, pSession->NumBkidCandidate * sizeof(tBkidCandidateInfo));
+                        vos_mem_copy(pBkidList, pSession->BkidCandidateInfo, pSession->NumBkidCandidate * sizeof(tBkidCandidateInfo));
                     }
                     csrScanResultPurge(pMac, hBSSList);
                 }//Have scan result
             }
-            palFreeMemory(pMac->hHdd, pScanFilter);
+            vos_mem_free(pScanFilter);
         }
     }
 
@@ -6810,13 +7213,13 @@
 
 
 
-//This function is usually used for BSSs that suppresses SSID so the profile
+//This function is usually used for BSSs that suppresses SSID so the profile 
 //shall have one and only one SSID
-eHalStatus csrScanForSSID(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, tANI_U32 roamId)
+eHalStatus csrScanForSSID(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, tANI_U32 roamId, tANI_BOOLEAN notify)
 {
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
     tSmeCmd *pScanCmd = NULL;
-    tANI_U8 bAddr[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+    tANI_U8 bAddr[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; 
     tANI_U8  index = 0;
     tANI_U32 numSsid = pProfile->SSIDs.numOfSSIDs;
 
@@ -6836,10 +7239,12 @@
                 smsLog(pMac, LOGE, FL("failed to allocate command buffer"));
                 break;
             }
-            palZeroMemory(pMac->hHdd, &pScanCmd->u.scanCmd, sizeof(tScanCmd));
-            status = palAllocateMemory(pMac->hHdd, (void **)&pScanCmd->u.scanCmd.pToRoamProfile, sizeof(tCsrRoamProfile));
-            if(!HAL_STATUS_SUCCESS(status))
-                break;
+            vos_mem_set(&pScanCmd->u.scanCmd, sizeof(tScanCmd), 0);
+            pScanCmd->u.scanCmd.pToRoamProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+            if ( NULL == pScanCmd->u.scanCmd.pToRoamProfile )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
             status = csrRoamCopyProfile(pMac, pScanCmd->u.scanCmd.pToRoamProfile, pProfile);
             if(!HAL_STATUS_SUCCESS(status))
                 break;
@@ -6848,9 +7253,9 @@
             pScanCmd->sessionId = (tANI_U8)sessionId;
             pScanCmd->u.scanCmd.callback = NULL;
             pScanCmd->u.scanCmd.pContext = NULL;
-            pScanCmd->u.scanCmd.reason = eCsrScanForSsid;
+            pScanCmd->u.scanCmd.reason = eCsrScanForSsid;//Need to check: might need a new reason for SSID scan for LFR during multisession with p2p
             pScanCmd->u.scanCmd.scanID = pMac->scan.nextScanID++; //let it wrap around
-            palZeroMemory(pMac->hHdd, &pScanCmd->u.scanCmd.u.scanRequest, sizeof(tCsrScanRequest));
+            vos_mem_set(&pScanCmd->u.scanCmd.u.scanRequest, sizeof(tCsrScanRequest), 0);
             pScanCmd->u.scanCmd.u.scanRequest.scanType = eSIR_ACTIVE_SCAN;
             pScanCmd->u.scanCmd.u.scanRequest.BSSType = pProfile->BSSType;
             // To avoid 11b rate in probe request Set p2pSearch flag as 1 for P2P Client Mode
@@ -6860,13 +7265,18 @@
             }
             if(pProfile->pAddIEScan)
             {
-                status = palAllocateMemory(pMac->hHdd,
-                                (void **)&pScanCmd->u.scanCmd.u.scanRequest.pIEField,
-                                pProfile->nAddIEScanLength);
-                palZeroMemory(pMac->hHdd, pScanCmd->u.scanCmd.u.scanRequest.pIEField, pProfile->nAddIEScanLength);
-                if(HAL_STATUS_SUCCESS(status))
+                pScanCmd->u.scanCmd.u.scanRequest.pIEField = vos_mem_malloc(
+                                                    pProfile->nAddIEScanLength);
+                if ( NULL == pScanCmd->u.scanCmd.u.scanRequest.pIEField )
+                    status = eHAL_STATUS_FAILURE;
+                else
+                    status = eHAL_STATUS_SUCCESS;
+                vos_mem_set(pScanCmd->u.scanCmd.u.scanRequest.pIEField,
+                            pProfile->nAddIEScanLength, 0);
+                if (HAL_STATUS_SUCCESS(status))
                 {
-                    palCopyMemory(pMac->hHdd, pScanCmd->u.scanCmd.u.scanRequest.pIEField, pProfile->pAddIEScan, pProfile->nAddIEScanLength);
+                    vos_mem_copy(pScanCmd->u.scanCmd.u.scanRequest.pIEField,
+                                 pProfile->pAddIEScan, pProfile->nAddIEScanLength);
                     pScanCmd->u.scanCmd.u.scanRequest.uIEFieldLen = pProfile->nAddIEScanLength;
                 }
                 else
@@ -6886,35 +7296,46 @@
             }
             else
             {
-                 pScanCmd->u.scanCmd.u.scanRequest.maxChnTime = pMac->roam.configParam.nActiveMaxChnTime;
-                 pScanCmd->u.scanCmd.u.scanRequest.minChnTime = pMac->roam.configParam.nActiveMinChnTime;
+                 pScanCmd->u.scanCmd.u.scanRequest.maxChnTime =
+                                   pMac->roam.configParam.nActiveMaxChnTime;
+                 pScanCmd->u.scanCmd.u.scanRequest.minChnTime =
+                                   pMac->roam.configParam.nActiveMinChnTime;
             }
-	    pScanCmd->u.scanCmd.u.scanRequest.maxChnTimeBtc = pMac->roam.configParam.nActiveMaxChnTimeBtc;
-	    pScanCmd->u.scanCmd.u.scanRequest.minChnTimeBtc = pMac->roam.configParam.nActiveMinChnTimeBtc;
+            pScanCmd->u.scanCmd.u.scanRequest.maxChnTimeBtc =
+                                   pMac->roam.configParam.nActiveMaxChnTimeBtc;
+            pScanCmd->u.scanCmd.u.scanRequest.minChnTimeBtc =
+                                   pMac->roam.configParam.nActiveMinChnTimeBtc;
             if(pProfile->BSSIDs.numOfBSSIDs == 1)
             {
-                palCopyMemory(pMac->hHdd, pScanCmd->u.scanCmd.u.scanRequest.bssid, pProfile->BSSIDs.bssid, sizeof(tCsrBssid));
+                vos_mem_copy(pScanCmd->u.scanCmd.u.scanRequest.bssid,
+                             pProfile->BSSIDs.bssid, sizeof(tCsrBssid));
             }
             else
             {
-                palCopyMemory(pMac->hHdd, pScanCmd->u.scanCmd.u.scanRequest.bssid, bAddr, 6);
+                vos_mem_copy(pScanCmd->u.scanCmd.u.scanRequest.bssid, bAddr, 6);
             }
             if(pProfile->ChannelInfo.numOfChannels)
             {
-               status = palAllocateMemory(pMac->hHdd, (void **)&pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList, sizeof(*pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList) * pProfile->ChannelInfo.numOfChannels);
-               pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = 0;
-               if(HAL_STATUS_SUCCESS(status))
+                pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = vos_mem_malloc(
+                                 sizeof(*pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList)
+                                 * pProfile->ChannelInfo.numOfChannels);
+                if ( NULL == pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList )
+                    status = eHAL_STATUS_FAILURE;
+                else
+                    status = eHAL_STATUS_SUCCESS;
+                pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = 0;
+                if(HAL_STATUS_SUCCESS(status))
                 {
                   csrRoamIsChannelValid(pMac, pProfile->ChannelInfo.ChannelList[0]);
                   for(index = 0; index < pProfile->ChannelInfo.numOfChannels; index++)
                   {
                      if(csrRoamIsValidChannel(pMac, pProfile->ChannelInfo.ChannelList[index]))
                      {
-                        pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels]
+                        pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels] 
                            = pProfile->ChannelInfo.ChannelList[index];
                         pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels++;
                      }
-                     else
+                     else 
                      {
                          smsLog(pMac, LOGW, FL("process a channel (%d) that is invalid"), pProfile->ChannelInfo.ChannelList[index]);
                      }
@@ -6933,15 +7354,19 @@
             }
             if(pProfile->SSIDs.numOfSSIDs)
             {
-                status = palAllocateMemory(pMac->hHdd, (void **)&pScanCmd->u.scanCmd.u.scanRequest.SSIDs.SSIDList,
-                                            pProfile->SSIDs.numOfSSIDs * sizeof(tCsrSSIDInfo));
+                pScanCmd->u.scanCmd.u.scanRequest.SSIDs.SSIDList = vos_mem_malloc(
+                                     pProfile->SSIDs.numOfSSIDs * sizeof(tCsrSSIDInfo));
+                if ( NULL == pScanCmd->u.scanCmd.u.scanRequest.SSIDs.SSIDList )
+                    status = eHAL_STATUS_FAILURE;
+                else
+                    status = eHAL_STATUS_SUCCESS;
                 if(!HAL_STATUS_SUCCESS(status))
                 {
                     break;
                 }
                 pScanCmd->u.scanCmd.u.scanRequest.SSIDs.numOfSSIDs = 1;
-                palCopyMemory(pMac->hHdd, pScanCmd->u.scanCmd.u.scanRequest.SSIDs.SSIDList, pProfile->SSIDs.SSIDList,
-                                sizeof(tCsrSSIDInfo));
+                vos_mem_copy(pScanCmd->u.scanCmd.u.scanRequest.SSIDs.SSIDList,
+                             pProfile->SSIDs.SSIDList, sizeof(tCsrSSIDInfo));
             }
             //Start process the command
             status = csrQueueSmeCommand(pMac, pScanCmd, eANI_BOOLEAN_FALSE);
@@ -6958,15 +7383,18 @@
                 csrReleaseCommandScan(pMac, pScanCmd);
                 //TODO:free the memory that is allocated in this function
             }
+            if(notify)
+            {
             csrRoamCallCallback(pMac, sessionId, NULL, roamId, eCSR_ROAM_FAILED, eCSR_ROAM_RESULT_FAILURE);
         }
+        }
     }//valid
     else
     {
         smsLog(pMac, LOGE, FL("cannot scan because scanEnable (%d) or numSSID (%d) is invalid"),
                 pMac->scan.fScanEnable, pProfile->SSIDs.numOfSSIDs);
     }
-
+    
     return (status);
 }
 
@@ -6990,10 +7418,10 @@
                 status = eHAL_STATUS_RESOURCES;
                 break;
             }
-            palZeroMemory(pMac->hHdd, &pScanCmd->u.scanCmd, sizeof(tScanCmd));
+            vos_mem_set(&pScanCmd->u.scanCmd, sizeof(tScanCmd), 0);
             status = eHAL_STATUS_SUCCESS;
             pScanCmd->u.scanCmd.roamId = 0;
-            pScanCmd->command = eSmeCommandScan;
+            pScanCmd->command = eSmeCommandScan; 
             pScanCmd->u.scanCmd.callback = NULL;
             pScanCmd->u.scanCmd.pContext = NULL;
             pScanCmd->u.scanCmd.reason = eCsrScanForCapsChange;
@@ -7011,7 +7439,7 @@
             {
                 csrReleaseCommandScan(pMac, pScanCmd);
             }
-        }
+        }    
     }
 
     return (status);
@@ -7023,20 +7451,21 @@
 {
     tANI_U32 len = CSR_MIN(sizeof(pMac->roam.validChannelList), sizeof(pMac->scan.bgScanChannelList));
 
-    palZeroMemory(pMac->hHdd, pMac->scan.bgScanChannelList, len);
+    vos_mem_set(pMac->scan.bgScanChannelList, len, 0);
     pMac->scan.numBGScanChannel = 0;
 
     if(HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac, pMac->roam.validChannelList, &len)))
     {
         pMac->roam.numValidChannels = len;
         pMac->scan.numBGScanChannel = (tANI_U8)CSR_MIN(len, WNI_CFG_BG_SCAN_CHANNEL_LIST_LEN);
-        palCopyMemory(pMac->hHdd, pMac->scan.bgScanChannelList, pMac->roam.validChannelList, pMac->scan.numBGScanChannel);
+        vos_mem_copy(pMac->scan.bgScanChannelList, pMac->roam.validChannelList,
+                     pMac->scan.numBGScanChannel);
         csrSetBGScanChannelList(pMac, pMac->scan.bgScanChannelList, pMac->scan.numBGScanChannel);
     }
 }
 
 
-//This function return TRUE if background scan channel list is adjusted.
+//This function return TRUE if background scan channel list is adjusted. 
 //this function will only shrink the background scan channel list
 tANI_BOOLEAN csrAdjustBGScanChannelList(tpAniSirGlobal pMac, tANI_U8 *pChannelList, tANI_U8 NumChannels,
                                         tANI_U8 *pAdjustChannels, tANI_U8 *pNumAdjustChannels)
@@ -7059,7 +7488,7 @@
             count--;
             if(count - i)
             {
-                palCopyMemory(pMac->hHdd, &pAdjustChannels[i], &pAdjustChannels[i+1], count - i);
+                vos_mem_copy(&pAdjustChannels[i], &pAdjustChannels[i+1], count - i);
             }
             else
             {
@@ -7094,7 +7523,7 @@
         smsLog( pMac, LOGE, FL(" failed") );
         pMac->scan.baseChannels.numChannels = 0;
     }
-
+    
     return ( status );
 }
 
@@ -7144,9 +7573,9 @@
 
     //allocate maximum space for all channels
     dataLen = WNI_CFG_VALID_CHANNEL_LIST_LEN * sizeof(tSirMacChanInfo);
-    if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pBuf, dataLen)))
+    if ( (pBuf = vos_mem_malloc(dataLen)) != NULL )
     {
-        palZeroMemory(pMac->hHdd, pBuf, dataLen);
+        vos_mem_set(pBuf, dataLen, 0);
         pChannelPowerSet = (tSirMacChanInfo *)(pBuf);
 
         pEntry = csrLLPeekHead( pList, LL_ACCESS_LOCK );
@@ -7211,9 +7640,9 @@
 
         if(cbLen)
         {
-            ccmCfgSetStr(pMac, cfgId, (tANI_U8 *)pBuf, cbLen, NULL, eANI_BOOLEAN_FALSE);
+            ccmCfgSetStr(pMac, cfgId, (tANI_U8 *)pBuf, cbLen, NULL, eANI_BOOLEAN_FALSE); 
         }
-        palFreeMemory( pMac->hHdd, pBuf );
+        vos_mem_free(pBuf);
     }//Allocate memory
 }
 
@@ -7222,9 +7651,9 @@
 {
     tANI_U8 cc[WNI_CFG_COUNTRY_CODE_LEN];
     ///v_REGDOMAIN_t DomainId;
-
+    
     smsLog( pMac, LOG3, "Setting Country Code in Cfg from csrSetCfgCountryCode %s",countryCode );
-    palCopyMemory( pMac->hHdd, cc, countryCode, WNI_CFG_COUNTRY_CODE_LEN );
+    vos_mem_copy(cc, countryCode, WNI_CFG_COUNTRY_CODE_LEN);
 
     // don't program the bogus country codes that we created for Korea in the MAC.  if we see
     // the bogus country codes, program the MAC with the right country code.
@@ -7238,7 +7667,7 @@
     }
     ccmCfgSetStr(pMac, WNI_CFG_COUNTRY_CODE, cc, WNI_CFG_COUNTRY_CODE_LEN, NULL, eANI_BOOLEAN_FALSE);
 
-    //Need to let HALPHY know about the current domain so it can apply some
+    //Need to let HALPHY know about the current domain so it can apply some 
     //domain-specific settings (TX filter...)
     /*if(HAL_STATUS_SUCCESS(csrGetRegulatoryDomainForCountry(pMac, cc, &DomainId)))
     {
@@ -7262,53 +7691,45 @@
             *pbLen = (tANI_U8)len;
         }
     }
-
+    
     return (status);
 }
 
 
 void csrSetCfgScanControlList( tpAniSirGlobal pMac, tANI_U8 *countryCode, tCsrChannel *pChannelList  )
-{
+{   
     tANI_U8 i, j;
-    tANI_BOOLEAN found=FALSE;
+    tANI_BOOLEAN found=FALSE;  
     tANI_U8 *pControlList = NULL;
     tANI_U32 len = WNI_CFG_SCAN_CONTROL_LIST_LEN;
 
-    if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pControlList, WNI_CFG_SCAN_CONTROL_LIST_LEN)))
+    if ( (pControlList = vos_mem_malloc(WNI_CFG_SCAN_CONTROL_LIST_LEN)) != NULL )
     {
-        palZeroMemory(pMac->hHdd, (void *)pControlList, WNI_CFG_SCAN_CONTROL_LIST_LEN);
+        vos_mem_set((void *)pControlList, WNI_CFG_SCAN_CONTROL_LIST_LEN, 0);
         if(HAL_STATUS_SUCCESS(ccmCfgGetStr(pMac, WNI_CFG_SCAN_CONTROL_LIST, pControlList, &len)))
         {
             for (i = 0; i < pChannelList->numChannels; i++)
             {
-                for (j = 0; j < len; j += 2)
+                for (j = 0; j < len; j += 2) 
                 {
-                    if (pControlList[j] == pChannelList->channelList[i])
+                    if (pControlList[j] == pChannelList->channelList[i]) 
                     {
                         found = TRUE;
                         break;
                     }
                 }
-
+                   
                 if (found)    // insert a pair(channel#, flag)
                 {
-                    if (CSR_IS_CHANNEL_5GHZ(pControlList[j]))
-                    {
-                        pControlList[j+1] = csrGetScanType(pMac, pControlList[j]);
-                    }
-                    else
-                    {
-                        pControlList[j+1]  = eSIR_ACTIVE_SCAN;
-                    }
-
+                    pControlList[j+1] = csrGetScanType(pMac, pControlList[j]);
                     found = FALSE;  // reset the flag
                 }
-
-            }
+                       
+            }            
 
             ccmCfgSetStr(pMac, WNI_CFG_SCAN_CONTROL_LIST, pControlList, len, NULL, eANI_BOOLEAN_FALSE);
         }//Successfully getting scan control list
-        palFreeMemory(pMac->hHdd, pControlList);
+        vos_mem_free(pControlList);
     }//AllocateMemory
 }
 
@@ -7318,7 +7739,7 @@
 {
     return (ccmCfgSetInt(pMac, WNI_CFG_BACKGROUND_SCAN_PERIOD, bgPeriod, (tCcmCfgSetCallback) csrScanCcmCfgSetCallback, eANI_BOOLEAN_FALSE));
 }
-
+    
 
 void csrScanCcmCfgSetCallback(tHalHandle hHal, tANI_S32 result)
 {
@@ -7345,7 +7766,7 @@
         {
             smsLog( pMac, LOGW, "CSR: Scan Completion called but SCAN command is not ACTIVE ..." );
         }
-    }
+    }   
     smeProcessPendingQueue( pMac );
 }
 
@@ -7354,7 +7775,7 @@
     eHalStatus status;
     tCsrBGScanRequest *pScanReq = &pCommand->u.scanCmd.u.bgScanRequest;
     tANI_U32 dataLen = sizeof( tANI_U8 ) * pScanReq->ChannelInfo.numOfChannels;
-
+        
     //***setcfg for background scan channel list
     status = ccmCfgSetInt(pMac, WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME, pScanReq->minChnTime, NULL, eANI_BOOLEAN_FALSE);
     status = ccmCfgSetInt(pMac, WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME, pScanReq->maxChnTime, NULL, eANI_BOOLEAN_FALSE);
@@ -7382,8 +7803,9 @@
                 pScanLog->numChannel = pScanReq->ChannelInfo.numOfChannels;
                 if(pScanLog->numChannel && (pScanLog->numChannel < VOS_LOG_MAX_NUM_CHANNEL))
                 {
-                    palCopyMemory(pMac->hHdd, pScanLog->channels, pScanReq->ChannelInfo.ChannelList,
-                        pScanLog->numChannel);
+                    vos_mem_copy(pScanLog->channels,
+                                 pScanReq->ChannelInfo.ChannelList,
+                                 pScanLog->numChannel);
                 }
                 WLAN_VOS_DIAG_LOG_REPORT(pScanLog);
             }
@@ -7397,12 +7819,12 @@
         //No need to stop aging because IDLE scan is still running
         status = ccmCfgSetInt(pMac, WNI_CFG_BACKGROUND_SCAN_PERIOD, 0, NULL, eANI_BOOLEAN_FALSE);
     }
-
+    
     if(pScanReq->SSID.length > WNI_CFG_SSID_LEN)
     {
         pScanReq->SSID.length = WNI_CFG_SSID_LEN;
     }
-
+    
     status = ccmCfgSetStr(pMac, WNI_CFG_BG_SCAN_CHANNEL_LIST, pScanReq->ChannelInfo.ChannelList, dataLen, NULL, eANI_BOOLEAN_FALSE);
     status = ccmCfgSetStr(pMac, WNI_CFG_SSID, (tANI_U8 *)pScanReq->SSID.ssId, pScanReq->SSID.length, NULL, eANI_BOOLEAN_FALSE);
 
@@ -7462,18 +7884,20 @@
            pCommand->sessionId == sessionId)
         {
             msgLen = (tANI_U16)(sizeof(tSirSmeScanAbortReq));
-            status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-            if(HAL_STATUS_SUCCESS(status))
+            pMsg = vos_mem_malloc(msgLen);
+            if ( NULL == pMsg )
             {
-                palZeroMemory(pMac->hHdd, (void *)pMsg, msgLen);
+               status = eHAL_STATUS_FAILURE;
+               smsLog(pMac, LOGE, FL("Failed to allocate memory for SmeScanAbortReq"));
+            }
+            else
+            {
+                vos_mem_set((void *)pMsg, msgLen, 0);
                 pMsg->type = pal_cpu_to_be16((tANI_U16)eWNI_SME_SCAN_ABORT_IND);
                 pMsg->msgLen = pal_cpu_to_be16(msgLen);
                 pMsg->sessionId = sessionId;
                 status = palSendMBMessage(pMac->hHdd, pMsg);
             }
-            else
-                smsLog(pMac, LOGE, FL("Failed to allocate memory for"
-                                      " SmeScanAbortReq"));
         }
     }
 
@@ -7608,16 +8032,18 @@
     else
         msgLen = (tANI_U16)(sizeof(tSirMbMsg));
 
-    status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-    if(HAL_STATUS_SUCCESS(status))
+    pMsg = vos_mem_malloc(msgLen);
+    if ( NULL == pMsg )
+        status = eHAL_STATUS_FAILURE;
+    else
     {
-        palZeroMemory(pMac->hHdd, pMsg, msgLen);
+        vos_mem_set(pMsg, msgLen, 0);
         pMsg->type = eWNI_SME_GET_SCANNED_CHANNEL_REQ;
         pMsg->msgLen = msgLen;
         if (pMac->fScanOffload)
             ((tSirSmeGetScanChanReq *)pMsg)->sessionId = sessionId;
         status = palSendMBMessage(pMac->hHdd, pMsg);
-    }
+    }                             
 
     return( status );
 }
@@ -7627,7 +8053,7 @@
     tANI_BOOLEAN fValid = FALSE;
     tANI_U32 idxValidChannels;
     tANI_U32 len = pMac->roam.numValidChannels;
-
+    
     for ( idxValidChannels = 0; ( idxValidChannels < len ); idxValidChannels++ )
     {
        if ( channel == pMac->roam.validChannelList[ idxValidChannels ] )
@@ -7636,7 +8062,7 @@
           break;
        }
     }
-
+        
     return fValid;
 }
 
@@ -7653,7 +8079,9 @@
     pSession->lastRoamStateBeforePno =
                csrRoamStateChange(pMac, eCSR_ROAMING_STATE_SCANNING, sessionId);
 }
+#endif
 
+#ifdef FEATURE_WLAN_SCAN_PNO
 eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
             tSirPrefNetworkFoundInd *pPrefNetworkFoundInd)
 {
@@ -7668,7 +8096,7 @@
    tpSirMacMgmtHdr macHeader = (tpSirMacMgmtHdr)pPrefNetworkFoundInd->data;
 
    pParsedFrame =
-       (tpSirProbeRespBeacon) vos_mem_malloc(sizeof(tSirProbeRespBeacon));
+       (tpSirProbeRespBeacon)vos_mem_malloc(sizeof(tSirProbeRespBeacon));
 
    if (NULL == pParsedFrame)
    {
@@ -7705,15 +8133,15 @@
           (SIR_MAC_HDR_LEN_3A + SIR_MAC_B_PR_SSID_OFFSET);
    }
 
-   if ( !HAL_STATUS_SUCCESS(palAllocateMemory( pMac->hHdd,
-            (void **)&pScanResult, sizeof(tCsrScanResult) + uLen )) )
+   pScanResult = vos_mem_malloc(sizeof(tCsrScanResult) + uLen);
+   if ( NULL == pScanResult )
    {
       smsLog(pMac, LOGE, FL(" fail to allocate memory for frame"));
       vos_mem_free(pParsedFrame);
       return eHAL_STATUS_RESOURCES;
    }
 
-   palZeroMemory( pMac->hHdd, pScanResult, sizeof(tCsrScanResult) + uLen );
+   vos_mem_set(pScanResult, sizeof(tCsrScanResult) + uLen, 0);
    pBssDescr = &pScanResult->Result.BssDescriptor;
    /**
       * Length of BSS desription is without length of
@@ -7767,9 +8195,7 @@
    pBssDescr->timeStamp[0]   = pParsedFrame->timeStamp[0];
    pBssDescr->timeStamp[1]   = pParsedFrame->timeStamp[1];
    pBssDescr->capabilityInfo = *((tANI_U16 *)&pParsedFrame->capabilityInfo);
-   palCopyMemory( pMac->hHdd, (tANI_U8 *) &pBssDescr->bssId,
-                  (tANI_U8 *) macHeader->bssId,
-                  sizeof(tSirMacAddr));
+   vos_mem_copy((tANI_U8 *) &pBssDescr->bssId, (tANI_U8 *) macHeader->bssId, sizeof(tSirMacAddr));
    pBssDescr->nReceivedTime = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
 
    smsLog( pMac, LOG2, "(%s):Bssid= %02x-%02x-%02x-%02x-%02x-%02x "
@@ -7783,10 +8209,9 @@
    //IEs
    if (uLen)
    {
-      vos_mem_copy( &pBssDescr->ieFields,
-         pPrefNetworkFoundInd->data +
-         (SIR_MAC_HDR_LEN_3A + SIR_MAC_B_PR_SSID_OFFSET),
-         uLen);
+      vos_mem_copy(&pBssDescr->ieFields,
+                   pPrefNetworkFoundInd->data + (SIR_MAC_HDR_LEN_3A + SIR_MAC_B_PR_SSID_OFFSET),
+                   uLen);
    }
 
    pIesLocal = (tDot11fBeaconIEs *)( pScanResult->Result.pvIes );
@@ -7801,7 +8226,7 @@
    }
 
    fDupBss = csrRemoveDupBssDescription( pMac,
-           &pScanResult->Result.BssDescriptor, pIesLocal, &tmpSsid , &timer);
+           &pScanResult->Result.BssDescriptor, pIesLocal, &tmpSsid, &timer, FALSE);
    //Check whether we have reach out limit
    if ( CSR_SCAN_IS_OVER_BSS_LIMIT(pMac) )
    {
@@ -7810,7 +8235,7 @@
       //Free the resources
       if( (pScanResult->Result.pvIes == NULL) && pIesLocal )
       {
-            palFreeMemory(pMac->hHdd, pIesLocal);
+         vos_mem_free(pIesLocal);
       }
       csrFreeScanResultEntry(pMac, pScanResult);
       vos_mem_free(pParsedFrame);
@@ -7819,11 +8244,16 @@
    //Add to scan cache
    csrScanAddResult(pMac, pScanResult, pIesLocal);
 
+   if( (pScanResult->Result.pvIes == NULL) && pIesLocal )
+   {
+      vos_mem_free(pIesLocal);
+   }
+
    vos_mem_free(pParsedFrame);
 
    return eHAL_STATUS_SUCCESS;
 }
-#endif
+#endif //FEATURE_WLAN_SCAN_PNO
 
 #ifdef FEATURE_WLAN_LFR
 void csrInitOccupiedChannelsList(tpAniSirGlobal pMac)
@@ -7860,7 +8290,7 @@
       pIes = (tDot11fBeaconIEs *)( pBssDesc->Result.pvIes );
 
       //At this time, pBssDescription->Result.pvIes may be NULL
-      if( !pIes && (!HAL_STATUS_SUCCESS(csrGetParsedBssDescriptionIEs(pMac,
+      if( !pIes && (!HAL_STATUS_SUCCESS(csrGetParsedBssDescriptionIEs(pMac, 
                     &pBssDesc->Result.BssDescriptor, &pIes))) )
       {
           continue;
@@ -7873,13 +8303,115 @@
        */
       if( (pBssDesc->Result.pvIes == NULL) && pIes )
       {
-          palFreeMemory(pMac->hHdd, pIes);
+          vos_mem_free(pIes);
       }
 
       pEntry = csrLLNext( &pMac->scan.scanResultList, pEntry, LL_ACCESS_NOLOCK );
   }//while
   csrLLUnlock(&pMac->scan.scanResultList);
+    
+}
+#endif
 
+eHalStatus csrScanCreateEntryInScanCache(tpAniSirGlobal pMac, tANI_U32 sessionId,
+                                         tCsrBssid bssid, tANI_U8 channel)
+{
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tDot11fBeaconIEs *pNewIes = NULL;
+    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
+    tSirBssDescription *pNewBssDescriptor = NULL;
+    tANI_U32 size = 0;
+
+    if(NULL == pSession)
+    {
+       status = eHAL_STATUS_FAILURE;
+       return status;
+    }
+    smsLog(pMac, LOG2, FL("csrScanCreateEntryInScanCache: Current bssid::"
+                          "0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x"),
+                           pSession->pConnectBssDesc->bssId[0],
+                           pSession->pConnectBssDesc->bssId[1],
+                           pSession->pConnectBssDesc->bssId[2],
+                           pSession->pConnectBssDesc->bssId[3],
+                           pSession->pConnectBssDesc->bssId[4],
+                           pSession->pConnectBssDesc->bssId[5]);
+    smsLog(pMac, LOG2, FL("csrScanCreateEntryInScanCache: My bssid::"
+                          "0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x channel %d"),
+                           bssid[0],bssid[1],bssid[2],
+                           bssid[3],bssid[4],bssid[5],channel);
+
+    do
+    {
+        if(!HAL_STATUS_SUCCESS(csrGetParsedBssDescriptionIEs(pMac,
+                                                             pSession->pConnectBssDesc, &pNewIes)))
+        {
+            smsLog(pMac, LOGE, FL("%s: Failed to parse IEs"),
+                                  __func__);
+            status = eHAL_STATUS_FAILURE;
+            break;
+        }
+
+        size = pSession->pConnectBssDesc->length + sizeof(pSession->pConnectBssDesc->length);
+        if (size)
+        {
+            pNewBssDescriptor = vos_mem_malloc(size);
+            if ( NULL == pNewBssDescriptor )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+            if (HAL_STATUS_SUCCESS(status))
+            {
+                vos_mem_copy(pNewBssDescriptor, pSession->pConnectBssDesc, size);
+            }
+            else
+            {
+                smsLog(pMac, LOGE, FL("%s: memory allocation failed"),
+                                      __func__);
+                status = eHAL_STATUS_FAILURE;
+                break;
+            }
+
+            //change the BSSID & channel as passed
+            vos_mem_copy(pNewBssDescriptor->bssId, bssid, sizeof(tSirMacAddr));
+            pNewBssDescriptor->channelId = channel;
+            if(NULL == csrScanAppendBssDescription( pMac, pNewBssDescriptor, pNewIes, TRUE ))
+            {
+                smsLog(pMac, LOGE, FL("%s: csrScanAppendBssDescription failed"),
+                                      __func__);
+                status = eHAL_STATUS_FAILURE;
+                break;
+            }
+        }
+        else
+        {
+            smsLog(pMac, LOGE, FL("%s: length of bss descriptor is 0"),
+                                  __func__);
+            status = eHAL_STATUS_FAILURE;
+            break;
+        }
+        smsLog(pMac, LOGE, FL("%s: entry successfully added in scan cache"),
+                              __func__);
+    }while(0);
+
+    if(pNewIes)
+    {
+        vos_mem_free(pNewIes);
+    }
+    if(pNewBssDescriptor)
+    {
+        vos_mem_free(pNewBssDescriptor);
+    }
+    return status;
+}
+
+#ifdef FEATURE_WLAN_CCX
+//  Update the TSF with the difference in system time
+void UpdateCCKMTSF(tANI_U32 *timeStamp0, tANI_U32 *timeStamp1, tANI_U32 *incr)
+{
+    tANI_U64 timeStamp64 = ((tANI_U64)*timeStamp1 << 32) | (*timeStamp0);
+    timeStamp64 = (tANI_U64)(timeStamp64 + (tANI_U64)*incr);
+    *timeStamp0 = (tANI_U32)(timeStamp64 & 0xffffffff);
+    *timeStamp1 = (tANI_U32)((timeStamp64 >> 32) & 0xffffffff);
 }
 #endif
 
diff --git a/CORE/SME/src/csr/csrCmdProcess.c b/CORE/SME/src/csr/csrCmdProcess.c
index 100aca7..41d5f26 100644
--- a/CORE/SME/src/csr/csrCmdProcess.c
+++ b/CORE/SME/src/csr/csrCmdProcess.c
@@ -171,3 +171,5 @@
     }
 
 }
+
+
diff --git a/CORE/SME/src/csr/csrInsideApi.h b/CORE/SME/src/csr/csrInsideApi.h
index bdfc9cf..b1d545e 100644
--- a/CORE/SME/src/csr/csrInsideApi.h
+++ b/CORE/SME/src/csr/csrInsideApi.h
@@ -62,7 +62,8 @@
 
 #define CSR_REST_TIME_CONC                  100
 
-#define CSR_NUM_CHAN_COMBINED_CONC          1
+#define CSR_NUM_STA_CHAN_COMBINED_CONC      3
+#define CSR_NUM_P2P_CHAN_COMBINED_CONC      1
 #endif
 
 #define CSR_MAX_NUM_SUPPORTED_CHANNELS 55
@@ -70,6 +71,7 @@
 #define CSR_MAX_2_4_GHZ_SUPPORTED_CHANNELS 14
 
 #define CSR_MAX_BSS_SUPPORT            250
+#define SYSTEM_TIME_MSEC_TO_USEC      1000
 
 //This number minus 1 means the number of times a channel is scanned before a BSS is remvoed from
 //cache scan result
@@ -210,7 +212,7 @@
 void csrReleaseCommandWmStatusChange(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 //pIes2 can be NULL
 tANI_BOOLEAN csrIsDuplicateBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pSirBssDesc1, 
-                                           tSirBssDescription *pSirBssDesc2, tDot11fBeaconIEs *pIes2 );
+                                           tSirBssDescription *pSirBssDesc2, tDot11fBeaconIEs *pIes2, tANI_BOOLEAN fForced );
 eHalStatus csrRoamSaveConnectedBssDesc( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDescription *pBssDesc );
 tANI_BOOLEAN csrIsNetworkTypeEqual( tSirBssDescription *pSirBssDesc1, tSirBssDescription *pSirBssDesc2 );
 eHalStatus csrScanSmeScanResponse( tpAniSirGlobal pMac, void *pMsgBuf );
@@ -238,13 +240,13 @@
 eHalStatus csrScanHandleFailedLostlink3(tpAniSirGlobal pMac, tANI_U32 sessionId);
 tCsrScanResult *csrScanAppendBssDescription( tpAniSirGlobal pMac, 
                                              tSirBssDescription *pSirBssDescription,
-                                             tDot11fBeaconIEs *pIes);
+                                             tDot11fBeaconIEs *pIes, tANI_BOOLEAN fForced);
 void csrScanCallCallback(tpAniSirGlobal pMac, tSmeCmd *pCommand, eCsrScanStatus scanStatus);
 eHalStatus csrScanCopyRequest(tpAniSirGlobal pMac, tCsrScanRequest *pDstReq, tCsrScanRequest *pSrcReq);
 eHalStatus csrScanFreeRequest(tpAniSirGlobal pMac, tCsrScanRequest *pReq);
 eHalStatus csrScanCopyResultList(tpAniSirGlobal pMac, tScanResultHandle hIn, tScanResultHandle *phResult);
 void csrInitBGScanChannelList(tpAniSirGlobal pMac);
-eHalStatus csrScanForSSID(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, tANI_U32 roamId);
+eHalStatus csrScanForSSID(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile, tANI_U32 roamId, tANI_BOOLEAN notify);
 eHalStatus csrScanForCapabilityChange(tpAniSirGlobal pMac, tSirSmeApNewCaps *pNewCaps);
 eHalStatus csrScanStartGetResultTimer(tpAniSirGlobal pMac);
 eHalStatus csrScanStopGetResultTimer(tpAniSirGlobal pMac);
@@ -377,7 +379,7 @@
 void csrSaveChannelPowerForBand( tpAniSirGlobal pMac, tANI_BOOLEAN fPopulate5GBand );
 void csrApplyChannelPowerCountryInfo( tpAniSirGlobal pMac, tCsrChannel *pChannelList, tANI_U8 *countryCode, tANI_BOOLEAN updateRiva);
 void csrApplyPower2Current( tpAniSirGlobal pMac );
-void csrAssignRssiForCategory(tpAniSirGlobal pMac, tANI_U8 catOffset);
+void csrAssignRssiForCategory(tpAniSirGlobal pMac, tANI_S8 bestApRssi, tANI_U8 catOffset);
 tANI_BOOLEAN csrIsMacAddressZero( tpAniSirGlobal pMac, tCsrBssid *pMacAddr );
 tANI_BOOLEAN csrIsMacAddressBroadcast( tpAniSirGlobal pMac, tCsrBssid *pMacAddr );
 eHalStatus csrRoamRemoveConnectedBssFromScanCache(tpAniSirGlobal pMac, tCsrRoamConnectedProfile *pConnProfile);
@@ -404,9 +406,11 @@
 //pIes cannot be NULL
 tANI_BOOLEAN csrMatchCountryCode( tpAniSirGlobal pMac, tANI_U8 *pCountry, tDot11fBeaconIEs *pIes );
 eHalStatus csrRoamSetKey( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamSetKey *pSetKey, tANI_U32 roamId );
-eHalStatus csrRoamOpenSession( tpAniSirGlobal pMac, csrRoamCompleteCallback callback, void *pContext,
-                          tANI_U8 *pSelfMacAddr, tANI_U8 *pbSessionId,
-                          tANI_U32 type, tANI_U32 subType );
+eHalStatus csrRoamOpenSession(tpAniSirGlobal pMac,
+                              csrRoamCompleteCallback callback,
+                              void *pContext,
+                              tANI_U8 *pSelfMacAddr, tANI_U8 *pbSessionId,
+                              tANI_U32 type, tANI_U32 subType );
 //fSync: TRUE means cleanupneeds to handle synchronously.
 eHalStatus csrRoamCloseSession( tpAniSirGlobal pMac, tANI_U32 sessionId,
                                 tANI_BOOLEAN fSync, 
@@ -565,9 +569,13 @@
     CSR.
     \param pCountry - Caller allocated buffer with at least 3 bytes specifying the country code
     \param pDomainId - Caller allocated buffer to get the return domain ID upon success return. Can be NULL.
+    \param source - the source of country information.
     \return eHalStatus     
   -------------------------------------------------------------------------------*/
-eHalStatus csrGetRegulatoryDomainForCountry(tpAniSirGlobal pMac, tANI_U8 *pCountry, v_REGDOMAIN_t *pDomainId);
+eHalStatus csrGetRegulatoryDomainForCountry(tpAniSirGlobal pMac,
+                                            tANI_U8 *pCountry,
+                                            v_REGDOMAIN_t *pDomainId,
+                                            v_CountryInfoSource_t source);
 
 
 tANI_BOOLEAN csrSave11dCountryString( tpAniSirGlobal pMac, tANI_U8 *pCountryCode, tANI_BOOLEAN fForce );
@@ -945,10 +953,14 @@
 void csrRoamFTPreAuthRspProcessor( tHalHandle hHal, tpSirFTPreAuthRsp pFTPreAuthRsp );
 #endif
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 void csrCcxSendAdjacentApRepMsg(tpAniSirGlobal pMac, tCsrRoamSession *pSession);
 #endif
 
+#if defined(FEATURE_WLAN_CCX)
+void UpdateCCKMTSF(tANI_U32 *timeStamp0, tANI_U32 *timeStamp1, tANI_U32 *incr);
+#endif
+
 eHalStatus csrGetDefaultCountryCodeFrmNv(tpAniSirGlobal pMac, tANI_U8 *pCountry);
 eHalStatus csrGetCurrentCountryCode(tpAniSirGlobal pMac, tANI_U8 *pCountry);
 
@@ -964,6 +976,9 @@
 #endif
 eHalStatus csrSetTxPower(tpAniSirGlobal pMac, v_U8_t sessionId, v_U8_t mW);
 
+eHalStatus csrScanCreateEntryInScanCache(tpAniSirGlobal pMac, tANI_U32 sessionId,
+                                         tCsrBssid bssid, tANI_U8 channel);
+
 eHalStatus csrUpdateChannelList(tCsrScanStruct *pScan);
 eHalStatus csrRoamDelPMKIDfromCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
                                  tANI_U8 *pBSSId );
diff --git a/CORE/SME/src/csr/csrLinkList.c b/CORE/SME/src/csr/csrLinkList.c
index b7482d1..a2f1422 100644
--- a/CORE/SME/src/csr/csrLinkList.c
+++ b/CORE/SME/src/csr/csrLinkList.c
@@ -31,7 +31,6 @@
   
     Implementation for the Common link list interfaces.
   
-  
     Copyright (C) 2006 Airgo Networks, Incorporated 
    ========================================================================== */
 
@@ -40,6 +39,8 @@
 #include "vos_lock.h"
 #include "vos_memory.h"
 #include "vos_trace.h"
+#include "vos_timer.h"
+
 
 ANI_INLINE_FUNCTION void csrListInit(tListElem *pList)
 {
@@ -260,7 +261,7 @@
     if ( LIST_FLAG_OPEN != pList->Flag ) 
     {
         pList->Count = 0;
-
+        pList->cmdTimeoutTimer = NULL;
         vosStatus = vos_lock_init(&pList->Lock);
 
         if(VOS_IS_STATUS_SUCCESS(vosStatus))
@@ -340,6 +341,12 @@
         {
             csrLLUnlock(pList);
         }
+        if ( pList->cmdTimeoutTimer && pList->cmdTimeoutDuration )
+        {
+            /* timer to detect pending command in activelist*/
+            vos_timer_start( pList->cmdTimeoutTimer,
+                pList->cmdTimeoutDuration);
+        }
     }
 }
 
@@ -569,6 +576,10 @@
         {
             csrLLUnlock( pList );
         }
+        if ( pList->cmdTimeoutTimer )
+        {
+           vos_timer_stop(pList->cmdTimeoutTimer);
+        }
     }
 
     return( fFound );
diff --git a/CORE/SME/src/csr/csrLogDump.c b/CORE/SME/src/csr/csrLogDump.c
index a93e00b..9885ade 100644
--- a/CORE/SME/src/csr/csrLogDump.c
+++ b/CORE/SME/src/csr/csrLogDump.c
@@ -46,11 +46,11 @@
     static tCsrRoamProfile x;
     static tSirMacSSid ssid;   //To be allocated for array of SSIDs
     static tANI_U8 sessionId; // Defined for fixed session ID
-    palZeroMemory(pMac->hHdd, (void*)&x, sizeof(x)); 
+    vos_mem_set((void*)&x, sizeof(x), 0);
     x.SSIDs.numOfSSIDs=1 ;
     x.SSIDs.SSIDList[0].SSID = ssid ;
     ssid.length=6 ;
-    palCopyMemory(pMac->hHdd, ssid.ssId, "AniNet", 6);
+    vos_mem_copy(ssid.ssId, "AniNet", 6);
     if(HAL_STATUS_SUCCESS(sme_AcquireGlobalLock( &pMac->sme )))
     {
         (void)csrRoamConnect(pMac, sessionId, &x, NULL, NULL);
diff --git a/CORE/SME/src/csr/csrNeighborRoam.c b/CORE/SME/src/csr/csrNeighborRoam.c
index 4c707a1..d61113c 100644
--- a/CORE/SME/src/csr/csrNeighborRoam.c
+++ b/CORE/SME/src/csr/csrNeighborRoam.c
@@ -68,7 +68,7 @@
 #include "wlan_qct_tl.h"
 #include "sme_Api.h"
 #include "csrNeighborRoam.h"
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include "csrCcx.h"
 #endif
 
@@ -262,9 +262,14 @@
 #endif
     )
     {
-        if (eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN == pNeighborRoamInfo->neighborRoamState)
+        if ((eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN == pNeighborRoamInfo->neighborRoamState) ||
+            (eSME_ROAM_TRIGGER_FAST_ROAM == pNeighborRoamInfo->cfgRoamEn))
         {
             csrNeighborRoamIssuePreauthReq(pMac);
+            pNeighborRoamInfo->cfgRoamEn = eSME_ROAM_TRIGGER_NONE;
+            vos_mem_set(&pNeighborRoamInfo->cfgRoambssId[0],
+                        sizeof(pNeighborRoamInfo->cfgRoambssId),
+                        0xFF);
         }
         else
         {
@@ -299,11 +304,16 @@
             {
                 if ((eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN == pNeighborRoamInfo->neighborRoamState)
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-                || csrRoamIsRoamOffloadScanEnabled(pMac)
+                || csrRoamIsRoamOffloadScanEnabled(pMac) ||
+                (eSME_ROAM_TRIGGER_FAST_ROAM == pNeighborRoamInfo->cfgRoamEn)
 #endif
                 )
                 {
                     csrNeighborRoamIssuePreauthReq(pMac);
+                    pNeighborRoamInfo->cfgRoamEn = eSME_ROAM_TRIGGER_NONE;
+                    vos_mem_set(&pNeighborRoamInfo->cfgRoambssId[0],
+                                sizeof(pNeighborRoamInfo->cfgRoambssId),
+                                0xFF);
                 }
                 else
                 {
@@ -320,8 +330,8 @@
                 }
                 else
                 {
-                    smsLog(pMac, LOGE, FL("Non-11R Reassoc indication received in unexpected state %d"), pNeighborRoamInfo->neighborRoamState);
-                    VOS_ASSERT(0);
+                    smsLog(pMac, LOGE, FL("Non-11R Reassoc indication received in unexpected state %d"
+                                     " or Roaming is disabled"), pNeighborRoamInfo->neighborRoamState);
                 }
             }
 }
@@ -335,6 +345,12 @@
     {
         if (VOS_TRUE == fastRoamEnabled)
         {
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+            {
+                csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_START, REASON_CONNECT);
+            } else {
+#endif
             NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Registering neighbor lookup DOWN event with TL, RSSI = %d"),
                                     pNeighborRoamInfo->currentNeighborLookupThreshold);
             /* Register Neighbor Lookup threshold callback with TL for DOWN event only */
@@ -348,12 +364,24 @@
                 smsLog(pMac, LOGW, FL(" Couldn't register csrNeighborRoamNeighborLookupDOWNCallback with TL: Status = %d"), vosStatus);
                 vosStatus = VOS_STATUS_E_FAILURE;
             }
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            }
+#endif
         }
         else if (VOS_FALSE == fastRoamEnabled)
         {
             NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Currently in CONNECTED state, so deregister all events"));
             /* De-register existing lookup UP/DOWN, Rssi indications */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+            {
+               csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_STOP, REASON_DISCONNECTED);
+            } else {
+#endif
             csrNeighborRoamDeregAllRssiIndication(pMac);
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            }
+#endif
         }
     }
     else if (eCSR_NEIGHBOR_ROAM_STATE_INIT == pNeighborRoamInfo->neighborRoamState)
@@ -380,6 +408,12 @@
         {
             NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Registering neighbor lookup DOWN event with TL, RSSI = %d"),
                                     pNeighborRoamInfo->currentNeighborLookupThreshold);
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+            {
+                csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_START, REASON_CONNECT);
+            } else {
+#endif
             /* Register Neighbor Lookup threshold callback with TL for DOWN event only */
             vosStatus = WLANTL_RegRSSIIndicationCB(pMac->roam.gVosContext, (v_S7_t)pNeighborRoamInfo->currentNeighborLookupThreshold * (-1),
                                                 WLANTL_HO_THRESHOLD_DOWN,
@@ -391,12 +425,24 @@
                 smsLog(pMac, LOGW, FL(" Couldn't register csrNeighborRoamNeighborLookupDOWNCallback with TL: Status = %d"), vosStatus);
                 vosStatus = VOS_STATUS_E_FAILURE;
             }
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            }
+#endif
         }
         else if (VOS_FALSE == ccxMode)
         {
             NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Currently in CONNECTED state, so deregister all events"));
             /* De-register existing lookup UP/DOWN, Rssi indications */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+            {
+               csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_STOP, REASON_DISCONNECTED);
+            } else {
+#endif
             csrNeighborRoamDeregAllRssiIndication(pMac);
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            }
+#endif
         }
     }
     else if (eCSR_NEIGHBOR_ROAM_STATE_INIT == pNeighborRoamInfo->neighborRoamState)
@@ -422,23 +468,39 @@
     if (eCSR_NEIGHBOR_ROAM_STATE_CONNECTED == pNeighborRoamInfo->neighborRoamState)
     {
         NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Currently in CONNECTED state, so deregister all and re-register for DOWN event again"));
-        /* De-register existing lookup UP/DOWN, Rssi indications */
-        csrNeighborRoamDeregAllRssiIndication(pMac);
+
         pMac->roam.neighborRoamInfo.cfgParams.neighborLookupThreshold = neighborLookupRssiThreshold;
         pNeighborRoamInfo->currentNeighborLookupThreshold = pMac->roam.neighborRoamInfo.cfgParams.neighborLookupThreshold;
 
-        NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Registering neighbor lookup DOWN event with TL, RSSI = %d"), pNeighborRoamInfo->currentNeighborLookupThreshold);
-        /* Register Neighbor Lookup threshold callback with TL for DOWN event only */
-        vosStatus = WLANTL_RegRSSIIndicationCB(pMac->roam.gVosContext, (v_S7_t)pNeighborRoamInfo->currentNeighborLookupThreshold * (-1),
-                                                WLANTL_HO_THRESHOLD_DOWN,
-                                                csrNeighborRoamNeighborLookupDOWNCallback,
-                                                VOS_MODULE_ID_SME, pMac);
-        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+        /* De-register existing lookup UP/DOWN, Rssi indications */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+        if (pMac->roam.configParam.isRoamOffloadScanEnabled)
         {
-            //err msg
-            smsLog(pMac, LOGW, FL(" Couldn't register csrNeighborRoamNeighborLookupDOWNCallback with TL: Status = %d"), vosStatus);
-            vosStatus = VOS_STATUS_E_FAILURE;
+            csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG, REASON_LOOKUP_THRESH_CHANGED);
         }
+        else
+        {
+#endif
+           csrNeighborRoamDeregAllRssiIndication(pMac);
+
+           NEIGHBOR_ROAM_DEBUG(pMac, LOG2,
+           FL("Registering neighbor lookup DOWN event with TL, RSSI = %d"),
+           pNeighborRoamInfo->currentNeighborLookupThreshold);
+           /* Register Neighbor Lookup threshold callback with TL for DOWN event only */
+           vosStatus = WLANTL_RegRSSIIndicationCB(pMac->roam.gVosContext,
+                       (v_S7_t)pNeighborRoamInfo->currentNeighborLookupThreshold * (-1),
+                       WLANTL_HO_THRESHOLD_DOWN,
+                       csrNeighborRoamNeighborLookupDOWNCallback,
+                       VOS_MODULE_ID_SME, pMac);
+           if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+           {
+              //err msg
+              smsLog(pMac, LOGW, FL(" Couldn't register csrNeighborRoamNeighborLookupDOWNCallback with TL: Status = %d"), vosStatus);
+              vosStatus = VOS_STATUS_E_FAILURE;
+           }
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+        }
+#endif
     }
     else if (eCSR_NEIGHBOR_ROAM_STATE_INIT == pNeighborRoamInfo->neighborRoamState)
     {
@@ -477,39 +539,41 @@
     tpAniSirGlobal pMac = PMAC_STRUCT( pUserCtxt );
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;   
- 
-    NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Deregistering DOWN event reassoc callback with TL. Threshold RSSI = %d Reported RSSI = %d"),
+
+    if (eSME_ROAM_TRIGGER_FAST_ROAM != pNeighborRoamInfo->cfgRoamEn)
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Deregistering DOWN event reassoc callback with TL. Threshold RSSI = %d Reported RSSI = %d"),
                          pNeighborRoamInfo->cfgParams.neighborReassocThreshold * (-1),
                          avgRssi);
 
-    vosStatus = WLANTL_DeregRSSIIndicationCB(pMac->roam.gVosContext, (v_S7_t)pNeighborRoamInfo->cfgParams.neighborReassocThreshold * (-1),
+        vosStatus = WLANTL_DeregRSSIIndicationCB(pMac->roam.gVosContext, (v_S7_t)pNeighborRoamInfo->cfgParams.neighborReassocThreshold * (-1),
                                                         WLANTL_HO_THRESHOLD_DOWN, 
                                                         csrNeighborRoamReassocIndCallback,
                                                         VOS_MODULE_ID_SME);
                         
-    if(!VOS_IS_STATUS_SUCCESS(vosStatus))
-    {
-        //err msg
-        smsLog(pMac, LOGW, FL(" Couldn't deregister csrNeighborRoamReassocIndCallback with TL: Status = %d"), vosStatus);
-    }
-    
-    NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Rcvd reassoc notification-deregister UP indication. Threshold RSSI = %d Reported RSSI = %d"),
-            NEIGHBOR_ROAM_LOOKUP_UP_THRESHOLD * (-1), avgRssi);
-    vosStatus = WLANTL_DeregRSSIIndicationCB(pMac->roam.gVosContext,
-                        (v_S7_t)NEIGHBOR_ROAM_LOOKUP_UP_THRESHOLD * (-1),
-                        WLANTL_HO_THRESHOLD_UP,
-                        csrNeighborRoamNeighborLookupUPCallback,
-                        VOS_MODULE_ID_SME);
-                        
-    if(!VOS_IS_STATUS_SUCCESS(vosStatus))
-    {
-        //err msg
-        smsLog(pMac, LOGW, FL(" Couldn't deregister csrNeighborRoamNeighborLookupUPCallback with TL: Status = %d"), vosStatus);
-    }
+        if(!VOS_IS_STATUS_SUCCESS(vosStatus))
+        {
+            //err msg
+            smsLog(pMac, LOGW, FL(" Couldn't deregister csrNeighborRoamReassocIndCallback with TL: Status = %d"), vosStatus);
+        }
 
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG2, FL("Rcvd reassoc notification-deregister UP indication. Threshold RSSI = %d Reported RSSI = %d"),
+                            NEIGHBOR_ROAM_LOOKUP_UP_THRESHOLD * (-1), avgRssi);
+        vosStatus = WLANTL_DeregRSSIIndicationCB(pMac->roam.gVosContext,
+                           (v_S7_t)NEIGHBOR_ROAM_LOOKUP_UP_THRESHOLD * (-1),
+                           WLANTL_HO_THRESHOLD_UP,
+                           csrNeighborRoamNeighborLookupUPCallback,
+                           VOS_MODULE_ID_SME);
+
+       if(!VOS_IS_STATUS_SUCCESS(vosStatus))
+       {
+           //err msg
+           smsLog(pMac, LOGW, FL(" Couldn't deregister csrNeighborRoamNeighborLookupUPCallback with TL: Status = %d"), vosStatus);
+       }
+    }
     /* We dont need to run this timer any more. */
-    palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
-    palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
+    vos_timer_stop(&pNeighborRoamInfo->neighborResultsRefreshTimer);
+    vos_timer_stop(&pNeighborRoamInfo->emptyScanRefreshTimer);
 
     csrNeighborRoamTriggerHandoff(pMac, pNeighborRoamInfo);
 
@@ -543,13 +607,13 @@
         tpCsrNeighborRoamControlInfo pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
 
         /* Stop neighbor scan timer */
-        palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
+        vos_timer_stop(&pNeighborRoamInfo->neighborScanTimer);
 
         /* Stop neighbor scan results refresh timer */
-        palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
+        vos_timer_stop(&pNeighborRoamInfo->neighborResultsRefreshTimer);
 
         /* Stop empty scan results refresh timer */
-        palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
+        vos_timer_stop(&pNeighborRoamInfo->emptyScanRefreshTimer);
 
         /* Abort any ongoing scan */
         if (eANI_BOOLEAN_TRUE == pNeighborRoamInfo->scanRspPending)
@@ -581,6 +645,11 @@
         pNeighborRoamInfo->FTRoamInfo.numBssFromNeighborReport = 0;
         vos_mem_zero(pNeighborRoamInfo->FTRoamInfo.neighboReportBssInfo, sizeof(tCsrNeighborReportBssInfo) * MAX_BSS_IN_NEIGHBOR_RPT);
 #endif
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    pNeighborRoamInfo->uOsRequestedHandoff = 0;
+    vos_mem_zero(&pNeighborRoamInfo->handoffReqInfo, sizeof(tCsrHandoffRequest));
+#endif
+
 }
 
 static void csrNeighborRoamDeregAllRssiIndication(tpAniSirGlobal pMac)
@@ -673,8 +742,8 @@
     csrNeighborRoamFreeRoamableBSSList(pMac, &pNeighborRoamInfo->roamableAPList);
     
  /* We dont need to run this timer any more. */
-    palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);    
-    palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
+    vos_timer_stop(&pNeighborRoamInfo->neighborResultsRefreshTimer);
+    vos_timer_stop(&pNeighborRoamInfo->emptyScanRefreshTimer);
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
     /* Do not free up the preauth done list here */
@@ -685,6 +754,10 @@
     pNeighborRoamInfo->FTRoamInfo.preauthRspPending = 0;
     vos_mem_zero(pNeighborRoamInfo->FTRoamInfo.neighboReportBssInfo, sizeof(tCsrNeighborReportBssInfo) * MAX_BSS_IN_NEIGHBOR_RPT);
 #endif
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    pNeighborRoamInfo->uOsRequestedHandoff = 0;
+    vos_mem_zero(&pNeighborRoamInfo->handoffReqInfo, sizeof(tCsrHandoffRequest));
+#endif
 }
 
 void csrNeighborRoamResetReportScanStateControlInfo(tpAniSirGlobal pMac)
@@ -701,9 +774,9 @@
 #endif
 
     /* Stop scan refresh timer */
-    palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
+    vos_timer_stop(&pNeighborRoamInfo->neighborResultsRefreshTimer);
     /* Stop empty scan results refresh timer */
-    palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
+    vos_timer_stop(&pNeighborRoamInfo->emptyScanRefreshTimer);
      /* Purge roamable AP list */
        csrNeighborRoamFreeRoamableBSSList(pMac, &pNeighborRoamInfo->roamableAPList); 
     return;
@@ -832,8 +905,10 @@
         smsLog(pMac, LOGE, FL("Preauth fail list already full.. Cannot add new one"));
         return eHAL_STATUS_FAILURE;
     }
-    vos_mem_copy(pNeighborRoamInfo->FTRoamInfo.preAuthFailList.macAddress[pNeighborRoamInfo->FTRoamInfo.preAuthFailList.numMACAddress],
-                        bssId, sizeof(tSirMacAddr));
+    vos_mem_copy(pNeighborRoamInfo->FTRoamInfo.preAuthFailList.macAddress[
+                  pNeighborRoamInfo->FTRoamInfo.preAuthFailList.numMACAddress],
+                 bssId,
+                 sizeof(tSirMacAddr));
     pNeighborRoamInfo->FTRoamInfo.preAuthFailList.numMACAddress++;
     
     return eHAL_STATUS_SUCCESS;
@@ -896,6 +971,10 @@
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tpCsrNeighborRoamBSSInfo    pNeighborBssNode;
+
+#ifdef FEATURE_WLAN_LFR_METRICS
+    tCsrRoamInfo *roamInfo;
+#endif
     
     /* This must not be true here */
     VOS_ASSERT(pNeighborRoamInfo->FTRoamInfo.preauthRspPending == eANI_BOOLEAN_FALSE);
@@ -913,6 +992,25 @@
     }
     else
     {
+#ifdef FEATURE_WLAN_LFR_METRICS
+        /* LFR metrics - pre-auth initiation metric.
+           Send the event to supplicant that pre-auth was initiated */
+        roamInfo = vos_mem_malloc(sizeof(tCsrRoamInfo));
+        if (NULL == roamInfo)
+        {
+            smsLog(pMac, LOG1, FL("Memory allocation failed!"));
+        }
+        else
+        {
+            vos_mem_copy((void *)roamInfo->bssid,
+                (void *)pNeighborBssNode->pBssDescription->bssId,
+                sizeof(tCsrBssid));
+            csrRoamCallCallback(pMac, pNeighborRoamInfo->csrSessionId,
+                                roamInfo, 0, eCSR_ROAM_PREAUTH_INIT_NOTIFY, 0);
+            vos_mem_free(pRoamInfo);
+        }
+#endif
+
         status = csrRoamEnqueuePreauth(pMac, pNeighborRoamInfo->csrSessionId, pNeighborBssNode->pBssDescription,
                 eCsrPerformPreauth, eANI_BOOLEAN_TRUE);
 
@@ -970,6 +1068,10 @@
     eHalStatus  preauthProcessed = eHAL_STATUS_SUCCESS;
     tpCsrNeighborRoamBSSInfo pPreauthRspNode = NULL;
 
+#ifdef FEATURE_WLAN_LFR_METRICS
+    tCsrRoamInfo *roamInfo;
+#endif
+
     if (eANI_BOOLEAN_FALSE == pNeighborRoamInfo->FTRoamInfo.preauthRspPending)
     {
             
@@ -1003,7 +1105,7 @@
     }
     if ((eSIR_SUCCESS == limStatus) && (NULL != pPreauthRspNode))
     {
-        NEIGHBOR_ROAM_DEBUG(pMac, LOGE, FL("Preauth completed successfully after %d tries"), pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries);
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Preauth completed successfully after %d tries"), pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries);
 
         smsLog(pMac, LOG1, FL("After Pre-Auth: BSSID %02x:%02x:%02x:%02x:%02x:%02x, Ch:%d"),
                pPreauthRspNode->pBssDescription->bssId[0],
@@ -1014,6 +1116,25 @@
                pPreauthRspNode->pBssDescription->bssId[5],
                (int)pPreauthRspNode->pBssDescription->channelId);
 
+#ifdef FEATURE_WLAN_LFR_METRICS
+        /* LFR metrics - pre-auth completion metric.
+           Send the event to supplicant that pre-auth successfully completed */
+        roamInfo = vos_mem_malloc(sizeof(tCsrRoamInfo));
+        if (NULL == roamInfo)
+        {
+            smsLog(pMac, LOG1, FL("Memory allocation failed!"));
+        }
+        else
+        {
+            vos_mem_copy((void *)roamInfo->bssid,
+                (void *)pPreauthRspNode->pBssDescription->bssId,
+                sizeof(tCsrBssid));
+            csrRoamCallCallback(pMac, pNeighborRoamInfo->csrSessionId,
+                roamInfo, 0, eCSR_ROAM_PREAUTH_STATUS_SUCCESS, 0);
+            vos_mem_free(pRoamInfo);
+        }
+#endif
+
         /* Preauth competer successfully. Insert the preauthenticated node to tail of preAuthDoneList */
         csrNeighborRoamRemoveRoamableAPListEntry(pMac, &pNeighborRoamInfo->roamableAPList, pPreauthRspNode);
         csrLLInsertTail(&pNeighborRoamInfo->FTRoamInfo.preAuthDoneList, &pPreauthRspNode->List, LL_ACCESS_LOCK);
@@ -1046,8 +1167,33 @@
             if(pEntry)
             {
                 pNeighborBssNode = GET_BASE_ADDR(pEntry, tCsrNeighborRoamBSSInfo, List);
-            /* Add the BSSID to pre-auth fail list */
+                /* Add the BSSID to pre-auth fail list if it is not requested by HDD */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+                if(!pNeighborRoamInfo->uOsRequestedHandoff)
+#endif
+                {
             status = csrNeighborRoamAddBssIdToPreauthFailList(pMac, pNeighborBssNode->pBssDescription->bssId);
+                }
+
+#ifdef FEATURE_WLAN_LFR_METRICS
+                /* LFR metrics - pre-auth completion metric. Send the event
+                   to supplicant that pre-auth successfully completed */
+                roamInfo = vos_mem_malloc(sizeof(tCsrRoamInfo));
+                if (NULL == roamInfo)
+                {
+                    smsLog(pMac, LOG1, FL("Memory allocation failed!"));
+                }
+                else
+                {
+                    vos_mem_copy((void *)roamInfo->bssid,
+                        (void *)pNeighborBssNode->pBssDescription->bssId,
+                        sizeof(tCsrBssid));
+                    csrRoamCallCallback(pMac, pNeighborRoamInfo->csrSessionId,
+                        roamInfo, 0, eCSR_ROAM_PREAUTH_STATUS_FAILURE, 0);
+                    vos_mem_free(pRoamInfo);
+                }
+#endif
+
             /* Now we can free this node */
             csrNeighborRoamFreeNeighborRoamBSSNode(pMac, pNeighborBssNode);
             }
@@ -1060,7 +1206,15 @@
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
         if (csrRoamIsRoamOffloadScanEnabled(pMac))
         {
-          csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_RESTART, REASON_PREAUTH_FAILED_FOR_ALL);
+          if(pNeighborRoamInfo->uOsRequestedHandoff)
+          {
+             pNeighborRoamInfo->uOsRequestedHandoff = 0;
+             csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_START, REASON_PREAUTH_FAILED_FOR_ALL);
+          }
+          else
+          {
+             csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_RESTART, REASON_PREAUTH_FAILED_FOR_ALL);
+          }
           CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_CONNECTED);
         } else
         {
@@ -1083,10 +1237,9 @@
           }
 
           /* Start the neighbor results refresh timer and transition to REPORT_SCAN state to perform scan again */
-          status = palTimerStart(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer,
-                          pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod * PAL_TIMER_TO_MS_UNIT,
-                          eANI_BOOLEAN_FALSE);
-          if (eHAL_STATUS_SUCCESS != status)
+          status = vos_timer_start(&pNeighborRoamInfo->neighborResultsRefreshTimer,
+                          pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod);
+          if ( status != eHAL_STATUS_SUCCESS )
           {
              smsLog(pMac, LOGE, FL("Neighbor results refresh timer start failed with status %d"), status);
           }
@@ -1130,6 +1283,28 @@
     /* We dont want to set BSSID based Filter */
     pScanFilter->BSSIDs.numOfBSSIDs = 0;
 
+    //only for HDD requested handoff fill in the BSSID in the filter
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    if (pNeighborRoamInfo->uOsRequestedHandoff)
+    {
+        pScanFilter->BSSIDs.numOfBSSIDs = 1;
+        pScanFilter->BSSIDs.bssid = vos_mem_malloc(sizeof(tSirMacAddr) * pScanFilter->BSSIDs.numOfBSSIDs);
+        if (NULL == pScanFilter->BSSIDs.bssid)
+        {
+            smsLog(pMac, LOGE, FL("Scan Filter BSSID mem alloc failed"));
+            return eHAL_STATUS_FAILED_ALLOC;
+        }
+
+        vos_mem_zero(pScanFilter->BSSIDs.bssid, sizeof(tSirMacAddr) * pScanFilter->BSSIDs.numOfBSSIDs);
+
+        /* Populate the BSSID from handoff info received from HDD */
+        for (i = 0; i < pScanFilter->BSSIDs.numOfBSSIDs; i++)
+        {
+            vos_mem_copy(&pScanFilter->BSSIDs.bssid[i],
+                         pNeighborRoamInfo->handoffReqInfo.bssid, sizeof(tSirMacAddr));
+        }
+    }
+#endif
     /* Populate all the information from the connected profile */
     pScanFilter->SSIDs.numOfSSIDs = 1;  
     pScanFilter->SSIDs.SSIDList = vos_mem_malloc(sizeof(tCsrSSIDInfo));
@@ -1143,17 +1318,11 @@
     pScanFilter->SSIDs.SSIDList->SSID.length =  pCurProfile->SSID.length;
     vos_mem_copy((void *)pScanFilter->SSIDs.SSIDList->SSID.ssId, (void *)pCurProfile->SSID.ssId, pCurProfile->SSID.length); 
 
-    NEIGHBOR_ROAM_DEBUG(pMac, LOGE, FL("Filtering from scan results for"
-                        "SSID = 0x%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx\nSSID Length = %d"),
-                        pScanFilter->SSIDs.SSIDList->SSID.ssId[0],
-                        pScanFilter->SSIDs.SSIDList->SSID.ssId[4],
-                        pScanFilter->SSIDs.SSIDList->SSID.ssId[8],
-                        pScanFilter->SSIDs.SSIDList->SSID.ssId[12],
-                        pScanFilter->SSIDs.SSIDList->SSID.ssId[16],
-                        pScanFilter->SSIDs.SSIDList->SSID.ssId[20],
-                        pScanFilter->SSIDs.SSIDList->SSID.ssId[24],
-                        pScanFilter->SSIDs.SSIDList->SSID.ssId[28],
-                        pScanFilter->SSIDs.SSIDList->SSID.length);
+    NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Filtering for SSID %.*s from scan results,"
+                                "length of SSID = %u"),
+                                pScanFilter->SSIDs.SSIDList->SSID.length,
+                                pScanFilter->SSIDs.SSIDList->SSID.ssId,
+                                pScanFilter->SSIDs.SSIDList->SSID.length);
     pScanFilter->authType.numEntries = 1;
     pScanFilter->authType.authType[0] = pCurProfile->AuthType;
 
@@ -1274,7 +1443,7 @@
     while (NULL != (pScanResult = csrScanResultGetNext(pMac, *pScanResultList)))
     {
             VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
-            FL("Scan result: BSSID %02x:%02x:%02x:%02x:%02x:%02x (Rssi %d, Ch:%d)"),
+            FL("Scan result: BSSID %02x:%02x:%02x:%02x:%02x:%02x (Rssi %ld, Ch:%d)"),
             pScanResult->BssDescriptor.bssId[0],
             pScanResult->BssDescriptor.bssId[1],
             pScanResult->BssDescriptor.bssId[2],
@@ -1284,8 +1453,11 @@
             abs(pScanResult->BssDescriptor.rssi),
             pScanResult->BssDescriptor.channelId);
 
-       if (VOS_TRUE == vos_mem_compare(pScanResult->BssDescriptor.bssId, 
-                       pNeighborRoamInfo->currAPbssid, sizeof(tSirMacAddr)))
+       if ((VOS_TRUE == vos_mem_compare(pScanResult->BssDescriptor.bssId,
+           pNeighborRoamInfo->currAPbssid, sizeof(tSirMacAddr))) ||
+           ((eSME_ROAM_TRIGGER_SCAN == pNeighborRoamInfo->cfgRoamEn) &&
+           (VOS_TRUE != vos_mem_compare(pScanResult->BssDescriptor.bssId,
+                        pNeighborRoamInfo->cfgRoambssId, sizeof(tSirMacAddr)))))
         {
             /* currently associated AP. Do not have this in the roamable AP list */
             VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
@@ -1293,13 +1465,32 @@
             continue;
         }
 
+#ifdef FEATURE_WLAN_LFR
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+       /* In case of reassoc requested by upper layer, look for exact match of bssid & channel;
+          csr cache might have duplicates*/
+       if ((pNeighborRoamInfo->uOsRequestedHandoff) &&
+           ((VOS_FALSE == vos_mem_compare(pScanResult->BssDescriptor.bssId,
+                                         pNeighborRoamInfo->handoffReqInfo.bssid,
+                                         sizeof(tSirMacAddr)))||
+            (pScanResult->BssDescriptor.channelId != pNeighborRoamInfo->handoffReqInfo.channel)))
+
+       {
+           VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                      "SKIP-not a candidate AP for OS requested roam");
+           continue;
+       }
+#endif
+#endif
+
        /* This condition is to ensure to roam to an AP with better RSSI. if the value of RoamRssiDiff is Zero, this feature
         * is disabled and we continue to roam without any check*/
        if ((RoamRssiDiff > 0)
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
        && !csrRoamIsRoamOffloadScanEnabled(pMac)
 #endif
-       )
+       && ((eSME_ROAM_TRIGGER_SCAN != pNeighborRoamInfo->cfgRoamEn) ||
+           (eSME_ROAM_TRIGGER_FAST_ROAM != pNeighborRoamInfo->cfgRoamEn)))
        {
                /*
                * If RSSI is lower than the lookup threshold, then continue.
@@ -1460,14 +1651,19 @@
         csrLLInsertTail(&pNeighborRoamInfo->roamableAPList, &pBssInfo->List, LL_ACCESS_LOCK);
 
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
-        if ((abs(abs(CurrAPRssi) - abs(pScanResult->BssDescriptor.rssi)) >= immediateRoamRssiDiff)
+        if ((eSME_ROAM_TRIGGER_SCAN == pNeighborRoamInfo->cfgRoamEn) ||
+            (eSME_ROAM_TRIGGER_FAST_ROAM == pNeighborRoamInfo->cfgRoamEn))
+        {
+           roamNow = eANI_BOOLEAN_FALSE;
+        }
+        else if ((abs(abs(CurrAPRssi) - abs(pScanResult->BssDescriptor.rssi)) >= immediateRoamRssiDiff)
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
             && !csrRoamIsRoamOffloadScanEnabled(pMac)
 #endif
         )
         {
             VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                       "%s: [INFOLOG] potential candidate to roam immediately (diff=%d, expected=%d)", 
+                       "%s: [INFOLOG] potential candidate to roam immediately (diff=%ld, expected=%d)",
                        __func__, abs(abs(CurrAPRssi) - abs(pScanResult->BssDescriptor.rssi)),
                        immediateRoamRssiDiff);
             roamNow = eANI_BOOLEAN_TRUE;
@@ -1554,11 +1750,7 @@
 #endif
 
     /* Stop neighbor scan timer */
-    status = palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
-    if (eHAL_STATUS_SUCCESS != status) 
-    {
-        smsLog(pMac, LOGW, FL("stopping neighborScanTimer failed with status %d"), status);
-    }
+    vos_timer_stop(&pNeighborRoamInfo->neighborScanTimer);
 
     /*
      * Increase the neighbor lookup threshold by 3 dB
@@ -1666,10 +1858,9 @@
             pNeighborRoamInfo->uScanMode = SPLIT_SCAN_OCCUPIED_LIST;
 
             /* Start empty scan refresh timer */
-            if (eHAL_STATUS_SUCCESS !=
-                palTimerStart(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer,
-                    pNeighborRoamInfo->cfgParams.emptyScanRefreshPeriod * PAL_TIMER_TO_MS_UNIT,
-                    eANI_BOOLEAN_FALSE))
+            if (VOS_STATUS_SUCCESS !=
+                vos_timer_start(&pNeighborRoamInfo->emptyScanRefreshTimer,
+                    pNeighborRoamInfo->cfgParams.emptyScanRefreshPeriod))
             {
                 smsLog(pMac, LOGE, FL("Empty scan refresh timer failed to start (%d)"),
                         status);
@@ -1680,17 +1871,16 @@
             }
             else
             {
-                smsLog(pMac, LOGE, FL("Empty scan refresh timer started (%ld ms)"),
+                smsLog(pMac, LOGE, FL("Empty scan refresh timer started (%d ms)"),
                         (pNeighborRoamInfo->cfgParams.emptyScanRefreshPeriod));
             }
         }
         else if (eThirdEmptyScan == pNeighborRoamInfo->uEmptyScanCount)
         {
             /* Start neighbor scan results refresh timer */
-            if (eHAL_STATUS_SUCCESS !=
-                    palTimerStart(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer,
-                        pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod * PAL_TIMER_TO_MS_UNIT,
-                        eANI_BOOLEAN_FALSE))
+            if (VOS_STATUS_SUCCESS !=
+                    vos_timer_start(&pNeighborRoamInfo->neighborResultsRefreshTimer,
+                        pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod))
             {
                 smsLog(pMac, LOGE, FL("Neighbor results refresh timer failed to start (%d)"),
                         status);
@@ -1701,7 +1891,7 @@
             }
             else
             {
-                smsLog(pMac, LOG2, FL("Neighbor results refresh timer started (%ld ms)"),
+                smsLog(pMac, LOG2, FL("Neighbor results refresh timer started (%d ms)"),
                         (pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod * PAL_TIMER_TO_MS_UNIT));
             }
         }
@@ -1815,7 +2005,7 @@
                            need to restart the CFG CHAN list scan procedure if reassoc callback is not invoked from TL 
                            within certain duration */
                         
-//                        palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
+//                        vos_timer_stop(&pNeighborRoamInfo->neighborScanTimer);
                     }
                 }
                 else
@@ -1882,13 +2072,12 @@
                 return eHAL_STATUS_SUCCESS;
             }
 
-        hstatus = palTimerStart(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer, 
-                    pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod * PAL_TIMER_TO_MS_UNIT,
-                    eANI_BOOLEAN_FALSE);
+        hstatus = vos_timer_start(&pNeighborRoamInfo->neighborResultsRefreshTimer,
+                    pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod);
 
            /* This timer should be started before registering the Reassoc callback with TL. This is because, it is very likely 
             * that the callback getting called immediately and the timer would never be stopped when pre-auth is in progress */
-        if (eHAL_STATUS_SUCCESS != hstatus)
+        if( hstatus != eHAL_STATUS_SUCCESS)
             {
             smsLog(pMac, LOGE, FL("Neighbor results refresh timer failed to start, status = %d"), hstatus);
                 vos_mem_free(pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList);
@@ -1917,9 +2106,17 @@
    {
     if (!tempVal || !roamNow)
     {
-      /* There is no candidate or We are not roaming Now.
-       * Inform the FW to restart Roam Offload Scan  */
-       csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_RESTART, REASON_NO_CAND_FOUND_OR_NOT_ROAMING_NOW);
+       if (pNeighborRoamInfo->uOsRequestedHandoff)
+       {
+          csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_START, REASON_NO_CAND_FOUND_OR_NOT_ROAMING_NOW);
+          pNeighborRoamInfo->uOsRequestedHandoff = 0;
+       }
+       else
+       {
+         /* There is no candidate or We are not roaming Now.
+          * Inform the FW to restart Roam Offload Scan  */
+          csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_RESTART, REASON_NO_CAND_FOUND_OR_NOT_ROAMING_NOW);
+       }
        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_CONNECTED);
     }
    }
@@ -1961,6 +2158,15 @@
     if (NULL != pContext)
     {
         sessionId = *((tANI_U32*)pContext);
+
+        if (!csrRoamIsStaMode(pMac, sessionId))
+        {
+            smsLog(pMac, LOGE, FL("%s: Ignoring scan request callback on non-infra session %d in state %d"),
+                           __FUNCTION__, sessionId, pNeighborRoamInfo->neighborRoamState);
+            vos_mem_free(pContext);
+            return eHAL_STATUS_SUCCESS;
+        }
+
         if (!csrRoamIsFastRoamEnabled(pMac,sessionId))
         {
             smsLog(pMac, LOGE, FL("Received when fast roam is disabled. Ignore it"));
@@ -1984,7 +2190,7 @@
     currentChanIndex = (pMac->roam.neighborRoamInfo.roamChannelInfo.currentChanIndex) ? (pMac->roam.neighborRoamInfo.roamChannelInfo.currentChanIndex - 1) : 0;
 
     /* Validate inputs */
-    if (pMac->roam.neighborRoamInfo.roamChannelInfo.currentChannelListInfo.ChannelList) { 
+    if (pMac->roam.neighborRoamInfo.roamChannelInfo.currentChannelListInfo.ChannelList) {
         NEIGHBOR_ROAM_DEBUG(pMac, LOGW, FL("csrNeighborRoamScanRequestCallback received for Channel = %d, ChanIndex = %d"),
                     pMac->roam.neighborRoamInfo.roamChannelInfo.currentChannelListInfo.ChannelList[currentChanIndex], currentChanIndex);
     }
@@ -1998,7 +2204,7 @@
 
     if (eANI_BOOLEAN_FALSE == pNeighborRoamInfo->roamChannelInfo.chanListScanInProgress)
     {
-        /* Scan is completed in the  CFG_CHAN_SCAN state. We can transition to REPORT_SCAN state 
+        /* Scan is completed in the  CFG_CHAN_SCAN state. We can transition to REPORT_SCAN state
            just to get the results and perform PREAUTH */
         /* Now we have completed scanning the channel list. We have get the result by applying appropriate filter
            sort the results based on neighborScore and RSSI and select the best candidate out of the list */
@@ -2019,10 +2225,8 @@
     {
 
         /* Restart the timer for the next scan sequence as scanning is not over */
-        hstatus = palTimerStart(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer, 
-                    pNeighborRoamInfo->cfgParams.neighborScanPeriod * PAL_TIMER_TO_MS_UNIT, 
-                    eANI_BOOLEAN_FALSE);
-    
+        hstatus = vos_timer_start(&pNeighborRoamInfo->neighborScanTimer,
+                    pNeighborRoamInfo->cfgParams.neighborScanPeriod);
         if (eHAL_STATUS_SUCCESS != hstatus)
         {
             /* Timer start failed.. Should we ASSERT here??? */
@@ -2090,7 +2294,7 @@
 #endif //WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 
 #ifdef FEATURE_WLAN_LFR
-static eHalStatus csrNeighborRoamContiguousScanRequestCallback(tHalHandle halHandle, 
+static eHalStatus csrNeighborRoamContiguousScanRequestCallback(tHalHandle halHandle,
         void *pContext, tANI_U32 scanId, eCsrScanStatus status)
 {
     tpAniSirGlobal                  pMac = (tpAniSirGlobal) halHandle;
@@ -2110,7 +2314,7 @@
     }
 
     pMac->roam.neighborRoamInfo.scanRspPending = eANI_BOOLEAN_FALSE;
-    
+
     /* This can happen when we receive a UP event from TL in any of the scan states. Silently ignore it */
     if (eCSR_NEIGHBOR_ROAM_STATE_CONNECTED == pNeighborRoamInfo->neighborRoamState)
     {
@@ -2130,12 +2334,12 @@
 
     NEIGHBOR_ROAM_DEBUG(pMac, LOGW, "%s: process scan results", __func__);
     hstatus = csrNeighborRoamProcessScanComplete(pMac);
-    
+
     if (eHAL_STATUS_SUCCESS != hstatus)
     {
         smsLog(pMac, LOGE, FL("Neighbor scan process complete failed with status %d"), hstatus);
     }
-    
+
     if (NULL != pContext)
         vos_mem_free(pContext);
 
@@ -2173,11 +2377,11 @@
             pMac->roam.neighborRoamInfo.roamChannelInfo.currentChanIndex);
 
     //send down the scan req for 1 channel on the associated SSID
-    palZeroMemory(pMac->hHdd, &scanReq, sizeof(tCsrScanRequest));
+    vos_mem_set(&scanReq, sizeof(tCsrScanRequest), 0);
     /* Fill in the SSID Info */
     scanReq.SSIDs.numOfSSIDs = 1;
     scanReq.SSIDs.SSIDList = vos_mem_malloc(sizeof(tCsrSSIDInfo) * scanReq.SSIDs.numOfSSIDs);
-    if(NULL == scanReq.SSIDs.SSIDList)
+    if (NULL == scanReq.SSIDs.SSIDList)
     {
        //err msg
        smsLog(pMac, LOGE, FL("Couldn't allocate memory for the SSID..Freeing memory allocated for Channel List"));
@@ -2227,7 +2431,7 @@
 
     vos_mem_free(scanReq.SSIDs.SSIDList);
     if (1 == pBgScanParams->ChannelInfo.numOfChannels)
-        NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Channel List Address = %08x, Actual index = %d"),
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Channel List Address = %p, Actual index = %d"),
                 &pMac->roam.neighborRoamInfo.roamChannelInfo.currentChannelListInfo.ChannelList[0], 
                 pMac->roam.neighborRoamInfo.roamChannelInfo.currentChanIndex);
 
@@ -2273,7 +2477,7 @@
 
     if (pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList)
     {
-        NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Channel List Address = %08x"), &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList[0]);
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Channel List Address = %p"), &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList[0]);
     }
     else 
     {
@@ -2298,7 +2502,7 @@
 
     /* Need to perform scan here before getting the list */
 
-    palZeroMemory(pMac->hHdd, &bgScanParams, sizeof(tCsrBGScanRequest));
+    vos_mem_set(&bgScanParams, sizeof(tCsrBGScanRequest), 0);
 
     channel = pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList[pNeighborRoamInfo->roamChannelInfo.currentChanIndex];
     bgScanParams.ChannelInfo.numOfChannels = 1;
@@ -2347,35 +2551,26 @@
 {
     eHalStatus      status = eHAL_STATUS_SUCCESS;
     tCsrBGScanRequest   bgScanParams;
-    int numOfChannels = 0, i = 0;
+    tANI_U8   numOfChannels = 0, i = 0;
     tANI_U8   *channelList = NULL;
     tANI_U8   *pInChannelList = NULL;
     tANI_U8   tmpChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN];
 
-    palZeroMemory(pMac->hHdd, &bgScanParams, sizeof(tCsrBGScanRequest));
+    vos_mem_set(&bgScanParams, sizeof(tCsrBGScanRequest), 0);
 
     /* Contiguously scan all channels from valid list */
     NEIGHBOR_ROAM_DEBUG(pMac, LOG2, "%s: get valid channel list", __func__);
 
-    if (NULL != pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.ChannelList)
-    {
-        /* this list is filled only if the country code is set to KR */
-        numOfChannels = pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.numOfChannels;
-        pInChannelList = pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.countryValidChannelList.ChannelList;
-    }
-    else
-    {
-        numOfChannels = sizeof(pMac->roam.validChannelList);
+    numOfChannels = sizeof(pMac->roam.validChannelList);
 
-        if(!HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac,
-                              (tANI_U8 *)pMac->roam.validChannelList,
-                              (tANI_U32 *) &numOfChannels)))
-        {
-            smsLog(pMac, LOGE, FL("Could not get valid channel list"));
-            return eHAL_STATUS_FAILURE;
-        }
-        pInChannelList = pMac->roam.validChannelList;
+    if(!HAL_STATUS_SUCCESS(csrGetCfgValidChannels(pMac,
+                          (tANI_U8 *)pMac->roam.validChannelList,
+                          (tANI_U32 *) &numOfChannels)))
+    {
+        smsLog(pMac, LOGE, FL("Could not get valid channel list"));
+        return eHAL_STATUS_FAILURE;
     }
+    pInChannelList = pMac->roam.validChannelList;
 
     if (CSR_IS_ROAM_INTRA_BAND_ENABLED(pMac))
     {
@@ -2388,8 +2583,8 @@
         pInChannelList = tmpChannelList;
     }
 
-    channelList = vos_mem_malloc( numOfChannels );
-    if( NULL == channelList )
+    channelList = vos_mem_malloc(numOfChannels);
+    if ( NULL == channelList )
     {
         smsLog(pMac, LOGE, FL("could not allocate memory for channelList"));
         return eHAL_STATUS_FAILURE;
@@ -2409,7 +2604,7 @@
     status = csrNeighborRoamIssueBgScanRequest(pMac, &bgScanParams,
                                                sessionId, csrNeighborRoamContiguousScanRequestCallback);
 
-    vos_mem_free( channelList );
+    vos_mem_free(channelList);
 
     if (eHAL_STATUS_SUCCESS != status)
     {
@@ -2634,13 +2829,13 @@
 VOS_STATUS csrNeighborRoamChannelsFilterByCurrentBand(
                       tpAniSirGlobal pMac,
                       tANI_U8*  pInputChannelList,
-                      int       inputNumOfChannels,
+                      tANI_U8   inputNumOfChannels,
                       tANI_U8*  pOutputChannelList,
-                      int*      pMergedOutputNumOfChannels
+                      tANI_U8*  pMergedOutputNumOfChannels
                       )
 {
-    int i = 0;
-    int numChannels = 0;
+    tANI_U8 i = 0;
+    tANI_U8 numChannels = 0;
     tANI_U8   currAPoperationChannel = pMac->roam.neighborRoamInfo.currAPoperationChannel;
     // Check for NULL pointer
     if (!pInputChannelList) return VOS_STATUS_E_INVAL;
@@ -2690,16 +2885,16 @@
 ---------------------------------------------------------------------------*/
 VOS_STATUS csrNeighborRoamMergeChannelLists( 
         tpAniSirGlobal pMac, 
-        tANI_U8   *pInputChannelList, 
-        int inputNumOfChannels,
-        tANI_U8   *pOutputChannelList,
-        int outputNumOfChannels,
-        int *pMergedOutputNumOfChannels 
+        tANI_U8 *pInputChannelList,
+        tANI_U8 inputNumOfChannels,
+        tANI_U8 *pOutputChannelList,
+        tANI_U8 outputNumOfChannels,
+        tANI_U8 *pMergedOutputNumOfChannels
         )
 {
-    int i = 0;
-    int j = 0;
-    int numChannels = outputNumOfChannels;
+    tANI_U8 i = 0;
+    tANI_U8 j = 0;
+    tANI_U8 numChannels = outputNumOfChannels;
 
     // Check for NULL pointer
     if (!pInputChannelList) return VOS_STATUS_E_INVAL;
@@ -2761,6 +2956,7 @@
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     tANI_U8         numChannels = 0, i = 0;
     tANI_U8         channelList[MAX_BSS_IN_NEIGHBOR_RPT];
+    tANI_U8         mergedOutputNumOfChannels = 0;
 #if 0
     eHalStatus  status = eHAL_STATUS_SUCCESS;
 #endif
@@ -2855,13 +3051,33 @@
     vos_mem_copy(pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList, 
                                             channelList, (numChannels) * sizeof(tANI_U8));
     pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.numOfChannels = numChannels;
+    /*
+     * Create a Union of occupied channel list learnt by the DUT along with the Neighbor
+     * report Channels. This increases the chances of the DUT to get a candidate AP while
+     * roaming even if the Neighbor Report is not able to provide sufficient information.
+     * */
+    if (pMac->scan.occupiedChannels.numChannels)
+    {
+       csrNeighborRoamMergeChannelLists(pMac,
+                  &pMac->scan.occupiedChannels.channelList[0],
+                  pMac->scan.occupiedChannels.numChannels,
+                  &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList[0],
+                  pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.numOfChannels,
+                  &mergedOutputNumOfChannels);
+       pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.numOfChannels =
+                  mergedOutputNumOfChannels;
+
+    }
+    /*Indicate the firmware about the update only if any new channels are added.
+     * Otherwise, the firmware would already be knowing the non-IAPPneighborlist
+     * channels. There is no need to update.*/
     if (numChannels)
     {
         smsLog(pMac, LOG1, FL("IAPP Neighbor list callback received as expected in state %d."),
             pNeighborRoamInfo->neighborRoamState);
         pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_TRUE;
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-        if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+        if (csrRoamIsRoamOffloadScanEnabled(pMac))
         {
            csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG, REASON_CHANNEL_LIST_CHANGED);
         }
@@ -2916,9 +3132,8 @@
                 /* Now ready for neighbor scan based on the channel list created */
                 /* Start Neighbor scan timer now. Multiplication by PAL_TIMER_TO_MS_UNIT is to convert ms to us which is 
                    what palTimerStart expects */
-                status = palTimerStart(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer, 
-                                pNeighborRoamInfo->cfgParams.neighborScanPeriod * PAL_TIMER_TO_MS_UNIT, 
-                                eANI_BOOLEAN_FALSE);
+                status = vos_timer_start(&pNeighborRoamInfo->neighborScanTimer,
+                                pNeighborRoamInfo->cfgParams.neighborScanPeriod);
                 if (eHAL_STATUS_SUCCESS != status)
                 {
                     /* Timer start failed.. Should we ASSERT here??? */
@@ -3061,8 +3276,9 @@
         {
             fNew = FALSE;
         }
-        if (pIes) {
-            palFreeMemory(pMac->hHdd, pIes);
+        if (pIes)
+        {
+            vos_mem_free(pIes);
         }
     }
 
@@ -3123,14 +3339,14 @@
 ---------------------------------------------------------------------------*/
 VOS_STATUS csrNeighborRoamPrepareNonOccupiedChannelList(
         tpAniSirGlobal pMac, 
-        tANI_U8   *pInputChannelList, 
-        int numOfChannels,
-        tANI_U8   *pOutputChannelList,
-        int *pOutputNumOfChannels 
+        tANI_U8 *pInputChannelList,
+        tANI_U8 numOfChannels,
+        tANI_U8 *pOutputChannelList,
+        tANI_U8 *pOutputNumOfChannels
         )
 {
-    int i = 0;
-    int outputNumOfChannels  = 0; // Clear the output number of channels
+    tANI_U8 i = 0;
+    tANI_U8 outputNumOfChannels  = 0; // Clear the output number of channels
     tANI_U8 numOccupiedChannels = pMac->scan.occupiedChannels.numChannels;
     tANI_U8 *pOccupiedChannelList = pMac->scan.occupiedChannels.channelList;
 
@@ -3173,7 +3389,7 @@
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     eHalStatus  status  = eHAL_STATUS_SUCCESS;
     int i = 0;
-    int numOfChannels = 0;
+    tANI_U8 numOfChannels = 0;
     tANI_U8   channelList[WNI_CFG_VALID_CHANNEL_LIST_LEN];
     tpCsrChannelInfo    currChannelListInfo;
 #ifdef FEATURE_WLAN_LFR
@@ -3258,17 +3474,17 @@
 
             pNeighborRoamInfo->scanRequestTimeStamp = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
 
-            palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
+            vos_timer_stop(&pNeighborRoamInfo->neighborScanTimer);
 
             /* We are about to start a fresh scan cycle, 
              * purge non-P2P results from the past */
             csrScanFlushSelectiveResult(pMac, VOS_FALSE);
-    
+
             csrNeighborRoamPerformContiguousBgScan(pMac, sessionId);
 
             /* Transition to CFG_CHAN_LIST_SCAN */
             CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN);
-            
+
             return VOS_STATUS_SUCCESS;
         }
 #endif
@@ -3322,6 +3538,10 @@
                     smsLog(pMac, LOGE, FL("Memory allocation for Channel list failed"));
                     return VOS_STATUS_E_RESOURCES;
                 }
+                if (numOfChannels > WNI_CFG_VALID_CHANNEL_LIST_LEN)
+                {
+                    numOfChannels = WNI_CFG_VALID_CHANNEL_LIST_LEN;
+                }
                 vos_mem_copy(currChannelListInfo->ChannelList,
                         channelList,
                         numOfChannels * sizeof(tANI_U8));
@@ -3413,12 +3633,11 @@
     /* We are gonna scan now. Remember the time stamp to filter out results only after this timestamp */
     pNeighborRoamInfo->scanRequestTimeStamp = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
     
-    palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
+    vos_timer_stop(&pNeighborRoamInfo->neighborScanTimer);
     /* Start Neighbor scan timer now. Multiplication by PAL_TIMER_TO_MS_UNIT is to convert ms to us which is 
             what palTimerStart expects */
-    status = palTimerStart(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer, 
-                    pNeighborRoamInfo->cfgParams.neighborScanPeriod * PAL_TIMER_TO_MS_UNIT, 
-                    eANI_BOOLEAN_FALSE);
+    status = vos_timer_start(&pNeighborRoamInfo->neighborScanTimer,
+                    pNeighborRoamInfo->cfgParams.neighborScanPeriod);
     
     if (eHAL_STATUS_SUCCESS != status)
     {
@@ -3698,13 +3917,14 @@
 #endif
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId);
 
-    smsLog(pMac, LOGE, FL("Disconnect indication on session %d in state %d"),
-           sessionId, pNeighborRoamInfo->neighborRoamState);
+    smsLog(pMac, LOGE, FL("Disconnect indication on session %d in state %d from BSSID : "
+                          MAC_ADDRESS_STR), sessionId, pNeighborRoamInfo->neighborRoamState,
+                          MAC_ADDR_ARRAY(pSession->connectedProfile.bssid));
  
 #ifdef FEATURE_WLAN_LFR
     /*Free the current previous profile and move the current profile to prev profile.*/
     csrRoamFreeConnectProfile(pMac, pPrevProfile);
-    csrRoamGetConnectProfile(pMac, sessionId, pPrevProfile);
+    csrRoamCopyConnectProfile(pMac, sessionId, pPrevProfile);
 #endif
     if (NULL != pSession)
     {
@@ -3718,21 +3938,20 @@
                 return eHAL_STATUS_SUCCESS;
             }
         }
-    }
 
 #ifdef FEATURE_WLAN_CCX
-    {
-      if (pSession->connectedProfile.isCCXAssoc)
-      {
-          vos_mem_copy(&pSession->prevApSSID, &pSession->connectedProfile.SSID, sizeof(tSirMacSSid));
-          vos_mem_copy(pSession->prevApBssid, pSession->connectedProfile.bssid, sizeof(tSirMacAddr));
-          pSession->prevOpChannel = pSession->connectedProfile.operationChannel;
-          pSession->isPrevApInfoValid = TRUE;
-          pSession->roamTS1 = vos_timer_get_system_time();
-
-      }
-    }
+        if (pSession->connectedProfile.isCCXAssoc)
+        {
+           vos_mem_copy(&pSession->prevApSSID, &pSession->connectedProfile.SSID,
+                        sizeof(tSirMacSSid));
+           vos_mem_copy(pSession->prevApBssid, pSession->connectedProfile.bssid,
+                        sizeof(tSirMacAddr));
+           pSession->prevOpChannel = pSession->connectedProfile.operationChannel;
+           pSession->isPrevApInfoValid = TRUE;
+           pSession->roamTS1 = vos_timer_get_system_time();
+        }
 #endif
+    } //if (NULL != pSession)
    
 #ifdef RSSI_HACK
     dumpCmdRSSI = -40;
@@ -3743,9 +3962,9 @@
             // Stop scan and neighbor refresh timers.
             // These are indeed not required when we are in reassociating
             // state.
-            palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
-            palTimerStop(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
-            palTimerStop(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
+            vos_timer_stop(&pNeighborRoamInfo->neighborScanTimer);
+            vos_timer_stop(&pNeighborRoamInfo->neighborResultsRefreshTimer);
+            vos_timer_stop(&pNeighborRoamInfo->emptyScanRefreshTimer);
             if (!CSR_IS_ROAM_SUBSTATE_DISASSOC_HO( pMac, sessionId )) {
                 /*
                  * Disconnect indication during Disassoc Handoff sub-state
@@ -3757,13 +3976,14 @@
                  * in-turn block scans (see csrIsScanAllowed).
                  */
                 CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT);
+                pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
             }
             break;
 
         case eCSR_NEIGHBOR_ROAM_STATE_INIT:
             csrNeighborRoamResetInitStateControlInfo(pMac);
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-            if(!pMac->roam.configParam.isRoamOffloadScanEnabled)
+            if (!csrRoamIsRoamOffloadScanEnabled(pMac))
             {
 #endif
               csrNeighborRoamDeregAllRssiIndication(pMac);
@@ -3774,9 +3994,10 @@
 
         case eCSR_NEIGHBOR_ROAM_STATE_CONNECTED:
             CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT)
+            pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
             csrNeighborRoamResetConnectedStateControlInfo(pMac);
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-            if(!pMac->roam.configParam.isRoamOffloadScanEnabled)
+            if (!csrRoamIsRoamOffloadScanEnabled(pMac))
             {
 #endif
               csrNeighborRoamDeregAllRssiIndication(pMac);
@@ -3787,9 +4008,10 @@
 
         case eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN:
             CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT);
+            pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
             csrNeighborRoamResetCfgListChanScanControlInfo(pMac);
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-            if (!pMac->roam.configParam.isRoamOffloadScanEnabled)
+            if (!csrRoamIsRoamOffloadScanEnabled(pMac))
             {
 #endif
               csrNeighborRoamDeregAllRssiIndication(pMac);
@@ -3800,14 +4022,15 @@
 
         case eCSR_NEIGHBOR_ROAM_STATE_PREAUTH_DONE:
             /* Stop pre-auth to reassoc interval timer */
-            palTimerStop(pMac->hHdd, pMac->ft.ftSmeContext.preAuthReassocIntvlTimer);
+            vos_timer_stop(&pMac->ft.ftSmeContext.preAuthReassocIntvlTimer);
         case eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN:
         case eCSR_NEIGHBOR_ROAM_STATE_PREAUTHENTICATING:
             CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT)
+            pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
             csrNeighborRoamResetPreauthControlInfo(pMac);
             csrNeighborRoamResetReportScanStateControlInfo(pMac);
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-            if (!pMac->roam.configParam.isRoamOffloadScanEnabled)
+            if (!csrRoamIsRoamOffloadScanEnabled(pMac))
             {
 #endif
               csrNeighborRoamDeregAllRssiIndication(pMac);
@@ -3820,12 +4043,15 @@
             NEIGHBOR_ROAM_DEBUG(pMac, LOGW, FL("Received disconnect event in state %d"), pNeighborRoamInfo->neighborRoamState);
             NEIGHBOR_ROAM_DEBUG(pMac, LOGW, FL("Transitioning to INIT state"));
             CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT)
+            pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
             break;
     }
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
     /*Inform the Firmware to STOP Scanning as the host has a disconnect.*/
     if (csrRoamIsStaMode(pMac, sessionId))
+    {
        csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_STOP, REASON_DISCONNECTED);
+    }
 #endif
     return eHAL_STATUS_SUCCESS;
 }
@@ -3855,20 +4081,39 @@
     int  init_ft_flag = FALSE;
 #endif
 
+    // if session id invalid then we need return failure
+    if (NULL == pNeighborRoamInfo || !CSR_IS_SESSION_VALID(pMac, sessionId) ||
+        (NULL == pMac->roam.roamSession[sessionId].pCurRoamProfile))
+    {
+        return eHAL_STATUS_FAILURE;
+    }
     smsLog(pMac, LOG2, FL("Connect indication received with session id %d in state %d"), sessionId, pNeighborRoamInfo->neighborRoamState);
 
-    // Bail out if this is NOT a STA persona or if a concurrent session is running
-    if ((pMac->roam.roamSession[sessionId].pCurRoamProfile->csrPersona != VOS_STA_MODE)||
-        csrIsConcurrentSessionRunning(pMac))
+    // Bail out if this is NOT a STA persona
+    if (pMac->roam.roamSession[sessionId].pCurRoamProfile->csrPersona != VOS_STA_MODE)
     {
         smsLog(pMac, LOGE, FL("Ignoring Connect indication received from a non STA persona."
-                              "sessionId: %d, csrPersonna %d, is multisession %d"),
+                              "sessionId: %d, csrPersonna %d"),
                sessionId,
-               (int)pMac->roam.roamSession[sessionId].pCurRoamProfile->csrPersona,
-               csrIsConcurrentSessionRunning(pMac));
+               (int)pMac->roam.roamSession[sessionId].pCurRoamProfile->csrPersona);
         return eHAL_STATUS_SUCCESS;
     }
 
+    // if a concurrent session is running
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    if (eANI_BOOLEAN_FALSE == CSR_IS_FASTROAM_IN_CONCURRENCY_INI_FEATURE_ENABLED(pMac))
+    {
+#endif
+        if (csrIsConcurrentSessionRunning(pMac))
+        {
+            smsLog(pMac, LOGE, FL("Ignoring Connect indication received in multisession %d"),
+                                  csrIsConcurrentSessionRunning(pMac));
+            return eHAL_STATUS_SUCCESS;
+        }
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    }
+#endif
+
     switch (pNeighborRoamInfo->neighborRoamState)
     {
         case eCSR_NEIGHBOR_ROAM_STATE_REASSOCIATING:
@@ -3876,6 +4121,7 @@
             {
                 /* Just transition the state to INIT state. Rest of the clean up happens when we get next connect indication */
                 CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT)
+                pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
                 break;
             }
             /* Fall through if the status is SUCCESS */
@@ -3958,13 +4204,16 @@
                 pNeighborRoamInfo->FTRoamInfo.currentNeighborRptRetryNum = 0;
                 csrNeighborRoamPurgePreauthFailedList(pMac);
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-              if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+              if (csrRoamIsRoamOffloadScanEnabled(pMac))
               {
                  /*If this is not a INFRA type BSS, then do not send the command
                   * down to firmware.Do not send the START command for other session
                   * connections.*/
                  if(csrRoamIsStaMode(pMac, sessionId))
-                  csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_START, REASON_CONNECT);
+                 {
+                     pNeighborRoamInfo->uOsRequestedHandoff = 0;
+                     csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_START, REASON_CONNECT);
+                 }
               } else {
 #endif
 
@@ -4089,17 +4338,6 @@
     pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod = pMac->roam.configParam.neighborRoamConfig.nNeighborResultsRefreshPeriod;
     pNeighborRoamInfo->cfgParams.emptyScanRefreshPeriod = pMac->roam.configParam.neighborRoamConfig.nEmptyScanRefreshPeriod;
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_LFR)
-    pNeighborRoamInfo->cfgParams.countryChannelInfo.revision = SME_KR_25;
-    pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.ChannelList = NULL;
-    pNeighborRoamInfo->cfgParams.countryChannelInfo.countryValidChannelList.numOfChannels = 0;
-
-    if (0 == strncmp(pMac->scan.countryCodeCurrent, "KR", 2))
-    {
-       csrInitCountryValidChannelList(pMac, SME_KR_25);
-    }
-#endif
-
     pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels   =
                         pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.numChannels;
 
@@ -4113,7 +4351,7 @@
     }
 
     /* Update the roam global structure from CFG */
-    palCopyMemory(pMac->hHdd, pNeighborRoamInfo->cfgParams.channelInfo.ChannelList,
+    vos_mem_copy(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList,
                         pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.channelList,
                         pMac->roam.configParam.neighborRoamConfig.neighborScanChanList.numChannels);
 
@@ -4123,14 +4361,13 @@
     pNeighborRoamInfo->lookupDOWNRssi = 0;
     pNeighborRoamInfo->uEmptyScanCount = 0;
     pNeighborRoamInfo->uScanMode = DEFAULT_SCAN;
-    palZeroMemory(pMac->hHdd, &pNeighborRoamInfo->prevConnProfile,
-                  sizeof(tCsrRoamConnectedProfile));
+    vos_mem_set(&pNeighborRoamInfo->prevConnProfile, sizeof(tCsrRoamConnectedProfile), 0);
 #endif
     pNeighborRoamInfo->scanRspPending = eANI_BOOLEAN_FALSE;
 
     pNeighborRoamInfo->neighborScanTimerInfo.pMac = pMac;
     pNeighborRoamInfo->neighborScanTimerInfo.sessionId = CSR_SESSION_ID_INVALID;
-    status = palTimerAlloc(pMac->hHdd, &pNeighborRoamInfo->neighborScanTimer, 
+    status = vos_timer_init(&pNeighborRoamInfo->neighborScanTimer, VOS_TIMER_TYPE_SW,
                     csrNeighborRoamNeighborScanTimerCallback, (void *)&pNeighborRoamInfo->neighborScanTimerInfo);
 
     if (eHAL_STATUS_SUCCESS != status)
@@ -4141,7 +4378,7 @@
         return eHAL_STATUS_RESOURCES;
     }
 
-    status = palTimerAlloc(pMac->hHdd, &pNeighborRoamInfo->neighborResultsRefreshTimer, 
+    status = vos_timer_init(&pNeighborRoamInfo->neighborResultsRefreshTimer, VOS_TIMER_TYPE_SW,
                     csrNeighborRoamResultsRefreshTimerCallback, (void *)&pNeighborRoamInfo->neighborScanTimerInfo);
 
     if (eHAL_STATUS_SUCCESS != status)
@@ -4149,11 +4386,11 @@
         smsLog(pMac, LOGE, FL("Neighbor results refresh timer allocation failed"));
         vos_mem_free(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList);
         pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
-        palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
+        vos_timer_destroy(&pNeighborRoamInfo->neighborScanTimer);
         return eHAL_STATUS_RESOURCES;
     }
 
-    status = palTimerAlloc(pMac->hHdd, &pNeighborRoamInfo->emptyScanRefreshTimer,
+    status = vos_timer_init(&pNeighborRoamInfo->emptyScanRefreshTimer, VOS_TIMER_TYPE_SW,
                 csrNeighborRoamEmptyScanRefreshTimerCallback,
                 (void *)&pNeighborRoamInfo->neighborScanTimerInfo);
 
@@ -4162,8 +4399,8 @@
         smsLog(pMac, LOGE, FL("Empty scan refresh timer allocation failed"));
         vos_mem_free(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList);
         pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
-        palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
-        palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
+        vos_timer_destroy(&pNeighborRoamInfo->neighborScanTimer);
+        vos_timer_destroy(&pNeighborRoamInfo->neighborResultsRefreshTimer);
         return eHAL_STATUS_RESOURCES;
     }
 
@@ -4173,9 +4410,9 @@
         smsLog(pMac, LOGE, FL("LL Open of roamable AP List failed"));
         vos_mem_free(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList);
         pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
-        palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
-        palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
-        palTimerFree(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
+        vos_timer_destroy(&pNeighborRoamInfo->neighborScanTimer);
+        vos_timer_destroy(&pNeighborRoamInfo->neighborResultsRefreshTimer);
+        vos_timer_destroy(&pNeighborRoamInfo->emptyScanRefreshTimer);
         return eHAL_STATUS_RESOURCES;
     }
 
@@ -4192,9 +4429,9 @@
         smsLog(pMac, LOGE, FL("LL Open of roamable AP List failed"));
         vos_mem_free(pNeighborRoamInfo->cfgParams.channelInfo.ChannelList);
         pNeighborRoamInfo->cfgParams.channelInfo.ChannelList = NULL;
-        palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
-        palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);        
-        palTimerFree(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
+        vos_timer_destroy(&pNeighborRoamInfo->neighborScanTimer);
+        vos_timer_destroy(&pNeighborRoamInfo->neighborResultsRefreshTimer);
+        vos_timer_destroy(&pNeighborRoamInfo->emptyScanRefreshTimer);
         csrLLClose(&pNeighborRoamInfo->roamableAPList);
         return eHAL_STATUS_RESOURCES;
     }
@@ -4203,7 +4440,7 @@
     pNeighborRoamInfo->scanRequestTimeStamp = (tANI_TIMESTAMP)palGetTickCount(pMac->hHdd);
 
     CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT)
-    
+    pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
     return eHAL_STATUS_SUCCESS;
 }
 
@@ -4235,9 +4472,9 @@
     
     pNeighborRoamInfo->neighborScanTimerInfo.pMac = NULL;
     pNeighborRoamInfo->neighborScanTimerInfo.sessionId = CSR_SESSION_ID_INVALID;
-    palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborScanTimer);
-    palTimerFree(pMac->hHdd, pNeighborRoamInfo->neighborResultsRefreshTimer);
-    palTimerFree(pMac->hHdd, pNeighborRoamInfo->emptyScanRefreshTimer);
+    vos_timer_destroy(&pNeighborRoamInfo->neighborScanTimer);
+    vos_timer_destroy(&pNeighborRoamInfo->neighborResultsRefreshTimer);
+    vos_timer_destroy(&pNeighborRoamInfo->emptyScanRefreshTimer);
 
     /* Should free up the nodes in the list before closing the double Linked list */
     csrNeighborRoamFreeRoamableBSSList(pMac, &pNeighborRoamInfo->roamableAPList);
@@ -4297,6 +4534,10 @@
     extern void csrRoamRoamingStateDisassocRspProcessor( tpAniSirGlobal pMac, tSirSmeDisassocRsp *pSmeDisassocRsp );
     tANI_U32 roamId = 0;
 
+#ifdef FEATURE_WLAN_LFR_METRICS
+    tCsrRoamInfo *roamInfoMetrics;
+#endif
+
     if (pMac->roam.neighborRoamInfo.neighborRoamState != eCSR_NEIGHBOR_ROAM_STATE_PREAUTH_DONE) 
     {
         smsLog(pMac, LOGE, FL("Roam requested when Neighbor roam is in %d state"),
@@ -4320,7 +4561,25 @@
                                                 handoffNode.pBssDescription->bssId[3], 
                                                 handoffNode.pBssDescription->bssId[4], 
                                                 handoffNode.pBssDescription->bssId[5]);
-   
+
+#ifdef FEATURE_WLAN_LFR_METRICS
+    /* LFR metrics - pre-auth completion metric.
+       Send the event to supplicant that pre-auth successfully completed */
+    roamInfoMetrics = vos_mem_malloc(sizeof(tCsrRoamInfo));
+    if (NULL == roamInfoMetrics)
+    {
+        smsLog(pMac, LOG1, FL("Memory allocation failed!"));
+    }
+    else
+    {
+        vos_mem_copy((void *)roamInfoMetrics->bssid,
+            (void *)&handoffNode.pBssDescription->bssId, sizeof(tCsrBssid));
+        csrRoamCallCallback(pMac, pNeighborRoamInfo->csrSessionId,
+            roamInfoMetrics, 0, eCSR_ROAM_HANDOVER_SUCCESS, 0);
+        vos_mem_free(pRoamInfo);
+    }
+#endif
+
     /* Free the profile.. Just to make sure we dont leak memory here */ 
     csrReleaseProfile(pMac, &pNeighborRoamInfo->csrNeighborRoamProfile);
     /* Create the Handoff AP profile. Copy the currently connected profile and update only the BSSID and channel number
@@ -4476,14 +4735,16 @@
 ---------------------------------------------------------------------------*/
 void csrNeighborRoamTranistionPreauthDoneToDisconnected(tpAniSirGlobal pMac)
 {
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     if (pMac->roam.neighborRoamInfo.neighborRoamState != 
                eCSR_NEIGHBOR_ROAM_STATE_PREAUTH_DONE) return;
 
     // Stop timer
-    palTimerStop(pMac->hHdd, pMac->ft.ftSmeContext.preAuthReassocIntvlTimer);
+    vos_timer_stop(&pMac->ft.ftSmeContext.preAuthReassocIntvlTimer);
 
     // Transition to init state
     CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT)
+    pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
 }
 
 /* ---------------------------------------------------------------------------
@@ -4538,9 +4799,10 @@
     tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
     eHalStatus status = eHAL_STATUS_SUCCESS;
     /* we must be in connected state, if not ignore it */
-    if (eCSR_NEIGHBOR_ROAM_STATE_CONNECTED != pNeighborRoamInfo->neighborRoamState)
+    if ((eCSR_NEIGHBOR_ROAM_STATE_CONNECTED != pNeighborRoamInfo->neighborRoamState)
+        || (pNeighborRoamInfo->uOsRequestedHandoff))
     {
-        smsLog(pMac, LOGW, FL("Received in not CONNECTED state. Ignore it"));
+        smsLog(pMac, LOGE, FL("Received in not CONNECTED state OR uOsRequestedHandoff is set. Ignore it"));
         status = eHAL_STATUS_FAILURE;
     }
     else
@@ -4558,5 +4820,269 @@
 
     return status;
 }
+
+/* ---------------------------------------------------------------------------
+
+    \fn csrNeighborRoamProcessHandoffReq
+
+    \brief  This function is called start with the handoff process. First do a
+    SSID scan for the BSSID provided
+
+    \param  pMac - The handle returned by macOpen.
+
+    \return eHAL_STATUS_SUCCESS on success, corresponding error code otherwise
+
+---------------------------------------------------------------------------*/
+eHalStatus csrNeighborRoamProcessHandoffReq(tpAniSirGlobal pMac)
+{
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    tANI_U32 roamId;
+    tCsrRoamProfile *pProfile = NULL;
+    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, pNeighborRoamInfo->csrSessionId );
+    tANI_U8 i = 0;
+
+    do
+    {
+        roamId = GET_NEXT_ROAM_ID(&pMac->roam);
+        pProfile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+        if ( NULL == pProfile )
+        {
+            smsLog(pMac, LOGE, FL("Memory alloc failed"));
+            return eHAL_STATUS_FAILURE;
+        }
+        vos_mem_set(pProfile, sizeof(tCsrRoamProfile), 0);
+        status = csrRoamCopyProfile(pMac, pProfile, pSession->pCurRoamProfile);
+        if(!HAL_STATUS_SUCCESS(status))
+        {
+            smsLog(pMac, LOGE, FL("Profile copy failed"));
+            break;
+        }
+
+        //Add the BSSID & Channel
+        pProfile->BSSIDs.numOfBSSIDs = 1;
+        pProfile->BSSIDs.bssid = vos_mem_malloc(sizeof(tSirMacAddr) * pProfile->BSSIDs.numOfBSSIDs);
+        if (NULL == pProfile->BSSIDs.bssid)
+        {
+            smsLog(pMac, LOGE, FL("mem alloc failed for BSSID"));
+            status = eHAL_STATUS_FAILURE;
+            break;
+        }
+
+        vos_mem_zero(pProfile->BSSIDs.bssid, sizeof(tSirMacAddr) * pProfile->BSSIDs.numOfBSSIDs);
+
+        /* Populate the BSSID from handoff info received from HDD */
+        for (i = 0; i < pProfile->BSSIDs.numOfBSSIDs; i++)
+        {
+            vos_mem_copy(&pProfile->BSSIDs.bssid[i],
+                         pNeighborRoamInfo->handoffReqInfo.bssid, sizeof(tSirMacAddr));
+        }
+
+        pProfile->ChannelInfo.numOfChannels = 1;
+        pProfile->ChannelInfo.ChannelList =
+        vos_mem_malloc(sizeof(*pProfile->ChannelInfo.ChannelList) *
+                           pProfile->ChannelInfo.numOfChannels);
+        if (NULL == pProfile->ChannelInfo.ChannelList)
+        {
+            smsLog(pMac, LOGE, FL("mem alloc failed for ChannelList"));
+            status = eHAL_STATUS_FAILURE;
+            break;
+        }
+        pProfile->ChannelInfo.ChannelList[0] = pNeighborRoamInfo->handoffReqInfo.channel;
+
+        //clean up csr cache first
+        //csrScanFlushSelectiveResult(pMac, VOS_FALSE);
+        //do a SSID scan
+        status = csrScanForSSID(pMac, pNeighborRoamInfo->csrSessionId, pProfile, roamId, FALSE);
+        if(!HAL_STATUS_SUCCESS(status))
+        {
+            smsLog(pMac, LOGE, FL("SSID scan failed"));
+        }
+    }while(0);
+
+    if(NULL != pProfile)
+    {
+        csrReleaseProfile(pMac, pProfile);
+        vos_mem_free(pProfile);
+    }
+
+    return status;
+}
+
+/* ---------------------------------------------------------------------------
+
+    \fn csrNeighborRoamSssidScanDone
+
+    \brief  This function is called once SSID scan is done. If SSID scan failed
+    to find our candidate add an entry to csr scan cache ourself before starting
+    the handoff process
+
+    \param  pMac - The handle returned by macOpen.
+
+    \return eHAL_STATUS_SUCCESS on success, corresponding error code otherwise
+
+---------------------------------------------------------------------------*/
+eHalStatus csrNeighborRoamSssidScanDone(tpAniSirGlobal pMac, eHalStatus status)
+{
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    eHalStatus                      hstatus;
+
+    smsLog(pMac, LOGE, FL("called "));
+
+    /* we must be in connected state, if not ignore it */
+    if (eCSR_NEIGHBOR_ROAM_STATE_CONNECTED != pNeighborRoamInfo->neighborRoamState)
+    {
+        smsLog(pMac, LOGE, FL("Received in not CONNECTED state. Ignore it"));
+        return eHAL_STATUS_FAILURE;
+    }
+
+    //if SSID scan failed to find our candidate add an entry to csr scan cache ourself
+    if(!HAL_STATUS_SUCCESS(status))
+    {
+        smsLog(pMac, LOGE, FL("Add an entry to csr scan cache"));
+        hstatus = csrScanCreateEntryInScanCache(pMac, pNeighborRoamInfo->csrSessionId,
+                                                pNeighborRoamInfo->handoffReqInfo.bssid,
+                                                pNeighborRoamInfo->handoffReqInfo.channel);
+        if (eHAL_STATUS_SUCCESS != hstatus)
+        {
+            smsLog(pMac, LOGE, FL("csrScanCreateEntryInScanCache failed with status %d"), hstatus);
+            return eHAL_STATUS_FAILURE;
+        }
+    }
+
+    /* Now we have completed scanning for the candidate provided by HDD. Let move on to HO*/
+    hstatus = csrNeighborRoamProcessScanComplete(pMac);
+
+    if (eHAL_STATUS_SUCCESS != hstatus)
+    {
+        smsLog(pMac, LOGE, FL("Neighbor scan process complete failed with status %d"), hstatus);
+        return eHAL_STATUS_FAILURE;
+    }
+    return eHAL_STATUS_SUCCESS;
+}
+
+/* ---------------------------------------------------------------------------
+
+    \fn csrNeighborRoamHandoffReqHdlr
+
+    \brief  This function is called by CSR as soon as it gets a handoff request
+            to SME via MC thread
+
+    \param  pMac - The handle returned by macOpen.
+            pMsg - Msg sent by HDD
+
+    \return eHAL_STATUS_SUCCESS on success, corresponding error code otherwise
+
+---------------------------------------------------------------------------*/
+eHalStatus csrNeighborRoamHandoffReqHdlr(tpAniSirGlobal pMac, void* pMsg)
+{
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    tAniHandoffReq                 *pHandoffReqInfo;
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    /* we must be in connected state, if not ignore it */
+    if (eCSR_NEIGHBOR_ROAM_STATE_CONNECTED != pNeighborRoamInfo->neighborRoamState)
+    {
+        smsLog(pMac, LOGE, FL("Received in not CONNECTED state. Ignore it"));
+        status = eHAL_STATUS_FAILURE;
+    }
+    else
+    {
+        //save the handoff info came from HDD as part of the reassoc req
+        pHandoffReqInfo = (tAniHandoffReq *)pMsg;
+        if (NULL != pHandoffReqInfo)
+        {
+            //sanity check
+            if (VOS_FALSE == vos_mem_compare(pHandoffReqInfo->bssid,
+                                             pNeighborRoamInfo->currAPbssid,
+                                             sizeof(tSirMacAddr)))
+            {
+
+                pNeighborRoamInfo->handoffReqInfo.channel = pHandoffReqInfo->channel;
+                vos_mem_copy(pNeighborRoamInfo->handoffReqInfo.bssid,
+                             pHandoffReqInfo->bssid,
+                             6);
+                pNeighborRoamInfo->uOsRequestedHandoff = 1;
+                status = csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_STOP,
+                                            REASON_OS_REQUESTED_ROAMING_NOW);
+                if (eHAL_STATUS_SUCCESS != status)
+                {
+                    smsLog(pMac, LOGE, FL("csrRoamOffloadScan failed"));
+                    pNeighborRoamInfo->uOsRequestedHandoff = 0;
+                }
+            }
+            else
+            {
+                smsLog(pMac, LOGE, FL("Received req has same BSSID as current AP!!"));
+                status = eHAL_STATUS_FAILURE;
+            }
+        }
+        else
+        {
+            smsLog(pMac, LOGE, FL("Received msg is NULL"));
+            status = eHAL_STATUS_FAILURE;
+        }
+    }
+
+    return status;
+}
+
+/* ---------------------------------------------------------------------------
+
+    \fn csrNeighborRoamProceedWithHandoffReq
+
+    \brief  This function is called by CSR as soon as it gets rsp back for
+            ROAM_SCAN_OFFLOAD_STOP with reason REASON_OS_REQUESTED_ROAMING_NOW
+
+    \param  pMac - The handle returned by macOpen.
+
+    \return eHAL_STATUS_SUCCESS on success, corresponding error code otherwise
+
+---------------------------------------------------------------------------*/
+eHalStatus csrNeighborRoamProceedWithHandoffReq(tpAniSirGlobal pMac)
+{
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    /* we must be in connected state, if not ignore it */
+    if ((eCSR_NEIGHBOR_ROAM_STATE_CONNECTED != pNeighborRoamInfo->neighborRoamState)
+        || (!pNeighborRoamInfo->uOsRequestedHandoff))
+    {
+        smsLog(pMac, LOGE, FL("Received in not CONNECTED state or uOsRequestedHandoff is not set. Ignore it"));
+        status = eHAL_STATUS_FAILURE;
+    }
+    else
+    {
+        //Let's go ahead with handoff
+        status = csrNeighborRoamProcessHandoffReq(pMac);
+    }
+    if(!HAL_STATUS_SUCCESS(status))
+    {
+        pNeighborRoamInfo->uOsRequestedHandoff = 0;
+    }
+    return status;
+}
+
+/* ---------------------------------------------------------------------------
+
+    \fn csrNeighborRoamStartLfrScan
+
+    \brief  This function is called if HDD requested handoff failed for some
+    reason. start the LFR logic at that point.By the time, this function is
+    called, a STOP command has already been issued.
+
+    \param  pMac - The handle returned by macOpen.
+
+    \return eHAL_STATUS_SUCCESS on success, corresponding error code otherwise
+
+---------------------------------------------------------------------------*/
+eHalStatus csrNeighborRoamStartLfrScan(tpAniSirGlobal pMac)
+{
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    pNeighborRoamInfo->uOsRequestedHandoff = 0;
+    /* There is no candidate or We are not roaming Now.
+     * Inform the FW to restart Roam Offload Scan  */
+    csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_START, REASON_NO_CAND_FOUND_OR_NOT_ROAMING_NOW);
+
+    return eHAL_STATUS_SUCCESS;
+}
 #endif //WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 #endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
diff --git a/CORE/SME/src/csr/csrTdlsProcess.c b/CORE/SME/src/csr/csrTdlsProcess.c
index 5ea523b..cca0add 100644
--- a/CORE/SME/src/csr/csrTdlsProcess.c
+++ b/CORE/SME/src/csr/csrTdlsProcess.c
@@ -128,20 +128,23 @@
             tdlsSendMgmtCmdInfo->dialog = tdlsSendMgmt->dialog ;   
             tdlsSendMgmtCmdInfo->statusCode = tdlsSendMgmt->statusCode ;
             tdlsSendMgmtCmdInfo->responder = tdlsSendMgmt->responder;
-            palCopyMemory(pMac->hHdd, tdlsSendMgmtCmdInfo->peerMac, 
+            vos_mem_copy(tdlsSendMgmtCmdInfo->peerMac,
                                    tdlsSendMgmt->peerMac, sizeof(tSirMacAddr)) ; 
 
             if( (0 != tdlsSendMgmt->len) && (NULL != tdlsSendMgmt->buf) )
             {
-                status = palAllocateMemory( pMac->hHdd, (void **)&tdlsSendMgmtCmdInfo->buf, 
-                        tdlsSendMgmt->len );
+                tdlsSendMgmtCmdInfo->buf = vos_mem_malloc(tdlsSendMgmt->len);
+                if ( NULL == tdlsSendMgmtCmdInfo->buf )
+                    status = eHAL_STATUS_FAILURE;
+                else
+                    status = eHAL_STATUS_SUCCESS;
                 if(!HAL_STATUS_SUCCESS( status ) )
                 {
                     smsLog( pMac, LOGE, FL("Alloc Failed") );
                     VOS_ASSERT(0) ;
                     return status ;
                 }
-                palCopyMemory(pMac->hHdd, tdlsSendMgmtCmdInfo->buf,
+                vos_mem_copy(tdlsSendMgmtCmdInfo->buf,
                         tdlsSendMgmt->buf, tdlsSendMgmt->len );
                 tdlsSendMgmtCmdInfo->len = tdlsSendMgmt->len;
             }
@@ -187,33 +190,33 @@
 
             tdlsAddStaCmd->sessionId = sessionId;
 
-            palCopyMemory(pMac->hHdd, tdlsAddStaCmdInfo->peerMac,
+            vos_mem_copy(tdlsAddStaCmdInfo->peerMac,
                           peerMac, sizeof(tSirMacAddr)) ;
             tdlsAddStaCmdInfo->capability = pstaParams->capability;
             tdlsAddStaCmdInfo->uapsdQueues = pstaParams->uapsd_queues;
             tdlsAddStaCmdInfo->maxSp = pstaParams->max_sp;
-            palCopyMemory(pMac->hHdd, tdlsAddStaCmdInfo->extnCapability,
+            vos_mem_copy(tdlsAddStaCmdInfo->extnCapability,
                           pstaParams->extn_capability,
                           sizeof(pstaParams->extn_capability));
 
             tdlsAddStaCmdInfo->htcap_present = pstaParams->htcap_present;
-            if(pstaParams->htcap_present)
-                palCopyMemory(pMac->hHdd, &tdlsAddStaCmdInfo->HTCap,
-                              &pstaParams->HTCap, sizeof(pstaParams->HTCap));
+				if(pstaParams->htcap_present)
+					vos_mem_copy(&tdlsAddStaCmdInfo->HTCap,
+							&pstaParams->HTCap, sizeof(pstaParams->HTCap));
             else
-                palZeroMemory(pMac->hHdd, &tdlsAddStaCmdInfo->HTCap, sizeof(pstaParams->HTCap));
+                vos_mem_set(&tdlsAddStaCmdInfo->HTCap, sizeof(pstaParams->HTCap), 0);
 
             tdlsAddStaCmdInfo->vhtcap_present = pstaParams->vhtcap_present;
             if(pstaParams->vhtcap_present)
-                palCopyMemory(pMac->hHdd, &tdlsAddStaCmdInfo->VHTCap,
+                vos_mem_copy(&tdlsAddStaCmdInfo->VHTCap,
                               &pstaParams->VHTCap, sizeof(pstaParams->VHTCap));
             else
-                palZeroMemory(pMac->hHdd, &tdlsAddStaCmdInfo->VHTCap, sizeof(pstaParams->VHTCap));
+                vos_mem_set(&tdlsAddStaCmdInfo->VHTCap, sizeof(pstaParams->VHTCap), 0);
 
-			tdlsAddStaCmdInfo->supportedRatesLen = pstaParams->supported_rates_len;
+            tdlsAddStaCmdInfo->supportedRatesLen = pstaParams->supported_rates_len;
 
             if (0 != pstaParams->supported_rates_len)
-                palCopyMemory(pMac->hHdd, &tdlsAddStaCmdInfo->supportedRates,
+                vos_mem_copy(&tdlsAddStaCmdInfo->supportedRates,
                               pstaParams->supported_rates,
                               pstaParams->supported_rates_len);
 
@@ -226,6 +229,46 @@
 
     return status ;
 }
+/*
+ * TDLS request API, called from HDD to Send Link Establishment Parameters
+ */
+VOS_STATUS csrTdlsSendLinkEstablishParams(tHalHandle hHal,
+                                                 tANI_U8 sessionId,
+                                                 tSirMacAddr peerMac,
+                                                 tCsrTdlsLinkEstablishParams *tdlsLinkEstablishParams)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    tSmeCmd *tdlsLinkEstablishCmd;
+    eHalStatus status = eHAL_STATUS_FAILURE ;
+    //If connected and in Infra. Only then allow this
+    if( CSR_IS_SESSION_VALID( pMac, sessionId ) &&
+        csrIsConnStateConnectedInfra( pMac, sessionId ) &&
+        (NULL != peerMac) )
+    {
+        tdlsLinkEstablishCmd = csrGetCommandBuffer(pMac) ;
+
+        if(tdlsLinkEstablishCmd)
+        {
+            tTdlsLinkEstablishCmdInfo *tdlsLinkEstablishCmdInfo =
+            &tdlsLinkEstablishCmd->u.tdlsCmd.u.tdlsLinkEstablishCmdInfo ;
+
+            tdlsLinkEstablishCmd->sessionId = sessionId;
+
+            vos_mem_copy( tdlsLinkEstablishCmdInfo->peerMac,
+                          peerMac, sizeof(tSirMacAddr));
+            tdlsLinkEstablishCmdInfo->isBufSta = tdlsLinkEstablishParams->isBufSta;
+            tdlsLinkEstablishCmdInfo->isResponder= tdlsLinkEstablishParams->isResponder;
+            tdlsLinkEstablishCmdInfo->maxSp= tdlsLinkEstablishParams->maxSp;
+            tdlsLinkEstablishCmdInfo->uapsdQueues= tdlsLinkEstablishParams->uapsdQueues;
+            tdlsLinkEstablishCmd->command = eSmeCommandTdlsLinkEstablish ;
+            tdlsLinkEstablishCmd->u.tdlsCmd.size = sizeof(tTdlsLinkEstablishCmdInfo) ;
+            smePushCommand(pMac, tdlsLinkEstablishCmd, FALSE) ;
+            status = eHAL_STATUS_SUCCESS ;
+        }
+    }
+
+    return status ;
+}
 
 /*
  * TDLS request API, called from HDD to add a TDLS peer
@@ -251,7 +294,7 @@
             tdlsAddStaCmd->sessionId = sessionId;
             tdlsAddStaCmdInfo->tdlsAddOper = TDLS_OPER_ADD;
 
-            palCopyMemory(pMac->hHdd, tdlsAddStaCmdInfo->peerMac, 
+            vos_mem_copy( tdlsAddStaCmdInfo->peerMac,
                     peerMac, sizeof(tSirMacAddr)) ; 
 
             tdlsAddStaCmd->command = eSmeCommandTdlsAddPeer ;
@@ -287,7 +330,7 @@
 
             tdlsDelStaCmd->sessionId = sessionId;
 
-            palCopyMemory(pMac->hHdd, tdlsDelStaCmdInfo->peerMac, 
+            vos_mem_copy(tdlsDelStaCmdInfo->peerMac,
                                    peerMac, sizeof(tSirMacAddr)) ; 
 
             tdlsDelStaCmd->command = eSmeCommandTdlsDelPeer ;
@@ -322,7 +365,7 @@
             tdlsDisReqCmd->sessionId = sessionId;
 
             disReqCmdInfo->tdlsDisType = tdlsDisReq->disType ;   
-            palCopyMemory(pMac->hHdd, disReqCmdInfo->peerMac, 
+            vos_mem_copy(disReqCmdInfo->peerMac,
                                    tdlsDisReq->peerMac, sizeof(tSirMacAddr)) ; 
             tdlsDisReqCmd->command = eSmeCommandTdlsDiscovery ;
             tdlsDisReqCmd->u.tdlsCmd.size = sizeof(tTdlsDisReqCmdinfo) ;
@@ -355,7 +398,7 @@
 
             tdlsSetupReqCmd->sessionId = sessionId;
 
-            palCopyMemory(pMac->hHdd, setupCmdInfo->peerMac, 
+            vos_mem_copy(setupCmdInfo->peerMac,
                                 tdlsSetupReq->peerMac, sizeof(tSirMacAddr)) ; 
             tdlsSetupReqCmd->command = eSmeCommandTdlsLinkSetup ;
             tdlsSetupReqCmd->u.tdlsCmd.size = sizeof(tTdlsLinkSetupReqCmdinfo) ;
@@ -388,7 +431,7 @@
 
             tdlsTeardownReqCmd->sessionId = sessionId;
 
-            palCopyMemory(pMac->hHdd, teardownCmdInfo->peerMac, 
+            vos_mem_copy(teardownCmdInfo->peerMac,
                          tdlsTeardownReq->peerMac, sizeof(tSirMacAddr)) ; 
             tdlsTeardownReqCmd->command = eSmeCommandTdlsLinkTear ;
             tdlsTeardownReqCmd->u.tdlsCmd.size = 
@@ -439,8 +482,12 @@
         return eHAL_STATUS_FAILURE;
     }
 
-    status = palAllocateMemory( pMac->hHdd, (void **)&tdlsSendMgmtReq, 
-            (sizeof(tSirTdlsSendMgmtReq) + tdlsSendMgmtCmdInfo->len ) );
+    tdlsSendMgmtReq = vos_mem_malloc(
+                      sizeof(tSirTdlsSendMgmtReq) + tdlsSendMgmtCmdInfo->len);
+    if ( NULL == tdlsSendMgmtReq )
+       status = eHAL_STATUS_FAILURE;
+    else
+       status = eHAL_STATUS_SUCCESS;
 
     if (!HAL_STATUS_SUCCESS( status ) )
     {
@@ -456,15 +503,15 @@
     tdlsSendMgmtReq->statusCode =  tdlsSendMgmtCmdInfo->statusCode ;
     tdlsSendMgmtReq->responder =  tdlsSendMgmtCmdInfo->responder;
 
-    palCopyMemory(pMac->hHdd, tdlsSendMgmtReq->bssid,
+    vos_mem_copy(tdlsSendMgmtReq->bssid,
                   pSession->pConnectBssDesc->bssId, sizeof (tSirMacAddr));
 
-    palCopyMemory(pMac->hHdd, tdlsSendMgmtReq->peerMac, 
+    vos_mem_copy(tdlsSendMgmtReq->peerMac,
             tdlsSendMgmtCmdInfo->peerMac, sizeof(tSirMacAddr)) ;
 
     if(tdlsSendMgmtCmdInfo->len && tdlsSendMgmtCmdInfo->buf)
     {
-        palCopyMemory(pMac->hHdd, tdlsSendMgmtReq->addIe, tdlsSendMgmtCmdInfo->buf,
+        vos_mem_copy(tdlsSendMgmtReq->addIe, tdlsSendMgmtCmdInfo->buf,
                 tdlsSendMgmtCmdInfo->len);
 
     }
@@ -479,7 +526,7 @@
     if(tdlsSendMgmtCmdInfo->len && tdlsSendMgmtCmdInfo->buf)
     {
         //Done with the buf. Free it.
-        palFreeMemory( pMac->hHdd, tdlsSendMgmtCmdInfo->buf );
+        vos_mem_free( tdlsSendMgmtCmdInfo->buf );
         tdlsSendMgmtCmdInfo->len = 0;
     }
 
@@ -499,8 +546,11 @@
         return eHAL_STATUS_FAILURE;
     }
 
-    status = palAllocateMemory( pMac->hHdd, (void **)&tdlsAddStaReq, 
-            (sizeof(tSirTdlsAddStaReq) ) );
+    tdlsAddStaReq = vos_mem_malloc(sizeof(tSirTdlsAddStaReq));
+    if ( NULL == tdlsAddStaReq )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
 
     if (!HAL_STATUS_SUCCESS( status ) )
     {
@@ -513,27 +563,27 @@
     //Using dialog as transactionId. This can be used to match response with request
     tdlsAddStaReq->transactionId = 0;
 
-    palCopyMemory(pMac->hHdd, tdlsAddStaReq->bssid,
+    vos_mem_copy( tdlsAddStaReq->bssid,
                   pSession->pConnectBssDesc->bssId, sizeof (tSirMacAddr));
 
-    palCopyMemory(pMac->hHdd, tdlsAddStaReq->peerMac, 
+    vos_mem_copy( tdlsAddStaReq->peerMac,
             tdlsAddStaCmdInfo->peerMac, sizeof(tSirMacAddr)) ;
 
     tdlsAddStaReq->capability = tdlsAddStaCmdInfo->capability;
     tdlsAddStaReq->uapsd_queues = tdlsAddStaCmdInfo->uapsdQueues;
     tdlsAddStaReq->max_sp = tdlsAddStaCmdInfo->maxSp;
 
-    palCopyMemory(pMac->hHdd, tdlsAddStaReq->extn_capability,
+    vos_mem_copy( tdlsAddStaReq->extn_capability,
                               tdlsAddStaCmdInfo->extnCapability,
                               SIR_MAC_MAX_EXTN_CAP);
     tdlsAddStaReq->htcap_present = tdlsAddStaCmdInfo->htcap_present;
-    palCopyMemory(pMac->hHdd, &tdlsAddStaReq->htCap,
+    vos_mem_copy( &tdlsAddStaReq->htCap,
                   &tdlsAddStaCmdInfo->HTCap, sizeof(tdlsAddStaCmdInfo->HTCap));
     tdlsAddStaReq->vhtcap_present = tdlsAddStaCmdInfo->vhtcap_present;
-    palCopyMemory(pMac->hHdd, &tdlsAddStaReq->vhtCap,
+    vos_mem_copy( &tdlsAddStaReq->vhtCap,
                   &tdlsAddStaCmdInfo->VHTCap, sizeof(tdlsAddStaCmdInfo->VHTCap));
     tdlsAddStaReq->supported_rates_length = tdlsAddStaCmdInfo->supportedRatesLen;
-    palCopyMemory(pMac->hHdd, &tdlsAddStaReq->supported_rates,
+    vos_mem_copy( &tdlsAddStaReq->supported_rates,
                   tdlsAddStaCmdInfo->supportedRates, tdlsAddStaCmdInfo->supportedRatesLen);
 
     // Send the request to PE.
@@ -560,8 +610,12 @@
         return eHAL_STATUS_FAILURE;
     }
 
-    status = palAllocateMemory( pMac->hHdd, (void **)&tdlsDelStaReq, 
-            (sizeof(tSirTdlsDelStaReq) ) );
+    tdlsDelStaReq = vos_mem_malloc(sizeof(tSirTdlsDelStaReq));
+    if ( NULL == tdlsDelStaReq )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
+
 
     if (!HAL_STATUS_SUCCESS( status ) )
     {
@@ -573,10 +627,10 @@
     //Using dialog as transactionId. This can be used to match response with request
     tdlsDelStaReq->transactionId = 0;
 
-    palCopyMemory(pMac->hHdd, tdlsDelStaReq->bssid,
+    vos_mem_copy( tdlsDelStaReq->bssid,
                   pSession->pConnectBssDesc->bssId, sizeof (tSirMacAddr));
 
-    palCopyMemory(pMac->hHdd, tdlsDelStaReq->peerMac, 
+    vos_mem_copy( tdlsDelStaReq->peerMac,
             tdlsDelStaCmdInfo->peerMac, sizeof(tSirMacAddr)) ;
 
     // Send the request to PE.
@@ -635,6 +689,15 @@
             }
         }
         break;
+        case eSmeCommandTdlsLinkEstablish:
+        {
+            status = csrTdlsProcessLinkEstablish( pMac, cmd );
+            if(HAL_STATUS_SUCCESS( status ) )
+            {
+               status = eANI_BOOLEAN_FALSE ;
+            }
+        }
+        break;
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
         case eSmeCommandTdlsDiscovery:
         {
@@ -642,8 +705,11 @@
             tSirTdlsDisReq *disReq = NULL ;
             tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, cmd->sessionId );
             
-            status = palAllocateMemory( pMac->hHdd, (void **)&disReq, 
-                                                      sizeof(tSirTdlsDisReq));
+            disReq = vos_mem_malloc(sizeof(tSirTdlsDisReq));
+            if ( NULL == disReq )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
 
             if(!HAL_STATUS_SUCCESS( status ) )
             {
@@ -654,9 +720,9 @@
             disReq->sessionId = cmd->sessionId;
             disReq->transactionId = 0;  /* TODO ? */
             disReq->reqType =  disReqCmdInfo->tdlsDisType ;
-            palCopyMemory(pMac->hHdd, disReq->bssid, pSession->pConnectBssDesc->bssId, 
+            vos_mem_copy( disReq->bssid, pSession->pConnectBssDesc->bssId,
                                  sizeof (tSirMacAddr));
-            palCopyMemory(pMac->hHdd, disReq->peerMac, 
+            vos_mem_copy( disReq->peerMac,
                                  disReqCmdInfo->peerMac, sizeof(tSirMacAddr)) ;
             smsLog( pMac, LOGE, "sending TDLS discovery to PE " );
             status = tdlsSendMessage(pMac, eWNI_SME_TDLS_DISCOVERY_START_REQ, 
@@ -676,8 +742,12 @@
             tSirTdlsSetupReq *setupReq = NULL ;
             tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, cmd->sessionId );
 
-            status = palAllocateMemory( pMac->hHdd, (void **)&setupReq, 
-                                                sizeof(tSirTdlsSetupReq));
+            setupReq = vos_mem_malloc(sizeof(tSirTdlsSetupReq));
+            if ( NULL == setupReq )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+
 
             if(!HAL_STATUS_SUCCESS( status ) )
             {
@@ -688,9 +758,9 @@
             setupReq->sessionId = cmd->sessionId;
             setupReq->transactionId = 0;  /* TODO ? */
             
-            palCopyMemory(pMac->hHdd, setupReq->bssid, pSession->pConnectBssDesc->bssId, 
+            vos_mem_copy( setupReq->bssid, pSession->pConnectBssDesc->bssId,
                                  sizeof (tSirMacAddr));
-            palCopyMemory(pMac->hHdd, setupReq->peerMac, 
+            vos_mem_copy( setupReq->peerMac,
                            linkSetupReqCmdInfo->peerMac, sizeof(tSirMacAddr)) ;
     
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, 
@@ -712,8 +782,12 @@
             tSirTdlsTeardownReq *teardownReq = NULL ;
             tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, cmd->sessionId );
 
-            status = palAllocateMemory( pMac->hHdd, (void **)&teardownReq, 
-                                                sizeof(tSirTdlsTeardownReq));
+            teardownReq = vos_mem_malloc(sizeof(tSirTdlsTeardownReq));
+            if ( NULL == teardownReq )
+                status = eHAL_STATUS_FAILURE;
+            else
+                status = eHAL_STATUS_SUCCESS;
+
             if(!HAL_STATUS_SUCCESS( status ) )
             {
                 smsLog( pMac, LOGE, "teardown Req alloc failed " );
@@ -723,9 +797,9 @@
             teardownReq->sessionId = cmd->sessionId;
             teardownReq->transactionId = 0;  /* TODO ? */
 
-            palCopyMemory(pMac->hHdd, teardownReq->bssid, pSession->pConnectBssDesc->bssId, 
+            vos_mem_copy( teardownReq->bssid, pSession->pConnectBssDesc->bssId,
                                  sizeof (tSirMacAddr));
-            palCopyMemory(pMac->hHdd, &teardownReq->peerMac, 
+            vos_mem_copy( &teardownReq->peerMac,
                            linkTeardownCmdInfo->peerMac, sizeof(tSirMacAddr)) ;
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, 
                                                 ("teardown request..")) ;
@@ -750,6 +824,46 @@
     return status ; 
 }
 
+eHalStatus csrTdlsProcessLinkEstablish( tpAniSirGlobal pMac, tSmeCmd *cmd )
+{
+    tTdlsLinkEstablishCmdInfo *tdlsLinkEstablishCmdInfo = &cmd->u.tdlsCmd.u.tdlsLinkEstablishCmdInfo ;
+    tSirTdlsLinkEstablishReq *tdlsLinkEstablishReq = NULL ;
+    eHalStatus status = eHAL_STATUS_FAILURE;
+    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, cmd->sessionId );
+
+    tdlsLinkEstablishReq = vos_mem_malloc(sizeof(tSirTdlsLinkEstablishReq));
+
+    if (tdlsLinkEstablishReq == NULL)
+    {
+        smsLog( pMac, LOGE, FL("alloc failed \n") );
+        VOS_ASSERT(0) ;
+        return status ;
+    }
+    tdlsLinkEstablishReq->sessionId = cmd->sessionId;
+    //Using dialog as transactionId. This can be used to match response with request
+    tdlsLinkEstablishReq->transactionId = 0;
+    vos_mem_copy(tdlsLinkEstablishReq->peerMac,
+                  tdlsLinkEstablishCmdInfo->peerMac, sizeof(tSirMacAddr));
+    vos_mem_copy(tdlsLinkEstablishReq->bssid, pSession->pConnectBssDesc->bssId,
+                  sizeof (tSirMacAddr));
+    tdlsLinkEstablishReq->isBufSta = tdlsLinkEstablishCmdInfo->isBufSta;
+    tdlsLinkEstablishReq->isResponder= tdlsLinkEstablishCmdInfo->isResponder;
+    tdlsLinkEstablishReq->uapsdQueues= tdlsLinkEstablishCmdInfo->uapsdQueues;
+    tdlsLinkEstablishReq->maxSp= tdlsLinkEstablishCmdInfo->maxSp;
+
+
+    // Send the request to PE.
+    smsLog( pMac, LOGE, "sending TDLS Link Establish Request to PE \n" );
+    status = tdlsSendMessage(pMac, eWNI_SME_TDLS_LINK_ESTABLISH_REQ,
+                             (void *)tdlsLinkEstablishReq,
+                             sizeof(tSirTdlsLinkEstablishReq));
+    if (!HAL_STATUS_SUCCESS( status ) )
+    {
+        smsLog( pMac, LOGE, FL("Failed to send request to MAC\n"));
+    }
+    return status;
+}
+
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
 /*
  * Find specific TDLS peer (based on peer MAC address).
@@ -768,7 +882,7 @@
                                                         tdlsPeerStaLink) ;
         peerInfo = &peerLinkInfo->tdlsDisPeerInfo ;
  
-        if(palEqualMemory( pMac->hHdd,(tANI_U8 *)peerInfo->peerMac,
+        if ( vos_mem_compare( (tANI_U8 *)peerInfo->peerMac,
                               (tANI_U8 *) peerMac, sizeof(tSirMacAddr)) )
         {
             break ;
@@ -793,7 +907,8 @@
     if((csrLLRemoveEntry(&disInfo->tdlsPotentialPeerList, 
                         &peerInfo->tdlsPeerStaLink, LL_ACCESS_NOLOCK)))
     {
-       status = palFreeMemory(pMac->hHdd, (void *)peerInfo) ;
+       vos_mem_free((void *)peerInfo) ;
+       status = eHAL_STATUS_SUCCESS;
 
     }
 
@@ -845,8 +960,11 @@
      * at the time the peer node is getting deleted, possible case is 
      * teardown
      */
-    status = palAllocateMemory( pMac->hHdd, (void **)&peerInfo, 
-                                sizeof(tCsrTdlsPeerLinkinfo));
+    peerInfo = vos_mem_malloc(sizeof(tCsrTdlsPeerLinkinfo));
+    if ( NULL = peerInfo )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
 
     /* 
      * go ahead and copy peerInfo and insert this node info discovery rsp
@@ -854,9 +972,9 @@
      */ 
     if (HAL_STATUS_SUCCESS(status))
     {
-        palZeroMemory(pMac->hHdd, &peerInfo->tdlsDisPeerInfo, 
-                                            sizeof(tSirTdlsPeerInfo));
-        palCopyMemory(pMac->hHdd, &peerInfo->tdlsDisPeerInfo, disPeerInfo, 
+        vos_mem_set( &peerInfo->tdlsDisPeerInfo,
+                                            sizeof(tSirTdlsPeerInfo), 0);
+        vos_mem_copy( &peerInfo->tdlsDisPeerInfo, disPeerInfo,
                                              sizeof(tSirTdlsPeerInfo));
 
         /*
@@ -897,7 +1015,7 @@
             tSirTdlsAddStaRsp *addStaRsp = (tSirTdlsAddStaRsp *) pMsgBuf ;
             eCsrRoamResult roamResult ;
             tCsrRoamInfo roamInfo = {0} ;
-            palCopyMemory(pMac->hHdd, &roamInfo.peerMac, addStaRsp->peerMac, 
+            vos_mem_copy( &roamInfo.peerMac, addStaRsp->peerMac,
                                          sizeof(tSirMacAddr)) ;
             roamInfo.staId = addStaRsp->staId ;
             roamInfo.ucastSig = addStaRsp->ucastSig ;
@@ -924,7 +1042,7 @@
             tSirTdlsDelStaRsp *delStaRsp = (tSirTdlsDelStaRsp *) pMsgBuf ;
             tCsrRoamInfo roamInfo = {0} ;
 
-            palCopyMemory(pMac->hHdd, &roamInfo.peerMac, delStaRsp->peerMac, 
+            vos_mem_copy( &roamInfo.peerMac, delStaRsp->peerMac,
                                          sizeof(tSirMacAddr)) ;
             roamInfo.staId = delStaRsp->staId ;
             roamInfo.statusCode = delStaRsp->statusCode ;
@@ -943,7 +1061,7 @@
         {
             tpSirTdlsDelStaInd pSirTdlsDelStaInd = (tpSirTdlsDelStaInd) pMsgBuf ;
             tCsrRoamInfo roamInfo = {0} ;
-            palCopyMemory(pMac->hHdd, &roamInfo.peerMac, pSirTdlsDelStaInd->peerMac,
+            vos_mem_copy( &roamInfo.peerMac, pSirTdlsDelStaInd->peerMac,
                                          sizeof(tSirMacAddr)) ;
             roamInfo.staId = pSirTdlsDelStaInd->staId ;
             roamInfo.reasonCode = pSirTdlsDelStaInd->reasonCode ;
@@ -973,6 +1091,24 @@
 
             csrRoamCallCallback(pMac, pSirTdlsDelAllPeerInd->sessionId, &roamInfo,
                                 0, eCSR_ROAM_RESULT_MGMT_TX_COMPLETE_IND, 0);
+            break;
+        }
+        case eWNI_SME_TDLS_LINK_ESTABLISH_RSP:
+        {
+            tSirTdlsLinkEstablishReqRsp *linkEstablishReqRsp = (tSirTdlsLinkEstablishReqRsp *) pMsgBuf ;
+            tCsrRoamInfo roamInfo = {0} ;
+#if 0
+            vos_mem_copy(&roamInfo.peerMac, delStaRsp->peerMac,
+                                         sizeof(tSirMacAddr)) ;
+            roamInfo.staId = delStaRsp->staId ;
+            roamInfo.statusCode = delStaRsp->statusCode ;
+#endif
+            csrRoamCallCallback(pMac, linkEstablishReqRsp->sessionId, &roamInfo, 0,
+                         eCSR_ROAM_TDLS_STATUS_UPDATE,
+                               eCSR_ROAM_RESULT_LINK_ESTABLISH_REQ_RSP);
+            /* remove pending eSmeCommandTdlsLinkEstablish command */
+            csrTdlsRemoveSmeCmd(pMac, eSmeCommandTdlsLinkEstablish);
+            break;
         }
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
         case eWNI_SME_TDLS_DISCOVERY_START_RSP:
@@ -1106,7 +1242,7 @@
         {
             tSirTdlsPeerInd *peerInd = (tSirTdlsPeerInd *) pMsgBuf ;
             tCsrRoamInfo roamInfo = {0} ;
-            palCopyMemory(pMac->hHdd, &roamInfo.peerMac, peerInd->peerMac, 
+            vos_mem_copy( &roamInfo.peerMac, peerInd->peerMac,
                                          sizeof(tSirMacAddr)) ;
             roamInfo.staId = peerInd->staId ;
             roamInfo.ucastSig = peerInd->ucastSig ;
@@ -1125,7 +1261,7 @@
         {
             tSirTdlsPeerInd *peerInd = (tSirTdlsPeerInd *) pMsgBuf ;
             tCsrRoamInfo roamInfo = {0} ;
-            palCopyMemory(pMac->hHdd, &roamInfo.peerMac, peerInd->peerMac, 
+            vos_mem_copy( &roamInfo.peerMac, peerInd->peerMac,
                                          sizeof(tSirMacAddr)) ;
             roamInfo.staId = peerInd->staId ;
             /*
diff --git a/CORE/SME/src/csr/csrUtil.c b/CORE/SME/src/csr/csrUtil.c
index 1d765c1..6e4859a 100644
--- a/CORE/SME/src/csr/csrUtil.c
+++ b/CORE/SME/src/csr/csrUtil.c
@@ -47,10 +47,10 @@
 #include "smeQosInternal.h"
 #include "wlan_qct_wda.h"
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include "vos_utils.h"
 #include "csrCcx.h"
-#endif /* FEATURE_WLAN_CCX */
+#endif /* FEATURE_WLAN_CCX && !FEATURE_WLAN_CCX_UPLOAD*/
 
 tANI_U8 csrWpaOui[][ CSR_WPA_OUI_SIZE ] = {
     { 0x00, 0x50, 0xf2, 0x00 },
@@ -1285,8 +1285,7 @@
 
 tANI_BOOLEAN csrGetBssIdBssDesc( tHalHandle hHal, tSirBssDescription *pSirBssDesc, tCsrBssid *pBssId )
 {
-    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-    palCopyMemory( pMac->hHdd, pBssId, &pSirBssDesc->bssId[ 0 ], sizeof(tCsrBssid) );
+    vos_mem_copy(pBssId, &pSirBssDesc->bssId[ 0 ], sizeof(tCsrBssid));
     return( TRUE );
 }
 
@@ -1853,19 +1852,19 @@
         }
         if( ( !pIes1->SSID.present ) || ( !pIesLocal->SSID.present ) ) break;
         if ( pIes1->SSID.num_ssid != pIesLocal->SSID.num_ssid ) break;
-        palCopyMemory(pMac->hHdd, Ssid1.ssId, pIes1->SSID.ssid, pIes1->SSID.num_ssid);
-        palCopyMemory(pMac->hHdd, Ssid2.ssId, pIesLocal->SSID.ssid, pIesLocal->SSID.num_ssid);
+        vos_mem_copy(Ssid1.ssId, pIes1->SSID.ssid, pIes1->SSID.num_ssid);
+        vos_mem_copy(Ssid2.ssId, pIesLocal->SSID.ssid, pIesLocal->SSID.num_ssid);
 
-        fEqual = palEqualMemory(pMac->hHdd, Ssid1.ssId, Ssid2.ssId, pIesLocal->SSID.num_ssid );
+        fEqual = vos_mem_compare(Ssid1.ssId, Ssid2.ssId, pIesLocal->SSID.num_ssid);
 
     } while( 0 );
     if(pIes1)
     {
-        palFreeMemory(pMac->hHdd, pIes1);
+        vos_mem_free(pIes1);
     }
     if( pIesLocal && !pIes2 )
     {
-        palFreeMemory(pMac->hHdd, pIesLocal);
+        vos_mem_free(pIesLocal);
     }
 
     return( fEqual );
@@ -1921,7 +1920,7 @@
     if( ( pIes == NULL ) && ( NULL != pIesTemp ) )
     {
         //we allocate memory here so free it before returning
-        palFreeMemory(pMac->hHdd, pIesTemp);
+        vos_mem_free(pIesTemp);
     }
 
     return( fWme );
@@ -2015,14 +2014,14 @@
 
     if(pBssDesc && ppIEStruct)
     {
-        status = palAllocateMemory(pMac->hHdd, (void **)ppIEStruct, sizeof(tDot11fBeaconIEs));
-        if(HAL_STATUS_SUCCESS(status))
+        *ppIEStruct = vos_mem_malloc(sizeof(tDot11fBeaconIEs));
+        if ( (*ppIEStruct) != NULL)
         {
-            palZeroMemory(pMac->hHdd, (void *)*ppIEStruct, sizeof(tDot11fBeaconIEs));
+            vos_mem_set((void *)*ppIEStruct, sizeof(tDot11fBeaconIEs), 0);
             status = csrParseBssDescriptionIEs(hHal, pBssDesc, *ppIEStruct);
             if(!HAL_STATUS_SUCCESS(status))
             {
-                palFreeMemory(pMac->hHdd, *ppIEStruct);
+                vos_mem_free(*ppIEStruct);
                 *ppIEStruct = NULL;
             }
         }
@@ -2030,7 +2029,8 @@
         {
             smsLog( pMac, LOGE, FL(" failed to allocate memory") );
             VOS_ASSERT( 0 );
-    }
+            return eHAL_STATUS_FAILURE;
+        }
     }
 
     return (status);
@@ -2571,18 +2571,25 @@
     eCsrBand eBand = pMac->roam.configParam.eBand;
 
 
+    if ((0 == phyMode) ||
 #ifdef WLAN_FEATURE_11AC
-    if ((0 == phyMode) || ((eCSR_DOT11_MODE_AUTO & phyMode) && (IS_FEATURE_SUPPORTED_BY_FW(DOT11AC))) 
-           || ((eCSR_DOT11_MODE_11ac & phyMode) && (IS_FEATURE_SUPPORTED_BY_FW(DOT11AC))))
-    {
-        cfgDot11ModeToUse = eCSR_CFG_DOT11_MODE_11AC;
-    }
-    else
+        (eCSR_DOT11_MODE_11ac & phyMode) ||
 #endif
-
-    if ((0 == phyMode) || (eCSR_DOT11_MODE_AUTO & phyMode))
+        (eCSR_DOT11_MODE_AUTO & phyMode))
     {
-        cfgDot11ModeToUse = eCSR_CFG_DOT11_MODE_11N;
+#ifdef WLAN_FEATURE_11AC
+        if (IS_FEATURE_SUPPORTED_BY_FW(DOT11AC))
+        {
+           cfgDot11ModeToUse = eCSR_CFG_DOT11_MODE_11AC;
+        }
+        else
+#endif
+        {
+           /* Default to 11N mode if user has configured 11ac mode
+            * and FW doesn't supports 11ac mode .
+            */
+           cfgDot11ModeToUse = eCSR_CFG_DOT11_MODE_11N;
+        }
     }
     else
     {
@@ -2741,23 +2748,37 @@
             switch (currBssPersona)
             {
                 case VOS_STA_MODE:
-                case VOS_P2P_CLIENT_MODE:
-                    smsLog(pMac, LOG4, FL(" Second session for persona %d"), currBssPersona);
-                    return eHAL_STATUS_SUCCESS;
+#ifndef QCA_WIFI_2_0
+                    if(pMac->roam.roamSession[sessionId].pCurRoamProfile &&
+                      (pMac->roam.roamSession[sessionId].pCurRoamProfile->csrPersona
+                                      == VOS_STA_MODE)) //check for P2P client mode
+                    {
+                        smsLog(pMac, LOGE, FL(" ****STA mode already exists ****"));
+                        return eHAL_STATUS_FAILURE;
+                    }
                     break;
+#else
+                    smsLog(pMac, LOG1, FL(" **** STA session ****"));
+                    return eHAL_STATUS_SUCCESS;
+#endif
 
                 case VOS_STA_SAP_MODE:
                     if((pMac->roam.roamSession[sessionId].bssParams.bssPersona
                                       == VOS_STA_SAP_MODE)&&
-                    (pMac->roam.roamSession[sessionId].connectState != eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED))
+                       (pMac->roam.roamSession[sessionId].connectState
+                                      != eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED))
                     {
                         smsLog(pMac, LOGE, FL(" ****SoftAP mode already exists ****"));
                         return eHAL_STATUS_FAILURE;
                     }
-                    
-                    else if((pMac->roam.roamSession[sessionId].bssParams.bssPersona
-                                      == VOS_P2P_GO_MODE) &&
-                    (pMac->roam.roamSession[sessionId].connectState != eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED))
+                    else if( (pMac->roam.roamSession[sessionId].bssParams.bssPersona
+                                      == VOS_P2P_GO_MODE &&
+                              pMac->roam.roamSession[sessionId].connectState
+                                      != eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED) ||
+                             (pMac->roam.roamSession[sessionId].bssParams.bssPersona
+                                      == VOS_IBSS_MODE &&
+                              pMac->roam.roamSession[sessionId].connectState
+                                      != eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED))
                     {
                         smsLog(pMac, LOGE, FL(" ****Cannot start Multiple Beaconing Role ****"));
                         return eHAL_STATUS_FAILURE;
@@ -2767,20 +2788,50 @@
                 case VOS_P2P_GO_MODE:
                     if((pMac->roam.roamSession[sessionId].bssParams.bssPersona
                                       == VOS_P2P_GO_MODE) &&
-                    (pMac->roam.roamSession[sessionId].connectState != eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED))
+                       (pMac->roam.roamSession[sessionId].connectState
+                                      != eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED))
                     {
                         smsLog(pMac, LOGE, FL(" ****P2P GO mode already exists ****"));
                         return eHAL_STATUS_FAILURE;
                     }
-                    else if((pMac->roam.roamSession[sessionId].bssParams.bssPersona
-                                      == VOS_STA_SAP_MODE) &&
-                    (pMac->roam.roamSession[sessionId].connectState != eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED))
+                    else if( (pMac->roam.roamSession[sessionId].bssParams.bssPersona
+                                      == VOS_STA_SAP_MODE &&
+                              pMac->roam.roamSession[sessionId].connectState
+                                      != eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED) ||
+                             (pMac->roam.roamSession[sessionId].bssParams.bssPersona
+                                      == VOS_IBSS_MODE &&
+                              pMac->roam.roamSession[sessionId].connectState
+                                      != eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED) )
                     {
                         smsLog(pMac, LOGE, FL(" ****Cannot start Multiple Beaconing Role ****"));
                         return eHAL_STATUS_FAILURE;
                     }
                     break;
-
+                case VOS_IBSS_MODE:
+                    if((pMac->roam.roamSession[sessionId].bssParams.bssPersona
+                                      == VOS_IBSS_MODE) &&
+                       (pMac->roam.roamSession[sessionId].connectState
+                                      != eCSR_ASSOC_STATE_TYPE_IBSS_CONNECTED))
+                    {
+                        smsLog(pMac, LOGE, FL(" ****IBSS mode already exists ****"));
+                        return eHAL_STATUS_FAILURE;
+                    }
+                    else if( (pMac->roam.roamSession[sessionId].bssParams.bssPersona
+                                      == VOS_P2P_GO_MODE ||
+                              pMac->roam.roamSession[sessionId].bssParams.bssPersona
+                                      == VOS_STA_SAP_MODE) &&
+                              pMac->roam.roamSession[sessionId].connectState
+                                     != eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED)
+                    {
+                        smsLog(pMac, LOGE, FL(" ****Cannot start Multiple Beaconing Role ****"));
+                        return eHAL_STATUS_FAILURE;
+                    }
+                    break;
+#ifdef QCA_WIFI_2_0
+                case VOS_P2P_CLIENT_MODE:
+                    smsLog(pMac, LOG1, FL(" **** P2P-Client session ****"));
+                    return eHAL_STATUS_SUCCESS;
+#endif
                 default :
                     smsLog(pMac, LOGE, FL("***Persona not handled = %d*****"),currBssPersona);
                     break;
@@ -2910,11 +2961,16 @@
                     else if (pMac->roam.roamSession[sessionId].bssParams.bssPersona
                                       == VOS_STA_SAP_MODE)
                     {
-                        if (pMac->roam.roamSession[sessionId].bssParams.operationChn
+                        if (pMac->roam.roamSession[sessionId].bssParams.operationChn 
                                                         != channelId )
                         {
+#ifndef QCA_WIFI_2_0
+                            smsLog(pMac, LOGE, FL("***MCC is not enabled for SAP +STA****"));
+                            return eHAL_STATUS_FAILURE;
+#else
                             smsLog(pMac, LOGE, FL("*** MCC with SAP+STA sessions ****"));
                             return eHAL_STATUS_SUCCESS;
+#endif
                         }
                     }
                     else if (pMac->roam.roamSession[sessionId].bssParams.bssPersona
@@ -3140,7 +3196,7 @@
 
 static tANI_BOOLEAN csrIsWapiOuiEqual( tpAniSirGlobal pMac, tANI_U8 *Oui1, tANI_U8 *Oui2 )
 {
-    return( palEqualMemory(pMac->hHdd, Oui1, Oui2, CSR_WAPI_OUI_SIZE ) );
+    return (vos_mem_compare(Oui1, Oui2, CSR_WAPI_OUI_SIZE));
 }
 
 static tANI_BOOLEAN csrIsWapiOuiMatch( tpAniSirGlobal pMac, tANI_U8 AllCyphers[][CSR_WAPI_OUI_SIZE],
@@ -3162,7 +3218,7 @@
 
     if ( fYes && Oui )
     {
-        palCopyMemory( pMac->hHdd, Oui, AllCyphers[ idx ], CSR_WAPI_OUI_SIZE );
+        vos_mem_copy(Oui, AllCyphers[ idx ], CSR_WAPI_OUI_SIZE);
     }
 
     return( fYes );
@@ -3171,7 +3227,7 @@
 
 static tANI_BOOLEAN csrIsWpaOuiEqual( tpAniSirGlobal pMac, tANI_U8 *Oui1, tANI_U8 *Oui2 )
 {
-    return( palEqualMemory(pMac->hHdd, Oui1, Oui2, CSR_WPA_OUI_SIZE ) );
+    return(vos_mem_compare(Oui1, Oui2, CSR_WPA_OUI_SIZE));
 }
 
 static tANI_BOOLEAN csrIsOuiMatch( tpAniSirGlobal pMac, tANI_U8 AllCyphers[][CSR_WPA_OUI_SIZE],
@@ -3193,7 +3249,7 @@
 
     if ( fYes && Oui )
     {
-        palCopyMemory( pMac->hHdd, Oui, AllCyphers[ idx ], CSR_WPA_OUI_SIZE );
+        vos_mem_copy(Oui, AllCyphers[ idx ], CSR_WPA_OUI_SIZE);
     }
 
     return( fYes );
@@ -3511,13 +3567,14 @@
         if ( pRSNIe->present )
         {
             cMulticastCyphers++;
-            palCopyMemory(pMac->hHdd, MulticastCyphers, pRSNIe->gp_cipher_suite, CSR_RSN_OUI_SIZE);
+            vos_mem_copy(MulticastCyphers, pRSNIe->gp_cipher_suite, CSR_RSN_OUI_SIZE);
             cUnicastCyphers = (tANI_U8)(pRSNIe->pwise_cipher_suite_count);
             cAuthSuites = (tANI_U8)(pRSNIe->akm_suite_count);
             for(i = 0; i < cAuthSuites && i < CSR_RSN_MAX_AUTH_SUITES; i++)
             {
-                palCopyMemory(pMac->hHdd, (void *)&AuthSuites[i],
-                        (void *)&pRSNIe->akm_suites[i], CSR_RSN_OUI_SIZE);
+                vos_mem_copy((void *)&AuthSuites[i],
+                             (void *)&pRSNIe->akm_suites[i],
+                             CSR_RSN_OUI_SIZE);
             }
 
             //Check - Is requested Unicast Cipher supported by the BSS.
@@ -3603,17 +3660,17 @@
     {
         if ( MulticastCypher )
         {
-            palCopyMemory( pMac->hHdd, MulticastCypher, Multicast, CSR_RSN_OUI_SIZE );
+            vos_mem_copy(MulticastCypher, Multicast, CSR_RSN_OUI_SIZE);
         }
 
         if ( UnicastCypher )
         {
-            palCopyMemory( pMac->hHdd, UnicastCypher, Unicast, CSR_RSN_OUI_SIZE );
+            vos_mem_copy(UnicastCypher, Unicast, CSR_RSN_OUI_SIZE);
         }
 
         if ( AuthSuite )
         {
-            palCopyMemory( pMac->hHdd, AuthSuite, Authentication, CSR_RSN_OUI_SIZE );
+            vos_mem_copy(AuthSuite, Authentication, CSR_RSN_OUI_SIZE);
         }
 
         if ( pNegotiatedAuthtype )
@@ -3626,10 +3683,8 @@
             Capabilities->NoPairwise = (pRSNIe->RSN_Cap[0] >> 1) & 0x1 ; // Bit 1 No Pairwise
             Capabilities->PTKSAReplayCounter = (pRSNIe->RSN_Cap[0] >> 2) & 0x3 ; // Bit 2, 3 PTKSA Replay Counter
             Capabilities->GTKSAReplayCounter = (pRSNIe->RSN_Cap[0] >> 4) & 0x3 ; // Bit 4, 5 GTKSA Replay Counter
-#ifdef WLAN_FEATURE_11W
             Capabilities->MFPRequired = (pRSNIe->RSN_Cap[0] >> 6) & 0x1 ; // Bit 6 MFPR
             Capabilities->MFPCapable = (pRSNIe->RSN_Cap[0] >> 7) & 0x1 ; // Bit 7 MFPC
-#endif
             Capabilities->Reserved = pRSNIe->RSN_Cap[1]  & 0xff ; // remaining reserved
         }
     }
@@ -3677,7 +3732,7 @@
         {
             smsLog(pMac, LOGW, "match PMKID %02X-%02X-%02X-%02X-%02X-%02X to ",
                 pBSSId[0], pBSSId[1], pBSSId[2], pBSSId[3], pBSSId[4], pBSSId[5]);
-            if( palEqualMemory( pMac->hHdd, pBSSId, pSession->PmkidCacheInfo[Index].BSSID, sizeof(tCsrBssid) ) )
+            if( vos_mem_compare(pBSSId, pSession->PmkidCacheInfo[Index].BSSID, sizeof(tCsrBssid)) )
             {
                 // match found
                 fMatchFound = TRUE;
@@ -3687,7 +3742,7 @@
 
         if( !fMatchFound ) break;
 
-        palCopyMemory( pMac->hHdd, pPMKId, pSession->PmkidCacheInfo[Index].PMKID, CSR_RSN_PMKID_SIZE );
+        vos_mem_copy(pPMKId, pSession->PmkidCacheInfo[Index].PMKID, CSR_RSN_PMKID_SIZE);
 
         fRC = TRUE;
     }
@@ -3712,6 +3767,9 @@
     tCsrRSNCapabilities RSNCapabilities;
     tCsrRSNPMKIe        *pPMK;
     tANI_U8 PMKId[CSR_RSN_PMKID_SIZE];
+#ifdef WLAN_FEATURE_11W
+    tANI_U8 *pGroupMgmtCipherSuite;
+#endif
     tDot11fBeaconIEs *pIesLocal = pIes;
 
     smsLog(pMac, LOGW, "%s called...", __func__);
@@ -3735,16 +3793,16 @@
 
         pRSNIe->Version = CSR_RSN_VERSION_SUPPORTED;
 
-        palCopyMemory( pMac->hHdd, pRSNIe->MulticastOui, MulticastCypher, sizeof( MulticastCypher ) );
+        vos_mem_copy(pRSNIe->MulticastOui, MulticastCypher, sizeof( MulticastCypher ));
 
         pRSNIe->cUnicastCyphers = 1;
 
-        palCopyMemory( pMac->hHdd, &pRSNIe->UnicastOui[ 0 ], UnicastCypher, sizeof( UnicastCypher ) );
+        vos_mem_copy(&pRSNIe->UnicastOui[ 0 ], UnicastCypher, sizeof( UnicastCypher ));
 
         pAuthSuite = (tCsrRSNAuthIe *)( &pRSNIe->UnicastOui[ pRSNIe->cUnicastCyphers ] );
 
         pAuthSuite->cAuthenticationSuites = 1;
-        palCopyMemory( pMac->hHdd, &pAuthSuite->AuthOui[ 0 ], AuthSuite, sizeof( AuthSuite ) );
+        vos_mem_copy(&pAuthSuite->AuthOui[ 0 ], AuthSuite, sizeof( AuthSuite ));
 
         // RSN capabilities follows the Auth Suite (two octects)
         // !!REVIEW - What should STA put in RSN capabilities, currently
@@ -3764,17 +3822,27 @@
         {
             pPMK->cPMKIDs = 1;
 
-            palCopyMemory( pMac->hHdd, pPMK->PMKIDList[0].PMKID, PMKId, CSR_RSN_PMKID_SIZE );
+            vos_mem_copy(pPMK->PMKIDList[0].PMKID, PMKId, CSR_RSN_PMKID_SIZE);
         }
         else
         {
             pPMK->cPMKIDs = 0;
         }
 
+#ifdef WLAN_FEATURE_11W
+        if ( pProfile->MFPEnabled )
+        {
+            pGroupMgmtCipherSuite = (tANI_U8 *) pPMK + sizeof ( tANI_U16 ) +
+                ( pPMK->cPMKIDs * CSR_RSN_PMKID_SIZE );
+            vos_mem_copy(pGroupMgmtCipherSuite, csrRSNOui[07], CSR_WPA_OUI_SIZE);
+        }
+#endif
+
         // Add in the fixed fields plus 1 Unicast cypher, less the IE Header length
         // Add in the size of the Auth suite (count plus a single OUI)
         // Add in the RSN caps field.
         // Add PMKID count and PMKID (if any)
+        // Add group management cipher suite
         pRSNIe->IeHeader.Length = (tANI_U8) (sizeof( *pRSNIe ) - sizeof ( pRSNIe->IeHeader ) +
                                   sizeof( *pAuthSuite ) +
                                   sizeof( tCsrRSNCapabilities ));
@@ -3783,6 +3851,15 @@
             pRSNIe->IeHeader.Length += (tANI_U8)(sizeof( tANI_U16 ) +
                                         (pPMK->cPMKIDs * CSR_RSN_PMKID_SIZE));
         }
+#ifdef WLAN_FEATURE_11W
+        if ( pProfile->MFPEnabled )
+        {
+            if ( 0 == pPMK->cPMKIDs )
+                pRSNIe->IeHeader.Length += sizeof( tANI_U16 );
+            pRSNIe->IeHeader.Length += CSR_WPA_OUI_SIZE;
+        }
+#endif
+
         // return the size of the IE header (total) constructed...
         cbRSNIe = pRSNIe->IeHeader.Length + sizeof( pRSNIe->IeHeader );
 
@@ -3791,7 +3868,7 @@
     if( !pIes && pIesLocal )
     {
         //locally allocated
-        palFreeMemory(pMac->hHdd, pIesLocal);
+        vos_mem_free(pIesLocal);
     }
 
     return( cbRSNIe );
@@ -3823,13 +3900,14 @@
         if ( pWapiIe->present )
         {
             cMulticastCyphers++;
-            palCopyMemory(pMac->hHdd, MulticastCyphers, pWapiIe->multicast_cipher_suite, CSR_WAPI_OUI_SIZE);
+            vos_mem_copy(MulticastCyphers, pWapiIe->multicast_cipher_suite,
+                         CSR_WAPI_OUI_SIZE);
             cUnicastCyphers = (tANI_U8)(pWapiIe->unicast_cipher_suite_count);
             cAuthSuites = (tANI_U8)(pWapiIe->akm_suite_count);
             for(i = 0; i < cAuthSuites && i < CSR_WAPI_MAX_AUTH_SUITES; i++)
             {
-                palCopyMemory(pMac->hHdd, (void *)&AuthSuites[i],
-                        (void *)&pWapiIe->akm_suites[i], CSR_WAPI_OUI_SIZE);
+                vos_mem_copy((void *)&AuthSuites[i], (void *)&pWapiIe->akm_suites[i],
+                             CSR_WAPI_OUI_SIZE);
             }
 
             //Check - Is requested Unicast Cipher supported by the BSS.
@@ -3889,17 +3967,17 @@
     {
         if ( MulticastCypher )
         {
-            palCopyMemory( pMac->hHdd, MulticastCypher, Multicast, CSR_WAPI_OUI_SIZE );
+           vos_mem_copy(MulticastCypher, Multicast, CSR_WAPI_OUI_SIZE);
         }
 
         if ( UnicastCypher )
         {
-            palCopyMemory( pMac->hHdd, UnicastCypher, Unicast, CSR_WAPI_OUI_SIZE );
+            vos_mem_copy(UnicastCypher, Unicast, CSR_WAPI_OUI_SIZE);
         }
 
         if ( AuthSuite )
         {
-            palCopyMemory( pMac->hHdd, AuthSuite, Authentication, CSR_WAPI_OUI_SIZE );
+            vos_mem_copy(AuthSuite, Authentication, CSR_WAPI_OUI_SIZE);
         }
 
         if ( pNegotiatedAuthtype )
@@ -3940,7 +4018,7 @@
         {
             smsLog(pMac, LOGW, "match BKID %02X-%02X-%02X-%02X-%02X-%02X to ",
                 pBSSId[0], pBSSId[1], pBSSId[2], pBSSId[3], pBSSId[4], pBSSId[5]);
-            if( palEqualMemory( pMac->hHdd, pBSSId, pSession->BkidCacheInfo[Index].BSSID, sizeof(tCsrBssid) ) )
+            if (vos_mem_compare(pBSSId, pSession->BkidCacheInfo[Index].BSSID, sizeof(tCsrBssid) ) )
             {
                 // match found
                 fMatchFound = TRUE;
@@ -3950,7 +4028,7 @@
 
         if( !fMatchFound ) break;
 
-        palCopyMemory( pMac->hHdd, pBKId, pSession->BkidCacheInfo[Index].BKID, CSR_WAPI_BKID_SIZE );
+        vos_mem_copy(pBKId, pSession->BkidCacheInfo[Index].BKID, CSR_WAPI_BKID_SIZE);
 
         fRC = TRUE;
     }
@@ -3988,23 +4066,23 @@
                                             UnicastCypher, MulticastCypher, AuthSuite, NULL, NULL );
         if ( !fWapiMatch ) break;
 
-        palZeroMemory(pMac->hHdd, pWapiIe, sizeof(tCsrWapiIe));
+        vos_mem_set(pWapiIe, sizeof(tCsrWapiIe), 0);
 
         pWapiIe->IeHeader.ElementID = DOT11F_EID_WAPI;
 
         pWapiIe->Version = CSR_WAPI_VERSION_SUPPORTED;
 
         pWapiIe->cAuthenticationSuites = 1;
-        palCopyMemory( pMac->hHdd, &pWapiIe->AuthOui[ 0 ], AuthSuite, sizeof( AuthSuite ) );
+        vos_mem_copy(&pWapiIe->AuthOui[ 0 ], AuthSuite, sizeof( AuthSuite ));
 
         pWapi = (tANI_U8 *) (&pWapiIe->AuthOui[ 1 ]);
 
         *pWapi = (tANI_U16)1; //cUnicastCyphers
         pWapi+=2;
-        palCopyMemory( pMac->hHdd, pWapi, UnicastCypher, sizeof( UnicastCypher ) );
+        vos_mem_copy(pWapi, UnicastCypher, sizeof( UnicastCypher ));
         pWapi += sizeof( UnicastCypher );
 
-        palCopyMemory( pMac->hHdd, pWapi, MulticastCypher, sizeof( MulticastCypher ) );
+        vos_mem_copy(pWapi, MulticastCypher, sizeof( MulticastCypher ));
         pWapi += sizeof( MulticastCypher );
 
 
@@ -4021,7 +4099,7 @@
             /* Do we need to change the endianness here */
             *pWapi = (tANI_U16)1; //cBKIDs
             pWapi+=2;
-            palCopyMemory( pMac->hHdd, pWapi, BKId, CSR_WAPI_BKID_SIZE );
+            vos_mem_copy(pWapi, BKId, CSR_WAPI_BKID_SIZE);
         }
         else
         {
@@ -4050,7 +4128,7 @@
     if( !pIes && pIesLocal )
     {
         //locally allocated
-        palFreeMemory(pMac->hHdd, pIesLocal);
+        vos_mem_free(pIesLocal);
     }
 
     return( cbWapiIe );
@@ -4081,7 +4159,7 @@
         if ( pWpaIe->present )
         {
             cMulticastCyphers = 1;
-            palCopyMemory(pMac->hHdd, MulticastCyphers, pWpaIe->multicast_cipher, CSR_WPA_OUI_SIZE);
+            vos_mem_copy(MulticastCyphers, pWpaIe->multicast_cipher, CSR_WPA_OUI_SIZE);
             cUnicastCyphers = (tANI_U8)(pWpaIe->unicast_cipher_count);
             cAuthSuites = (tANI_U8)(pWpaIe->auth_suite_count);
 
@@ -4146,17 +4224,17 @@
     {
         if ( MulticastCypher )
         {
-            palCopyMemory( pMac->hHdd, (tANI_U8 **)MulticastCypher, Multicast, CSR_WPA_OUI_SIZE );
+            vos_mem_copy((tANI_U8 **)MulticastCypher, Multicast, CSR_WPA_OUI_SIZE);
         }
 
         if ( UnicastCypher )
         {
-            palCopyMemory( pMac->hHdd, (tANI_U8 **)UnicastCypher, Unicast, CSR_WPA_OUI_SIZE );
+            vos_mem_copy((tANI_U8 **)UnicastCypher, Unicast, CSR_WPA_OUI_SIZE);
         }
 
         if ( AuthSuite )
         {
-            palCopyMemory( pMac->hHdd, (tANI_U8 **)AuthSuite, Authentication, CSR_WPA_OUI_SIZE );
+            vos_mem_copy((tANI_U8 **)AuthSuite, Authentication, CSR_WPA_OUI_SIZE);
         }
 
         if( pNegotiatedAuthtype )
@@ -4209,20 +4287,20 @@
 
         pWpaIe->IeHeader.ElementID = SIR_MAC_WPA_EID;
 
-        palCopyMemory( pMac->hHdd, pWpaIe->Oui, csrWpaOui[01], sizeof( pWpaIe->Oui ) );
+        vos_mem_copy(pWpaIe->Oui, csrWpaOui[01], sizeof( pWpaIe->Oui ));
 
         pWpaIe->Version = CSR_WPA_VERSION_SUPPORTED;
 
-        palCopyMemory( pMac->hHdd, pWpaIe->MulticastOui, MulticastCypher, sizeof( MulticastCypher ) );
+        vos_mem_copy(pWpaIe->MulticastOui, MulticastCypher, sizeof( MulticastCypher ));
 
         pWpaIe->cUnicastCyphers = 1;
 
-        palCopyMemory( pMac->hHdd, &pWpaIe->UnicastOui[ 0 ], UnicastCypher, sizeof( UnicastCypher ) );
+        vos_mem_copy(&pWpaIe->UnicastOui[ 0 ], UnicastCypher, sizeof( UnicastCypher ));
 
         pAuthSuite = (tCsrWpaAuthIe *)( &pWpaIe->UnicastOui[ pWpaIe->cUnicastCyphers ] );
 
         pAuthSuite->cAuthenticationSuites = 1;
-        palCopyMemory( pMac->hHdd, &pAuthSuite->AuthOui[ 0 ], AuthSuite, sizeof( AuthSuite ) );
+        vos_mem_copy(&pAuthSuite->AuthOui[ 0 ], AuthSuite, sizeof( AuthSuite ));
 
         // The WPA capabilities follows the Auth Suite (two octects)--
         // this field is optional, and we always "send" zero, so just
@@ -4243,7 +4321,7 @@
     if( !pIes && pIesLocal )
     {
         //locally allocated
-        palFreeMemory(pMac->hHdd, pIesLocal);
+        vos_mem_free(pIesLocal);
     }
 
     return( cbWpaIe );
@@ -4253,7 +4331,6 @@
 tANI_BOOLEAN csrGetWpaRsnIe( tHalHandle hHal, tANI_U8 *pIes, tANI_U32 len,
                              tANI_U8 *pWpaIe, tANI_U8 *pcbWpaIe, tANI_U8 *pRSNIe, tANI_U8 *pcbRSNIe)
 {
-    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     tDot11IEHeader *pIEHeader;
     tSirMacPropIE *pSirMacPropIE;
     tANI_U32 cbParsed;
@@ -4312,10 +4389,12 @@
                         // Check if this is a valid WPA IE.  Then check that the
                         // WPA OUI is in place and the version is one that we support.
                         if ( ( pIe->IeHeader.Length >= SIR_MAC_WPA_IE_MIN_LENGTH )   &&
-                             ( palEqualMemory(pMac->hHdd, pIe->Oui, (void *)csrWpaOui[1], sizeof( pIe->Oui ) ) ) &&
+                             ( vos_mem_compare( pIe->Oui, (void *)csrWpaOui[1],
+                                                sizeof( pIe->Oui ) ) ) &&
                              ( pIe->Version <= CSR_WPA_VERSION_SUPPORTED ) )
                         {
-                            palCopyMemory(pMac->hHdd, pWpaIe, pIe, pIe->IeHeader.Length + sizeof( pIe->IeHeader ) );
+                            vos_mem_copy(pWpaIe, pIe,
+                                  pIe->IeHeader.Length + sizeof( pIe->IeHeader ));
                             *pcbWpaIe = pIe->IeHeader.Length + sizeof( pIe->IeHeader );
                             cFoundIEs++;
 
@@ -4344,7 +4423,8 @@
                     // if there is enough room in the WpaIE passed in, then copy the Wpa IE into
                     // the buffer passed in.
                     if ( *pcbRSNIe < pIe->IeHeader.Length + sizeof( pIe->IeHeader ) ) break;
-                    palCopyMemory(pMac->hHdd, pRSNIe, pIe, pIe->IeHeader.Length + sizeof( pIe->IeHeader ) );
+                    vos_mem_copy(pRSNIe, pIe,
+                                 pIe->IeHeader.Length + sizeof( pIe->IeHeader ));
                     *pcbRSNIe = pIe->IeHeader.Length + sizeof( pIe->IeHeader );
 
                     break;
@@ -4383,7 +4463,7 @@
             if(SIR_MAC_WPA_IE_MAX_LENGTH >= pProfile->nWPAReqIELength)
             {
                 cbWpaIe = (tANI_U8)pProfile->nWPAReqIELength;
-                palCopyMemory(pMac->hHdd, pWpaIe, pProfile->pWPAReqIE, cbWpaIe);
+                vos_mem_copy(pWpaIe, pProfile->pWPAReqIE, cbWpaIe);
             }
             else
             {
@@ -4426,7 +4506,7 @@
             if(SIR_MAC_WPA_IE_MAX_LENGTH >= pProfile->nRSNReqIELength)
             {
                 cbRsnIe = (tANI_U8)pProfile->nRSNReqIELength;
-                palCopyMemory(pMac->hHdd, pRsnIe, pProfile->pRSNReqIE, cbRsnIe);
+                vos_mem_copy(pRsnIe, pProfile->pRSNReqIE, cbRsnIe);
             }
             else
             {
@@ -4461,7 +4541,7 @@
             if(DOT11F_IE_WAPI_MAX_LEN >= pProfile->nWAPIReqIELength)
             {
                 cbWapiIe = (tANI_U8)pProfile->nWAPIReqIELength;
-                palCopyMemory(pMac->hHdd, pWapiIe, pProfile->pWAPIReqIE, cbWapiIe);
+                vos_mem_copy(pWapiIe, pProfile->pWAPIReqIE, cbWapiIe);
             }
             else
             {
@@ -4504,7 +4584,7 @@
 
         if ( found )
         {
-            palCopyMemory(pMac->hHdd, returnChannelGroup, pChannelGroup, sizeof(tCsrChannelSet));
+            vos_mem_copy(returnChannelGroup, pChannelGroup, sizeof(tCsrChannelSet));
             break;
         }
         else
@@ -4595,6 +4675,7 @@
 #ifdef FEATURE_WLAN_WAPI
         case eCSR_ENCRYPT_TYPE_WPI:
             edType = eSIR_ED_WPI;
+            break ;
 #endif
 #ifdef WLAN_FEATURE_11W
         //11w BIP
@@ -4681,16 +4762,18 @@
                 ucEncryptionType = eCSR_ENCRYPT_TYPE_WEP104;
             }
             //else we can use the encryption type directly
-            if( pIes->WPA.present )
+            if ( pIes->WPA.present )
             {
-                fMatch = palEqualMemory(pMac->hHdd, pIes->WPA.multicast_cipher, 
-                            csrWpaOui[csrGetOUIIndexFromCipher( ucEncryptionType )], CSR_WPA_OUI_SIZE );
+                fMatch = vos_mem_compare(pIes->WPA.multicast_cipher,
+                                         csrWpaOui[csrGetOUIIndexFromCipher( ucEncryptionType )],
+                                         CSR_WPA_OUI_SIZE);
                 if( fMatch ) break;
             }
-            if( pIes->RSN.present )
+            if ( pIes->RSN.present )
             {
-                fMatch = palEqualMemory(pMac->hHdd, pIes->RSN.gp_cipher_suite, 
-                            csrRSNOui[csrGetOUIIndexFromCipher( ucEncryptionType )], CSR_RSN_OUI_SIZE );
+                fMatch = vos_mem_compare(pIes->RSN.gp_cipher_suite,
+                                         csrRSNOui[csrGetOUIIndexFromCipher( ucEncryptionType )],
+                                         CSR_RSN_OUI_SIZE);
             }
         }
 
@@ -4936,7 +5019,7 @@
         }
 
         if(ssid1Len != bssSsidLen) break;
-        if(palEqualMemory(pMac->hHdd, bssSsid, ssid1, bssSsidLen))
+        if (vos_mem_compare(bssSsid, ssid1, bssSsidLen))
         {
             fMatch = TRUE;
             break;
@@ -4951,7 +5034,6 @@
 //Null ssid means match
 tANI_BOOLEAN csrIsSsidInList( tHalHandle hHal, tSirMacSSid *pSsid, tCsrSSIDs *pSsidList )
 {
-    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     tANI_BOOLEAN fMatch = FALSE;
     tANI_U32 i;
 
@@ -4960,8 +5042,8 @@
         for(i = 0; i < pSsidList->numOfSSIDs; i++)
         {
             if(csrIsNULLSSID(pSsidList->SSIDList[i].SSID.ssId, pSsidList->SSIDList[i].SSID.length) ||
-                ((pSsidList->SSIDList[i].SSID.length == pSsid->length) &&
-                    palEqualMemory(pMac->hHdd, pSsid->ssId, pSsidList->SSIDList[i].SSID.ssId, pSsid->length)))
+              ((pSsidList->SSIDList[i].SSID.length == pSsid->length) &&
+               vos_mem_compare(pSsid->ssId, pSsidList->SSIDList[i].SSID.ssId, pSsid->length)))
             {
                 fMatch = TRUE;
                 break;
@@ -4977,7 +5059,7 @@
 {
     tANI_U8 bssid[WNI_CFG_BSSID_LEN] = {0, 0, 0, 0, 0, 0};
 
-    return( palEqualMemory(pMac->hHdd, bssid, pMacAddr, WNI_CFG_BSSID_LEN));
+    return (vos_mem_compare(bssid, pMacAddr, WNI_CFG_BSSID_LEN));
 }
 
 //like to use sirCompareMacAddr
@@ -4985,14 +5067,14 @@
 {
     tANI_U8 bssid[WNI_CFG_BSSID_LEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
-    return( palEqualMemory(pMac->hHdd, bssid, pMacAddr, WNI_CFG_BSSID_LEN));
+    return(vos_mem_compare(bssid, pMacAddr, WNI_CFG_BSSID_LEN));
 }
 
 
 //like to use sirCompareMacAddr
 tANI_BOOLEAN csrIsMacAddressEqual( tpAniSirGlobal pMac, tCsrBssid *pMacAddr1, tCsrBssid *pMacAddr2 )
 {
-    return( palEqualMemory(pMac->hHdd, pMacAddr1, pMacAddr2, sizeof(tCsrBssid)) );
+    return(vos_mem_compare(pMacAddr1, pMacAddr2, sizeof(tCsrBssid)));
 }
 
 
@@ -5004,7 +5086,7 @@
 
     // for efficiency of the MAC_ADDRESS functions, move the
     // Bssid's into MAC_ADDRESS structs.
-    palCopyMemory( pMac->hHdd, &ProfileBssid, pProfBssid, sizeof(tCsrBssid) );
+    vos_mem_copy(&ProfileBssid, pProfBssid, sizeof(tCsrBssid));
 
     do {
 
@@ -5483,7 +5565,7 @@
     }
     else if( pIes )
     {
-        palFreeMemory(pMac->hHdd, pIes);
+        vos_mem_free(pIes);
     }
 
     return( fRC );
@@ -5550,7 +5632,7 @@
     if( !pIes && pIesLocal )
     {
         //locally allocated
-        palFreeMemory(pMac->hHdd, pIesLocal);
+        vos_mem_free(pIesLocal);
     }
 
     return( fRC );
@@ -5697,56 +5779,49 @@
     {
         if(pProfile->BSSIDs.bssid)
         {
-            palFreeMemory(pMac->hHdd, pProfile->BSSIDs.bssid);
+            vos_mem_free(pProfile->BSSIDs.bssid);
             pProfile->BSSIDs.bssid = NULL;
         }
         if(pProfile->SSIDs.SSIDList)
         {
-            palFreeMemory(pMac->hHdd, pProfile->SSIDs.SSIDList);
+            vos_mem_free(pProfile->SSIDs.SSIDList);
             pProfile->SSIDs.SSIDList = NULL;
         }
         if(pProfile->pWPAReqIE)
         {
-            palFreeMemory(pMac->hHdd, pProfile->pWPAReqIE);
+            vos_mem_free(pProfile->pWPAReqIE);
             pProfile->pWPAReqIE = NULL;
         }
         if(pProfile->pRSNReqIE)
         {
-            palFreeMemory(pMac->hHdd, pProfile->pRSNReqIE);
+            vos_mem_free(pProfile->pRSNReqIE);
             pProfile->pRSNReqIE = NULL;
         }
 #ifdef FEATURE_WLAN_WAPI
         if(pProfile->pWAPIReqIE)
         {
-            palFreeMemory(pMac->hHdd, pProfile->pWAPIReqIE);
+            vos_mem_free(pProfile->pWAPIReqIE);
             pProfile->pWAPIReqIE = NULL;
         }
 #endif /* FEATURE_WLAN_WAPI */
 
         if(pProfile->pAddIEScan)
         {
-            palFreeMemory(pMac->hHdd, pProfile->pAddIEScan);
+            vos_mem_free(pProfile->pAddIEScan);
             pProfile->pAddIEScan = NULL;
         }
 
         if(pProfile->pAddIEAssoc)
         {
-            palFreeMemory(pMac->hHdd, pProfile->pAddIEAssoc);
+            vos_mem_free(pProfile->pAddIEAssoc);
             pProfile->pAddIEAssoc = NULL;
         }
-        {
-            palFreeMemory(pMac->hHdd, pProfile->pAddIEAssoc);
-            pProfile->pAddIEAssoc = NULL;
-        }
-
         if(pProfile->ChannelInfo.ChannelList)
         {
-            palFreeMemory(pMac->hHdd, pProfile->ChannelInfo.ChannelList);
+            vos_mem_free(pProfile->ChannelInfo.ChannelList);
             pProfile->ChannelInfo.ChannelList = NULL;
         }
-
-    
-        palZeroMemory(pMac->hHdd, pProfile, sizeof(tCsrRoamProfile));
+        vos_mem_set(pProfile, sizeof(tCsrRoamProfile), 0);
     }
 }
 
@@ -5754,17 +5829,17 @@
 {
     if(pScanFilter->BSSIDs.bssid)
     {
-        palFreeMemory(pMac->hHdd, pScanFilter->BSSIDs.bssid);
+        vos_mem_free(pScanFilter->BSSIDs.bssid);
         pScanFilter->BSSIDs.bssid = NULL;
     }
     if(pScanFilter->ChannelInfo.ChannelList)
     {
-        palFreeMemory(pMac->hHdd, pScanFilter->ChannelInfo.ChannelList);
+        vos_mem_free(pScanFilter->ChannelInfo.ChannelList);
         pScanFilter->ChannelInfo.ChannelList = NULL;
     }
     if(pScanFilter->SSIDs.SSIDList)
     {
-        palFreeMemory(pMac->hHdd, pScanFilter->SSIDs.SSIDList);
+        vos_mem_free(pScanFilter->SSIDs.SSIDList);
         pScanFilter->SSIDs.SSIDList = NULL;
     }
 }
@@ -5777,7 +5852,7 @@
     if(pSession->pCurRoamProfile)
     {
         csrReleaseProfile(pMac, pSession->pCurRoamProfile);
-        palFreeMemory(pMac->hHdd, pSession->pCurRoamProfile);
+        vos_mem_free(pSession->pCurRoamProfile);
         pSession->pCurRoamProfile = NULL;
     }
 }
@@ -5789,7 +5864,7 @@
 
     if(pSession->pConnectBssDesc)
     {
-        palFreeMemory(pMac->hHdd, pSession->pConnectBssDesc);
+        vos_mem_free(pSession->pConnectBssDesc);
         pSession->pConnectBssDesc = NULL;
     }
 }
@@ -5962,11 +6037,18 @@
         }
         else
         {
-            cfgDot11Mode = eCSR_CFG_DOT11_MODE_11AC;
+            cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
         }
         break;
     case eCSR_DOT11_MODE_11ac_ONLY:
-        cfgDot11Mode = eCSR_CFG_DOT11_MODE_11AC_ONLY;
+        if (IS_FEATURE_SUPPORTED_BY_FW(DOT11AC))
+        {
+            cfgDot11Mode = eCSR_CFG_DOT11_MODE_11AC_ONLY;
+        }
+        else
+        {
+            cfgDot11Mode = eCSR_CFG_DOT11_MODE_11N;
+        }
         break;
 #endif
     default:
@@ -6014,7 +6096,13 @@
 }
 
 
-eHalStatus csrGetRegulatoryDomainForCountry(tpAniSirGlobal pMac, tANI_U8 *pCountry, v_REGDOMAIN_t *pDomainId)
+eHalStatus csrGetRegulatoryDomainForCountry
+(
+tpAniSirGlobal pMac,
+tANI_U8 *pCountry,
+v_REGDOMAIN_t *pDomainId,
+v_CountryInfoSource_t source
+)
 {
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
     VOS_STATUS vosStatus;
@@ -6025,7 +6113,10 @@
     {
         countryCode[0] = pCountry[0];
         countryCode[1] = pCountry[1];
-        vosStatus = vos_nv_getRegDomainFromCountryCode( &domainId, countryCode );
+        vosStatus = vos_nv_getRegDomainFromCountryCode(&domainId,
+                                                       countryCode,
+                                                       source);
+
         if( VOS_IS_STATUS_SUCCESS(vosStatus) )
         {
             if( pDomainId )
@@ -6073,10 +6164,15 @@
             //Make sure this country is recognizable
             if( pIes->Country.present )
             {
-                status = csrGetRegulatoryDomainForCountry( pMac, pIes->Country.country, &domainId );
+                status = csrGetRegulatoryDomainForCountry(pMac,
+                                           pIes->Country.country,
+                                           &domainId, COUNTRY_QUERY);
                 if( !HAL_STATUS_SUCCESS( status ) )
                 {
-                     status = csrGetRegulatoryDomainForCountry( pMac, pMac->scan.countryCode11d,(v_REGDOMAIN_t *) &domainId );
+                     status = csrGetRegulatoryDomainForCountry(pMac,
+                                                 pMac->scan.countryCode11d,
+                                                 (v_REGDOMAIN_t *) &domainId,
+                                                 COUNTRY_QUERY);
                      if( !HAL_STATUS_SUCCESS( status ) )
                      {
                            fRet = eANI_BOOLEAN_FALSE;
@@ -6116,7 +6212,8 @@
             {
                 pCountry[i] = csrToUpper( pCountry[i] );
             }
-            if( !palEqualMemory(pMac->hHdd, pIes->Country.country, pCountry, WNI_CFG_COUNTRY_CODE_LEN - 1) )
+            if (!vos_mem_compare(pIes->Country.country, pCountry,
+                                WNI_CFG_COUNTRY_CODE_LEN - 1))
             {
                 fRet = eANI_BOOLEAN_FALSE;
                 break;
@@ -6146,16 +6243,18 @@
             {
                 for(j = 0; j < eCSR_NUM_COUNTRY_INDEX; j++)
                 {
-                    if(palEqualMemory(pMac->hHdd, gCsrCountryInfo[j].countryCode, 
-                                    pCountryDomainMapping->pCountryInfo[i].countryCode, 2))
+                    if (vos_mem_compare(gCsrCountryInfo[j].countryCode,
+                                        pCountryDomainMapping->pCountryInfo[i].countryCode,
+                                        2))
                     {
                         if(gCsrCountryInfo[j].domainId != pCountryDomainMapping->pCountryInfo[i].domainId)
                         {
                             gCsrCountryInfo[j].domainId = pCountryDomainMapping->pCountryInfo[i].domainId;
                             //Check whether it matches the currently used country code
                             //If matching, need to update base on the new domain setting.
-                            if(palEqualMemory(pMac->hHdd, countryCode, 
-                                        pCountryDomainMapping->pCountryInfo[i].countryCode, 2))
+                            if (vos_mem_compare(countryCode,
+                                                pCountryDomainMapping->pCountryInfo[i].countryCode,
+                                                2))
                             {
                                 fDomainChanged = eANI_BOOLEAN_TRUE;
                             }
@@ -6240,9 +6339,9 @@
       return eHAL_STATUS_FAILURE;
    }
 
-   palCopyMemory( pMac->hHdd, pModifyProfileFields, 
-                  &pMac->roam.roamSession[sessionId].connectedProfile.modifyProfileFields, 
-                  sizeof(tCsrRoamModifyProfileFields) );
+   vos_mem_copy(pModifyProfileFields,
+                &pMac->roam.roamSession[sessionId].connectedProfile.modifyProfileFields,
+                sizeof(tCsrRoamModifyProfileFields));
 
    return eHAL_STATUS_SUCCESS;
 }
@@ -6252,9 +6351,9 @@
 {
    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
 
-   palCopyMemory( pMac->hHdd, &pSession->connectedProfile.modifyProfileFields,
-                  pModifyProfileFields,
-                  sizeof(tCsrRoamModifyProfileFields) );
+   vos_mem_copy(&pSession->connectedProfile.modifyProfileFields,
+                 pModifyProfileFields,
+                 sizeof(tCsrRoamModifyProfileFields));
 
    return eHAL_STATUS_SUCCESS;
 }
@@ -6289,10 +6388,11 @@
             //We may need to alter the data structure and find a way to make this faster.
             tANI_U32 i;
 
-            for( i = 0; i < numOfCountry; i++ )
+            for ( i = 0; i < numOfCountry; i++ )
             {
-                palCopyMemory( pMac->hHdd, pBuf + ( i * WNI_CFG_COUNTRY_CODE_LEN ),
-                    gCsrCountryInfo[i].countryCode, WNI_CFG_COUNTRY_CODE_LEN );
+                vos_mem_copy(pBuf + ( i * WNI_CFG_COUNTRY_CODE_LEN ),
+                             gCsrCountryInfo[i].countryCode,
+                             WNI_CFG_COUNTRY_CODE_LEN);
             }
         }
     }
@@ -6356,19 +6456,15 @@
        {
           break;
        }
-       status = palAllocateMemory( pMac->hHdd, (void **)&pChannelInfo->ChannelList, 
-                                   pMac->scan.baseChannels.numChannels );
-       if( !HAL_STATUS_SUCCESS( status ) )
+       pChannelInfo->ChannelList = vos_mem_malloc(pMac->scan.baseChannels.numChannels);
+       if ( NULL == pChannelInfo->ChannelList )
        {
           smsLog( pMac, LOGE, FL("csrScanGetBaseChannels: fail to allocate memory") );
-          break;
+          return eHAL_STATUS_FAILURE;
        }
-       status = palCopyMemory( pMac->hHdd, pChannelInfo->ChannelList, pMac->scan.baseChannels.channelList, 
-                               pMac->scan.baseChannels.numChannels );
-       if( !HAL_STATUS_SUCCESS( status ) )
-       {
-          break;
-       }
+       vos_mem_copy(pChannelInfo->ChannelList,
+                    pMac->scan.baseChannels.channelList,
+                    pMac->scan.baseChannels.numChannels);
        pChannelInfo->numOfChannels = pMac->scan.baseChannels.numChannels;
 
     }while(0);
diff --git a/CORE/SME/src/oemData/oemDataApi.c b/CORE/SME/src/oemData/oemDataApi.c
index 79a9892..3b422a2 100644
--- a/CORE/SME/src/oemData/oemDataApi.c
+++ b/CORE/SME/src/oemData/oemDataApi.c
@@ -164,7 +164,9 @@
         pMac->oemData.pContext = pContext;
         pMac->oemData.oemDataReqID = *(pOemDataReqID);
 
-        vos_mem_copy((v_VOID_t*)(pMac->oemData.oemDataReqConfig.oemDataReq), (v_VOID_t*)(oemDataReqConfig->oemDataReq), OEM_DATA_REQ_SIZE);
+        vos_mem_copy((v_VOID_t*)(pMac->oemData.oemDataReqConfig.oemDataReq),
+                     (v_VOID_t*)(oemDataReqConfig->oemDataReq),
+                     OEM_DATA_REQ_SIZE);
 
         pMac->oemData.oemDataReqActive = eANI_BOOLEAN_FALSE;
 
@@ -181,7 +183,8 @@
             //set the oem data request
             pOemDataCmd->u.oemDataCmd.oemDataReq.sessionId = pMac->oemData.oemDataReqConfig.sessionId;
             vos_mem_copy((v_VOID_t*)(pOemDataCmd->u.oemDataCmd.oemDataReq.oemDataReq),
-                                    (v_VOID_t*)(pMac->oemData.oemDataReqConfig.oemDataReq), OEM_DATA_REQ_SIZE);
+                         (v_VOID_t*)(pMac->oemData.oemDataReqConfig.oemDataReq),
+                         OEM_DATA_REQ_SIZE);
         }
         else
         {
@@ -223,22 +226,19 @@
 
     msgLen = (tANI_U16)(sizeof(tSirOemDataReq));
 
-    status = palAllocateMemory(pMac->hHdd, (void**)&pMsg, msgLen);
+    pMsg = vos_mem_malloc(msgLen);
+    if ( NULL == pMsg )
+       status = eHAL_STATUS_FAILURE;
+    else
+       status = eHAL_STATUS_SUCCESS;
     if(HAL_STATUS_SUCCESS(status))
     {
-        palZeroMemory(pMac->hHdd, pMsg, msgLen);
+        vos_mem_set(pMsg, msgLen, 0);
         pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_OEM_DATA_REQ);
-        palCopyMemory(pMac->hHdd, pMsg->selfMacAddr, pSession->selfMacAddr, sizeof(tSirMacAddr) );
-        status = palCopyMemory(pMac->hHdd, pMsg->oemDataReq, pOemDataReq->oemDataReq, OEM_DATA_REQ_SIZE);
-        if(HAL_STATUS_SUCCESS(status))
-        {
-            smsLog(pMac, LOGW, "OEM_DATA: sending message to pe%s", __func__);
-            status = palSendMBMessage(pMac->hHdd, pMsg);
-        }
-        else
-        {
-            palFreeMemory(pMac->hHdd, pMsg);
-        }
+        vos_mem_copy(pMsg->selfMacAddr, pSession->selfMacAddr, sizeof(tSirMacAddr) );
+        vos_mem_copy(pMsg->oemDataReq, pOemDataReq->oemDataReq, OEM_DATA_REQ_SIZE);
+        smsLog(pMac, LOGW, "OEM_DATA: sending message to pe%s", __func__);
+        status = palSendMBMessage(pMac->hHdd, pMsg);
     }
 
     smsLog(pMac, LOGW, "OEM_DATA: exiting Function %s", __func__);
@@ -339,7 +339,9 @@
                 }
 
                 smsLog(pMac, LOGE, "Before memory copy");
-                vos_mem_copy((v_VOID_t*)(pMac->oemData.pOemDataRsp), (v_VOID_t*)(&pOemDataRsp->oemDataRsp), sizeof(tOemDataRsp));
+                vos_mem_copy((v_VOID_t*)(pMac->oemData.pOemDataRsp),
+                             (v_VOID_t*)(&pOemDataRsp->oemDataRsp),
+                             sizeof(tOemDataRsp));
                 smsLog(pMac, LOGE, "after memory copy");
                 sme_ReleaseGlobalLock(&pMac->sme);
             }
diff --git a/CORE/SME/src/p2p/p2p_Api.c b/CORE/SME/src/p2p/p2p_Api.c
index 961a03e..52113b2 100644
--- a/CORE/SME/src/p2p/p2p_Api.c
+++ b/CORE/SME/src/p2p/p2p_Api.c
@@ -25,6 +25,7 @@
  * to the Linux Foundation.
  */
 
+
 /*
  * Copyright (c) 2008 Qualcomm Technologies, Inc. All Rights Reserved.
  * Qualcomm Technologies Confidential and Proprietary 
@@ -62,7 +63,7 @@
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSirRemainOnChnReq* pMsg;
-    tANI_U16 len;
+    tANI_U32 len;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, p2pRemainonChn->sessionId );
 
     if(!pSession)
@@ -102,29 +103,40 @@
     len = sizeof(tSirRemainOnChnReq) + pMac->p2pContext.probeRspIeLength;
 #endif
 
-    status = palAllocateMemory(pMac->hHdd, (void**)&pMsg, len );
-    if(HAL_STATUS_SUCCESS(status))
+    if( len > 0xFFFF )
+    {
+       /*In coming len for Msg is more then 16bit value*/
+       smsLog(pMac, LOGE, FL("  Message length is very large, %d"),
+            len);
+       return eHAL_STATUS_FAILURE;
+    }
+
+    pMsg = vos_mem_malloc(len);
+    if ( NULL == pMsg )
+        status = eHAL_STATUS_FAILURE;
+    else
     {
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s call", __func__);
-        palZeroMemory(pMac->hHdd, pMsg, sizeof(tSirRemainOnChnReq));
+        vos_mem_set(pMsg, sizeof(tSirRemainOnChnReq), 0);
         pMsg->messageType = eWNI_SME_REMAIN_ON_CHANNEL_REQ;
-        pMsg->length = len;
-        palCopyMemory( pMac, pMsg->selfMacAddr, pSession->selfMacAddr, sizeof(tSirMacAddr) ); 
+        pMsg->length = (tANI_U16)len;
+        vos_mem_copy(pMsg->selfMacAddr, pSession->selfMacAddr, sizeof(tSirMacAddr));
         pMsg->chnNum = p2pRemainonChn->u.remainChlCmd.chn;
         pMsg->phyMode = p2pRemainonChn->u.remainChlCmd.phyMode;
         pMsg->duration = p2pRemainonChn->u.remainChlCmd.duration;
         pMsg->sessionId = p2pRemainonChn->sessionId;
+        pMsg->isProbeRequestAllowed = p2pRemainonChn->u.remainChlCmd.isP2PProbeReqAllowed;
 #ifdef WLAN_FEATURE_P2P_INTERNAL
         pMsg->sessionId = pSession->sessionId;
         if( p2pContext->probeRspIeLength )
         {
-            palCopyMemory(pMac->hHdd, (void *)pMsg->probeRspIe,
-                         (void *)p2pContext->probeRspIe, 
+            vos_mem_copy((void *)pMsg->probeRspIe, (void *)p2pContext->probeRspIe,
                          p2pContext->probeRspIeLength);
         }
 #else
         if( pMac->p2pContext.probeRspIeLength )
-           palCopyMemory(pMac->hHdd, (void *)pMsg->probeRspIe, (void *)pMac->p2pContext.probeRspIe, pMac->p2pContext.probeRspIeLength);
+           vos_mem_copy((void *)pMsg->probeRspIe, (void *)pMac->p2pContext.probeRspIe,
+                        pMac->p2pContext.probeRspIeLength);
 #endif
         status = palSendMBMessage(pMac->hHdd, pMsg);
     }
@@ -194,12 +206,12 @@
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus  status = eHAL_STATUS_SUCCESS;
     tCsrRoamInfo pRoamInfo = {0};
+    tANI_U8 i;
 #ifndef WLAN_FEATURE_P2P_INTERNAL
     tANI_U32 SessionId = pSmeMgmtFrm->sessionId;
 #endif
 
 #ifdef WLAN_FEATURE_P2P_INTERNAL
-    tANI_U8 i;
 
     //For now, only action frames are needed.
     if(SIR_MAC_MGMT_ACTION == pSmeMgmtFrm->frameType)
@@ -227,6 +239,17 @@
     pRoamInfo.frameType = pSmeMgmtFrm->frameType;
     pRoamInfo.rxChan   = pSmeMgmtFrm->rxChan;
     pRoamInfo.rxRssi   = pSmeMgmtFrm->rxRssi;
+    if(CSR_IS_SESSION_ANY(SessionId))
+    {
+       for(i = 0; i < CSR_ROAM_SESSION_MAX; i++)
+       {
+          if(CSR_IS_SESSION_VALID(pMac, i))
+          {
+             SessionId = i;
+             break;
+          }
+       }
+    }
 
     /* forward the mgmt frame to HDD */
     csrRoamCallCallback(pMac, SessionId, &pRoamInfo, 0, eCSR_ROAM_INDICATE_MGMT_FRAME, 0);
@@ -323,9 +346,8 @@
 
       if(NULL == pP2pContext->pNextActionFrm)
       {
-         status = palTimerStart(pMac->hHdd, pP2pContext->retryActionFrameTimer, 
-                        ACTION_FRAME_RETRY_TIMEOUT * PAL_TIMER_TO_MS_UNIT, eANI_BOOLEAN_FALSE);
-         if (!HAL_STATUS_SUCCESS(status))
+         status = vos_timer_start(&pP2pContext->retryActionFrameTimer, ACTION_FRAME_RETRY_TIMEOUT);
+         if (!VOS_IS_STATUS_SUCCESS(status))
          {
             smsLog(pMac, LOGE, " %s fail to start retryActionFrameTimerHandler",
                __func__, pP2pContext->NextActionFrameType);
@@ -344,12 +366,14 @@
 
    if (pP2pContext->actionFrameTimer)
    {
-      status = palTimerStop(pMac, pP2pContext->actionFrameTimer);
+      vos_timer_stop(&pP2pContext->actionFrameTimer);
+      status = eHAL_STATUS_SUCCESS;
    }
 
    if (pP2pContext->retryActionFrameTimer)
    {
-      status = palTimerStop(pMac, pP2pContext->retryActionFrameTimer);
+      vos_timer_stop(&pP2pContext->retryActionFrameTimer);
+      status = eHAL_STATUS_SUCCESS;
    }
 
    if(pP2pContext->pSentActionFrame)
@@ -398,9 +422,8 @@
    {
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, " sending next frame %d type",
                   pP2pContext->NextActionFrameType);
-      status = palTimerStart(pMac->hHdd, pP2pContext->actionFrameTimer, 
-                        pP2pContext->ActionFrameSendTimeout * PAL_TIMER_TO_MS_UNIT, eANI_BOOLEAN_FALSE);
-      if (!HAL_STATUS_SUCCESS(status))
+      status = vos_timer_start(&pP2pContext->actionFrameTimer, pP2pContext->ActionFrameSendTimeout);
+      if (!VOS_IS_STATUS_SUCCESS(status))
       {
          smsLog(pMac, LOGE, FL(" %s fail to start timer status %d"), __func__, status);
          //Without the timer we cannot continue
@@ -422,9 +445,8 @@
       {
          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, " sending next frame %d type",
                   pP2pContext->NextActionFrameType);
-         status = palTimerStart(pMac->hHdd, pP2pContext->retryActionFrameTimer, 
-                     ACTION_FRAME_RETRY_TIMEOUT * PAL_TIMER_TO_MS_UNIT, eANI_BOOLEAN_FALSE);
-         if (!HAL_STATUS_SUCCESS(status))
+         status = vos_timer_start(&pP2pContext->retryActionFrameTimer, ACTION_FRAME_RETRY_TIMEOUT);
+         if (!VOS_IS_STATUS_SUCCESS(status))
          {
             smsLog(pMac, LOGE, " %s fail to start retryActionFrameTimerHandler", __func__);
          }
@@ -494,71 +516,71 @@
       }      
       if( pP2pContext->probeRspIe )
       {
-         vos_mem_free( pP2pContext->probeRspIe );
+         vos_mem_free(pP2pContext->probeRspIe);
          pP2pContext->probeRspIe = NULL;
          pP2pContext->probeRspIeLength = 0;
       }
 
       if( pP2pContext->DiscoverReqIeField )
       {
-         vos_mem_free(pP2pContext->DiscoverReqIeField );
+         vos_mem_free(pP2pContext->DiscoverReqIeField);
          pP2pContext->DiscoverReqIeField = NULL;
          pP2pContext->DiscoverReqIeLength = 0;
       }
 
       if( pP2pContext->GoNegoCnfIeField )
       {
-         vos_mem_free( pP2pContext->GoNegoCnfIeField);
+         vos_mem_free(pP2pContext->GoNegoCnfIeField);
          pP2pContext->GoNegoCnfIeField = NULL;
          pP2pContext->GoNegoCnfIeLength = 0;
       }
 
       if( pP2pContext->GoNegoReqIeField )
       {
-         vos_mem_free( pP2pContext->GoNegoReqIeField );
+         vos_mem_free(pP2pContext->GoNegoReqIeField);
          pP2pContext->GoNegoReqIeField = NULL;
          pP2pContext->GoNegoReqIeLength = 0;
       }
 
       if( pP2pContext->GoNegoResIeField )
       {
-         vos_mem_free( pP2pContext->GoNegoResIeField );
+         vos_mem_free(pP2pContext->GoNegoResIeField);
          pP2pContext->GoNegoResIeField = NULL;
          pP2pContext->GoNegoResIeLength = 0;
       }
 
       if( pP2pContext->ProvDiscReqIeField )
       {
-         vos_mem_free( pP2pContext->ProvDiscReqIeField );
+         vos_mem_free(pP2pContext->ProvDiscReqIeField);
          pP2pContext->ProvDiscReqIeField = NULL;
          pP2pContext->ProvDiscReqIeLength = 0;
       }
 
       if( pP2pContext->ProvDiscResIeField )
       {
-         vos_mem_free( pP2pContext->ProvDiscResIeField );
+         vos_mem_free(pP2pContext->ProvDiscResIeField);
          pP2pContext->ProvDiscResIeLength = 0;
          pP2pContext->ProvDiscResIeField = NULL;
       }
 
       if (pP2pContext->actionFrameTimer)
       {
-         palTimerStop(pMac->hHdd, pP2pContext->actionFrameTimer);
+         vos_timer_stop(&pP2pContext->actionFrameTimer);
       }
 
       if (pP2pContext->discoverTimer)
       {
-         palTimerStop(pMac->hHdd, pP2pContext->discoverTimer);
+         vos_timer_stop(&pP2pContext->discoverTimer);
       }
 
       if (pP2pContext->listenTimerHandler)
       {
-         palTimerStop(pMac->hHdd, pP2pContext->listenTimerHandler);
+         vos_timer_stop(&pP2pContext->listenTimerHandler);
       }
 
       if (pP2pContext->WPSRegistrarCheckTimerHandler)
       {
-         palTimerStop(pMac->hHdd, pP2pContext->WPSRegistrarCheckTimerHandler);
+         vos_timer_stop(&pP2pContext->WPSRegistrarCheckTimerHandler);
       }
 
       if (pP2pContext->directedDiscoveryFilter)
@@ -596,30 +618,29 @@
 
       p2pResetContext(pP2pContext);
 
-      status = palTimerAlloc(pMac->hHdd, &pP2pContext->actionFrameTimer, 
-                                    p2pActionFrameTimerHandler, pP2pContext);
-      if (!HAL_STATUS_SUCCESS(status))
+      status = vos_timer_init(&pP2pContext->actionFrameTimer, VOS_TIMER_TYPE_SW, p2pActionFrameTimerHandler, pP2pContext);
+      if (!VOS_IS_STATUS_SUCCESS(status))
       {
          smsLog(pMac, LOGE, " %s fail to alloc actionFrame timer for session %d", __func__, i);
          break;
       }
-      status = palTimerAlloc(pMac->hHdd, &pP2pContext->listenTimerHandler, 
-                              p2pListenDiscoverTimerHandler, pP2pContext);
-      if (!HAL_STATUS_SUCCESS(status))
+      status = vos_timer_init(&pP2pContext->listenTimerHandler, VOS_TIMER_TYPE_SW,
+                                        p2pListenDiscoverTimerHandler, pP2pContext);
+      if (!VOS_IS_STATUS_SUCCESS(status))
       {
          smsLog(pMac, LOGE, " %s fail to alloc listen timer for session %d", __func__, i);
          break;
       } 
-      status = palTimerAlloc(pMac->hHdd, &pP2pContext->discoverTimer, p2pDiscoverTimerHandler, pP2pContext);
-      if (!HAL_STATUS_SUCCESS(status))
+      status = vos_timer_init(&pP2pContext->discoverTimer, VOS_TIMER_TYPE_SW, p2pDiscoverTimerHandler, pP2pContext);
+      if (!VOS_IS_STATUS_SUCCESS(status))
       {
          smsLog(pMac, LOGE, " %s fail to alloc discover timer for session %d", __func__, i);
          break;
       }
 
-      status = palTimerAlloc(pMac->hHdd, &pP2pContext->retryActionFrameTimer, 
+      status = vos_timer_init(&pP2pContext->retryActionFrameTimer, VOS_TIMER_TYPE_SW,
                      p2pRetryActionFrameTimerHandler, pP2pContext);
-      if (!HAL_STATUS_SUCCESS(status))
+      if (!VOS_IS_STATUS_SUCCESS(status))
       {
          smsLog(pMac, LOGE, " %s fail to alloc retryActionFrameTimerHandler timer for session %d", __func__, i);
          break;
@@ -629,7 +650,7 @@
    }
 #else
    //If static structure is too big, Need to change this function to allocate memory dynamically
-   vos_mem_zero( &pMac->p2pContext, sizeof( tp2pContext ) );
+   vos_mem_zero(&pMac->p2pContext, sizeof( tp2pContext ));
 #endif
 
    if(!HAL_STATUS_SUCCESS(status))
@@ -655,7 +676,7 @@
 #else  
    if( pMac->p2pContext.probeRspIe )
    {
-      vos_mem_free( pMac->p2pContext.probeRspIe );
+      vos_mem_free(pMac->p2pContext.probeRspIe);
       pMac->p2pContext.probeRspIe = NULL;
    }
   
@@ -682,25 +703,25 @@
       pContext = &pMac->p2pContext[i];
       if (pContext->actionFrameTimer)
       {
-         palTimerFree(hHal, pContext->actionFrameTimer);
+         vos_timer_destroy(&pContext->actionFrameTimer);
          pContext->actionFrameTimer = NULL;
       }
 
       if (pContext->discoverTimer)
       {
-         palTimerFree(hHal, pContext->discoverTimer);
+         vos_timer_destroy(&pContext->discoverTimer);
          pContext->discoverTimer = NULL;
       }
 
       if (pContext->listenTimerHandler)
       {
-         palTimerFree(hHal, pContext->listenTimerHandler);
+         vos_timer_destroy(&pContext->listenTimerHandler);
          pContext->listenTimerHandler = NULL;
       }
 
       if (pContext->WPSRegistrarCheckTimerHandler)
       {
-         palTimerFree(hHal, pContext->WPSRegistrarCheckTimerHandler);
+         vos_timer_destroy(&pContext->WPSRegistrarCheckTimerHandler);
          pContext->WPSRegistrarCheckTimerHandler = NULL;
       }
 
@@ -709,7 +730,7 @@
 #else  
     if( pMac->p2pContext.probeRspIe )
     {
-        vos_mem_free( pMac->p2pContext.probeRspIe );
+        vos_mem_free(pMac->p2pContext.probeRspIe);
         pMac->p2pContext.probeRspIe = NULL;
     }
   
@@ -749,7 +770,7 @@
 eHalStatus p2pRemainOnChannel(tHalHandle hHal, tANI_U8 sessionId,
          tANI_U8 channel, tANI_U32 duration,
         remainOnChanCallback callback, 
-        void *pContext
+        void *pContext, tANI_U8 isP2PProbeReqAllowed
 #ifdef WLAN_FEATURE_P2P_INTERNAL
         , eP2PRemainOnChnReason reason
 #endif
@@ -782,6 +803,7 @@
         pRemainChlCmd->sessionId = sessionId;
         pRemainChlCmd->u.remainChlCmd.chn = channel;
         pRemainChlCmd->u.remainChlCmd.duration = duration;
+        pRemainChlCmd->u.remainChlCmd.isP2PProbeReqAllowed = isP2PProbeReqAllowed;
         pRemainChlCmd->u.remainChlCmd.callback = callback;
         pRemainChlCmd->u.remainChlCmd.callbackCtx = pContext;
     
@@ -809,16 +831,18 @@
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_MED,
        " %s sends action frame", __func__);
     msgLen = (tANI_U16)((sizeof( tSirMbMsg )) + len);
-    status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-    if(HAL_STATUS_SUCCESS(status))
+    pMsg = vos_mem_malloc(msgLen);
+    if ( NULL == pMsg )
+        status = eHAL_STATUS_FAILURE;
+    else
     {
-        palZeroMemory(pMac->hHdd, (void *)pMsg, msgLen);
+        vos_mem_set((void *)pMsg, msgLen, 0);
         pMsg->type = pal_cpu_to_be16((tANI_U16)eWNI_SME_SEND_ACTION_FRAME_IND);
         pMsg->msgLen = pal_cpu_to_be16(msgLen);
         pMsg->sessionId = sessionId;
         pMsg->noack = noack;
         pMsg->wait = (tANI_U16)wait;
-        palCopyMemory( pMac->hHdd, pMsg->data, pBuf, len );
+        vos_mem_copy(pMsg->data, pBuf, len);
         status = palSendMBMessage(pMac->hHdd, pMsg);
     }
 
@@ -835,10 +859,12 @@
     //Need to check session ID to support concurrency
 
     msgLen = (tANI_U16)(sizeof( tSirMbMsg ));
-    status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-    if(HAL_STATUS_SUCCESS(status))
+    pMsg = vos_mem_malloc(msgLen);
+    if ( NULL == pMsg )
+       status = eHAL_STATUS_FAILURE;
+    else
     {
-        palZeroMemory(pMac->hHdd, (void *)pMsg, msgLen);
+        vos_mem_set((void *)pMsg, msgLen, 0);
         pMsg->type = pal_cpu_to_be16((tANI_U16)eWNI_SME_ABORT_REMAIN_ON_CHAN_IND);
         pMsg->msgLen = pal_cpu_to_be16(msgLen);
         pMsg->sessionId = sessionId;
@@ -855,11 +881,13 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
-    status = palAllocateMemory(pMac->hHdd, (void**)&pNoAParam, sizeof(tP2pPsConfig));
-    if(HAL_STATUS_SUCCESS(status))
+    pNoAParam = vos_mem_malloc(sizeof(tP2pPsConfig));
+    if ( NULL == pNoAParam )
+       status = eHAL_STATUS_FAILURE;
+    else
     {
-        palZeroMemory(pMac->hHdd, pNoAParam, sizeof(tP2pPsConfig));
-        palCopyMemory(pMac->hHdd, pNoAParam, pNoA, sizeof(tP2pPsConfig)); 
+        vos_mem_set(pNoAParam, sizeof(tP2pPsConfig), 0);
+        vos_mem_copy(pNoAParam, pNoA, sizeof(tP2pPsConfig));
         msg.type = eWNI_SME_UPDATE_NOA;
         msg.bodyval = 0;
         msg.bodyptr = pNoAParam;
@@ -1026,9 +1054,12 @@
    macHdr->fc.subType = 13;
    macHdr->durationLo = 0;
    macHdr->durationHi = 0;
-   vos_mem_copy(macHdr->da, pMac->p2pContext[SessionID].peerMacAddress, P2P_MAC_ADDRESS_LEN);
-   vos_mem_copy(macHdr->sa, pMac->p2pContext[SessionID].selfMacAddress, P2P_MAC_ADDRESS_LEN);
-   vos_mem_copy(macHdr->bssId, pMac->p2pContext[SessionID].peerMacAddress, P2P_MAC_ADDRESS_LEN);
+   vos_mem_copy(macHdr->da, pMac->p2pContext[SessionID].peerMacAddress,
+                P2P_MAC_ADDRESS_LEN);
+   vos_mem_copy(macHdr->sa, pMac->p2pContext[SessionID].selfMacAddress,
+                P2P_MAC_ADDRESS_LEN);
+   vos_mem_copy(macHdr->bssId, pMac->p2pContext[SessionID].peerMacAddress,
+                P2P_MAC_ADDRESS_LEN);
 
    return;
 }
@@ -1081,7 +1112,7 @@
    p2pContext->PeerFound = TRUE;
    smsLog( pMac, LOGE, "%s Calling remain on channel ", __func__);
    status = p2pRemainOnChannel( pMac, p2pContext->SMEsessionId, p2pContext->P2PListenChannel/*pScanResult->BssDescriptor.channelId*/, P2P_REMAIN_ON_CHAN_TIMEOUT_LOW,
-                                    NULL, NULL, eP2PRemainOnChnReasonSendFrame);
+                                    NULL, NULL, TRUE, eP2PRemainOnChnReasonSendFrame);
    if(status != eHAL_STATUS_SUCCESS)
    {
       smsLog( pMac, LOGE, "%s remain on channel failed", __func__);
@@ -1212,7 +1243,7 @@
    P2P_UpdateMacHdr(pMac, SessionID, pActionFrm);
 
    pBuf = (tANI_U8 *)vos_mem_malloc( nActionFrmlen);
-   if(NULL == pBuf)
+   if (NULL == pBuf)
    {
       smsLog(pMac, LOGE, FL("  fail to allocate memory"));
       if (pActionFrm) 
@@ -1301,7 +1332,9 @@
                   __func__, pScanResult->BssDescriptor.channelId);
                p2pSetListenChannel(pMac, pP2pContext->sessionId, pScanResult->BssDescriptor.channelId);
             }
-            vos_mem_copy(pP2pContext->formationReq.deviceAddress, pScanResult->BssDescriptor.bssId, P2P_MAC_ADDRESS_LEN);
+            vos_mem_copy(pP2pContext->formationReq.deviceAddress,
+                         pScanResult->BssDescriptor.bssId,
+                         P2P_MAC_ADDRESS_LEN);
          }
          csrScanResultPurge(pMac, hScanResult);
       } 
@@ -1311,9 +1344,9 @@
          filter.bWPSAssociation = TRUE;
          filter.BSSType = eCSR_BSS_TYPE_ANY;
          filter.SSIDs.SSIDList =( tCsrSSIDInfo *)vos_mem_malloc(sizeof(tCsrSSIDInfo));
-         if( filter.SSIDs.SSIDList == NULL )
+         if ( NULL == filter.SSIDs.SSIDList )
          {
-            smsLog( pMac, LOGP, FL("vos_mem_malloc failed:") );
+            smsLog( pMac, LOGP, FL("memory allocation failed for SSIDList") );
             pP2pContext->GroupFormationPending = FALSE;
             return eHAL_STATUS_FAILURE;
          }
@@ -1330,14 +1363,17 @@
             {
                pScanResult = csrScanResultGetFirst(pMac, hScanResult );
                pP2pContext->formationReq.targetListenChannel = pScanResult->BssDescriptor.channelId;
-               vos_mem_copy(pP2pContext->formationReq.deviceAddress, pScanResult->BssDescriptor.bssId, P2P_MAC_ADDRESS_LEN);
+               vos_mem_copy(pP2pContext->formationReq.deviceAddress,
+                            pScanResult->BssDescriptor.bssId,
+                            P2P_MAC_ADDRESS_LEN);
                csrScanResultPurge(pMac, hScanResult);
             }
             else
             {
                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s not found match", __func__);
                pP2pContext->formationReq.targetListenChannel = 0;
-               vos_mem_copy(pP2pContext->formationReq.deviceAddress, pP2pContext->peerMacAddress, P2P_MAC_ADDRESS_LEN);
+               vos_mem_copy(pP2pContext->formationReq.deviceAddress, pP2pContext->peerMacAddress,
+                            P2P_MAC_ADDRESS_LEN);
                status = eHAL_STATUS_SUCCESS;
             }
             vos_mem_free(filter.SSIDs.SSIDList);
@@ -1346,7 +1382,8 @@
          {
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s not found match", __func__);
             pP2pContext->formationReq.targetListenChannel = 0;
-            vos_mem_copy(pP2pContext->formationReq.deviceAddress, pP2pContext->peerMacAddress, P2P_MAC_ADDRESS_LEN);
+            vos_mem_copy(pP2pContext->formationReq.deviceAddress,
+                         pP2pContext->peerMacAddress, P2P_MAC_ADDRESS_LEN);
             status = eHAL_STATUS_SUCCESS;
          }    
       }
@@ -1376,7 +1413,7 @@
 
          if(p2pRemainOnChannel( pMac, pP2pContext->SMEsessionId, 
                                       pP2pContext->P2PListenChannel, P2P_REMAIN_ON_CHAN_TIMEOUT_LOW,
-                                      NULL, NULL, eP2PRemainOnChnReasonSendFrame))
+                                      NULL, NULL, TRUE, eP2PRemainOnChnReasonSendFrame))
          {
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,  "%s remain on channel failed", __func__);
          }
@@ -1418,9 +1455,9 @@
          pP2pContext->ActionFrameSendTimeout = WLAN_P2P_DEF_ACTION_FRM_TIMEOUT_VALUE;
       }
 
-      status = palTimerStart(pMac->hHdd, pP2pContext->actionFrameTimer, 
-                        pP2pContext->ActionFrameSendTimeout * PAL_TIMER_TO_MS_UNIT, eANI_BOOLEAN_FALSE);
-      if (!HAL_STATUS_SUCCESS(status))
+      status = vos_timer_start(&pP2pContext->actionFrameTimer,
+                        pP2pContext->ActionFrameSendTimeout);
+      if (!VOS_IS_STATUS_SUCCESS(status))
       {
          tCsrRoamInfo RoamInfo;
 
@@ -1482,7 +1519,7 @@
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s Calling RemainOnChannel with duration %d on channel %d",
              __func__, p2pContext->listenDuration, p2pContext->P2PListenChannel);
       status = p2pRemainOnChannel( p2pContext->hHal, p2pContext->SMEsessionId, p2pContext->P2PListenChannel, p2pContext->listenDuration, 
-                                    p2pListenStateDiscoverableCallback, p2pContext, eP2PRemainOnChnReasonListen);
+                                    p2pListenStateDiscoverableCallback, p2pContext, TRUE, eP2PRemainOnChnReasonListen);
    }
    else
    {
@@ -1506,8 +1543,8 @@
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s restart listen timer expire time %d",
                   __func__, p2pContext->expire_time);
       //We can restart the listening
-      status = palTimerStart(pMac->hHdd, p2pContext->listenTimerHandler, p2pContext->expire_time, eANI_BOOLEAN_FALSE);
-      if (eHAL_STATUS_SUCCESS != status)
+      status = vos_timer_start(&p2pContext->listenTimerHandler, (p2pContext->expire_time)/PAL_TIMER_TO_MS_UNIT);
+      if (!VOS_IS_STATUS_SUCCESS(status))
       {
          VOS_ASSERT(status);
       }
@@ -1540,7 +1577,8 @@
 
          if (pMac->p2pContext[sessionId].listenTimerHandler)
          {
-            status = palTimerStop(pMac->hHdd, pMac->p2pContext[sessionId].listenTimerHandler);
+            vos_timer_stop(&pMac->p2pContext[sessionId].listenTimerHandler);
+            status = eHAL_STATUS_SUCCESS;
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s Timer Stop status %d",
                         __func__, status);
          }
@@ -1564,7 +1602,7 @@
                      __func__, pMac->p2pContext[sessionId].listenDuration, pMac->p2pContext[sessionId].P2PListenChannel);
          p2pRemainOnChannel( pMac, pMac->p2pContext[sessionId].SMEsessionId, pMac->p2pContext[sessionId].P2PListenChannel, 
                               pMac->p2pContext[sessionId].listenDuration, p2pListenStateDiscoverableCallback, 
-                              &pMac->p2pContext[sessionId], eP2PRemainOnChnReasonListen);
+                              &pMac->p2pContext[sessionId], TRUE, eP2PRemainOnChnReasonListen);
       }
       else
       {
@@ -1585,7 +1623,7 @@
                      __func__, pMac->p2pContext[sessionId].listenDuration, pMac->p2pContext[sessionId].P2PListenChannel);
          p2pRemainOnChannel( pMac, pMac->p2pContext[sessionId].SMEsessionId, pMac->p2pContext[sessionId].P2PListenChannel, 
                               pMac->p2pContext[sessionId].listenDuration, p2pListenStateDiscoverableCallback, 
-                              &pMac->p2pContext[sessionId], eP2PRemainOnChnReasonListen);
+                              &pMac->p2pContext[sessionId], TRUE, eP2PRemainOnChnReasonListen);
       }
       else
       {
@@ -1617,7 +1655,7 @@
                      __func__, pMac->p2pContext[sessionId].listenDuration, pMac->p2pContext[sessionId].P2PListenChannel);
          p2pRemainOnChannel( pMac, pMac->p2pContext[sessionId].SMEsessionId, pMac->p2pContext[sessionId].P2PListenChannel, 
                               pMac->p2pContext[sessionId].listenDuration, p2pListenStateDiscoverableCallback, 
-                              &pMac->p2pContext[sessionId], eP2PRemainOnChnReasonListen);
+                              &pMac->p2pContext[sessionId], TRUE, eP2PRemainOnChnReasonListen);
       }
       
       break;
@@ -1699,8 +1737,9 @@
          directedDiscoveryFilter = pP2pContext->directedDiscoveryFilter;
          if (pFilter->BSSIDs.numOfBSSIDs)
          {
-            bssid = ( tCsrBssid *) vos_mem_malloc( sizeof( tCsrBssid ) * pFilter->BSSIDs.numOfBSSIDs );
-            if(NULL == bssid)
+            bssid = ( tCsrBssid *) vos_mem_malloc(
+                       sizeof( tCsrBssid ) * pFilter->BSSIDs.numOfBSSIDs );
+            if (NULL == bssid)
             {
                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, 
                   " %s fail to allocate bssid", __func__);
@@ -1712,7 +1751,8 @@
 
             for (i = 0; i < uNumDeviceFilters; i++)
             {
-               vos_mem_copy(bssid, directedDiscoveryFilter->DeviceID, P2P_MAC_ADDRESS_LEN);
+               vos_mem_copy(bssid, directedDiscoveryFilter->DeviceID,
+                            P2P_MAC_ADDRESS_LEN);
                bssid += sizeof(tCsrBssid);
                directedDiscoveryFilter += sizeof(tp2pDiscoverDeviceFilter);
             }
@@ -1721,9 +1761,9 @@
          directedDiscoveryFilter = pP2pContext->directedDiscoveryFilter;
          if (pFilter->SSIDs.numOfSSIDs)
          {
-            pFilter->SSIDs.SSIDList = (tCsrSSIDInfo *)vos_mem_malloc( sizeof( *pFilter->SSIDs.SSIDList ) *
-                                                      pFilter->SSIDs.numOfSSIDs );
-            if(NULL == pFilter->SSIDs.SSIDList)
+            pFilter->SSIDs.SSIDList = (tCsrSSIDInfo *)vos_mem_malloc(
+                    sizeof( *pFilter->SSIDs.SSIDList ) * pFilter->SSIDs.numOfSSIDs );
+            if (NULL == pFilter->SSIDs.SSIDList)
             {
                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, 
                   " %s fail to allocate bssid", __func__);
@@ -1825,7 +1865,8 @@
    if (pDiscoverRequest->uIELen)
    {
       pP2pContext->DiscoverReqIeField = (tANI_U8 *)vos_mem_malloc(pDiscoverRequest->uIELen);
-      vos_mem_copy((tANI_U8 *)pP2pContext->DiscoverReqIeField, pDiscoverRequest->pIEField, pDiscoverRequest->uIELen);
+      vos_mem_copy((tANI_U8 *)pP2pContext->DiscoverReqIeField,
+                   pDiscoverRequest->pIEField, pDiscoverRequest->uIELen);
       pP2pContext->DiscoverReqIeLength = pDiscoverRequest->uIELen;
    } 
    else
@@ -1855,7 +1896,7 @@
             }
             pP2pContext->directedDiscoveryFilter = (tp2pDiscoverDeviceFilter *)
                   vos_mem_malloc(sizeof(tp2pDiscoverDeviceFilter) * uNumDeviceFilters);
-            if(NULL == pP2pContext->directedDiscoveryFilter)
+            if (NULL == pP2pContext->directedDiscoveryFilter)
             {
                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, 
                   "%s fail to allocate memory for discoverFilter", __func__);
@@ -1868,8 +1909,8 @@
          pDeviceFilters = pDiscoverRequest->pDeviceFilters;
          if(NULL != pDeviceFilters)
          {
-            vos_mem_copy ( pP2pContext->directedDiscoveryFilter, pDeviceFilters,
-                              sizeof(tp2pDiscoverDeviceFilter) * uNumDeviceFilters);
+            vos_mem_copy (pP2pContext->directedDiscoveryFilter, pDeviceFilters,
+                          sizeof(tp2pDiscoverDeviceFilter) * uNumDeviceFilters);
 
             if(!HAL_STATUS_SUCCESS(status = p2pGetResultFilter(pP2pContext, &filter)))
             {
@@ -1900,7 +1941,8 @@
             if (pDiscoverRequest->uNumDeviceFilters == 1 && filter.BSSIDs.numOfBSSIDs == 1)
             {
                vos_mem_copy(&pP2pContext->formationReq.deviceAddress, 
-                              pDiscoverRequest->pDeviceFilters->DeviceID, P2P_MAC_ADDRESS_LEN);
+                            pDiscoverRequest->pDeviceFilters->DeviceID,
+                            P2P_MAC_ADDRESS_LEN);
             }
          }
       }
@@ -1920,9 +1962,9 @@
 
       pP2pContext->uDiscoverTimeout = pDiscoverRequest->uDiscoverTimeout;
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_MED, "%s Start discover", __func__);
-      status = palTimerStart(pMac->hHdd, pP2pContext->discoverTimer, 
-                     pP2pContext->uDiscoverTimeout * 1000, eANI_BOOLEAN_FALSE);
-      if(!HAL_STATUS_SUCCESS(status))
+      status = vos_timer_start(&pP2pContext->discoverTimer,
+                     pP2pContext->uDiscoverTimeout);
+      if (!VOS_IS_STATUS_SUCCESS(status))
       {
          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, 
             "%s failt to start discover timer", __func__);
@@ -1986,7 +2028,7 @@
    /* set the scan type to active */
    scanRequest.scanType = eSIR_ACTIVE_SCAN;
 
-   vos_mem_set( scanRequest.bssid, sizeof( tCsrBssid ), 0xff );
+   vos_mem_set(scanRequest.bssid, sizeof( tCsrBssid ), 0xff);
 
    scanRequest.requestType = eCSR_SCAN_P2P_FIND_PEER;
    /* set min and max channel time to zero */
@@ -2001,7 +2043,8 @@
    scanRequest.p2pSearch = VOS_FALSE;
        
    P2P_GetIE(p2pContext, p2pContext->sessionId, eP2P_GROUP_ID, &p2pIe, &p2pIeLen);
-   vos_mem_copy(scanRequest.bssid, ((tP2PGroupId *)p2pIe)->deviceAddress, P2P_MAC_ADDRESS_LEN);
+   vos_mem_copy(scanRequest.bssid, ((tP2PGroupId *)p2pIe)->deviceAddress,
+                P2P_MAC_ADDRESS_LEN);
 
    P2P_GetIE(p2pContext, p2pContext->sessionId, eP2P_PROBE_REQ,  &scanRequest.pIEField, &len);
 
@@ -2128,7 +2171,7 @@
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
    eHalStatus status = eHAL_STATUS_SUCCESS;
 
-   status = palTimerStop(pMac->hHdd, pMac->p2pContext[SessionID].discoverTimer);
+   status = vos_timer_stop(&pMac->p2pContext[SessionID].discoverTimer);
    if (status != eHAL_STATUS_SUCCESS)
    {
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s Timer Stop status %d",  __func__, status);
@@ -2175,7 +2218,7 @@
             csrFreeScanResultEntry( pMac, pBssResult );
          }
       }
-      palFreeMemory(pMac->hHdd, pIes);
+      vos_mem_free(pIes);
       pEntry = pNext;
    }
 
@@ -2253,10 +2296,12 @@
     tSirMsgQ msg;
     eHalStatus status = eHAL_STATUS_SUCCESS;
 
-    status = palAllocateMemory(pMac->hHdd, (void**)&pNoA, sizeof(tP2pPsConfig));
-    if(HAL_STATUS_SUCCESS(status))
+    pNoA = vos_mem_malloc(sizeof(tP2pPsConfig));
+    if ( NULL == pNoA )
+        status = eHAL_STATUS_FAILURE;
+    else
     {
-        palZeroMemory(pMac->hHdd, pNoA, sizeof(tP2pPsConfig));
+        vos_mem_set(pNoA, sizeof(tP2pPsConfig), 0);
         pNoA->opp_ps = pNoACmd->u.NoACmd.NoA.opp_ps;
         pNoA->ctWindow = pNoACmd->u.NoACmd.NoA.ctWindow;
         pNoA->duration = pNoACmd->u.NoACmd.NoA.duration;
diff --git a/CORE/SME/src/pmc/pmc.c b/CORE/SME/src/pmc/pmc.c
index 692613b..e9020b6 100644
--- a/CORE/SME/src/pmc/pmc.c
+++ b/CORE/SME/src/pmc/pmc.c
@@ -72,24 +72,24 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcEnterLowPowerState"));
+    pmcLog(pMac, LOG2, FL("Entering pmcEnterLowPowerState"));
 
     /* If already in Low Power State, just return. */
     if (pMac->pmc.pmcState == LOW_POWER)
         return eHAL_STATUS_SUCCESS;
 
     /* Cancel any running timers. */
-    if (palTimerStop(pMac->hHdd, pMac->pmc.hImpsTimer) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_stop(&pMac->pmc.hImpsTimer) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot cancel IMPS timer"));
+        pmcLog(pMac, LOGE, FL("Cannot cancel IMPS timer"));
         return eHAL_STATUS_FAILURE;
     }
 
     pmcStopTrafficTimer(hHal);
 
-    if (palTimerStop(pMac->hHdd, pMac->pmc.hExitPowerSaveTimer) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_stop(&pMac->pmc.hExitPowerSaveTimer) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot cancel exit power save mode timer"));
+        pmcLog(pMac, LOGE, FL("Cannot cancel exit power save mode timer"));
         return eHAL_STATUS_FAILURE;
     }
 
@@ -122,12 +122,12 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcExitLowPowerState"));
+    pmcLog(pMac, LOG2, FL("Entering pmcExitLowPowerState"));
 
     /* Must be in Low Power State if we are going to exit that state. */
     if (pMac->pmc.pmcState != LOW_POWER)
     {
-        smsLog(pMac, LOGE, FL("Cannot exit Low Power State if not in that state"));
+        pmcLog(pMac, LOGE, FL("Cannot exit Low Power State if not in that state"));
         return eHAL_STATUS_FAILURE;
     }
 
@@ -166,7 +166,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcEnterFullPowerState"));
+    pmcLog(pMac, LOG2, FL("Entering pmcEnterFullPowerState"));
 
     /* Take action based on the current state. */
     switch (pMac->pmc.pmcState)
@@ -202,15 +202,15 @@
 
     /* Cannot go directly to Full Power State from these states. */
     default:
-        smsLog(pMac, LOGE, FL("Trying to enter Full Power State from state %d"), pMac->pmc.pmcState);
+        pmcLog(pMac, LOGE, FL("Trying to enter Full Power State from state %d"), pMac->pmc.pmcState);
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
 
-    smsLog(pMac, LOG1, "PMC: Enter full power done: Cancel XO Core ON vote");
+    pmcLog(pMac, LOG1, "PMC: Enter full power done: Cancel XO Core ON vote");
     if (vos_chipVoteXOCore(NULL, NULL, NULL, VOS_FALSE) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, "Could not cancel XO Core ON vote. Not returning failure. "
+        pmcLog(pMac, LOGE, "Could not cancel XO Core ON vote. Not returning failure. "
                                 "Power consumed will be high");
     }
 
@@ -240,7 +240,7 @@
     vos_call_status_type callType;
     VOS_STATUS status;
 
-    smsLog(pMac, LOG2, FL("Entering pmcEnterRequestFullPowerState"));
+    pmcLog(pMac, LOG2, FL("Entering pmcEnterRequestFullPowerState"));
 
     /* Take action based on the current state of the device. */
     switch (pMac->pmc.pmcState)
@@ -248,12 +248,12 @@
 
     /* Should not request full power if already there. */
     case FULL_POWER:
-        smsLog(pMac, LOGE, FL("Requesting Full Power State when already there"));
+        pmcLog(pMac, LOGE, FL("Requesting Full Power State when already there"));
         return eHAL_STATUS_FAILURE;
 
     /* Only power events can take device out of Low Power State. */
     case LOW_POWER:
-        smsLog(pMac, LOGE, FL("Cannot request exit from Low Power State"));
+        pmcLog(pMac, LOGE, FL("Cannot request exit from Low Power State"));
         return eHAL_STATUS_FAILURE;
 
     /* Cannot go directly to Request Full Power state from these states.
@@ -265,7 +265,7 @@
     case REQUEST_BMPS:
     case REQUEST_ENTER_WOWL:
     case REQUEST_EXIT_WOWL:
-        smsLog(pMac, LOGW, FL("Request for full power is being buffered. "
+        pmcLog(pMac, LOGW, FL("Request for full power is being buffered. "
             "Current state is %d"), pMac->pmc.pmcState);
         //Ignore the new reason if request for full power is already pending
         if( !pMac->pmc.requestFullPowerPending )
@@ -333,7 +333,7 @@
         if (pmcIssueCommand(hHal, 0,  eSmeCommandExitImps, NULL, 0, FALSE)
                             != eHAL_STATUS_SUCCESS)
         {
-            smsLog(pMac, LOGE, "PMC: failure to send message "
+            pmcLog(pMac, LOGE, "PMC: failure to send message "
             "eWNI_PMC_EXIT_IMPS_REQ");
             return eHAL_STATUS_FAILURE;
         }
@@ -346,7 +346,7 @@
         if (pmcIssueCommand(hHal, 0, eSmeCommandExitUapsd, &fullPowerReason,
             sizeof(tRequestFullPowerReason), FALSE) != eHAL_STATUS_SUCCESS)
         {
-            smsLog(pMac, LOGE, "PMC: failure to send message "
+            pmcLog(pMac, LOGE, "PMC: failure to send message "
             "eWNI_PMC_EXIT_UAPSD_REQ");
             return eHAL_STATUS_FAILURE;
         }
@@ -357,7 +357,7 @@
         if (pmcIssueCommand(hHal, 0, eSmeCommandExitWowl, &fullPowerReason,
             sizeof(tRequestFullPowerReason), FALSE) != eHAL_STATUS_SUCCESS)
         {
-            smsLog(pMac, LOGP, "PMC: failure to send message "
+            pmcLog(pMac, LOGP, "PMC: failure to send message "
             "eWNI_PMC_EXIT_WOWL_REQ");
             return eHAL_STATUS_FAILURE;
         }
@@ -365,7 +365,8 @@
 
     /* Cannot go directly to Request Full Power State from these states. */
     default:
-        smsLog(pMac, LOGE, FL("Trying to enter Request Full Power State from state %d"), pMac->pmc.pmcState);
+        pmcLog(pMac, LOGE,
+               FL("Trying to enter Request Full Power State from state %d"), pMac->pmc.pmcState);
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -391,12 +392,12 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcEnterRequestImpsState"));
+    pmcLog(pMac, LOG2, FL("Entering pmcEnterRequestImpsState"));
 
     /* Can enter Request IMPS State only from Full Power State. */
     if (pMac->pmc.pmcState != FULL_POWER)
     {
-        smsLog(pMac, LOGE, FL("Trying to enter Request IMPS State from state %d"), pMac->pmc.pmcState);
+        pmcLog(pMac, LOGE, FL("Trying to enter Request IMPS State from state %d"), pMac->pmc.pmcState);
         return eHAL_STATUS_FAILURE;
     }
 
@@ -407,14 +408,14 @@
     if (pmcIssueCommand(hHal, 0, eSmeCommandEnterImps, NULL, 0, FALSE)
                         != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_IMPS_REQ");
+        pmcLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_IMPS_REQ");
         pMac->pmc.pmcState = FULL_POWER;
         if(pmcShouldBmpsTimerRun(pMac))
             (void)pmcStartTrafficTimer(hHal, pMac->pmc.bmpsConfig.trafficMeasurePeriod);
         return eHAL_STATUS_FAILURE;
      }
 
-    smsLog(pMac, LOG2, FL("eWNI_PMC_ENTER_IMPS_REQ sent to PE"));
+    pmcLog(pMac, LOG2, FL("eWNI_PMC_ENTER_IMPS_REQ sent to PE"));
 
     return eHAL_STATUS_SUCCESS;
 }
@@ -440,12 +441,12 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     vos_call_status_type callType;
     VOS_STATUS status;
-    smsLog(pMac, LOG2, FL("Entering pmcEnterImpsState"));
+    pmcLog(pMac, LOG2, FL("Entering pmcEnterImpsState"));
 
     /* Can enter IMPS State only from Request IMPS State. */
     if (pMac->pmc.pmcState != REQUEST_IMPS)
     {
-        smsLog(pMac, LOGE, FL("Trying to enter IMPS State from state %d"), pMac->pmc.pmcState);
+        pmcLog(pMac, LOGE, FL("Trying to enter IMPS State from state %d"), pMac->pmc.pmcState);
         return eHAL_STATUS_FAILURE;
     }
 
@@ -464,21 +465,23 @@
     /* Set timer to come out of IMPS.only if impsPeriod is non-Zero*/
     if(0 != pMac->pmc.impsPeriod)
     {
-        if (palTimerStart(pMac->hHdd, pMac->pmc.hImpsTimer, pMac->pmc.impsPeriod * 1000, FALSE) != eHAL_STATUS_SUCCESS)
+        if (vos_timer_start(&pMac->pmc.hImpsTimer, pMac->pmc.impsPeriod) != VOS_STATUS_SUCCESS)
         {
             PMC_ABORT;
             pMac->pmc.ImpsReqTimerFailed = VOS_TRUE;
             if (!(pMac->pmc.ImpsReqTimerfailCnt & 0xF))
             {
                 pMac->pmc.ImpsReqTimerfailCnt++;
-                smsLog(pMac, LOGE, FL("Cannot start IMPS timer, FailCnt - %d"), pMac->pmc.ImpsReqTimerfailCnt);
+                pmcLog(pMac, LOGE,
+                       FL("Cannot start IMPS timer, FailCnt - %d"), pMac->pmc.ImpsReqTimerfailCnt);
             }
             pmcEnterRequestFullPowerState(hHal, eSME_REASON_OTHER);
             return eHAL_STATUS_FAILURE;
         }
         if (pMac->pmc.ImpsReqTimerfailCnt)
         {
-           smsLog(pMac, LOGE, FL("Start IMPS timer was failed %d times before success"), pMac->pmc.ImpsReqTimerfailCnt);
+           pmcLog(pMac, LOGE,
+                  FL("Start IMPS timer was failed %d times before success"), pMac->pmc.ImpsReqTimerfailCnt);
         }
         pMac->pmc.ImpsReqTimerfailCnt = 0;
     }
@@ -516,12 +519,13 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcEnterRequestBmpsState"));
+    pmcLog(pMac, LOG2, FL("Entering pmcEnterRequestBmpsState"));
 
     /* Can enter Request BMPS State only from Full Power State. */
     if (pMac->pmc.pmcState != FULL_POWER)
     {
-        smsLog(pMac, LOGE, FL("Trying to enter Request BMPS State from state %d"), pMac->pmc.pmcState);
+        pmcLog(pMac, LOGE,
+               FL("Trying to enter Request BMPS State from state %d"), pMac->pmc.pmcState);
         return eHAL_STATUS_FAILURE;
     }
 
@@ -536,7 +540,7 @@
         if(pmcIssueCommand(hHal, 0,  eSmeCommandEnterBmps, NULL, 0, FALSE)
            != eHAL_STATUS_SUCCESS)
         {
-            smsLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_BMPS_REQ");
+            pmcLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_BMPS_REQ");
             pMac->pmc.bmpsRequestQueued = eANI_BOOLEAN_FALSE;
             pMac->pmc.pmcState = FULL_POWER;
             if(pmcShouldBmpsTimerRun(pMac))
@@ -548,7 +552,7 @@
     }
     else
     {
-        smsLog(pMac, LOGE, "PMC: enter BMPS command already queued");
+        pmcLog(pMac, LOGE, "PMC: enter BMPS command already queued");
         //restart the timer if needed
         if(pmcShouldBmpsTimerRun(pMac))
         {
@@ -557,7 +561,7 @@
         return eHAL_STATUS_SUCCESS;
     }
 
-    smsLog(pMac, LOGW, FL("eWNI_PMC_ENTER_BMPS_REQ sent to PE"));
+    pmcLog(pMac, LOGW, FL("eWNI_PMC_ENTER_BMPS_REQ sent to PE"));
 
     return eHAL_STATUS_SUCCESS;
 }
@@ -582,7 +586,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcEnterBmpsState"));
+    pmcLog(pMac, LOG2, FL("Entering pmcEnterBmpsState"));
 
     /* Can enter BMPS State only from 5 states. */
     if (pMac->pmc.pmcState != REQUEST_BMPS &&
@@ -591,7 +595,7 @@
         pMac->pmc.pmcState != REQUEST_ENTER_WOWL &&
         pMac->pmc.pmcState != REQUEST_EXIT_WOWL)
     {
-        smsLog(pMac, LOGE, FL("Trying to enter BMPS State from state %d"), pMac->pmc.pmcState);
+        pmcLog(pMac, LOGE, FL("Trying to enter BMPS State from state %d"), pMac->pmc.pmcState);
         return eHAL_STATUS_FAILURE;
     }
 
@@ -608,7 +612,7 @@
     {
 
         /* Start exit BMPS sequence now. */
-        smsLog(pMac, LOGW, FL("Pending Full Power request found on entering BMPS mode. "
+        pmcLog(pMac, LOGW, FL("Pending Full Power request found on entering BMPS mode. "
                   "Start exit BMPS exit sequence"));
         //Note: Reason must have been set when requestFullPowerPending flag was set.
         pmcEnterRequestFullPowerState(hHal, pMac->pmc.requestFullPowerReason);
@@ -618,14 +622,14 @@
     /*This should never happen ideally. WOWL and UAPSD not supported at the same time */
     if (pMac->pmc.wowlModeRequired && pMac->pmc.uapsdSessionRequired)
     {
-        smsLog(pMac, LOGW, FL("Both UAPSD and WOWL is required on entering BMPS mode. "
+        pmcLog(pMac, LOGW, FL("Both UAPSD and WOWL is required on entering BMPS mode. "
                "UAPSD will be prioritized over WOWL"));
     }
 
     /* Do we need Uapsd?*/
     if (pMac->pmc.uapsdSessionRequired)
     {
-        smsLog(pMac, LOGW, FL("UAPSD session is required on entering BMPS mode. "
+        pmcLog(pMac, LOGW, FL("UAPSD session is required on entering BMPS mode. "
                   "Start UAPSD entry sequence"));
         pmcEnterRequestStartUapsdState(hHal);
         return eHAL_STATUS_SUCCESS;
@@ -634,7 +638,7 @@
     /* Do we need WOWL?*/
     if (pMac->pmc.wowlModeRequired)
     {
-        smsLog(pMac, LOGW, FL("WOWL is required on entering BMPS mode. "
+        pmcLog(pMac, LOGW, FL("WOWL is required on entering BMPS mode. "
                   "Start WOWL entry sequence"));
         pmcRequestEnterWowlState(hHal, &(pMac->pmc.wowlEnterParams));
     }
@@ -666,7 +670,7 @@
     tANI_BOOLEAN (*checkRoutine) (void *checkContext);
     tANI_BOOLEAN bResult=FALSE;
 
-    smsLog(pMac, LOG2, FL("Entering pmcPowerSaveCheck"));
+    pmcLog(pMac, LOG2, FL("Entering pmcPowerSaveCheck"));
 
     /* Call the routines in the power save check routine list.  If any
        return FALSE, then we cannot go into power save mode. */
@@ -682,7 +686,7 @@
         {
             if (!checkRoutine(pPowerSaveCheckEntry->checkContext))
             {
-                smsLog(pMac, LOGE, FL("pmcPowerSaveCheck fail!"));
+                pmcLog(pMac, LOGE, FL("pmcPowerSaveCheck fail!"));
                 bResult = FALSE;
                 break;
             }
@@ -718,9 +722,9 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     tSirPowerSaveCfg powerSaveConfig;
 
-    smsLog(pMac, LOG2, FL("Entering pmcSendPowerSaveConfigMessage"));
+    pmcLog(pMac, LOG2, FL("Entering pmcSendPowerSaveConfigMessage"));
 
-    palZeroMemory(pMac->hHdd, &(powerSaveConfig), sizeof(tSirPowerSaveCfg));
+    vos_mem_set(&(powerSaveConfig), sizeof(tSirPowerSaveCfg), 0);
 
     switch (pMac->pmc.bmpsConfig.forwardBeacons)
     {
@@ -779,7 +783,7 @@
     if (pmcSendMessage(hHal, eWNI_PMC_PWR_SAVE_CFG, &powerSaveConfig, sizeof(tSirPowerSaveCfg))
         != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Send of eWNI_PMC_PWR_SAVE_CFG to PE failed"));
+        pmcLog(pMac, LOGE, FL("Send of eWNI_PMC_PWR_SAVE_CFG to PE failed"));
         return eHAL_STATUS_FAILURE;
     }
 
@@ -809,12 +813,13 @@
 {
     tSirMbMsg *pMsg;
 
-    smsLog(pMac, LOG2, FL("Entering pmcSendMessage, message type %d"), messageType);
+    pmcLog(pMac, LOG2, FL("Entering pmcSendMessage, message type %d"), messageType);
 
     /* Allocate and fill in message. */
-    if (palAllocateMemory(pMac->hHdd, (void **)&pMsg, WNI_CFG_MB_HDR_LEN + messageSize) != eHAL_STATUS_SUCCESS)
+    pMsg = vos_mem_malloc(WNI_CFG_MB_HDR_LEN + messageSize);
+    if ( NULL == pMsg )
     {
-        smsLog(pMac, LOGE, FL("Cannot allocate memory for message"));
+        pmcLog(pMac, LOGE, FL("Cannot allocate memory for message"));
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -822,18 +827,13 @@
     pMsg->msgLen = (tANI_U16) (WNI_CFG_MB_HDR_LEN + messageSize);
     if (messageSize > 0)
     {
-        if (palCopyMemory(pMac->hHdd, pMsg->data, pMessageData, messageSize) != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot copy message data"));
-            PMC_ABORT;
-            return eHAL_STATUS_FAILURE;
-        }
+        vos_mem_copy(pMsg->data, pMessageData, messageSize);
     }
 
     /* Send message. */
     if (palSendMBMessage(pMac->hHdd, pMsg) != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot send message"));
+        pmcLog(pMac, LOGE, FL("Cannot send message"));
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -864,7 +864,7 @@
     tListElem *pEntry;
     tpRequestFullPowerEntry pRequestFullPowerEntry;
 
-    smsLog(pMac, LOG2, FL("Entering pmcDoCallbacks"));
+    pmcLog(pMac, LOG2, FL("Entering pmcDoCallbacks"));
 
     /* Call IMPS callback routine. */
     if (pMac->pmc.impsCallbackRoutine != NULL)
@@ -879,11 +879,7 @@
         pRequestFullPowerEntry = GET_BASE_ADDR(pEntry, tRequestFullPowerEntry, link);
         if (pRequestFullPowerEntry->callbackRoutine)
            pRequestFullPowerEntry->callbackRoutine(pRequestFullPowerEntry->callbackContext, callbackStatus);
-        if (palFreeMemory(pMac->hHdd, pRequestFullPowerEntry) != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free request full power routine list entry"));
-            PMC_ABORT;
-        }
+        vos_mem_free(pRequestFullPowerEntry);
     }
 
 }
@@ -910,7 +906,7 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     VOS_STATUS vosStatus;
 
-    smsLog(pMac, LOG2, FL("Entering pmcStartTrafficTimer"));
+    pmcLog(pMac, LOG2, FL("Entering pmcStartTrafficTimer"));
 
     vosStatus = vos_timer_start(&pMac->pmc.hTrafficTimer, expirationTime);
     if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
@@ -918,11 +914,11 @@
         if( VOS_STATUS_E_ALREADY == vosStatus )
         {
             //Consider this ok since the timer is already started.
-            smsLog(pMac, LOGW, FL("  traffic timer is already started"));
+            pmcLog(pMac, LOGW, FL("  traffic timer is already started"));
         }
         else
         {
-            smsLog(pMac, LOGP, FL("Cannot start traffic timer"));
+            pmcLog(pMac, LOGP, FL("Cannot start traffic timer"));
             return eHAL_STATUS_FAILURE;
         }
     }
@@ -947,7 +943,7 @@
 void pmcStopTrafficTimer (tHalHandle hHal)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-    smsLog(pMac, LOG2, FL("Entering pmcStopTrafficTimer"));
+    pmcLog(pMac, LOG2, FL("Entering pmcStopTrafficTimer"));
     vos_timer_stop(&pMac->pmc.hTrafficTimer);
 }
 
@@ -970,12 +966,12 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcImpsTimerExpired"));
+    pmcLog(pMac, LOG2, FL("Entering pmcImpsTimerExpired"));
 
     /* If timer expires and we are in a state other than IMPS State then something is wrong. */
     if (pMac->pmc.pmcState != IMPS)
     {
-        smsLog(pMac, LOGE, FL("Got IMPS timer expiration in state %d"), pMac->pmc.pmcState);
+        pmcLog(pMac, LOGE, FL("Got IMPS timer expiration in state %d"), pMac->pmc.pmcState);
         PMC_ABORT;
         return;
     }
@@ -1005,23 +1001,24 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     VOS_STATUS vosStatus;
 
-    smsLog(pMac, LOG2, FL("BMPS Traffic timer expired"));
+    pmcLog(pMac, LOG2, FL("BMPS Traffic timer expired"));
 
     /* If timer expires and we are in a state other than Full Power State then something is wrong. */
     if (pMac->pmc.pmcState != FULL_POWER)
     {
-        smsLog(pMac, LOGE, FL("Got traffic timer expiration in state %d"), pMac->pmc.pmcState);
+        pmcLog(pMac, LOGE, FL("Got traffic timer expiration in state %d"), pMac->pmc.pmcState);
         return;
     }
 
     /* Untill DHCP is not completed remain in power active */
     if(pMac->pmc.remainInPowerActiveTillDHCP)
     {
-        smsLog(pMac, LOG2, FL("BMPS Traffic Timer expired before DHCP completion ignore enter BMPS"));
+        pmcLog(pMac, LOG2, FL("BMPS Traffic Timer expired before DHCP completion ignore enter BMPS"));
         pMac->pmc.remainInPowerActiveThreshold++;
         if( pMac->pmc.remainInPowerActiveThreshold >= DHCP_REMAIN_POWER_ACTIVE_THRESHOLD)
         {
-           smsLog(pMac, LOGE, FL("Remain in power active DHCP threshold reached FALLBACK to enable enter BMPS"));
+           pmcLog(pMac, LOGE,
+                  FL("Remain in power active DHCP threshold reached FALLBACK to enable enter BMPS"));
            /*FALLBACK: reset the flag to make BMPS entry possible*/
            pMac->pmc.remainInPowerActiveTillDHCP = FALSE;
            pMac->pmc.remainInPowerActiveThreshold = 0;
@@ -1030,7 +1027,7 @@
         vosStatus = vos_timer_start(&pMac->pmc.hTrafficTimer, pMac->pmc.bmpsConfig.trafficMeasurePeriod);
         if ( !VOS_IS_STATUS_SUCCESS(vosStatus) && (VOS_STATUS_E_ALREADY != vosStatus) )
         {
-            smsLog(pMac, LOGP, FL("Cannot re-start traffic timer"));
+            pmcLog(pMac, LOGP, FL("Cannot re-start traffic timer"));
         }
         return;
     }
@@ -1041,32 +1038,32 @@
     /* Check if the timer should be running */
     if (!pmcShouldBmpsTimerRun(pMac))
     {
-        smsLog(pMac, LOGE, FL("BMPS timer should not be running"));
+        pmcLog(pMac, LOGE, FL("BMPS timer should not be running"));
         return;
     }
 
 #ifdef FEATURE_WLAN_TDLS
     if (pMac->isTdlsPowerSaveProhibited)
     {
-       smsLog(pMac, LOGE, FL("TDLS peer(s) connected/discovery sent. Dont enter BMPS"));
+       pmcLog(pMac, LOGE, FL("TDLS peer(s) connected/discovery sent. Dont enter BMPS"));
        return;
     }
 #endif
 
     if (pmcPowerSaveCheck(hHal))
     {
-        smsLog(pMac, LOGW, FL("BMPS entry criteria satisfied. Requesting BMPS state"));
+        pmcLog(pMac, LOGW, FL("BMPS entry criteria satisfied. Requesting BMPS state"));
         (void)pmcEnterRequestBmpsState(hHal);
     }
     else
     {
         /*Some module voted against Power Save. So timer should be restarted again to retry BMPS */
-        smsLog(pMac, LOGE, FL("Power Save check failed. Retry BMPS again later"));
+        pmcLog(pMac, LOGE, FL("Power Save check failed. Retry BMPS again later"));
         //Since hTrafficTimer is a vos_timer now, we need to restart the timer here
         vosStatus = vos_timer_start(&pMac->pmc.hTrafficTimer, pMac->pmc.bmpsConfig.trafficMeasurePeriod);
         if ( !VOS_IS_STATUS_SUCCESS(vosStatus) && (VOS_STATUS_E_ALREADY != vosStatus) )
         {
-            smsLog(pMac, LOGP, FL("Cannot start traffic timer"));
+            pmcLog(pMac, LOGP, FL("Cannot start traffic timer"));
             return;
         }
     }
@@ -1091,7 +1088,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcExitPowerSaveTimerExpired"));
+    pmcLog(pMac, LOG2, FL("Entering pmcExitPowerSaveTimerExpired"));
 
     /* Make sure process of exiting power save mode might hasn't already been started due to another trigger. */
     if (pMac->pmc.requestFullPowerPending)
@@ -1122,7 +1119,7 @@
    tListElem *pEntry;
    tpRequestBmpsEntry pRequestBmpsEntry;
 
-   smsLog(pMac, LOG2, "PMC: entering pmcDoBmpsCallbacks");
+   pmcLog(pMac, LOG2, "PMC: entering pmcDoBmpsCallbacks");
 
    /* Call the routines in the request BMPS callback routine list. */
    csrLLLock(&pMac->pmc.requestBmpsList);
@@ -1133,7 +1130,7 @@
       if (pRequestBmpsEntry->callbackRoutine)
          pRequestBmpsEntry->callbackRoutine(pRequestBmpsEntry->callbackContext,
          callbackStatus);
-      palFreeMemory(pMac->hHdd, pRequestBmpsEntry);
+      vos_mem_free(pRequestBmpsEntry);
       pEntry = csrLLRemoveHead(&pMac->pmc.requestBmpsList, FALSE);
    }
    csrLLUnlock(&pMac->pmc.requestBmpsList);
@@ -1164,7 +1161,7 @@
    tListElem *pEntry;
    tpStartUapsdEntry pStartUapsdEntry;
 
-   smsLog(pMac, LOG2, "PMC: entering pmcDoStartUapsdCallbacks");
+   pmcLog(pMac, LOG2, "PMC: entering pmcDoStartUapsdCallbacks");
    csrLLLock(&pMac->pmc.requestStartUapsdList);
    /* Call the routines in the request start UAPSD callback routine list. */
    pEntry = csrLLRemoveHead(&pMac->pmc.requestStartUapsdList, FALSE);
@@ -1173,7 +1170,7 @@
       pStartUapsdEntry = GET_BASE_ADDR(pEntry, tStartUapsdEntry, link);
       pStartUapsdEntry->callbackRoutine(pStartUapsdEntry->callbackContext,
          callbackStatus);
-      palFreeMemory(pMac->hHdd, pStartUapsdEntry);
+      vos_mem_free(pStartUapsdEntry);
       pEntry = csrLLRemoveHead(&pMac->pmc.requestStartUapsdList, FALSE);
    }
    csrLLUnlock(&pMac->pmc.requestStartUapsdList);
@@ -1199,7 +1196,7 @@
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
    v_BOOL_t fFullPower = VOS_FALSE;     //need to get back to full power state
 
-   smsLog(pMac, LOG2, "PMC: entering pmcEnterRequestStartUapsdState");
+   pmcLog(pMac, LOG2, "PMC: entering pmcEnterRequestStartUapsdState");
 
    /* Can enter UAPSD State only from FULL_POWER or BMPS State. */
    switch (pMac->pmc.pmcState)
@@ -1208,7 +1205,7 @@
          /* Check that entry into a power save mode is allowed at this time. */
          if (!pmcPowerSaveCheck(hHal))
          {
-            smsLog(pMac, LOGW, "PMC: Power save check failed. UAPSD request "
+            pmcLog(pMac, LOGW, "PMC: Power save check failed. UAPSD request "
                       "will be accepted and buffered");
             /* UAPSD mode will be attempted when we enter BMPS later */
             pMac->pmc.uapsdSessionRequired = TRUE;
@@ -1229,7 +1226,7 @@
                   That is why no need to buffer the UAPSD request*/
                if(pmcEnterRequestBmpsState(hHal) != eHAL_STATUS_SUCCESS)
                {
-                   smsLog(pMac, LOGE, "PMC: Device in Full Power. Enter Request Bmps failed. "
+                   pmcLog(pMac, LOGE, "PMC: Device in Full Power. Enter Request Bmps failed. "
                             "UAPSD request will be dropped ");
                   return eHAL_STATUS_FAILURE;
                }
@@ -1253,7 +1250,7 @@
             if (pmcIssueCommand(hHal, 0, eSmeCommandEnterUapsd, NULL, 0, FALSE)
                                 != eHAL_STATUS_SUCCESS)
             {
-               smsLog(pMac, LOGE, "PMC: failure to send message "
+               pmcLog(pMac, LOGE, "PMC: failure to send message "
                   "eWNI_PMC_ENTER_BMPS_REQ");
                return eHAL_STATUS_FAILURE;
             }
@@ -1262,7 +1259,7 @@
          else
          {
             //Not ready for UAPSD at this time, save it first and wake up the chip
-            smsLog(pMac, LOGE, " PMC state = %d",pMac->pmc.pmcState);
+            pmcLog(pMac, LOGE, " PMC state = %d",pMac->pmc.pmcState);
             pMac->pmc.uapsdSessionRequired = TRUE;
             /* While BTC traffic is going on, STA can be in BMPS
              * and need not go to Full Power */
@@ -1294,7 +1291,7 @@
         break;
 
       default:
-         smsLog(pMac, LOGE, "PMC: trying to enter UAPSD State from state %d",
+         pmcLog(pMac, LOGE, "PMC: trying to enter UAPSD State from state %d",
             pMac->pmc.pmcState);
          return eHAL_STATUS_FAILURE;
    }
@@ -1304,7 +1301,7 @@
       if( eHAL_STATUS_PMC_PENDING != pmcRequestFullPower( pMac, NULL, NULL, eSME_REASON_OTHER ) )
       {
          //This is an error
-         smsLog(pMac, LOGE, FL(" fail to request full power because BTC"));
+         pmcLog(pMac, LOGE, FL(" fail to request full power because BTC"));
       }
    }
 
@@ -1330,12 +1327,12 @@
 {
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-   smsLog(pMac, LOG2, "PMC: entering pmcEnterUapsdState");
+   pmcLog(pMac, LOG2, "PMC: entering pmcEnterUapsdState");
 
    /* Can enter UAPSD State only from Request UAPSD State. */
    if (pMac->pmc.pmcState != REQUEST_START_UAPSD )
    {
-      smsLog(pMac, LOGE, "PMC: trying to enter UAPSD State from state %d",
+      pmcLog(pMac, LOGE, "PMC: trying to enter UAPSD State from state %d",
       pMac->pmc.pmcState);
       return eHAL_STATUS_FAILURE;
    }
@@ -1379,7 +1376,7 @@
 {
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-   smsLog(pMac, LOG2, "PMC: entering pmcEnterRequestStopUapsdState");
+   pmcLog(pMac, LOG2, "PMC: entering pmcEnterRequestStopUapsdState");
 
    /* If already in REQUEST_STOP_UAPSD, simply return */
    if (pMac->pmc.pmcState == REQUEST_STOP_UAPSD)
@@ -1390,7 +1387,7 @@
    /* Can enter Request Stop UAPSD State only from UAPSD */
    if (pMac->pmc.pmcState != UAPSD)
    {
-      smsLog(pMac, LOGE, "PMC: trying to enter Request Stop UAPSD State from "
+      pmcLog(pMac, LOGE, "PMC: trying to enter Request Stop UAPSD State from "
          "state %d", pMac->pmc.pmcState);
       return eHAL_STATUS_FAILURE;
    }
@@ -1399,7 +1396,7 @@
    if (pmcIssueCommand(hHal, 0,  eSmeCommandExitUapsd, NULL, 0, FALSE)
                        != eHAL_STATUS_SUCCESS)
    {
-      smsLog(pMac, LOGE, "PMC: failure to send message "
+      pmcLog(pMac, LOGE, "PMC: failure to send message "
          "eWNI_PMC_EXIT_UAPSD_REQ");
       return eHAL_STATUS_FAILURE;
    }
@@ -1426,12 +1423,12 @@
 {
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-   smsLog(pMac, LOG2, "PMC: entering pmcEnterRequestStandbyState");
+   pmcLog(pMac, LOG2, "PMC: entering pmcEnterRequestStandbyState");
 
    /* Can enter Standby State only from Full Power State. */
    if (pMac->pmc.pmcState != FULL_POWER)
    {
-      smsLog(pMac, LOGE, "PMC: trying to enter Standby State from "
+      pmcLog(pMac, LOGE, "PMC: trying to enter Standby State from "
          "state %d", pMac->pmc.pmcState);
       return eHAL_STATUS_FAILURE;
    }
@@ -1444,7 +1441,7 @@
    if (pmcIssueCommand(hHal, 0, eSmeCommandEnterStandby, NULL, 0, FALSE)
                        != eHAL_STATUS_SUCCESS)
    {
-      smsLog(pMac, LOGE, "PMC: failure to send message "
+      pmcLog(pMac, LOGE, "PMC: failure to send message "
          "eWNI_PMC_ENTER_IMPS_REQ");
       pMac->pmc.pmcState = FULL_POWER;
 
@@ -1477,12 +1474,12 @@
    vos_call_status_type callType;
    VOS_STATUS status;
 
-   smsLog(pMac, LOG2, "PMC: entering pmcEnterStandbyState");
+   pmcLog(pMac, LOG2, "PMC: entering pmcEnterStandbyState");
 
    /* Can enter STANDBY State only from REQUEST_STANDBY State. */
    if (pMac->pmc.pmcState != REQUEST_STANDBY)
    {
-      smsLog(pMac, LOGE, "PMC: trying to enter STANDBY State from state %d",
+      pmcLog(pMac, LOGE, "PMC: trying to enter STANDBY State from state %d",
          pMac->pmc.pmcState);
       return eHAL_STATUS_FAILURE;
    }
@@ -1530,7 +1527,7 @@
 {
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-   smsLog(pMac, LOG2, "PMC: entering pmcDoStandbyCallbacks");
+   pmcLog(pMac, LOG2, "PMC: entering pmcDoStandbyCallbacks");
 
    /* Call Standby callback routine. */
    if (pMac->pmc.standbyCallbackRoutine != NULL)
@@ -1609,7 +1606,7 @@
     tpDeviceStateUpdateIndEntry pDeviceStateUpdateIndEntry;
     void (*callbackRoutine) (void *callbackContext, tPmcState pmcState);
 
-    smsLog(pMac, LOG2, FL("PMC - Update registered modules of new device "
+    pmcLog(pMac, LOG2, FL("PMC - Update registered modules of new device "
            "state: %s"), pmcGetPmcStateStr(state));
 
     /* Call the routines in the update device state routine list. */
@@ -1641,7 +1638,7 @@
 eHalStatus pmcRequestEnterWowlState(tHalHandle hHal, tpSirSmeWowlEnterParams wowlEnterParams)
 {
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-   smsLog(pMac, LOG2, "PMC: entering pmcRequestEnterWowlState");
+   pmcLog(pMac, LOG2, "PMC: entering pmcRequestEnterWowlState");
 
    if(pMac->psOffloadEnabled)
    {
@@ -1661,14 +1658,14 @@
          /* Put device in BMPS mode first. This step should NEVER fail. */
          if(pmcEnterRequestBmpsState(hHal) != eHAL_STATUS_SUCCESS)
          {
-            smsLog(pMac, LOGE, "PMC: Device in Full Power. pmcEnterRequestBmpsState failed. "
+            pmcLog(pMac, LOGE, "PMC: Device in Full Power. pmcEnterRequestBmpsState failed. "
                     "Cannot enter WOWL");
             return eHAL_STATUS_FAILURE;
          }
          break;
 
       case REQUEST_BMPS:
-         smsLog(pMac, LOGW, "PMC: BMPS transaction going on. WOWL request "
+         pmcLog(pMac, LOGW, "PMC: BMPS transaction going on. WOWL request "
                     "will be buffered");
          break;
 
@@ -1680,24 +1677,24 @@
          if (pmcIssueCommand(hHal, 0, eSmeCommandEnterWowl, wowlEnterParams,
              sizeof(tSirSmeWowlEnterParams), FALSE) != eHAL_STATUS_SUCCESS)
          {
-            smsLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_WOWL_REQ");
+            pmcLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_WOWL_REQ");
             return eHAL_STATUS_FAILURE;
          }
          break;
 
       case REQUEST_ENTER_WOWL:
          //Multiple enter WOWL requests at the same time are not accepted
-         smsLog(pMac, LOGE, "PMC: Enter WOWL transaction already going on. New WOWL request "
+         pmcLog(pMac, LOGE, "PMC: Enter WOWL transaction already going on. New WOWL request "
                     "will be rejected");
          return eHAL_STATUS_FAILURE;
 
       case REQUEST_EXIT_WOWL:
-         smsLog(pMac, LOGW, "PMC: Exit WOWL transaction going on. New WOWL request "
+         pmcLog(pMac, LOGW, "PMC: Exit WOWL transaction going on. New WOWL request "
                    "will be buffered");
          break;
 
       default:
-         smsLog(pMac, LOGE, "PMC: Trying to enter WOWL State from state %s",
+         pmcLog(pMac, LOGE, "PMC: Trying to enter WOWL State from state %s",
             pmcGetPmcStateStr(pMac->pmc.pmcState));
          return eHAL_STATUS_FAILURE;
    }
@@ -1724,12 +1721,12 @@
 {
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-   smsLog(pMac, LOG2, "PMC: entering pmcEnterWowlState");
+   pmcLog(pMac, LOG2, "PMC: entering pmcEnterWowlState");
 
    /* Can enter WOWL State only from Request WOWL State. */
    if (pMac->pmc.pmcState != REQUEST_ENTER_WOWL )
    {
-      smsLog(pMac, LOGP, "PMC: trying to enter WOWL State from state %d",
+      pmcLog(pMac, LOGP, "PMC: trying to enter WOWL State from state %d",
         pMac->pmc.pmcState);
       return eHAL_STATUS_FAILURE;
    }
@@ -1772,7 +1769,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, "PMC: entering pmcRequestExitWowlState");
+    pmcLog(pMac, LOG2, "PMC: entering pmcRequestExitWowlState");
 
     if (pMac->psOffloadEnabled)
     {
@@ -1793,17 +1790,17 @@
             if (pmcIssueCommand(hHal, 0, eSmeCommandExitWowl, NULL, 0, FALSE)
                 != eHAL_STATUS_SUCCESS)
             {
-                smsLog(pMac, LOGP, "PMC: failure to send message eWNI_PMC_EXIT_WOWL_REQ");
+                pmcLog(pMac, LOGP, "PMC: failure to send message eWNI_PMC_EXIT_WOWL_REQ");
                 return eHAL_STATUS_FAILURE;
             }
             break;
 
         case REQUEST_ENTER_WOWL:
-            smsLog(pMac, LOGP, "PMC: Rcvd exit WOWL even before enter WOWL was completed");
+            pmcLog(pMac, LOGP, "PMC: Rcvd exit WOWL even before enter WOWL was completed");
             return eHAL_STATUS_FAILURE;
 
         default:
-            smsLog(pMac, LOGW, "PMC: Got exit WOWL in state %s. Nothing to do as already out of WOWL",
+            pmcLog(pMac, LOGW, "PMC: Got exit WOWL in state %s. Nothing to do as already out of WOWL",
             pmcGetPmcStateStr(pMac->pmc.pmcState));
             break;
     }
@@ -1828,7 +1825,7 @@
 {
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-   smsLog(pMac, LOG2, "PMC: entering pmcDoWowlCallbacks");
+   pmcLog(pMac, LOG2, "PMC: entering pmcDoWowlCallbacks");
 
    /* Call Wowl callback routine. */
    if (pMac->pmc.enterWowlCallbackRoutine != NULL)
@@ -1855,7 +1852,7 @@
                     &pDeferredMsg->u.wowlAddPattern, sizeof(tSirWowlAddBcastPtrn))
                     != eHAL_STATUS_SUCCESS)
             {
-                smsLog(pMac, LOGE, FL("Send of eWNI_PMC_WOWL_ADD_BCAST_PTRN to PE failed"));
+                pmcLog(pMac, LOGE, FL("Send of eWNI_PMC_WOWL_ADD_BCAST_PTRN to PE failed"));
             }
             break;
 
@@ -1865,7 +1862,7 @@
                     &pDeferredMsg->u.wowlDelPattern, sizeof(tSirWowlDelBcastPtrn))
                     != eHAL_STATUS_SUCCESS)
             {
-                smsLog(pMac, LOGE, FL("Send of eWNI_PMC_WOWL_ADD_BCAST_PTRN to PE failed"));
+                pmcLog(pMac, LOGE, FL("Send of eWNI_PMC_WOWL_ADD_BCAST_PTRN to PE failed"));
             }
             break;
 
@@ -1875,16 +1872,16 @@
                     &pDeferredMsg->u.powerSaveConfig, sizeof(tSirPowerSaveCfg))
                 != eHAL_STATUS_SUCCESS)
             {
-                smsLog(pMac, LOGE, FL("Send of eWNI_PMC_PWR_SAVE_CFG to PE failed"));
+                pmcLog(pMac, LOGE, FL("Send of eWNI_PMC_PWR_SAVE_CFG to PE failed"));
             }
             break;
 
         default:
-            smsLog(pMac, LOGE, FL("unknown message (%d)"), pDeferredMsg->messageType);
+            pmcLog(pMac, LOGE, FL("unknown message (%d)"), pDeferredMsg->messageType);
             break;
         }
         //Need to free the memory here
-        palFreeMemory( pMac->hHdd, pDeferredMsg );
+        vos_mem_free(pDeferredMsg);
     } //while
 }
 
@@ -1894,23 +1891,18 @@
     tPmcDeferredMsg *pDeferredMsg;
     eHalStatus status;
 
-    if( !HAL_STATUS_SUCCESS( palAllocateMemory( pMac->hHdd, (void **)&pDeferredMsg, sizeof(tPmcDeferredMsg) ) ) )
+    pDeferredMsg = vos_mem_malloc(sizeof(tPmcDeferredMsg));
+    if ( NULL == pDeferredMsg )
     {
-        smsLog(pMac, LOGE, FL("Cannot allocate memory for callback context"));
+        pmcLog(pMac, LOGE, FL("Cannot allocate memory for callback context"));
         return eHAL_STATUS_RESOURCES;
     }
-    palZeroMemory( pMac->hHdd, pDeferredMsg, sizeof(tPmcDeferredMsg) );
+    vos_mem_set(pDeferredMsg, sizeof(tPmcDeferredMsg), 0);
     pDeferredMsg->messageType = messageType;
     pDeferredMsg->size = (tANI_U16)size;
     if( pData )
     {
-        if( !HAL_STATUS_SUCCESS( palCopyMemory( pMac->hHdd, &pDeferredMsg->u.data,
-                                    pData, size ) ) )
-        {
-            smsLog(pMac, LOGE, FL("Cannot copy pattern for callback context"));
-            palFreeMemory( pMac->hHdd, pDeferredMsg );
-            return eHAL_STATUS_FAILURE;
-        }
+        vos_mem_copy(&pDeferredMsg->u.data, pData, size);
     }
     csrLLInsertTail( &pMac->pmc.deferredMsgList, &pDeferredMsg->link, eANI_BOOLEAN_TRUE );
     //No callback is needed. The messages are put into deferred queue and be processed first
@@ -1921,11 +1913,11 @@
         //either fail or already in full power
         if( csrLLRemoveEntry( &pMac->pmc.deferredMsgList, &pDeferredMsg->link, eANI_BOOLEAN_TRUE ) )
         {
-            palFreeMemory( pMac->hHdd, pDeferredMsg );
+            vos_mem_free(pDeferredMsg);
         }
         if( !HAL_STATUS_SUCCESS( status ) )
         {
-            smsLog(pMac, LOGE, FL("failed to request full power status = %d"), status);
+            pmcLog(pMac, LOGE, FL("failed to request full power status = %d"), status);
         }
     }
 
@@ -1943,7 +1935,7 @@
     else
     {
         //this is a specially allocated comamnd due to out of command buffer. free it.
-        palFreeMemory(pMac->hHdd, pCommand);
+        vos_mem_free(pCommand);
     }
 }
 
@@ -1960,54 +1952,54 @@
             switch( pCommand->command )
             {
             case eSmeCommandEnterImps:
-                smsLog(pMac, LOGE, FL("aborting request to enter IMPS"));
+                pmcLog(pMac, LOGE, FL("aborting request to enter IMPS"));
                 pmcEnterFullPowerState(pMac);
                 break;
 
             case eSmeCommandExitImps:
-                smsLog(pMac, LOGE, FL("aborting request to exit IMPS "));
+                pmcLog(pMac, LOGE, FL("aborting request to exit IMPS "));
                 pmcEnterFullPowerState(pMac);
                 break;
 
             case eSmeCommandEnterBmps:
-                smsLog(pMac, LOGE, FL("aborting request to enter BMPS "));
+                pmcLog(pMac, LOGE, FL("aborting request to enter BMPS "));
                 pMac->pmc.bmpsRequestQueued = eANI_BOOLEAN_FALSE;
                 pmcEnterFullPowerState(pMac);
                 pmcDoBmpsCallbacks(pMac, eHAL_STATUS_FAILURE);
                 break;
 
             case eSmeCommandExitBmps:
-                smsLog(pMac, LOGE, FL("aborting request to exit BMPS "));
+                pmcLog(pMac, LOGE, FL("aborting request to exit BMPS "));
                 pmcEnterFullPowerState(pMac);
                 break;
 
             case eSmeCommandEnterUapsd:
-                smsLog(pMac, LOGE, FL("aborting request to enter UAPSD "));
+                pmcLog(pMac, LOGE, FL("aborting request to enter UAPSD "));
                 //Since there is no retry for UAPSD, tell the requester here we are done with failure
                 pMac->pmc.uapsdSessionRequired = FALSE;
                 pmcDoStartUapsdCallbacks(pMac, eHAL_STATUS_FAILURE);
                 break;
 
             case eSmeCommandExitUapsd:
-                smsLog(pMac, LOGE, FL("aborting request to exit UAPSD "));
+                pmcLog(pMac, LOGE, FL("aborting request to exit UAPSD "));
                 break;
 
             case eSmeCommandEnterWowl:
-                smsLog(pMac, LOGE, FL("aborting request to enter WOWL "));
+                pmcLog(pMac, LOGE, FL("aborting request to enter WOWL "));
                 pmcDoEnterWowlCallbacks(pMac, eHAL_STATUS_FAILURE);
                 break;
 
             case eSmeCommandExitWowl:
-                smsLog(pMac, LOGE, FL("aborting request to exit WOWL "));
+                pmcLog(pMac, LOGE, FL("aborting request to exit WOWL "));
                 break;
 
             case eSmeCommandEnterStandby:
-                smsLog(pMac, LOGE, FL("aborting request to enter Standby "));
+                pmcLog(pMac, LOGE, FL("aborting request to enter Standby "));
                 pmcDoStandbyCallbacks(pMac, eHAL_STATUS_FAILURE);
                 break;
 
             default:
-                smsLog(pMac, LOGE, FL("Request for PMC command (%d) is dropped"), pCommand->command);
+                pmcLog(pMac, LOGE, FL("Request for PMC command (%d) is dropped"), pCommand->command);
                 break;
             }
         }// !stopping
@@ -2044,20 +2036,24 @@
         }
         else
         {
-            smsLog( pMac, LOGE, FL(" fail to get command buffer for command 0x%X curState = %d"), cmdType, pMac->pmc.pmcState );
+            pmcLog( pMac, LOGE,
+                    FL(" fail to get command buffer for command 0x%X curState = %d"),
+                    cmdType, pMac->pmc.pmcState );
             //For certain PMC command, we cannot fail
             if( PMC_IS_COMMAND_CANNOT_FAIL(cmdType) )
             {
-                smsLog( pMac, LOGE, FL(" command 0x%X  cannot fail try allocating memory for it"), cmdType );
-                status = palAllocateMemory(pMac->hHdd, (void **)&pCommand, sizeof(tSmeCmd));
-                if(!HAL_STATUS_SUCCESS(status))
+                pmcLog( pMac, LOGE,
+                        FL(" command 0x%X  cannot fail try allocating memory for it"), cmdType );
+                pCommand = vos_mem_malloc(sizeof(tSmeCmd));
+                if ( NULL == pCommand )
                 {
-                    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL, "%s fail to allocate memory for command (0x%X)",
-                        __func__, cmdType);
+                    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL,
+                                "%s fail to allocate memory for command (0x%X)",
+                                __func__, cmdType);
                     pCommand = NULL;
-                    break;
+                    return eHAL_STATUS_FAILURE;
                 }
-                palZeroMemory(pMac->hHdd, pCommand, sizeof(tSmeCmd));
+                vos_mem_set(pCommand, sizeof(tSmeCmd), 0);
                 //Make sure it will be free when it is done
                 pCommand->u.pmcCmd.fReleaseWhenDone = TRUE;
             }
@@ -2109,7 +2105,7 @@
             }
             else
             {
-                smsLog( pMac, LOGE, (" exit BMPS must have a reason code") );
+                pmcLog( pMac, LOGE, (" exit BMPS must have a reason code") );
             }
             break;
 
@@ -2122,7 +2118,7 @@
             break;
 
         default:
-            smsLog( pMac, LOGE, FL("  invalid command type %d"), cmdType );
+            pmcLog( pMac, LOGE, FL("  invalid command type %d"), cmdType );
             status = eHAL_STATUS_INVALID_PARAMETER;
             break;
         }
@@ -2196,7 +2192,8 @@
                 }
                 if( !HAL_STATUS_SUCCESS( status ) )
                 {
-                    smsLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_IMPS_REQ or pmcEnterImpsCheck failed");
+                    pmcLog(pMac, LOGE,
+                           "PMC: failure to send message eWNI_PMC_ENTER_IMPS_REQ or pmcEnterImpsCheck failed");
                     pmcEnterFullPowerState( pMac );
                     if(pmcShouldBmpsTimerRun(pMac))
                         (void)pmcStartTrafficTimer(pMac, pMac->pmc.bmpsConfig.trafficMeasurePeriod);
@@ -2219,12 +2216,13 @@
                 if ( HAL_STATUS_SUCCESS( status ) )
                 {
                     pMac->pmc.pmcState = REQUEST_FULL_POWER;
-                    smsLog(pMac, LOG2, FL("eWNI_PMC_EXIT_IMPS_REQ sent to PE"));
+                    pmcLog(pMac, LOG2, FL("eWNI_PMC_EXIT_IMPS_REQ sent to PE"));
                     fRemoveCmd = eANI_BOOLEAN_FALSE;
                 }
                 else
                 {
-                    smsLog(pMac, LOGE, FL("eWNI_PMC_EXIT_IMPS_REQ fail to be sent to PE status %d"), status);
+                    pmcLog(pMac, LOGE,
+                           FL("eWNI_PMC_EXIT_IMPS_REQ fail to be sent to PE status %d"), status);
                     //Callbacks are called with success srarus, do we need to pass in real status??
                     pmcEnterFullPowerState(pMac);
                 }
@@ -2240,11 +2238,11 @@
                 {
                     /* Change PMC state */
                     pMac->pmc.pmcState = REQUEST_BMPS;
-                    smsLog(pMac, LOG2, "PMC: Enter BMPS req done: Force XO Core ON");
+                    pmcLog(pMac, LOG2, "PMC: Enter BMPS req done: Force XO Core ON");
                     vstatus = vos_chipVoteXOCore(NULL, NULL, NULL, VOS_TRUE);
                     if ( !VOS_IS_STATUS_SUCCESS(vstatus) )
                     {
-                        smsLog(pMac, LOGE, "Could not turn XO Core ON. Can't go to BMPS");
+                        pmcLog(pMac, LOGE, "Could not turn XO Core ON. Can't go to BMPS");
                     }
                     else /* XO Core turn ON was successful */
                     {
@@ -2256,13 +2254,13 @@
                     }
                     else
                     {
-                        smsLog(pMac, LOGE, "Fail to send enter BMPS msg to PE");
+                        pmcLog(pMac, LOGE, "Fail to send enter BMPS msg to PE");
                             /* Cancel the vote for XO Core */
-                            smsLog(pMac, LOGW, "In module init: Cancel the vote for XO CORE ON "
+                            pmcLog(pMac, LOGW, "In module init: Cancel the vote for XO CORE ON "
                                                              "since send enter bmps failed");
                             if (vos_chipVoteXOCore(NULL, NULL, NULL, VOS_FALSE) != VOS_STATUS_SUCCESS)
                             {
-                                smsLog(pMac, LOGE, "Could not cancel XO Core ON vote."
+                                pmcLog(pMac, LOGE, "Could not cancel XO Core ON vote."
                                                    "Not returning failure."
                                                    "Power consumed will be high");
                             }
@@ -2272,7 +2270,8 @@
                 }
                 if( !HAL_STATUS_SUCCESS( status ) )
                 {
-                    smsLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_BMPS_REQ status %d", status);
+                    pmcLog(pMac, LOGE,
+                           "PMC: failure to send message eWNI_PMC_ENTER_BMPS_REQ status %d", status);
                     pMac->pmc.bmpsRequestQueued = eANI_BOOLEAN_FALSE;
                     pmcEnterFullPowerState(pMac);
                     //Do not call UAPSD callback here since it may be retried
@@ -2294,12 +2293,12 @@
                 {
                     pMac->pmc.pmcState = REQUEST_FULL_POWER;
                     fRemoveCmd = eANI_BOOLEAN_FALSE;
-                    smsLog(pMac, LOG2, FL("eWNI_PMC_EXIT_BMPS_REQ sent to PE"));
+                    pmcLog(pMac, LOG2, FL("eWNI_PMC_EXIT_BMPS_REQ sent to PE"));
 
                 }
                 else
                 {
-                    smsLog(pMac, LOGE, FL("eWNI_PMC_EXIT_BMPS_REQ fail to be sent to PE status %d"), status);
+                    pmcLog(pMac, LOGE, FL("eWNI_PMC_EXIT_BMPS_REQ fail to be sent to PE status %d"), status);
                     pmcEnterFullPowerState(pMac);
                 }
             }
@@ -2317,7 +2316,7 @@
                 }
                 else
                 {
-                    smsLog(pMac, LOGE, "PMC: failure to send message "
+                    pmcLog(pMac, LOGE, "PMC: failure to send message "
                        "eWNI_PMC_ENTER_BMPS_REQ");
                     //there is no retry for re-entering UAPSD so tell the requester we are done witgh failure.
                     pMac->pmc.uapsdSessionRequired = FALSE;
@@ -2349,7 +2348,7 @@
                }
                else
                {
-                   smsLog(pMac, LOGE, "PMC: failure to send message "
+                   pmcLog(pMac, LOGE, "PMC: failure to send message "
                       "eWNI_PMC_EXIT_UAPSD_REQ");
                    pmcEnterBmpsState(pMac);
                }
@@ -2369,7 +2368,7 @@
                 }
                 else
                 {
-                    smsLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_WOWL_REQ");
+                    pmcLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_ENTER_WOWL_REQ");
                     pmcDoEnterWowlCallbacks(pMac, eHAL_STATUS_FAILURE);
                 }
             }
@@ -2393,7 +2392,7 @@
                 }
                 else
                 {
-                    smsLog(pMac, LOGP, "PMC: failure to send message eWNI_PMC_EXIT_WOWL_REQ");
+                    pmcLog(pMac, LOGP, "PMC: failure to send message eWNI_PMC_EXIT_WOWL_REQ");
                     pmcEnterBmpsState(pMac);
                 }
             }
@@ -2436,7 +2435,7 @@
                 }
                 else
                 {
-                    smsLog(pMac, LOGE, "PMC: failure to send message "
+                    pmcLog(pMac, LOGE, "PMC: failure to send message "
                         "eWNI_PMC_ENTER_IMPS_REQ");
                     pmcEnterFullPowerState(pMac);
                     pmcDoStandbyCallbacks(pMac, eHAL_STATUS_FAILURE);
@@ -2449,7 +2448,7 @@
             break;
 
         default:
-            smsLog( pMac, LOGE, FL("  invalid command type %d"), pCommand->command );
+            pmcLog( pMac, LOGE, FL("  invalid command type %d"), pCommand->command );
             break;
         }
 
@@ -2463,8 +2462,8 @@
 
     if( !PMC_IS_READY(pMac) )
     {
-        smsLog(pMac, LOGE, FL("Requesting IMPS when PMC not ready"));
-        smsLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
+        pmcLog(pMac, LOGE, FL("Requesting IMPS when PMC not ready"));
+        pmcLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
             pMac->pmc.pmcReady, pmcGetPmcStateStr(pMac->pmc.pmcState));
         return eHAL_STATUS_FAILURE;
     }
@@ -2472,21 +2471,21 @@
     /* Check if IMPS is enabled. */
     if (!pMac->pmc.impsEnabled)
     {
-        smsLog(pMac, LOG2, FL("IMPS is disabled"));
+        pmcLog(pMac, LOG2, FL("IMPS is disabled"));
         return eHAL_STATUS_PMC_DISABLED;
     }
 
     /* Check if IMPS enabled for current power source. */
     if ((pMac->pmc.powerSource == AC_POWER) && !pMac->pmc.impsConfig.enterOnAc)
     {
-        smsLog(pMac, LOG2, FL("IMPS is disabled when operating on AC power"));
+        pmcLog(pMac, LOG2, FL("IMPS is disabled when operating on AC power"));
         return eHAL_STATUS_PMC_AC_POWER;
     }
 
     /* Check that entry into a power save mode is allowed at this time. */
     if (!pmcPowerSaveCheck(pMac))
     {
-        smsLog(pMac, LOG2, FL("IMPS cannot be entered now"));
+        pmcLog(pMac, LOG2, FL("IMPS cannot be entered now"));
         return eHAL_STATUS_PMC_NOT_NOW;
     }
 
@@ -2494,7 +2493,7 @@
        running sessions agree. */
     if (!pmcAllowImps(pMac))
     {
-        smsLog(pMac, LOG2, FL("IMPS cannot be entered now"));
+        pmcLog(pMac, LOG2, FL("IMPS cannot be entered now"));
         return eHAL_STATUS_PMC_NOT_NOW;
     }
 
@@ -2502,10 +2501,17 @@
     if ((pMac->pmc.pmcState == REQUEST_IMPS) || (pMac->pmc.pmcState == IMPS) ||
         (pMac->pmc.pmcState == REQUEST_FULL_POWER))
     {
-        smsLog(pMac, LOG2, FL("Already in IMPS"));
+        pmcLog(pMac, LOG2, FL("Already in IMPS"));
         return eHAL_STATUS_PMC_ALREADY_IN_IMPS;
     }
 
+    /* Check whether driver load unload is in progress */
+    if(vos_is_load_unload_in_progress( VOS_MODULE_ID_VOSS, NULL))
+    {
+       pmcLog(pMac, LOGW, FL("Driver load/unload is in progress"));
+       return eHAL_STATUS_PMC_NOT_NOW;
+    }
+
     return ( eHAL_STATUS_SUCCESS );
 }
 
@@ -2518,14 +2524,14 @@
    /* Check if BMPS is enabled. */
    if (!pMac->pmc.bmpsEnabled)
    {
-      smsLog(pMac, LOGE, "PMC: Cannot initiate BMPS. BMPS is disabled");
+      pmcLog(pMac, LOGE, "PMC: Cannot initiate BMPS. BMPS is disabled");
       return eHAL_STATUS_PMC_DISABLED;
    }
 
    if( !PMC_IS_READY(pMac) )
    {
-       smsLog(pMac, LOGE, FL("Requesting BMPS when PMC not ready"));
-       smsLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
+       pmcLog(pMac, LOGE, FL("Requesting BMPS when PMC not ready"));
+       pmcLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
            pMac->pmc.pmcReady, pmcGetPmcStateStr(pMac->pmc.pmcState));
        return eHAL_STATUS_FAILURE;
    }
@@ -2533,20 +2539,21 @@
    /* Check that we are associated with a single active session. */
    if (!pmcValidateConnectState( pMac ))
    {
-      smsLog(pMac, LOGE, "PMC: STA not associated with an AP with single active session. BMPS cannot be entered");
+      pmcLog(pMac, LOGE, "PMC: STA not associated with an AP with single active session. BMPS cannot be entered");
       return eHAL_STATUS_FAILURE;
    }
 
    /* BMPS can only be requested when device is in Full Power */
    if (pMac->pmc.pmcState != FULL_POWER)
    {
-      smsLog(pMac, LOGE, "PMC: Device not in full power. Cannot request BMPS. pmcState %d", pMac->pmc.pmcState);
+      pmcLog(pMac, LOGE,
+             "PMC: Device not in full power. Cannot request BMPS. pmcState %d", pMac->pmc.pmcState);
       return eHAL_STATUS_FAILURE;
    }
    /* Check that entry into a power save mode is allowed at this time. */
    if (!pmcPowerSaveCheck(pMac))
    {
-      smsLog(pMac, LOGE, "PMC: Power save check failed. BMPS cannot be entered now");
+      pmcLog(pMac, LOGE, "PMC: Power save check failed. BMPS cannot be entered now");
       return eHAL_STATUS_PMC_NOT_NOW;
    }
 
@@ -2554,13 +2561,15 @@
     //BMPS_WORKAROUND_NOT_NEEDED
     if(!IS_FEATURE_SUPPORTED_BY_FW(SLM_SESSIONIZATION))
     {
-        smsLog(pMac, LOG1, FL("doBMPSWorkaround %u"), pMac->roam.configParam.doBMPSWorkaround);
+        pmcLog(pMac, LOG1, FL("doBMPSWorkaround %u"), pMac->roam.configParam.doBMPSWorkaround);
         if (pMac->roam.configParam.doBMPSWorkaround)
         {
             pMac->roam.configParam.doBMPSWorkaround = 0;
-            smsLog(pMac, LOG1, FL("reset doBMPSWorkaround to disabled %u"), pMac->roam.configParam.doBMPSWorkaround);
+            pmcLog(pMac, LOG1,
+                   FL("reset doBMPSWorkaround to disabled %u"), pMac->roam.configParam.doBMPSWorkaround);
             csrDisconnectAllActiveSessions(pMac);
-            smsLog(pMac, LOGE, "PMC: doBMPSWorkaround was enabled. First Disconnect all sessions. pmcState %d", pMac->pmc.pmcState);
+            pmcLog(pMac, LOGE,
+                   "PMC: doBMPSWorkaround was enabled. First Disconnect all sessions. pmcState %d", pMac->pmc.pmcState);
             return eHAL_STATUS_FAILURE;
         }
      }
@@ -2579,13 +2588,14 @@
           pMac->pmc.uapsdSessionRequired || pMac->pmc.bmpsRequestedByHdd ||
           pMac->pmc.wowlModeRequired )))
     {
-        smsLog(pMac, LOG1, FL("BMPS is not enabled or not required"));
+        pmcLog(pMac, LOG1, FL("BMPS is not enabled or not required"));
         return eANI_BOOLEAN_FALSE;
     }
 
     if(pMac->pmc.isHostPsEn && pMac->pmc.remainInPowerActiveTillDHCP)
     {
-        smsLog(pMac, LOG1, FL("Host controlled ps enabled and host wants active mode, so dont allow BMPS"));
+        pmcLog(pMac, LOG1,
+               FL("Host controlled ps enabled and host wants active mode, so dont allow BMPS"));
         return eANI_BOOLEAN_FALSE;
     }
 
@@ -2594,14 +2604,14 @@
         (vos_get_concurrency_mode()& VOS_SAP) ||
         (vos_get_concurrency_mode()& VOS_P2P_GO))))
     {
-        smsLog(pMac, LOG1, FL("Multiple Sessions/GO/SAP sessions . BMPS should not be started"));
+        pmcLog(pMac, LOG1, FL("Multiple Sessions/GO/SAP sessions . BMPS should not be started"));
         return eANI_BOOLEAN_FALSE;
     }
     /* Check if there is an Infra session. BMPS is possible only if there is
      * an Infra session */
     if (!csrIsInfraConnected(pMac))
     {
-        smsLog(pMac, LOG1, FL("No Infra Session or multiple sessions. BMPS should not be started"));
+        pmcLog(pMac, LOG1, FL("No Infra Session or multiple sessions. BMPS should not be started"));
         return eANI_BOOLEAN_FALSE;
     }
     return eANI_BOOLEAN_TRUE;
@@ -2623,25 +2633,25 @@
 
     WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 
-    smsLog(pMac, LOGW, FL("DIAG event timer expired"));
+    pmcLog(pMac, LOGW, FL("DIAG event timer expired"));
 
     /* re-arm timer */
     if (pmcStartDiagEvtTimer(hHal) != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGP, FL("Cannot re-arm DIAG evt timer"));
+        pmcLog(pMac, LOGP, FL("Cannot re-arm DIAG evt timer"));
     }
+    vos_timer_start(&pMac->pmc.hDiagEvtTimer, PMC_DIAG_EVT_TIMER_INTERVAL);
 }
 
 eHalStatus pmcStartDiagEvtTimer (tHalHandle hHal)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcStartDiagEvtTimer"));
+    pmcLog(pMac, LOG2, FL("Entering pmcStartDiagEvtTimer"));
 
-    if (palTimerStart(pMac->hHdd, pMac->pmc.hDiagEvtTimer, PMC_DIAG_EVT_TIMER_INTERVAL *
-                          1000, TRUE) != eHAL_STATUS_SUCCESS)
+    if ( vos_timer_start(&pMac->pmc.hDiagEvtTimer, PMC_DIAG_EVT_TIMER_INTERVAL) != VOS_STATUS_SUCCESS)
     {
-       smsLog(pMac, LOGP, FL("Cannot start DIAG evt timer"));
+       pmcLog(pMac, LOGP, FL("Cannot start DIAG evt timer"));
        return eHAL_STATUS_FAILURE;
     }
 
@@ -2651,8 +2661,8 @@
 void pmcStopDiagEvtTimer (tHalHandle hHal)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-    smsLog(pMac, LOG2, FL("Entering pmcStopDiagEvtTimer"));
-    (void)palTimerStop(pMac->hHdd, pMac->pmc.hDiagEvtTimer);
+    pmcLog(pMac, LOG2, FL("Entering pmcStopDiagEvtTimer"));
+    (void)vos_timer_stop(&pMac->pmc.hDiagEvtTimer);
 }
 #endif
 
@@ -2668,12 +2678,7 @@
     {
         pPowerSaveCheckEntry = GET_BASE_ADDR(pEntry, tPmcOffloadPsCheckEntry,
                                              link);
-        if(palFreeMemory(pMac->hHdd, pPowerSaveCheckEntry)
-                         != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            break;
-        }
+        vos_mem_free(pPowerSaveCheckEntry);
         pEntry = csrLLRemoveHead(&pmc->pwrsaveCheckList, FALSE);
     }
     csrLLUnlock(&pmc->pwrsaveCheckList);
@@ -2692,12 +2697,7 @@
     {
         pPowerSaveDevStateEntry = GET_BASE_ADDR(pEntry,
                         tPmcOffloadDevStateUpdIndEntry, link);
-        if(palFreeMemory(pMac->hHdd, pPowerSaveDevStateEntry)
-                         != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            break;
-        }
+        vos_mem_free(pPowerSaveDevStateEntry);
         pEntry = csrLLRemoveHead(&pmc->deviceStateUpdateIndList, FALSE);
     }
     csrLLUnlock(&pmc->deviceStateUpdateIndList);
@@ -2716,12 +2716,7 @@
     {
         pPowerSaveStartUapsdEntry = GET_BASE_ADDR(pEntry,
                         tPmcOffloadStartUapsdEntry, link);
-        if(palFreeMemory(pMac->hHdd, pPowerSaveStartUapsdEntry)
-                         != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            break;
-        }
+        vos_mem_free(pPowerSaveStartUapsdEntry);
         pEntry = csrLLRemoveHead(&pmc->uapsdCbList, FALSE);
     }
     csrLLUnlock(&pmc->uapsdCbList);
@@ -2740,12 +2735,7 @@
     {
         pPowerSaveFullPowerReqEntry = GET_BASE_ADDR(pEntry,
                         tPmcOffloadReqFullPowerEntry, link);
-        if(palFreeMemory(pMac->hHdd, pPowerSaveFullPowerReqEntry)
-                         != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            break;
-        }
+        vos_mem_free(pPowerSaveFullPowerReqEntry);
         pEntry = csrLLRemoveHead(&pmc->fullPowerCbList, FALSE);
     }
     csrLLUnlock(&pmc->fullPowerCbList);
@@ -2883,11 +2873,7 @@
         if(pReqFullPwrEntry->fullPwrCb)
             pReqFullPwrEntry->fullPwrCb(pReqFullPwrEntry->callbackContext,
                                         sessionId, status);
-        if(palFreeMemory(pMac->hHdd, pReqFullPwrEntry) != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE,
-                FL("Cannot free request full power routine list entry"));
-        }
+        vos_mem_free(pReqFullPwrEntry);
         pEntry = csrLLRemoveHead(&pmc->fullPowerCbList, TRUE);
     }
 }
@@ -2933,7 +2919,7 @@
       pStartUapsdEntry = GET_BASE_ADDR(pEntry, tPmcOffloadStartUapsdEntry, link);
       pStartUapsdEntry->uapsdStartInd(pStartUapsdEntry->callbackContext,
                                    pStartUapsdEntry->sessionId, status);
-      palFreeMemory(pMac->hHdd, pStartUapsdEntry);
+      vos_mem_free(pStartUapsdEntry);
       pEntry = csrLLRemoveHead(&pmc->uapsdCbList, FALSE);
    }
    csrLLUnlock(&pmc->uapsdCbList);
@@ -3463,8 +3449,9 @@
 
 void pmcOffloadExitBmpsIndHandler(tpAniSirGlobal pMac, tSirSmeRsp *pMsg)
 {
+    tpSirSmeExitBmpsInd pExitBmpsInd = (tpSirSmeExitBmpsInd)pMsg;
    /* Enter Full Power State. */
-   if (pMsg->statusCode != eSIR_SME_SUCCESS)
+   if (pExitBmpsInd->statusCode != eSIR_SME_SUCCESS)
    {
        smsLog(pMac, LOGP,
        FL("Exit BMPS indication indicates failure, status %x"),
@@ -3472,8 +3459,10 @@
    }
    else
    {
-        tpSirSmeExitBmpsInd pExitBmpsInd = (tpSirSmeExitBmpsInd)pMsg;
-        pmcOffloadQueueRequestFullPower(pMac, pMsg->sessionId,
+        smsLog(pMac, LOG1,
+                FL("Exit BMPS indication on session %lu, reason %d"),
+                pExitBmpsInd->smeSessionId, pExitBmpsInd->exitBmpsReason);
+        pmcOffloadQueueRequestFullPower(pMac, pExitBmpsInd->smeSessionId,
                                 pExitBmpsInd->exitBmpsReason);
    }
 }
diff --git a/CORE/SME/src/pmc/pmcApi.c b/CORE/SME/src/pmc/pmcApi.c
index 140fbe5..ec2ae65 100644
--- a/CORE/SME/src/pmc/pmcApi.c
+++ b/CORE/SME/src/pmc/pmcApi.c
@@ -81,7 +81,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcOpen"));
+    pmcLog(pMac, LOG2, FL("Entering pmcOpen"));
 
     /* Initialize basic PMC information about device. */
     pMac->pmc.powerSource = BATTERY_POWER;
@@ -98,14 +98,14 @@
     pMac->pmc.wowlEnabled = TRUE;
     pMac->pmc.rfSuppliesVotedOff= FALSE;
 
-    palZeroMemory(pMac->hHdd, &(pMac->pmc.bmpsConfig), sizeof(tPmcBmpsConfigParams));
-    palZeroMemory(pMac->hHdd, &(pMac->pmc.impsConfig), sizeof(tPmcImpsConfigParams));
-    palZeroMemory(pMac->hHdd, &(pMac->pmc.smpsConfig), sizeof(tPmcSmpsConfigParams));
+    vos_mem_set(&(pMac->pmc.bmpsConfig), sizeof(tPmcBmpsConfigParams), 0);
+    vos_mem_set(&(pMac->pmc.impsConfig), sizeof(tPmcImpsConfigParams), 0);
+    vos_mem_set(&(pMac->pmc.smpsConfig), sizeof(tPmcSmpsConfigParams), 0);
 
     /* Allocate a timer to use with IMPS. */
-    if (palTimerAlloc(pMac->hHdd, &pMac->pmc.hImpsTimer, pmcImpsTimerExpired, hHal) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_init(&pMac->pmc.hImpsTimer, VOS_TIMER_TYPE_SW, pmcImpsTimerExpired, hHal) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot allocate timer for IMPS"));
+        pmcLog(pMac, LOGE, FL("Cannot allocate timer for IMPS"));
         return eHAL_STATUS_FAILURE;
     }
 
@@ -114,15 +114,15 @@
     if (!VOS_IS_STATUS_SUCCESS(vos_timer_init(&pMac->pmc.hTrafficTimer, 
                                 VOS_TIMER_TYPE_SW, pmcTrafficTimerExpired, hHal)))
     {
-        smsLog(pMac, LOGE, FL("Cannot allocate timer for traffic measurement"));
+        pmcLog(pMac, LOGE, FL("Cannot allocate timer for traffic measurement"));
         return eHAL_STATUS_FAILURE;
     }
 
 #ifdef FEATURE_WLAN_DIAG_SUPPORT    
     /* Allocate a timer used to report current PMC state through periodic DIAG event */
-    if (palTimerAlloc(pMac->hHdd, &pMac->pmc.hDiagEvtTimer, pmcDiagEvtTimerExpired, hHal) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_init(&pMac->pmc.hDiagEvtTimer, VOS_TIMER_TYPE_SW, pmcDiagEvtTimerExpired, hHal) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot allocate timer for diag event reporting"));
+        pmcLog(pMac, LOGE, FL("Cannot allocate timer for diag event reporting"));
         return eHAL_STATUS_FAILURE;
     }
 #endif
@@ -132,10 +132,10 @@
     pMac->pmc.bmpsConfig.bmpsPeriod = WNI_CFG_LISTEN_INTERVAL_STADEF;
 
     /* Allocate a timer used to schedule a deferred power save mode exit. */
-    if (palTimerAlloc(pMac->hHdd, &pMac->pmc.hExitPowerSaveTimer,
-                      pmcExitPowerSaveTimerExpired, hHal) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_init(&pMac->pmc.hExitPowerSaveTimer, VOS_TIMER_TYPE_SW,
+                      pmcExitPowerSaveTimerExpired, hHal) !=VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot allocate exit power save mode timer"));
+        pmcLog(pMac, LOGE, FL("Cannot allocate exit power save mode timer"));
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -143,13 +143,13 @@
     /* Initialize lists for power save check routines and request full power callback routines. */
     if (csrLLOpen(pMac->hHdd, &pMac->pmc.powerSaveCheckList) != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot initialize power save check routine list"));
+        pmcLog(pMac, LOGE, FL("Cannot initialize power save check routine list"));
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
     if (csrLLOpen(pMac->hHdd, &pMac->pmc.requestFullPowerList) != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot initialize request full power callback routine list"));
+        pmcLog(pMac, LOGE, FL("Cannot initialize request full power callback routine list"));
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -158,27 +158,27 @@
     if (csrLLOpen(pMac->hHdd, &pMac->pmc.requestBmpsList) !=
       eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, "PMC: cannot initialize request BMPS callback routine list");
+        pmcLog(pMac, LOGE, "PMC: cannot initialize request BMPS callback routine list");
         return eHAL_STATUS_FAILURE;
     }
 
     /* Initialize lists for request start UAPSD callback routines. */
     if (csrLLOpen(pMac->hHdd, &pMac->pmc.requestStartUapsdList) != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, "PMC: cannot initialize request start UAPSD callback routine list");
+        pmcLog(pMac, LOGE, "PMC: cannot initialize request start UAPSD callback routine list");
         return eHAL_STATUS_FAILURE;
     }
 
     /* Initialize lists for device state update indication callback routines. */
     if (csrLLOpen(pMac->hHdd, &pMac->pmc.deviceStateUpdateIndList) != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, "PMC: cannot initialize device state update indication callback list");
+        pmcLog(pMac, LOGE, "PMC: cannot initialize device state update indication callback list");
         return eHAL_STATUS_FAILURE;
     }
 
     if (csrLLOpen(pMac->hHdd, &pMac->pmc.deferredMsgList) != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot initialize deferred msg list"));
+        pmcLog(pMac, LOGE, FL("Cannot initialize deferred msg list"));
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -207,7 +207,7 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     tSirMacHTMIMOPowerSaveState  htMimoPowerSaveState;
 
-    smsLog(pMac, LOG2, FL("Entering pmcStart"));
+    pmcLog(pMac, LOG2, FL("Entering pmcStart"));
 
     /* Initialize basic PMC information about device. */
     pMac->pmc.pmcState = FULL_POWER;
@@ -290,12 +290,12 @@
     tListElem *pEntry;
     tPmcDeferredMsg *pDeferredMsg;
 
-    smsLog(pMac, LOG2, FL("Entering pmcStop"));
+    pmcLog(pMac, LOG2, FL("Entering pmcStop"));
 
     /* Cancel any running timers. */
-    if (palTimerStop(pMac->hHdd, pMac->pmc.hImpsTimer) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_stop(&pMac->pmc.hImpsTimer) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot cancel IMPS timer"));
+        pmcLog(pMac, LOGE, FL("Cannot cancel IMPS timer"));
     }
 
     pmcStopTrafficTimer(hHal);
@@ -304,9 +304,9 @@
     pmcStopDiagEvtTimer(hHal);
 #endif
 
-    if (palTimerStop(pMac->hHdd, pMac->pmc.hExitPowerSaveTimer) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_stop(&pMac->pmc.hExitPowerSaveTimer) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot cancel exit power save mode timer"));
+        pmcLog(pMac, LOGE, FL("Cannot cancel exit power save mode timer"));
     }
 
     /* Do all the callbacks. */
@@ -321,7 +321,7 @@
     while( NULL != ( pEntry = csrLLRemoveHead( &pMac->pmc.deferredMsgList, eANI_BOOLEAN_FALSE ) ) )
     {
         pDeferredMsg = GET_BASE_ADDR( pEntry, tPmcDeferredMsg, link );
-        palFreeMemory( pMac->hHdd, pDeferredMsg );
+        vos_mem_free(pDeferredMsg);
     }
     csrLLUnlock( &pMac->pmc.deferredMsgList );
 
@@ -352,26 +352,26 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcClose"));
+    pmcLog(pMac, LOG2, FL("Entering pmcClose"));
 
     /* Free up allocated resources. */
-    if (palTimerFree(pMac->hHdd, pMac->pmc.hImpsTimer) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_destroy(&pMac->pmc.hImpsTimer) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot deallocate IMPS timer"));
+        pmcLog(pMac, LOGE, FL("Cannot deallocate IMPS timer"));
     }
     if (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy(&pMac->pmc.hTrafficTimer)))
     {
-        smsLog(pMac, LOGE, FL("Cannot deallocate traffic timer"));
+        pmcLog(pMac, LOGE, FL("Cannot deallocate traffic timer"));
     }
 #ifdef FEATURE_WLAN_DIAG_SUPPORT    
-    if (palTimerFree(pMac->hHdd, pMac->pmc.hDiagEvtTimer) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_destroy(&pMac->pmc.hDiagEvtTimer) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot deallocate timer for diag event reporting"));
+        pmcLog(pMac, LOGE, FL("Cannot deallocate timer for diag event reporting"));
     }
 #endif
-    if (palTimerFree(pMac->hHdd, pMac->pmc.hExitPowerSaveTimer) != eHAL_STATUS_SUCCESS)
+    if (vos_timer_destroy(&pMac->pmc.hExitPowerSaveTimer) != VOS_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Cannot deallocate exit power save mode timer"));
+        pmcLog(pMac, LOGE, FL("Cannot deallocate exit power save mode timer"));
     }
 
     /*
@@ -412,7 +412,7 @@
     tSirMacHTMIMOPowerSaveState  htMimoPowerSaveState;
 #endif
 
-    smsLog(pMac, LOG2, FL("Entering pmcSignalPowerEvent, event %d"), event);
+    pmcLog(pMac, LOG2, FL("Entering pmcSignalPowerEvent, event %d"), event);
 
     /* Take action based on the event being signaled. */
     switch (event)
@@ -470,7 +470,7 @@
         return eHAL_STATUS_SUCCESS;
 #endif //GEN6_ONWARDS
     default:
-        smsLog(pMac, LOGE, FL("Invalid event %d"), event);
+        pmcLog(pMac, LOGE, FL("Invalid event %d"), event);
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -503,7 +503,7 @@
     WLAN_VOS_DIAG_EVENT_DEF(psRequest, vos_event_wlan_powersave_payload_type);
 #endif
 
-    smsLog(pMac, LOG2, FL("Entering pmcSetConfigPowerSave, power save mode %d"), psMode);
+    pmcLog(pMac, LOG2, FL("Entering pmcSetConfigPowerSave, power save mode %d"), psMode);
 
     /* Configure the specified power saving mode. */
     switch (psMode)
@@ -511,35 +511,35 @@
     
     case ePMC_IDLE_MODE_POWER_SAVE:
         pMac->pmc.impsConfig = *(tpPmcImpsConfigParams)pConfigParams;
-        smsLog(pMac, LOG3, FL("IMPS configuration"));
-        smsLog(pMac, LOG3, "          enter on AC: %d",
+        pmcLog(pMac, LOG3, FL("IMPS configuration"));
+        pmcLog(pMac, LOG3, "          enter on AC: %d",
                pMac->pmc.impsConfig.enterOnAc);
         break;
 
     case ePMC_BEACON_MODE_POWER_SAVE:
         pMac->pmc.bmpsConfig = *(tpPmcBmpsConfigParams)pConfigParams;
-        smsLog(pMac, LOG3, FL("BMPS configuration"));
-        smsLog(pMac, LOG3, "          enter on AC: %d",
+        pmcLog(pMac, LOG3, FL("BMPS configuration"));
+        pmcLog(pMac, LOG3, "          enter on AC: %d",
                pMac->pmc.bmpsConfig.enterOnAc);
-        smsLog(pMac, LOG3, "          TX threshold: %d",
+        pmcLog(pMac, LOG3, "          TX threshold: %d",
                pMac->pmc.bmpsConfig.txThreshold);
-        smsLog(pMac, LOG3, "          RX threshold: %d",
+        pmcLog(pMac, LOG3, "          RX threshold: %d",
                pMac->pmc.bmpsConfig.rxThreshold);
-        smsLog(pMac, LOG3, "          traffic measurement period (ms): %d",
+        pmcLog(pMac, LOG3, "          traffic measurement period (ms): %d",
                pMac->pmc.bmpsConfig.trafficMeasurePeriod);
-        smsLog(pMac, LOG3, "          BMPS period: %d",
+        pmcLog(pMac, LOG3, "          BMPS period: %d",
                pMac->pmc.bmpsConfig.bmpsPeriod);
-        smsLog(pMac, LOG3, "          beacons to forward code: %d",
+        pmcLog(pMac, LOG3, "          beacons to forward code: %d",
                pMac->pmc.bmpsConfig.forwardBeacons);
-        smsLog(pMac, LOG3, "          value of N: %d",
+        pmcLog(pMac, LOG3, "          value of N: %d",
                pMac->pmc.bmpsConfig.valueOfN);
-        smsLog(pMac, LOG3, "          use PS poll: %d",
+        pmcLog(pMac, LOG3, "          use PS poll: %d",
                pMac->pmc.bmpsConfig.usePsPoll);
-        smsLog(pMac, LOG3, "          set PM on last frame: %d",
+        pmcLog(pMac, LOG3, "          set PM on last frame: %d",
                pMac->pmc.bmpsConfig.setPmOnLastFrame);
-        smsLog(pMac, LOG3, "          value of enableBeaconEarlyTermination: %d",
+        pmcLog(pMac, LOG3, "          value of enableBeaconEarlyTermination: %d",
                pMac->pmc.bmpsConfig.enableBeaconEarlyTermination);
-        smsLog(pMac, LOG3, "          value of bcnEarlyTermWakeInterval: %d",
+        pmcLog(pMac, LOG3, "          value of bcnEarlyTermWakeInterval: %d",
                pMac->pmc.bmpsConfig.bcnEarlyTermWakeInterval);
 
 #ifdef FEATURE_WLAN_DIAG_SUPPORT    
@@ -558,14 +558,14 @@
 
     case ePMC_SPATIAL_MULTIPLEX_POWER_SAVE:
         pMac->pmc.smpsConfig = *(tpPmcSmpsConfigParams)pConfigParams;
-        smsLog(pMac, LOG3, FL("SMPS configuration"));
-        smsLog(pMac, LOG3, "          mode: %d", pMac->pmc.smpsConfig.mode);
-        smsLog(pMac, LOG3, "          enter on AC: %d",
+        pmcLog(pMac, LOG3, FL("SMPS configuration"));
+        pmcLog(pMac, LOG3, "          mode: %d", pMac->pmc.smpsConfig.mode);
+        pmcLog(pMac, LOG3, "          enter on AC: %d",
                pMac->pmc.smpsConfig.enterOnAc);
         break;
 
     default:
-        smsLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
+        pmcLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -603,7 +603,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcGetConfigPowerSave, power save mode %d"), psMode);
+    pmcLog(pMac, LOG2, FL("Entering pmcGetConfigPowerSave, power save mode %d"), psMode);
 
     /* Configure the specified power saving mode. */
     switch (psMode)
@@ -622,7 +622,7 @@
         break;
 
     default:
-        smsLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
+        pmcLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
         return eHAL_STATUS_FAILURE;
     }
 
@@ -659,7 +659,7 @@
     WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 #endif
     
-    smsLog(pMac, LOG2, FL("Entering pmcEnablePowerSave, power save mode %d"), psMode);
+    pmcLog(pMac, LOG2, FL("Entering pmcEnablePowerSave, power save mode %d"), psMode);
 
     /* Enable the specified power saving mode. */
     switch (psMode)
@@ -704,7 +704,7 @@
         break;
 
     default:
-        smsLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
+        pmcLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -732,12 +732,12 @@
    WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 #endif
 
-   smsLog(pMac, LOG2, FL("Entering pmcStartAutoBmpsTimer"));
+   pmcLog(pMac, LOG2, FL("Entering pmcStartAutoBmpsTimer"));
 
    /* Check if BMPS is enabled. */
    if (!pMac->pmc.bmpsEnabled)
    {
-      smsLog(pMac, LOGE, "PMC: Cannot enable BMPS timer. BMPS is disabled");
+      pmcLog(pMac, LOGE, "PMC: Cannot enable BMPS timer. BMPS is disabled");
       return eHAL_STATUS_FAILURE;
    }
 
@@ -778,7 +778,7 @@
    WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 #endif
 
-   smsLog(pMac, LOG2, FL("Entering pmcStopAutoBmpsTimer"));
+   pmcLog(pMac, LOG2, FL("Entering pmcStopAutoBmpsTimer"));
 
    pMac->pmc.autoBmpsEntryEnabled = FALSE;
    /* If uapsd session is not required or HDD has not requested BMPS, stop the auto bmps timer.*/
@@ -819,7 +819,7 @@
     WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 #endif
 
-    smsLog(pMac, LOG2, FL("Entering pmcDisablePowerSave, power save mode %d"), psMode);
+    pmcLog(pMac, LOG2, FL("Entering pmcDisablePowerSave, power save mode %d"), psMode);
 
     /* Disable the specified power saving mode. */
     switch (psMode)
@@ -856,7 +856,7 @@
         break;
 
     default:
-        smsLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
+        pmcLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -890,7 +890,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcQueryPowerState"));
+    pmcLog(pMac, LOG2, FL("Entering pmcQueryPowerState"));
 
     /* Return current power state based on PMC state. */
     if(pPowerState != NULL)
@@ -942,7 +942,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcIsPowerSaveEnabled, power save mode %d"), psMode);
+    pmcLog(pMac, LOG2, FL("Entering pmcIsPowerSaveEnabled, power save mode %d"), psMode);
 
     /* Check ability to enter based on the specified power saving mode. */
     switch (psMode)
@@ -968,7 +968,7 @@
         break;
 
     default:
-        smsLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
+        pmcLog(pMac, LOGE, FL("Invalid power save mode %d"), psMode);
         PMC_ABORT;
         return FALSE;
     }
@@ -1018,12 +1018,12 @@
     WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 #endif
 
-    smsLog(pMac, LOG2, FL("Entering pmcRequestFullPower"));
+    pmcLog(pMac, LOG2, FL("Entering pmcRequestFullPower"));
 
     if( !PMC_IS_READY(pMac) )
     {
-        smsLog(pMac, LOGE, FL("Requesting Full Power when PMC not ready"));
-        smsLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
+        pmcLog(pMac, LOGE, FL("Requesting Full Power when PMC not ready"));
+        pmcLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
             pMac->pmc.pmcReady, pmcGetPmcStateStr(pMac->pmc.pmcState));
         return eHAL_STATUS_FAILURE;
     }
@@ -1042,12 +1042,10 @@
 
     /* If in IMPS State, then cancel the timer. */
     if (pMac->pmc.pmcState == IMPS)
-        if (palTimerStop(pMac->hHdd, pMac->pmc.hImpsTimer) != eHAL_STATUS_SUCCESS)
+        if (vos_timer_stop(&pMac->pmc.hImpsTimer) != VOS_STATUS_SUCCESS)
         {
-            smsLog(pMac, LOGE, FL("Cannot cancel IMPS timer"));
-            return eHAL_STATUS_FAILURE;
+            pmcLog(pMac, LOGE, FL("Cannot cancel IMPS timer"));
         }
-
     /* Enter Request Full Power State. */
     if (pmcEnterRequestFullPowerState(hHal, fullPowerReason) != eHAL_STATUS_SUCCESS)
         return eHAL_STATUS_FAILURE;
@@ -1057,9 +1055,11 @@
     //If caller doesn't need a callback, simply waits up the chip.
     if( callbackRoutine )
     {
-        if (palAllocateMemory(pMac->hHdd, (void **)&pEntry, sizeof(tRequestFullPowerEntry)) != eHAL_STATUS_SUCCESS)
+        pEntry = vos_mem_malloc(sizeof(tRequestFullPowerEntry));
+        if ( NULL == pEntry )
         {
-            smsLog(pMac, LOGE, FL("Cannot allocate memory for request full power routine list entry"));
+            pmcLog(pMac, LOGE,
+                   FL("Cannot allocate memory for request full power routine list entry"));
             PMC_ABORT;
             return eHAL_STATUS_FAILURE;
         }
@@ -1123,7 +1123,7 @@
 #endif
 
 
-    smsLog(pMac, LOG2, FL("Entering pmcRequestImps"));
+    pmcLog(pMac, LOG2, FL("Entering pmcRequestImps"));
 
     status = pmcEnterImpsCheck( pMac );
     if( HAL_STATUS_SUCCESS( status ) )
@@ -1176,12 +1176,13 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     tpPowerSaveCheckEntry pEntry;
 
-    smsLog(pMac, LOG2, FL("Entering pmcRegisterPowerSaveCheck"));
+    pmcLog(pMac, LOG2, FL("Entering pmcRegisterPowerSaveCheck"));
 
     /* Allocate entry for power save check routine list. */
-    if (palAllocateMemory(pMac->hHdd, (void **)&pEntry, sizeof(tPowerSaveCheckEntry)) != eHAL_STATUS_SUCCESS)
+    pEntry = vos_mem_malloc(sizeof(tPowerSaveCheckEntry));
+    if ( NULL == pEntry )
     {
-        smsLog(pMac, LOGE, FL("Cannot allocate memory for power save check routine list entry"));
+        pmcLog(pMac, LOGE, FL("Cannot allocate memory for power save check routine list entry"));
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -1220,7 +1221,7 @@
     tListElem *pEntry;
     tpPowerSaveCheckEntry pPowerSaveCheckEntry;
 
-    smsLog(pMac, LOG2, FL("Entering pmcDeregisterPowerSaveCheck"));
+    pmcLog(pMac, LOG2, FL("Entering pmcDeregisterPowerSaveCheck"));
 
     /* Find entry in the power save check routine list that matches
        the specified routine and remove it. */
@@ -1232,16 +1233,11 @@
         {
             if (csrLLRemoveEntry(&pMac->pmc.powerSaveCheckList, pEntry, FALSE))
             {
-                if (palFreeMemory(pMac->hHdd, pPowerSaveCheckEntry) != eHAL_STATUS_SUCCESS)
-                {
-                    smsLog(pMac, LOGE, FL("Cannot free memory for power save check routine list entry"));
-                    PMC_ABORT;
-                    return eHAL_STATUS_FAILURE;
-                }
+                vos_mem_free(pPowerSaveCheckEntry);
             }
             else
             {
-                smsLog(pMac, LOGE, FL("Cannot remove power save check routine list entry"));
+                pmcLog(pMac, LOGE, FL("Cannot remove power save check routine list entry"));
                 return eHAL_STATUS_FAILURE;
             }
             return eHAL_STATUS_SUCCESS;
@@ -1265,7 +1261,7 @@
     {
         pCommand = GET_BASE_ADDR(pEntry, tSmeCmd, Link);
 
-        smsLog(pMac, LOG2, FL("process message = %d"), pMsg->messageType);
+        pmcLog(pMac, LOG2, FL("process message = %d"), pMsg->messageType);
 
     /* Process each different type of message. */
     switch (pMsg->messageType)
@@ -1273,10 +1269,10 @@
 
     /* We got a response to our IMPS request.  */
     case eWNI_PMC_ENTER_IMPS_RSP:
-        smsLog(pMac, LOG2, FL("Rcvd eWNI_PMC_ENTER_IMPS_RSP with status = %d"), pMsg->statusCode);
+        pmcLog(pMac, LOG2, FL("Rcvd eWNI_PMC_ENTER_IMPS_RSP with status = %d"), pMsg->statusCode);
             if( (eSmeCommandEnterImps != pCommand->command) && (eSmeCommandEnterStandby != pCommand->command) )
             {
-                smsLog(pMac, LOGW, FL("Rcvd eWNI_PMC_ENTER_IMPS_RSP without request"));
+                pmcLog(pMac, LOGW, FL("Rcvd eWNI_PMC_ENTER_IMPS_RSP without request"));
                 fRemoveCommand = eANI_BOOLEAN_FALSE;
                 break;
             }
@@ -1289,7 +1285,8 @@
                 pmcEnterImpsState(pMac);
                 if (!(pMac->pmc.ImpsReqFailed || pMac->pmc.ImpsReqTimerFailed) && pMac->pmc.ImpsReqFailCnt)
                 {
-                    smsLog(pMac, LOGE, FL("Response message to request to enter IMPS was failed %d times before success"),
+                    pmcLog(pMac, LOGE,
+                           FL("Response message to request to enter IMPS was failed %d times before success"),
                        pMac->pmc.ImpsReqFailCnt);
                        pMac->pmc.ImpsReqFailCnt = 0;
                 }
@@ -1301,7 +1298,8 @@
                 pMac->pmc.ImpsReqFailed = VOS_TRUE;
                 if (!(pMac->pmc.ImpsReqFailCnt & 0xF))
                 {
-                    smsLog(pMac, LOGE, FL("Response message to request to enter IMPS indicates failure, status %x, FailCnt - %d"),
+                    pmcLog(pMac, LOGE,
+                           FL("Response message to request to enter IMPS indicates failure, status %x, FailCnt - %d"),
                        pMsg->statusCode, ++pMac->pmc.ImpsReqFailCnt);
                 }
                 else
@@ -1324,7 +1322,7 @@
                and tell everyone that we aren't going into STANDBY. */
             else
             {
-                smsLog(pMac, LOGE, "PMC: response message to request to enter "
+                pmcLog(pMac, LOGE, "PMC: response message to request to enter "
                        "standby indicates failure, status %x", pMsg->statusCode);
                 pmcEnterFullPowerState(pMac);
                 pmcDoStandbyCallbacks(pMac, eHAL_STATUS_FAILURE);
@@ -1332,42 +1330,43 @@
         }
         else
         {
-            smsLog(pMac, LOGE, "PMC: Enter IMPS rsp rcvd when device is "
+            pmcLog(pMac, LOGE, "PMC: Enter IMPS rsp rcvd when device is "
                "in %d state", pMac->pmc.pmcState);
         }
         break;
 
     /* We got a response to our wake from IMPS request. */
     case eWNI_PMC_EXIT_IMPS_RSP:
-            smsLog(pMac, LOG2, FL("Rcvd eWNI_PMC_EXIT_IMPS_RSP with status = %d"), pMsg->statusCode);
+            pmcLog(pMac, LOG2, FL("Rcvd eWNI_PMC_EXIT_IMPS_RSP with status = %d"), pMsg->statusCode);
             if( eSmeCommandExitImps != pCommand->command )
             {
-                smsLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_IMPS_RSP without request"));
+                pmcLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_IMPS_RSP without request"));
                 fRemoveCommand = eANI_BOOLEAN_FALSE;
                 break;
             }
             /* Check that we are in the correct state for this message. */
             if (pMac->pmc.pmcState != REQUEST_FULL_POWER)
             {
-                smsLog(pMac, LOGE, FL("Got Exit IMPS Response Message while in state %d"), pMac->pmc.pmcState);
+                pmcLog(pMac, LOGE, FL("Got Exit IMPS Response Message while "
+                   "in state %d"), pMac->pmc.pmcState);
                 break;
             }
 
             /* Enter Full Power State. */
             if (pMsg->statusCode != eSIR_SME_SUCCESS)
             {
-                smsLog(pMac, LOGP, FL("Response message to request to exit IMPS indicates failure, status %x"),
-                       pMsg->statusCode);
+                pmcLog(pMac, LOGE, FL("Response message to request to exit "
+                   "IMPS indicates failure, status %x"), pMsg->statusCode);
             }
             pmcEnterFullPowerState(pMac);
         break;
 
     /* We got a response to our BMPS request.  */
     case eWNI_PMC_ENTER_BMPS_RSP:
-            smsLog(pMac, LOG2, FL("Rcvd eWNI_PMC_ENTER_BMPS_RSP with status = %d"), pMsg->statusCode);
+            pmcLog(pMac, LOG2, FL("Rcvd eWNI_PMC_ENTER_BMPS_RSP with status = %d"), pMsg->statusCode);
             if( eSmeCommandEnterBmps != pCommand->command )
             {
-                smsLog(pMac, LOGW, FL("Rcvd eWNI_PMC_ENTER_BMPS_RSP without request"));
+                pmcLog(pMac, LOGW, FL("Rcvd eWNI_PMC_ENTER_BMPS_RSP without request"));
                 fRemoveCommand = eANI_BOOLEAN_FALSE;
                 break;
             }
@@ -1375,7 +1374,8 @@
             /* Check that we are in the correct state for this message. */
             if (pMac->pmc.pmcState != REQUEST_BMPS)
             {
-                smsLog(pMac, LOGE, FL("Got Enter BMPS Response Message while in state %d"), pMac->pmc.pmcState);
+                pmcLog(pMac, LOGE,
+                       FL("Got Enter BMPS Response Message while in state %d"), pMac->pmc.pmcState);
                 break;
             }
 
@@ -1391,7 +1391,8 @@
         /* If response is failure, then we stay in Full Power State and tell everyone that we aren't going into BMPS. */
         else
         {
-                smsLog(pMac, LOGE, FL("Response message to request to enter BMPS indicates failure, status %x"),
+                pmcLog(pMac, LOGE,
+                       FL("Response message to request to enter BMPS indicates failure, status %x"),
                    pMsg->statusCode);
                 pmcEnterFullPowerState(pMac);
                 //Do not call UAPSD callback here since it may be re-entered
@@ -1401,24 +1402,26 @@
 
     /* We got a response to our wake from BMPS request. */
     case eWNI_PMC_EXIT_BMPS_RSP:
-            smsLog(pMac, LOG2, FL("Rcvd eWNI_PMC_EXIT_BMPS_RSP with status = %d"), pMsg->statusCode);
+            pmcLog(pMac, LOG2, FL("Rcvd eWNI_PMC_EXIT_BMPS_RSP with status = %d"), pMsg->statusCode);
             if( eSmeCommandExitBmps != pCommand->command )
             {
-                smsLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_BMPS_RSP without request"));
+                pmcLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_BMPS_RSP without request"));
                 fRemoveCommand = eANI_BOOLEAN_FALSE;
                 break;
             }
             /* Check that we are in the correct state for this message. */
             if (pMac->pmc.pmcState != REQUEST_FULL_POWER)
             {
-                smsLog(pMac, LOGE, FL("Got Exit BMPS Response Message while in state %d"), pMac->pmc.pmcState);
+                pmcLog(pMac, LOGE,
+                       FL("Got Exit BMPS Response Message while in state %d"), pMac->pmc.pmcState);
                 break;
             }
 
             /* Enter Full Power State. */
             if (pMsg->statusCode != eSIR_SME_SUCCESS)
             {
-                smsLog(pMac, LOGP, FL("Response message to request to exit BMPS indicates failure, status %x"),
+                pmcLog(pMac, LOGP,
+                       FL("Response message to request to exit BMPS indicates failure, status %x"),
                        pMsg->statusCode);
             }
             pmcEnterFullPowerState(pMac);
@@ -1426,17 +1429,18 @@
 
         /* We got a response to our Start UAPSD request.  */
         case eWNI_PMC_ENTER_UAPSD_RSP:
-            smsLog(pMac, LOG2, FL("Rcvd eWNI_PMC_ENTER_UAPSD_RSP with status = %d"), pMsg->statusCode);
+            pmcLog(pMac, LOG2, FL("Rcvd eWNI_PMC_ENTER_UAPSD_RSP with status = %d"), pMsg->statusCode);
             if( eSmeCommandEnterUapsd != pCommand->command )
         {
-                smsLog(pMac, LOGW, FL("Rcvd eWNI_PMC_ENTER_UAPSD_RSP without request"));
+                pmcLog(pMac, LOGW, FL("Rcvd eWNI_PMC_ENTER_UAPSD_RSP without request"));
                 fRemoveCommand = eANI_BOOLEAN_FALSE;
                 break;
             }
             /* Check that we are in the correct state for this message. */
             if (pMac->pmc.pmcState != REQUEST_START_UAPSD)
             {
-                smsLog(pMac, LOGE, FL("Got Enter Uapsd rsp Message while in state %d"), pMac->pmc.pmcState);
+                pmcLog(pMac, LOGE,
+                       FL("Got Enter Uapsd rsp Message while in state %d"), pMac->pmc.pmcState);
                 break;
             }
 
@@ -1449,7 +1453,7 @@
          /* If response is failure, then we try to put the chip back in
             BMPS mode*/
             else {
-                smsLog(pMac, LOGE, "PMC: response message to request to enter "
+                pmcLog(pMac, LOGE, "PMC: response message to request to enter "
                    "UAPSD indicates failure, status %x", pMsg->statusCode);
                 //Need to reset the UAPSD flag so pmcEnterBmpsState won't try to enter UAPSD.
                 pMac->pmc.uapsdSessionRequired = FALSE;
@@ -1461,23 +1465,24 @@
 
       /* We got a response to our Stop UAPSD request.  */
       case eWNI_PMC_EXIT_UAPSD_RSP:
-         smsLog(pMac, LOG2, FL("Rcvd eWNI_PMC_EXIT_UAPSD_RSP with status = %d"), pMsg->statusCode);
+         pmcLog(pMac, LOG2, FL("Rcvd eWNI_PMC_EXIT_UAPSD_RSP with status = %d"), pMsg->statusCode);
             if( eSmeCommandExitUapsd != pCommand->command )
             {
-                smsLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_UAPSD_RSP without request"));
+                pmcLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_UAPSD_RSP without request"));
                 fRemoveCommand = eANI_BOOLEAN_FALSE;
                 break;
             }
             /* Check that we are in the correct state for this message. */
             if (pMac->pmc.pmcState != REQUEST_STOP_UAPSD)
             {
-                smsLog(pMac, LOGE, FL("Got Exit Uapsd rsp Message while in state %d"), pMac->pmc.pmcState);
+                pmcLog(pMac, LOGE,
+                       FL("Got Exit Uapsd rsp Message while in state %d"), pMac->pmc.pmcState);
                 break;
             }
 
          /* Enter BMPS State */
          if (pMsg->statusCode != eSIR_SME_SUCCESS) {
-            smsLog(pMac, LOGP, "PMC: response message to request to exit "
+            pmcLog(pMac, LOGP, "PMC: response message to request to exit "
                "UAPSD indicates failure, status %x", pMsg->statusCode);
          }
             pmcEnterBmpsState(pMac);
@@ -1488,14 +1493,14 @@
 
             if( eSmeCommandEnterWowl != pCommand->command )
             {
-                smsLog(pMac, LOGW, FL("Rcvd eWNI_PMC_ENTER_WOWL_RSP without request"));
+                pmcLog(pMac, LOGW, FL("Rcvd eWNI_PMC_ENTER_WOWL_RSP without request"));
                 fRemoveCommand = eANI_BOOLEAN_FALSE;
                 break;
             }
             /* Check that we are in the correct state for this message. */
             if (pMac->pmc.pmcState != REQUEST_ENTER_WOWL)
             {
-                smsLog(pMac, LOGE, FL("Got eWNI_PMC_ENTER_WOWL_RSP while in state %s"),
+                pmcLog(pMac, LOGE, FL("Got eWNI_PMC_ENTER_WOWL_RSP while in state %s"),
                     pmcGetPmcStateStr(pMac->pmc.pmcState));
                 break;
             }
@@ -1509,7 +1514,7 @@
          /* If response is failure, then we try to put the chip back in
             BMPS mode*/
          else {
-            smsLog(pMac, LOGE, "PMC: response message to request to enter "
+            pmcLog(pMac, LOGE, "PMC: response message to request to enter "
                "WOWL indicates failure, status %x", pMsg->statusCode);
                 pmcEnterBmpsState(pMac);
                 pmcDoEnterWowlCallbacks(pMac, eHAL_STATUS_FAILURE);
@@ -1521,27 +1526,27 @@
 
             if( eSmeCommandExitWowl != pCommand->command )
             {
-                smsLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_WOWL_RSP without request"));
+                pmcLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_WOWL_RSP without request"));
                 fRemoveCommand = eANI_BOOLEAN_FALSE;
                 break;
             }
             /* Check that we are in the correct state for this message. */
             if (pMac->pmc.pmcState != REQUEST_EXIT_WOWL)
             {
-                smsLog(pMac, LOGE, FL("Got Exit WOWL rsp Message while in state %d"), pMac->pmc.pmcState);
+                pmcLog(pMac, LOGE, FL("Got Exit WOWL rsp Message while in state %d"), pMac->pmc.pmcState);
                 break;
             }
 
          /* Enter BMPS State */
          if (pMsg->statusCode != eSIR_SME_SUCCESS) {
-            smsLog(pMac, LOGP, "PMC: response message to request to exit "
+            pmcLog(pMac, LOGP, "PMC: response message to request to exit "
                "WOWL indicates failure, status %x", pMsg->statusCode);
          }
             pmcEnterBmpsState(pMac);
          break;
 
     default:
-        smsLog(pMac, LOGE, FL("Invalid message type %d received"), pMsg->messageType);
+        pmcLog(pMac, LOGE, FL("Invalid message type %d received"), pMsg->messageType);
         PMC_ABORT;
         break;
         }//switch
@@ -1557,7 +1562,7 @@
     }
     else
     {
-        smsLog(pMac, LOGE, FL("message type %d received but no request is found"), pMsg->messageType);
+        pmcLog(pMac, LOGE, FL("message type %d received but no request is found"), pMsg->messageType);
     }
 }
 
@@ -1581,7 +1586,7 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcMessageProcessor, message type %d"), pMsg->messageType);
+    pmcLog(pMac, LOG2, FL("Entering pmcMessageProcessor, message type %d"), pMsg->messageType);
 
     switch( pMsg->messageType )
     {
@@ -1589,7 +1594,7 @@
     //When PMC needs to handle more indication from PE, they need to be added here.
     {
         /* Device left BMPS on its own. */
-        smsLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_BMPS_IND with status = %d"), pMsg->statusCode);
+        pmcLog(pMac, LOGW, FL("Rcvd eWNI_PMC_EXIT_BMPS_IND with status = %d"), pMsg->statusCode);
         /* Check that we are in the correct state for this message. */
         switch(pMac->pmc.pmcState)
         {
@@ -1601,10 +1606,10 @@
         case WOWL:
         case REQUEST_EXIT_WOWL:
         case REQUEST_FULL_POWER:
-            smsLog(pMac, LOGW, FL("Got eWNI_PMC_EXIT_BMPS_IND while in state %d"), pMac->pmc.pmcState);
+            pmcLog(pMac, LOGW, FL("Got eWNI_PMC_EXIT_BMPS_IND while in state %d"), pMac->pmc.pmcState);
             break;
         default:
-            smsLog(pMac, LOGE, FL("Got eWNI_PMC_EXIT_BMPS_IND while in state %d"), pMac->pmc.pmcState);
+            pmcLog(pMac, LOGE, FL("Got eWNI_PMC_EXIT_BMPS_IND while in state %d"), pMac->pmc.pmcState);
             PMC_ABORT;
             break;
         }
@@ -1612,7 +1617,7 @@
         /* Enter Full Power State. */
         if (pMsg->statusCode != eSIR_SME_SUCCESS)
         {
-            smsLog(pMac, LOGP, FL("Exit BMPS indication indicates failure, status %x"), pMsg->statusCode);
+            pmcLog(pMac, LOGP, FL("Exit BMPS indication indicates failure, status %x"), pMsg->statusCode);
         }
         else
         {
@@ -1636,19 +1641,19 @@
 
    if ( !csrIsInfraConnected( pMac ) )
    {
-      smsLog(pMac, LOGW, "PMC: STA not associated. BMPS cannot be entered");
+      pmcLog(pMac, LOGW, "PMC: STA not associated. BMPS cannot be entered");
       return eANI_BOOLEAN_FALSE;
    }
 
    //Cannot have other session
    if ( csrIsIBSSStarted( pMac ) )
    {
-      smsLog(pMac, LOGW, "PMC: IBSS started. BMPS cannot be entered");
+      pmcLog(pMac, LOGW, "PMC: IBSS started. BMPS cannot be entered");
       return eANI_BOOLEAN_FALSE;
    }
    if ( csrIsBTAMPStarted( pMac ) )
    {
-      smsLog(pMac, LOGW, "PMC: BT-AMP exists. BMPS cannot be entered");
+      pmcLog(pMac, LOGW, "PMC: BT-AMP exists. BMPS cannot be entered");
       return eANI_BOOLEAN_FALSE;
    }
    if ((vos_concurrent_sessions_running()) &&
@@ -1656,7 +1661,7 @@
        (vos_get_concurrency_mode()& VOS_SAP) ||
        (vos_get_concurrency_mode()& VOS_P2P_GO)))
    {
-      smsLog(pMac, LOGW, "PMC: Multiple active sessions exists. BMPS cannot be entered");
+      pmcLog(pMac, LOGW, "PMC: Multiple active sessions exists. BMPS cannot be entered");
       return eANI_BOOLEAN_FALSE;
    }
    return eANI_BOOLEAN_TRUE;
@@ -1669,19 +1674,19 @@
     //Cannot have other session like IBSS or BT AMP running
     if ( csrIsIBSSStarted( pMac ) )
     {
-       smsLog(pMac, LOGW, "PMC: IBSS started. IMPS cannot be entered");
+       pmcLog(pMac, LOGW, "PMC: IBSS started. IMPS cannot be entered");
        return eANI_BOOLEAN_FALSE;
     }
     if ( csrIsBTAMPStarted( pMac ) )
     {
-       smsLog(pMac, LOGW, "PMC: BT-AMP exists. IMPS cannot be entered");
+       pmcLog(pMac, LOGW, "PMC: BT-AMP exists. IMPS cannot be entered");
        return eANI_BOOLEAN_FALSE;
     }
 
     //All sessions must be disconnected to allow IMPS
     if ( !csrIsAllSessionDisconnected( pMac ) )
     {
-       smsLog(pMac, LOGW, "PMC: Atleast one connected session. IMPS cannot be entered");
+       pmcLog(pMac, LOGW, "PMC: Atleast one connected session. IMPS cannot be entered");
        return eANI_BOOLEAN_FALSE;
     }
 
@@ -1725,12 +1730,12 @@
    WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 #endif
 
-   smsLog(pMac, LOG2, "PMC: entering pmcRequestBmps");
+   pmcLog(pMac, LOG2, "PMC: entering pmcRequestBmps");
 
    /* If already in BMPS, just return. */
    if (pMac->pmc.pmcState == BMPS || REQUEST_START_UAPSD == pMac->pmc.pmcState || UAPSD == pMac->pmc.pmcState)
    {
-      smsLog(pMac, LOG2, "PMC: Device already in BMPS pmcState %d", pMac->pmc.pmcState);
+      pmcLog(pMac, LOG2, "PMC: Device already in BMPS pmcState %d", pMac->pmc.pmcState);
       pMac->pmc.bmpsRequestedByHdd = TRUE;
       return eHAL_STATUS_SUCCESS;
    }
@@ -1749,11 +1754,10 @@
 
          /* If able to enter Request BMPS State, then request is pending.
             Allocate entry for request BMPS callback routine list. */
-         if (palAllocateMemory(
-               pMac->hHdd, (void **)&pEntry,
-               sizeof(tRequestBmpsEntry)) != eHAL_STATUS_SUCCESS)
+         pEntry = vos_mem_malloc(sizeof(tRequestBmpsEntry));
+         if ( NULL == pEntry )
          {
-            smsLog(pMac, LOGE, "PMC: cannot allocate memory for request "
+            pmcLog(pMac, LOGE, "PMC: cannot allocate memory for request "
                   "BMPS routine list entry");
             return eHAL_STATUS_FAILURE;
          }
@@ -1777,16 +1781,16 @@
    else if (status == eHAL_STATUS_PMC_NOT_NOW)
    {
       pmcStopTrafficTimer(hHal);
-      smsLog(pMac, LOG1, FL("Can't enter BMPS+++"));
+      pmcLog(pMac, LOG1, FL("Can't enter BMPS+++"));
       if (pmcShouldBmpsTimerRun(pMac))
       {
          if (pmcStartTrafficTimer(pMac,
                                   pMac->pmc.bmpsConfig.trafficMeasurePeriod)
                                   != eHAL_STATUS_SUCCESS)
          {
-            smsLog(pMac, LOG1, FL("Cannot start BMPS Retry timer"));
+            pmcLog(pMac, LOG1, FL("Cannot start BMPS Retry timer"));
          }
-         smsLog(pMac, LOG1,
+         pmcLog(pMac, LOG1,
                 FL("BMPS Retry Timer already running or started"));
       }
    }
@@ -1831,12 +1835,12 @@
    WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 #endif
 
-   smsLog(pMac, LOG2, "PMC: entering pmcStartUapsd");
+   pmcLog(pMac, LOG2, "PMC: entering pmcStartUapsd");
 
    if( !PMC_IS_READY(pMac) )
    {
-       smsLog(pMac, LOGE, FL("Requesting UAPSD when PMC not ready"));
-       smsLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
+       pmcLog(pMac, LOGE, FL("Requesting UAPSD when PMC not ready"));
+       pmcLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
            pMac->pmc.pmcReady, pmcGetPmcStateStr(pMac->pmc.pmcState));
        return eHAL_STATUS_FAILURE;
    }
@@ -1844,14 +1848,14 @@
    /* Check if BMPS is enabled. */
    if (!pMac->pmc.bmpsEnabled)
    {
-      smsLog(pMac, LOGE, "PMC: Cannot enter UAPSD. BMPS is disabled");
+      pmcLog(pMac, LOGE, "PMC: Cannot enter UAPSD. BMPS is disabled");
       return eHAL_STATUS_PMC_DISABLED;
    }
 
    /* Check if UAPSD is enabled. */
    if (!pMac->pmc.uapsdEnabled)
    {
-      smsLog(pMac, LOGE, "PMC: Cannot enter UAPSD. UAPSD is disabled");
+      pmcLog(pMac, LOGE, "PMC: Cannot enter UAPSD. UAPSD is disabled");
       return eHAL_STATUS_PMC_DISABLED;
    }
 
@@ -1862,7 +1866,7 @@
    /* Check that we are associated. */
    if (!pmcValidateConnectState( pMac ))
    {
-      smsLog(pMac, LOGE, "PMC: STA not associated with an AP. UAPSD cannot be entered");
+      pmcLog(pMac, LOGE, "PMC: STA not associated with an AP. UAPSD cannot be entered");
       return eHAL_STATUS_FAILURE;
    }
 
@@ -1873,10 +1877,10 @@
    if( NULL != callbackRoutine )
    {
       /* If success then request is pending. Allocate entry for callback routine list. */
-      if (palAllocateMemory(pMac->hHdd, (void **)&pEntry,
-            sizeof(tStartUapsdEntry)) != eHAL_STATUS_SUCCESS)
+      pEntry = vos_mem_malloc(sizeof(tStartUapsdEntry));
+      if ( NULL == pEntry )
       {
-         smsLog(pMac, LOGE, "PMC: cannot allocate memory for request "
+         pmcLog(pMac, LOGE, "PMC: cannot allocate memory for request "
             "start UAPSD routine list entry");
          return eHAL_STATUS_FAILURE;
       }
@@ -1920,7 +1924,7 @@
    WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 #endif
 
-   smsLog(pMac, LOG2, "PMC: entering pmcStopUapsd");
+   pmcLog(pMac, LOG2, "PMC: entering pmcStopUapsd");
 
    /* Clear any buffered command for entering UAPSD */
    pMac->pmc.uapsdSessionRequired = FALSE;
@@ -1929,7 +1933,7 @@
       some other module (HDD, BT-AMP) requested Full Power.*/
    if (pMac->pmc.pmcState != UAPSD && pMac->pmc.pmcState != REQUEST_STOP_UAPSD)
    {
-      smsLog(pMac, LOGW, "PMC: Device is already out of UAPSD "
+      pmcLog(pMac, LOGW, "PMC: Device is already out of UAPSD "
          "state. Current state is %d", pMac->pmc.pmcState);
       return eHAL_STATUS_SUCCESS;
    }
@@ -1968,19 +1972,19 @@
    WLAN_VOS_DIAG_EVENT_REPORT(&psRequest, EVENT_WLAN_POWERSAVE_GENERIC);
 #endif
 
-   smsLog(pMac, LOG2, "PMC: entering pmcRequestStandby");
+   pmcLog(pMac, LOG2, "PMC: entering pmcRequestStandby");
 
    /* Check if standby is enabled. */
    if (!pMac->pmc.standbyEnabled)
    {
-      smsLog(pMac, LOGE, "PMC: Cannot enter standby. Standby is disabled");
+      pmcLog(pMac, LOGE, "PMC: Cannot enter standby. Standby is disabled");
       return eHAL_STATUS_PMC_DISABLED;
    }
 
    if( !PMC_IS_READY(pMac) )
    {
-       smsLog(pMac, LOGE, FL("Requesting standby when PMC not ready"));
-       smsLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
+       pmcLog(pMac, LOGE, FL("Requesting standby when PMC not ready"));
+       pmcLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
            pMac->pmc.pmcReady, pmcGetPmcStateStr(pMac->pmc.pmcState));
        return eHAL_STATUS_FAILURE;
    }
@@ -2027,12 +2031,13 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     tpDeviceStateUpdateIndEntry pEntry;
 
-    smsLog(pMac, LOG2, FL("Entering pmcRegisterDeviceStateUpdateInd"));
+    pmcLog(pMac, LOG2, FL("Entering pmcRegisterDeviceStateUpdateInd"));
 
     /* Allocate entry for device power state update indication. */
-    if (palAllocateMemory(pMac->hHdd, (void **)&pEntry, sizeof(tDeviceStateUpdateIndEntry)) != eHAL_STATUS_SUCCESS)
+    pEntry = vos_mem_malloc(sizeof(tDeviceStateUpdateIndEntry));
+    if ( NULL == pEntry )
     {
-        smsLog(pMac, LOGE, FL("Cannot allocate memory for device power state update indication"));
+        pmcLog(pMac, LOGE, FL("Cannot allocate memory for device power state update indication"));
         PMC_ABORT;
         return eHAL_STATUS_FAILURE;
     }
@@ -2063,7 +2068,7 @@
     tListElem *pEntry;
     tpDeviceStateUpdateIndEntry pDeviceStateUpdateIndEntry;
 
-    smsLog(pMac, LOG2, FL("Entering pmcDeregisterDeviceStateUpdateInd"));
+    pmcLog(pMac, LOG2, FL("Entering pmcDeregisterDeviceStateUpdateInd"));
 
     /* Find entry in the power save update routine list that matches
        the specified routine and remove it. */
@@ -2075,15 +2080,10 @@
         {
             if (!csrLLRemoveEntry(&pMac->pmc.deviceStateUpdateIndList, pEntry, FALSE))
             {
-                smsLog(pMac, LOGE, FL("Cannot remove device state update ind entry from list"));
+                pmcLog(pMac, LOGE, FL("Cannot remove device state update ind entry from list"));
                 return eHAL_STATUS_FAILURE;
             }
-            if (palFreeMemory(pMac->hHdd, pDeviceStateUpdateIndEntry) != eHAL_STATUS_SUCCESS)
-            {
-                smsLog(pMac, LOGE, FL("Cannot free memory for device state update ind routine list entry"));
-                PMC_ABORT;
-                return eHAL_STATUS_FAILURE;
-            }
+            vos_mem_free(pDeviceStateUpdateIndEntry);
             return eHAL_STATUS_SUCCESS;
         }
         pEntry = csrLLNext(&pMac->pmc.deviceStateUpdateIndList, pEntry, FALSE);
@@ -2107,11 +2107,11 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-    smsLog(pMac, LOG2, FL("Entering pmcReady"));
+    pmcLog(pMac, LOG2, FL("Entering pmcReady"));
 
     if(pMac->pmc.pmcState == STOPPED)
     {
-        smsLog(pMac, LOGP, FL("pmcReady is invoked even before pmcStart"));
+        pmcLog(pMac, LOGP, FL("pmcReady is invoked even before pmcStart"));
         return eHAL_STATUS_FAILURE;
     }
 
@@ -2149,17 +2149,17 @@
     WLAN_VOS_DIAG_LOG_ALLOC(log_ptr, vos_log_powersave_wow_add_ptrn_pkt_type, LOG_WLAN_POWERSAVE_WOW_ADD_PTRN_C);
 #endif //#ifdef FEATURE_WLAN_DIAG_SUPPORT
 
-    smsLog(pMac, LOG2, "PMC: entering pmcWowlAddBcastPattern");
+    pmcLog(pMac, LOG2, "PMC: entering pmcWowlAddBcastPattern");
 
     if(pattern == NULL)
     {
-        smsLog(pMac, LOGE, FL("Null broadcast pattern being passed"));
+        pmcLog(pMac, LOGE, FL("Null broadcast pattern being passed"));
         return eHAL_STATUS_FAILURE;
     }
 
     if( pSession == NULL)
     {
-        smsLog(pMac, LOGE, FL("Session not found "));
+        pmcLog(pMac, LOGE, FL("Session not found "));
         return eHAL_STATUS_FAILURE;
     }
 
@@ -2171,18 +2171,21 @@
        log_ptr->pattern_size = pattern->ucPatternSize;
        log_ptr->pattern_mask_size = pattern->ucPatternMaskSize;
 
-       vos_mem_copy(log_ptr->pattern, pattern->ucPattern, SIR_WOWL_BCAST_PATTERN_MAX_SIZE);
+       vos_mem_copy(log_ptr->pattern, pattern->ucPattern,
+                    SIR_WOWL_BCAST_PATTERN_MAX_SIZE);
        /* 1 bit in the pattern mask denotes 1 byte of pattern hence pattern mask size is 1/8 */
-       vos_mem_copy(log_ptr->pattern_mask, pattern->ucPatternMask, SIR_WOWL_BCAST_PATTERN_MAX_SIZE >> 3);
+       vos_mem_copy(log_ptr->pattern_mask, pattern->ucPatternMask,
+                    SIR_WOWL_BCAST_PATTERN_MAX_SIZE >> 3);
     }
 
     WLAN_VOS_DIAG_LOG_REPORT(log_ptr);
+    WLAN_VOS_DIAG_LOG_FREE(log_ptr);
 #endif
 
 
     if(pattern->ucPatternId >= SIR_WOWL_BCAST_MAX_NUM_PATTERNS )
     {
-        smsLog(pMac, LOGE, FL("Pattern Id must range from 0 to %d"), SIR_WOWL_BCAST_MAX_NUM_PATTERNS-1);
+        pmcLog(pMac, LOGE, FL("Pattern Id must range from 0 to %d"), SIR_WOWL_BCAST_MAX_NUM_PATTERNS-1);
         return eHAL_STATUS_FAILURE;
     }
 
@@ -2192,39 +2195,33 @@
 
     if( pMac->pmc.pmcState == STANDBY || pMac->pmc.pmcState == REQUEST_STANDBY )
     {
-        smsLog(pMac, LOGE, FL("Cannot add WoWL Pattern as chip is in %s state"),
+        pmcLog(pMac, LOGE, FL("Cannot add WoWL Pattern as chip is in %s state"),
            pmcGetPmcStateStr(pMac->pmc.pmcState));
         return eHAL_STATUS_FAILURE;
     }
+
     if( pMac->pmc.pmcState == IMPS || pMac->pmc.pmcState == REQUEST_IMPS )
     {
-        eHalStatus status;
-        vos_mem_copy(pattern->bssId, pSession->connectedProfile.bssid, sizeof(tSirMacAddr));
-        //Wake up the chip first
-        status = pmcDeferMsg( pMac, eWNI_PMC_WOWL_ADD_BCAST_PTRN, 
-                                    pattern, sizeof(tSirWowlAddBcastPtrn) );
-
-        if( eHAL_STATUS_PMC_PENDING == status )
-        {
-            return eHAL_STATUS_SUCCESS;
-        }
-        else 
-        {
-            //either fail or already in full power
-            if( !HAL_STATUS_SUCCESS( status ) )
-            {
-                return ( status );
-            }
-            //else let it through because it is in full power state
-        }
+        pmcLog(pMac, LOGE, FL("Cannot add WoWL Pattern as chip is in %s state"),
+           pmcGetPmcStateStr(pMac->pmc.pmcState));
+        return eHAL_STATUS_FAILURE;
     }
 
+    if( !csrIsConnStateConnected(pMac, sessionId) )
+    {
+        pmcLog(pMac, LOGE, FL("Cannot add WoWL Pattern session in %d state"),
+           pSession->connectState);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    vos_mem_copy(pattern->bssId, pSession->connectedProfile.bssid, sizeof(tSirMacAddr));
+
 skip_pmc_state_transition:
 
     if (pmcSendMessage(hHal, eWNI_PMC_WOWL_ADD_BCAST_PTRN, pattern, sizeof(tSirWowlAddBcastPtrn))
         != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Send of eWNI_PMC_WOWL_ADD_BCAST_PTRN to PE failed"));
+        pmcLog(pMac, LOGE, FL("Send of eWNI_PMC_WOWL_ADD_BCAST_PTRN to PE failed"));
         return eHAL_STATUS_FAILURE;
     }
 
@@ -2258,17 +2255,17 @@
     WLAN_VOS_DIAG_EVENT_REPORT(&wowRequest, EVENT_WLAN_POWERSAVE_WOW);
 #endif
 
-    smsLog(pMac, LOG2, "PMC: entering pmcWowlDelBcastPattern");
+    pmcLog(pMac, LOG2, "PMC: entering pmcWowlDelBcastPattern");
 
     if( NULL == pSession )
     {
-        smsLog(pMac, LOGE, FL("Session not found "));
+        pmcLog(pMac, LOGE, FL("Session not found "));
         return eHAL_STATUS_FAILURE;
     }
 
     if(pattern->ucPatternId >= SIR_WOWL_BCAST_MAX_NUM_PATTERNS )
     {
-        smsLog(pMac, LOGE, FL("Pattern Id must range from 0 to %d"),
+        pmcLog(pMac, LOGE, FL("Pattern Id must range from 0 to %d"),
             SIR_WOWL_BCAST_MAX_NUM_PATTERNS-1);
         return eHAL_STATUS_FAILURE;
     }
@@ -2279,16 +2276,19 @@
 
     if(pMac->pmc.pmcState == STANDBY || pMac->pmc.pmcState == REQUEST_STANDBY)
     {
-        smsLog(pMac, LOGE, FL("Cannot delete WoWL Pattern as chip is in %s state"),
+        pmcLog(pMac, LOGE, FL("Cannot delete WoWL Pattern as chip is in %s state"),
            pmcGetPmcStateStr(pMac->pmc.pmcState));
         return eHAL_STATUS_FAILURE;
     }
 
+    vos_mem_copy(pattern->bssId, pSession->connectedProfile.bssid, sizeof(tSirMacAddr));
+
     if( pMac->pmc.pmcState == IMPS || pMac->pmc.pmcState == REQUEST_IMPS )
     {
         eHalStatus status;
 
-        vos_mem_copy(pattern->bssId, pSession->connectedProfile.bssid, sizeof(tSirMacAddr));
+        vos_mem_copy(pattern->bssId, pSession->connectedProfile.bssid,
+                     sizeof(tSirMacAddr));
         //Wake up the chip first
         status = pmcDeferMsg( pMac, eWNI_PMC_WOWL_DEL_BCAST_PTRN, 
                                     pattern, sizeof(tSirWowlDelBcastPtrn) );
@@ -2313,7 +2313,7 @@
     if (pmcSendMessage(hHal, eWNI_PMC_WOWL_DEL_BCAST_PTRN, pattern, sizeof(tSirWowlDelBcastPtrn))
         != eHAL_STATUS_SUCCESS)
     {
-        smsLog(pMac, LOGE, FL("Send of eWNI_PMC_WOWL_DEL_BCAST_PTRN to PE failed"));
+        pmcLog(pMac, LOGE, FL("Send of eWNI_PMC_WOWL_DEL_BCAST_PTRN to PE failed"));
         return eHAL_STATUS_FAILURE;
     }
 
@@ -2378,7 +2378,8 @@
    if(wowlEnterParams->ucMagicPktEnable)
    {
        wowRequest.wow_type |= 1;
-       vos_mem_copy(wowRequest.wow_magic_pattern, (tANI_U8 *)wowlEnterParams->magicPtrn, 6);
+       vos_mem_copy(wowRequest.wow_magic_pattern,
+                   (tANI_U8 *)wowlEnterParams->magicPtrn, 6);
    }
 
    if(wowlEnterParams->ucPatternFilteringEnable)
@@ -2388,11 +2389,11 @@
    WLAN_VOS_DIAG_EVENT_REPORT(&wowRequest, EVENT_WLAN_POWERSAVE_WOW);
 #endif
 
-   smsLog(pMac, LOG2, FL("PMC: entering pmcEnterWowl"));
+   pmcLog(pMac, LOG2, FL("PMC: entering pmcEnterWowl"));
 
    if( NULL == pSession )
    {
-       smsLog(pMac, LOGE, FL("Session not found "));
+       pmcLog(pMac, LOGE, FL("Session not found "));
        return eHAL_STATUS_FAILURE;
    }
 
@@ -2400,13 +2401,10 @@
    if( pMac->psOffloadEnabled )
         goto skip_pmc_state_transition;
 
-   vos_mem_copy(wowlEnterParams->bssId, pSession->connectedProfile.bssid, 
-               sizeof(tSirMacAddr));
-
    if( !PMC_IS_READY(pMac) )
    {
-       smsLog(pMac, LOGE, FL("Requesting WoWL when PMC not ready"));
-       smsLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
+       pmcLog(pMac, LOGE, FL("Requesting WoWL when PMC not ready"));
+       pmcLog(pMac, LOGE, FL("pmcReady = %d pmcState = %s"),
            pMac->pmc.pmcReady, pmcGetPmcStateStr(pMac->pmc.pmcState));
        return eHAL_STATUS_FAILURE;
    }
@@ -2414,21 +2412,21 @@
    /* Check if BMPS is enabled. */
    if (!pMac->pmc.bmpsEnabled)
    {
-      smsLog(pMac, LOGE, "PMC: Cannot enter WoWL. BMPS is disabled");
+      pmcLog(pMac, LOGE, "PMC: Cannot enter WoWL. BMPS is disabled");
       return eHAL_STATUS_PMC_DISABLED;
    }
 
    /* Check if WoWL is enabled. */
    if (!pMac->pmc.wowlEnabled)
    {
-      smsLog(pMac, LOGE, "PMC: Cannot enter WoWL. WoWL is disabled");
+      pmcLog(pMac, LOGE, "PMC: Cannot enter WoWL. WoWL is disabled");
       return eHAL_STATUS_PMC_DISABLED;
    }
 
    /* Check that we are associated with single Session. */
    if (!pmcValidateConnectState( pMac ))
    {
-      smsLog(pMac, LOGE, "PMC: Cannot enable WOWL. STA not associated "
+      pmcLog(pMac, LOGE, "PMC: Cannot enable WOWL. STA not associated "
              "with an Access Point in Infra Mode with single active session");
       return eHAL_STATUS_FAILURE;
    }
@@ -2437,18 +2435,21 @@
       module to do the necessary cleanup before triggring WOWL*/
    if(pMac->pmc.uapsdSessionRequired)
    {
-      smsLog(pMac, LOGE, "PMC: Cannot request WOWL. Pending UAPSD request");
+      pmcLog(pMac, LOGE, "PMC: Cannot request WOWL. Pending UAPSD request");
       return eHAL_STATUS_FAILURE;
    }
 
    /* Check that entry into a power save mode is allowed at this time. */
    if (pMac->pmc.pmcState == FULL_POWER && !pmcPowerSaveCheck(hHal))
    {
-      smsLog(pMac, LOGE, "PMC: Power save check failed. WOWL request "
+      pmcLog(pMac, LOGE, "PMC: Power save check failed. WOWL request "
              "will not be accepted");
       return eHAL_STATUS_FAILURE;
    }
 
+   vos_mem_copy(wowlEnterParams->bssId, pSession->connectedProfile.bssid,
+               sizeof(tSirMacAddr));
+
 skip_pmc_state_transition:
    // To avoid race condition, set callback routines before sending message.
    /* cache the WOWL information */
@@ -2496,7 +2497,7 @@
    WLAN_VOS_DIAG_EVENT_REPORT(&wowRequest, EVENT_WLAN_POWERSAVE_WOW);
 #endif
 
-   smsLog(pMac, LOG2, "PMC: entering pmcExitWowl");
+   pmcLog(pMac, LOG2, "PMC: entering pmcExitWowl");
 
    /* Clear any buffered command for entering WOWL */
    pMac->pmc.wowlModeRequired = FALSE;
@@ -2548,7 +2549,8 @@
         return eHAL_STATUS_FAILED_ALLOC;
     }
 
-    vos_mem_copy(pRequest->bssId, pSession->connectedProfile.bssid, sizeof(tSirMacAddr));
+    vos_mem_copy(pRequest->bssId, pSession->connectedProfile.bssid,
+                 sizeof(tSirMacAddr));
 
     vos_mem_copy(pRequestBuf, pRequest, sizeof(tSirHostOffloadReq));
 
@@ -2643,7 +2645,7 @@
 
     if( NULL == pSession )
     {
-        smsLog(pMac, LOGE, FL("Session not found "));
+        pmcLog(pMac, LOGE, FL("Session not found "));
         return eHAL_STATUS_FAILURE;
     }
 
@@ -2683,12 +2685,7 @@
     while ( (pEntry = csrLLRemoveHead(&pMac->pmc.powerSaveCheckList, FALSE)) )
     {
         pPowerSaveCheckEntry = GET_BASE_ADDR(pEntry, tPowerSaveCheckEntry, link);
-        if (palFreeMemory(pMac->hHdd, pPowerSaveCheckEntry) != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            PMC_ABORT;
-            break;
-        }
+        vos_mem_free(pPowerSaveCheckEntry);
     }
     csrLLUnlock(&pMac->pmc.powerSaveCheckList);
     csrLLClose(&pMac->pmc.powerSaveCheckList);
@@ -2704,12 +2701,7 @@
     while ( (pEntry = csrLLRemoveHead(&pMac->pmc.requestFullPowerList, FALSE)) )
     {
         pRequestFullPowerEntry = GET_BASE_ADDR(pEntry, tRequestFullPowerEntry, link);
-        if (palFreeMemory(pMac->hHdd, pRequestFullPowerEntry) != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            PMC_ABORT;
-            break;
-        }
+        vos_mem_free(pRequestFullPowerEntry);
     }
     csrLLUnlock(&pMac->pmc.requestFullPowerList);
     csrLLClose(&pMac->pmc.requestFullPowerList);
@@ -2725,12 +2717,7 @@
     while ( (pEntry = csrLLRemoveHead(&pMac->pmc.requestBmpsList, FALSE)) )
     {
         pRequestBmpsEntry = GET_BASE_ADDR(pEntry, tRequestBmpsEntry, link);
-        if (palFreeMemory(pMac->hHdd, pRequestBmpsEntry) != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            PMC_ABORT;
-            break;
-        }
+        vos_mem_free(pRequestBmpsEntry);
     }
     csrLLUnlock(&pMac->pmc.requestBmpsList);
     csrLLClose(&pMac->pmc.requestBmpsList);
@@ -2746,12 +2733,7 @@
     while ( (pEntry = csrLLRemoveHead(&pMac->pmc.requestStartUapsdList, FALSE)) )
     {
         pStartUapsdEntry = GET_BASE_ADDR(pEntry, tStartUapsdEntry, link);
-        if (palFreeMemory(pMac->hHdd, pStartUapsdEntry) != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            PMC_ABORT;
-            break;
-        }
+        vos_mem_free(pStartUapsdEntry);
     }
     csrLLUnlock(&pMac->pmc.requestStartUapsdList);
     csrLLClose(&pMac->pmc.requestStartUapsdList);
@@ -2767,12 +2749,7 @@
     while ( (pEntry = csrLLRemoveHead(&pMac->pmc.deviceStateUpdateIndList, FALSE)) )
     {
         pDeviceStateUpdateIndEntry = GET_BASE_ADDR(pEntry, tDeviceStateUpdateIndEntry, link);
-        if (palFreeMemory(pMac->hHdd, pDeviceStateUpdateIndEntry) != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            PMC_ABORT;
-            break;
-        }
+        vos_mem_free(pDeviceStateUpdateIndEntry);
     }
     csrLLUnlock(&pMac->pmc.deviceStateUpdateIndList);
     csrLLClose(&pMac->pmc.deviceStateUpdateIndList);
@@ -2788,12 +2765,7 @@
     while ( (pEntry = csrLLRemoveHead(&pMac->pmc.deferredMsgList, FALSE)) )
     {
         pDeferredMsg = GET_BASE_ADDR(pEntry, tPmcDeferredMsg, link);
-        if (palFreeMemory(pMac->hHdd, pDeferredMsg) != eHAL_STATUS_SUCCESS)
-        {
-            smsLog(pMac, LOGE, FL("Cannot free memory "));
-            PMC_ABORT;
-            break;
-        }
+        vos_mem_free(pDeferredMsg);
     }
     csrLLUnlock(&pMac->pmc.deferredMsgList);
     csrLLClose(&pMac->pmc.deferredMsgList);
@@ -2807,7 +2779,7 @@
                       tANI_U8* pBD,
                       tANI_U8 type,
                       tANI_U8 subType,
-                      tSirMacAddr peerAddr ,
+                      tSirMacAddr peerAddr,
                       tSirMacAddr selfMacAddr)
 {
     tSirRetStatus   statusCode = eSIR_SUCCESS;
@@ -2822,18 +2794,12 @@
     pMacHdr->fc.subType = subType;
 
     // Prepare Address 1
-    palCopyMemory( pMac->hHdd,
-                   (tANI_U8 *) pMacHdr->da,
-                   (tANI_U8 *) peerAddr,
-                   sizeof( tSirMacAddr ));
+    vos_mem_copy((tANI_U8 *) pMacHdr->da, (tANI_U8 *) peerAddr, sizeof( tSirMacAddr ));
 
     sirCopyMacAddr(pMacHdr->sa,selfMacAddr);
 
     // Prepare Address 3
-    palCopyMemory( pMac->hHdd,
-                   (tANI_U8 *) pMacHdr->bssId,
-                   (tANI_U8 *) peerAddr,
-                   sizeof( tSirMacAddr ));
+    vos_mem_copy((tANI_U8 *) pMacHdr->bssId, (tANI_U8 *) peerAddr, sizeof( tSirMacAddr ));
     return statusCode;
 } /*** pmcPopulateMacHeader() ***/
 
@@ -2857,7 +2823,7 @@
     // The scheme here is to fill out a 'tDot11fProbeRequest' structure
     // and then hand it off to 'dot11fPackProbeRequest' (for
     // serialization).  We start by zero-initializing the structure:
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&pr, sizeof( pr ) );
+    vos_mem_set(( tANI_U8* )&pr, sizeof( pr ), 0);
 
     PopulateDot11fSuppRates( pMac, nChannelNum, &pr.SuppRates,NULL);
 
@@ -2901,11 +2867,11 @@
     nBytes = nPayload + sizeof( tSirMacMgmtHdr );
   
     /* Prepare outgoing frame*/
-    palZeroMemory( pMac->hHdd, pFrame, nBytes );
+    vos_mem_set(pFrame, nBytes, 0);
 
     // Next, we fill out the buffer descriptor:
     nSirStatus = pmcPopulateMacHeader( pMac, pFrame, SIR_MAC_MGMT_FRAME,
-                                SIR_MAC_MGMT_PROBE_REQ, bssId ,selfMacAddr);
+                                SIR_MAC_MGMT_PROBE_REQ, bssId,selfMacAddr);
 
     if ( eSIR_SUCCESS != nSirStatus )
     {
@@ -2952,8 +2918,8 @@
     tANI_U8 ucDot11Mode;
 
     VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-               "%s: SSID = 0x%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx, "
-               "0x%08lx%08lx%08lx%08lx%08lx%08lx%08lx%08lx", __func__,
+               "%s: SSID = 0x%08x%08x%08x%08x%08x%08x%08x%08x, "
+               "0x%08x%08x%08x%08x%08x%08x%08x%08x", __func__,
                *((v_U32_t *) &pRequest->aNetworks[0].ssId.ssId[0]),
                *((v_U32_t *) &pRequest->aNetworks[0].ssId.ssId[4]),
                *((v_U32_t *) &pRequest->aNetworks[0].ssId.ssId[8]),
@@ -2986,15 +2952,60 @@
                                        csrFindBestPhyMode( pMac, pMac->roam.configParam.phyMode ));
 
     /*Prepare a probe request for 2.4GHz band and one for 5GHz band*/
-    pmcPrepareProbeReqTemplate(pMac,SIR_PNO_24G_DEFAULT_CH, ucDot11Mode, pSession->selfMacAddr,
-                               pRequestBuf->p24GProbeTemplate,
-                               &pRequestBuf->us24GProbeTemplateLen,
-                               pSession);
+    if (eSIR_SUCCESS == pmcPrepareProbeReqTemplate(pMac, SIR_PNO_24G_DEFAULT_CH,
+                              ucDot11Mode, pSession->selfMacAddr,
+                              pRequestBuf->p24GProbeTemplate,
+                              &pRequestBuf->us24GProbeTemplateLen, pSession))
+    {
+        /* Append IE passed by supplicant(if any) to probe request */
+        if ((0 < pRequest->us24GProbeTemplateLen) &&
+            ((pRequestBuf->us24GProbeTemplateLen +
+              pRequest->us24GProbeTemplateLen) < SIR_PNO_MAX_PB_REQ_SIZE ))
+        {
+            vos_mem_copy((tANI_U8 *)&pRequestBuf->p24GProbeTemplate +
+                          pRequestBuf->us24GProbeTemplateLen,
+                          (tANI_U8 *)&pRequest->p24GProbeTemplate,
+                          pRequest->us24GProbeTemplateLen);
+            pRequestBuf->us24GProbeTemplateLen +=
+                                                pRequest->us24GProbeTemplateLen;
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                   "%s: pRequest->us24GProbeTemplateLen = %d", __func__,
+                    pRequest->us24GProbeTemplateLen);
+        }
+        else
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                   "%s: Extra ie discarded on 2.4G, IE length = %d", __func__,
+                    pRequest->us24GProbeTemplateLen);
+        }
+    }
 
-    pmcPrepareProbeReqTemplate(pMac,SIR_PNO_5G_DEFAULT_CH, ucDot11Mode, pSession->selfMacAddr,
+    if (eSIR_SUCCESS == pmcPrepareProbeReqTemplate(pMac, SIR_PNO_5G_DEFAULT_CH,
+                               ucDot11Mode, pSession->selfMacAddr,
                                pRequestBuf->p5GProbeTemplate,
-                               &pRequestBuf->us5GProbeTemplateLen,
-                               pSession);
+                               &pRequestBuf->us5GProbeTemplateLen, pSession))
+    {
+        /* Append IE passed by supplicant(if any) to probe request */
+        if ((0 < pRequest->us5GProbeTemplateLen ) &&
+            ((pRequestBuf->us5GProbeTemplateLen +
+              pRequest->us5GProbeTemplateLen) < SIR_PNO_MAX_PB_REQ_SIZE ))
+        {
+            vos_mem_copy((tANI_U8 *)&pRequestBuf->p5GProbeTemplate +
+                          pRequestBuf->us5GProbeTemplateLen,
+                          (tANI_U8 *)&pRequest->p5GProbeTemplate,
+                          pRequest->us5GProbeTemplateLen);
+            pRequestBuf->us5GProbeTemplateLen += pRequest->us5GProbeTemplateLen;
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                    "%s: pRequestBuf->us5GProbeTemplateLen = %d", __func__,
+                     pRequest->us5GProbeTemplateLen);
+        }
+        else
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                   "%s: Extra IE discarded on 5G, IE length = %d", __func__,
+                    pRequest->us5GProbeTemplateLen);
+        }
+    }
 
     if (pMac->pnoOffload)
     {
@@ -3173,7 +3184,8 @@
         return eHAL_STATUS_FAILED_ALLOC;
     }
 
-    vos_mem_copy(pRequestBuf->bssId, pSession->connectedProfile.bssid, sizeof(tSirMacAddr)); 
+    vos_mem_copy(pRequestBuf->bssId, pSession->connectedProfile.bssid,
+                 sizeof(tSirMacAddr));
 
     msg.type = WDA_PACKET_COALESCING_FILTER_MATCH_COUNT_REQ;
     msg.reserved = 0;
@@ -3223,7 +3235,7 @@
     tpAniSirGlobal   pMac = PMAC_STRUCT(hHal);
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
 
-    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "%s: KeyReplayCounter: %d", 
+    VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "%s: KeyReplayCounter: %lld",
                 __func__, pGtkOffload->ullKeyReplayCounter);
 
     if(NULL == pSession )
@@ -3241,7 +3253,8 @@
         return eHAL_STATUS_FAILED_ALLOC;
     }
 
-    vos_mem_copy(pGtkOffload->bssId, pSession->connectedProfile.bssid, sizeof(tSirMacAddr)); 
+    vos_mem_copy(pGtkOffload->bssId, pSession->connectedProfile.bssid,
+                 sizeof(tSirMacAddr));
 
     vos_mem_copy(pRequestBuf, pGtkOffload, sizeof(tSirGtkOffloadParams));
 
@@ -3276,7 +3289,7 @@
     tpAniSirGlobal          pMac = PMAC_STRUCT(hHal);
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
 
-    VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s: filterId = %d", 
+    VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s: Entered",
                 __func__);
 
     if(NULL == pSession )
@@ -3343,6 +3356,154 @@
     pMac->pmc.ImpsReqTimerFailed = VOS_FALSE;
 }
 
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/* -----------------------------------------------------------------------------
+    \fn pmcSetBatchScanReq
+    \brief  setting batch scan request in FW
+    \param  hHal - The handle returned by macOpen.
+    \param  sessionId - session ID
+    \param  callbackRoutine - Pointer to set batch scan request callback routine
+    \param  callbackContext - Pointer to set batch scan request callback context
+    \return eHalStatus
+             eHAL_STATUS_FAILURE  Cannot set batch scan request
+             eHAL_STATUS_SUCCESS  Request accepted.
+ -----------------------------------------------------------------------------*/
+
+eHalStatus pmcSetBatchScanReq(tHalHandle hHal, tSirSetBatchScanReq *pRequest,
+    tANI_U8 sessionId, hddSetBatchScanReqCallback callbackRoutine,
+    void *callbackContext)
+{
+    tpSirSetBatchScanReq pRequestBuf;
+    vos_msg_t msg;
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+
+    pRequestBuf = vos_mem_malloc(sizeof(tSirSetBatchScanReq));
+    if (NULL == pRequestBuf)
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+          "%s: Not able to allocate memory for SET BATCH SCAN req", __func__);
+        return eHAL_STATUS_FAILED_ALLOC;
+    }
+
+    /* Cache HDD callback information*/
+    pMac->pmc.setBatchScanReqCallback = callbackRoutine;
+    pMac->pmc.setBatchScanReqCallbackContext = callbackContext;
+
+    pRequestBuf->scanFrequency = pRequest->scanFrequency;
+    pRequestBuf->numberOfScansToBatch = pRequest->numberOfScansToBatch;
+    pRequestBuf->bestNetwork = pRequest->bestNetwork;
+    pRequestBuf->rfBand = pRequest->rfBand;
+    pRequestBuf->rtt = pRequest->rtt;
+
+    msg.type     = WDA_SET_BATCH_SCAN_REQ;
+    msg.reserved = 0;
+    msg.bodyptr  = pRequestBuf;
+    if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+          "%s: Not able to post WDA_SET_BATCH_SCAN_REQ message to WDA",
+          __func__);
+        vos_mem_free(pRequestBuf);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    return eHAL_STATUS_SUCCESS;
+}
+
+/* -----------------------------------------------------------------------------
+    \fn pmcTriggerBatchScanResultInd
+    \brief  API to trigger batch scan results indications from FW
+    \param  hHal - The handle returned by macOpen.
+    \param  sessionId - session ID
+    \param  callbackRoutine - Pointer to get batch scan request callback routine
+    \param  callbackContext - Pointer to get batch scan request callback context
+    \return eHalStatus
+             eHAL_STATUS_FAILURE  Cannot set batch scan request
+             eHAL_STATUS_SUCCESS  Request accepted.
+ -----------------------------------------------------------------------------*/
+
+eHalStatus pmcTriggerBatchScanResultInd
+(
+    tHalHandle hHal, tSirTriggerBatchScanResultInd *pRequest, tANI_U8 sessionId,
+    hddTriggerBatchScanResultIndCallback callbackRoutine, void *callbackContext
+)
+{
+    tpSirTriggerBatchScanResultInd pRequestBuf;
+    vos_msg_t msg;
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+
+    pRequestBuf = vos_mem_malloc(sizeof(tSirTriggerBatchScanResultInd));
+    if (NULL == pRequestBuf)
+    {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+        "%s: Not able to allocate memory for WDA_TRIGGER_BATCH_SCAN_RESULT_IND",
+        __func__);
+        return eHAL_STATUS_FAILED_ALLOC;
+    }
+
+    /*HDD callback to be called after getting batch scan result ind from FW*/
+    pMac->pmc.batchScanResultCallback = callbackRoutine;
+    pMac->pmc.batchScanResultCallbackContext = callbackContext;
+
+    pRequestBuf->param = pRequest->param;
+
+    msg.type     = WDA_TRIGGER_BATCH_SCAN_RESULT_IND;
+    msg.reserved = 0;
+    msg.bodyptr  = pRequestBuf;
+    if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+          "%s: Not able to post WDA_TRIGGER_BATCH_SCAN_RESULT_IND message"
+          " to WDA", __func__);
+        vos_mem_free(pRequestBuf);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    return eHAL_STATUS_SUCCESS;
+}
+
+/* -----------------------------------------------------------------------------
+    \fn pmcStopBatchScanInd
+    \brief  Stoping batch scan request in FW
+    \param  hHal - The handle returned by macOpen.
+    \param  callbackRoutine - Pointer to stop batch scan request callback routine
+    \return eHalStatus
+             eHAL_STATUS_FAILURE  Cannot set batch scan request
+             eHAL_STATUS_SUCCESS  Request accepted.
+ -----------------------------------------------------------------------------*/
+
+eHalStatus pmcStopBatchScanInd(tHalHandle hHal, tSirStopBatchScanInd *pRequest,
+    tANI_U8 sessionId)
+{
+    tSirStopBatchScanInd *pRequestBuf;
+    vos_msg_t msg;
+
+    pRequestBuf = vos_mem_malloc(sizeof(tSirStopBatchScanInd));
+    if (NULL == pRequestBuf)
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+          "%s: Not able to allocate memory for STOP BATCH SCAN IND", __func__);
+        return eHAL_STATUS_FAILED_ALLOC;
+    }
+
+    pRequestBuf->param = pRequest->param;
+
+    msg.type     = WDA_STOP_BATCH_SCAN_IND;
+    msg.reserved = 0;
+    msg.bodyptr  = pRequestBuf;
+    if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+          "%s: Not able to post WDA_TOP_BATCH_SCAN_IND message to WDA", __func__);
+        vos_mem_free(pRequestBuf);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    return eHAL_STATUS_SUCCESS;
+}
+
+#endif
+
 eHalStatus pmcOffloadCleanup(tHalHandle hHal, tANI_U32 sessionId)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
@@ -3482,8 +3643,8 @@
     smsLog(pMac, LOG2, FL("Enter pmcOffloadRegPowerSaveCheck"));
 
     /* Allocate entry for power save check routine list. */
-    if(palAllocateMemory(pMac->hHdd, (void **)&pEntry,
-                      sizeof(tPmcOffloadPsCheckEntry)) != eHAL_STATUS_SUCCESS)
+    pEntry = vos_mem_malloc(sizeof(tPmcOffloadPsCheckEntry));
+    if (!pEntry)
     {
         smsLog(pMac, LOGE,
                FL("Cannot allocate memory for power save check routine list"));
@@ -3525,13 +3686,7 @@
         {
             if(csrLLRemoveEntry(&pmc->pwrsaveCheckList, pEntry, FALSE))
             {
-                if(palFreeMemory(pMac->hHdd, pPowerSaveCheckEntry)
-                                 != eHAL_STATUS_SUCCESS)
-                {
-                    smsLog(pMac, LOGE,
-                         FL("Cannot free powersave check routine list entry"));
-                    return eHAL_STATUS_FAILURE;
-                }
+                vos_mem_free(pPowerSaveCheckEntry);
             }
             else
             {
@@ -3559,8 +3714,8 @@
     smsLog(pMac, LOG2, FL("Enter pmcOffloadRegisterDeviceStateUpdateInd"));
 
     /* Allocate entry for device power state update indication. */
-    if(palAllocateMemory(pMac->hHdd, (void **)&pEntry,
-                sizeof(tPmcOffloadDevStateUpdIndEntry)) != eHAL_STATUS_SUCCESS)
+    pEntry = vos_mem_malloc(sizeof(tPmcOffloadDevStateUpdIndEntry));
+    if (!pEntry)
     {
         smsLog(pMac, LOGE,
                FL("Cannot allocate memory for device power state update ind"));
@@ -3607,13 +3762,7 @@
                     FL("Cannot remove devicestate update ind entry list"));
                 return eHAL_STATUS_FAILURE;
             }
-            if(eHAL_STATUS_SUCCESS !=
-               palFreeMemory(pMac->hHdd, pDeviceStateUpdateIndEntry))
-            {
-                smsLog(pMac, LOGE,
-                    FL("Cannot free device state update ind list entry"));
-                return eHAL_STATUS_FAILURE;
-            }
+            vos_mem_free(pDeviceStateUpdateIndEntry);
             return eHAL_STATUS_SUCCESS;
         }
         pEntry = csrLLNext(&pmc->deviceStateUpdateIndList, pEntry, FALSE);
@@ -3734,8 +3883,8 @@
         tpPmcOffloadReqFullPowerEntry pEntry;
 
         /* Allocate entry for Full Power Cb list. */
-        if(palAllocateMemory(pMac->hHdd, (void **)&pEntry,
-             sizeof(tPmcOffloadReqFullPowerEntry)) != eHAL_STATUS_SUCCESS)
+        pEntry = vos_mem_malloc(sizeof(tPmcOffloadReqFullPowerEntry));
+        if (!pEntry)
         {
             smsLog(pMac, LOGE,
                    FL("Cannot allocate memory for Full Power routine list"));
@@ -3793,8 +3942,8 @@
         tpPmcOffloadStartUapsdEntry pEntry;
         tpPsOffloadPerSessionInfo pmc = &pMac->pmcOffloadInfo.pmc[sessionId];
         /* Allocate entry for Start Uapsd Cb list. */
-        if(palAllocateMemory(pMac->hHdd, (void **)&pEntry,
-           sizeof(tPmcOffloadStartUapsdEntry)) != eHAL_STATUS_SUCCESS)
+        pEntry = vos_mem_malloc(sizeof(tPmcOffloadStartUapsdEntry));
+        if (!pEntry)
         {
             smsLog(pMac, LOGE,
                    FL("Cannot allocate memory for start uapsd list"));
@@ -4056,7 +4205,7 @@
                                     sizeof(tSirSmeWowlExitParams));
             if ( !HAL_STATUS_SUCCESS( status ) )
             {
-                smsLog(pMac, LOGE, "PMC: failure to send message eWNI_PMC_EXIT_WOWL_REQ");
+                smsLog(pMac, LOGP, "PMC: failure to send message eWNI_PMC_EXIT_WOWL_REQ");
             }
             break;
 
diff --git a/CORE/SME/src/pmc/pmcLogDump.c b/CORE/SME/src/pmc/pmcLogDump.c
index a15524d..f0bf73f 100644
--- a/CORE/SME/src/pmc/pmcLogDump.c
+++ b/CORE/SME/src/pmc/pmcLogDump.c
@@ -51,21 +51,21 @@
 void dump_pmc_callbackRoutine (void *callbackContext, eHalStatus status)
 {
     tpAniSirGlobal pMac = (tpAniSirGlobal)callbackContext;
-    smsLog(pMac, LOGW, "*********Received callback from PMC with status = %d\n*********",status);
+    pmcLog(pMac, LOGW, "*********Received callback from PMC with status = %d\n*********",status);
 }
 
 #ifdef WLAN_WAKEUP_EVENTS
 void dump_pmc_callbackRoutine2 (void *callbackContext, tpSirWakeReasonInd pWakeReasonInd)
 {
     tpAniSirGlobal pMac = (tpAniSirGlobal)callbackContext;
-    smsLog(pMac, LOGW, "*********Received callback from PMC with reason = %d\n*********",pWakeReasonInd->ulReason);
+    pmcLog(pMac, LOGW, "*********Received callback from PMC with reason = %d\n*********",pWakeReasonInd->ulReason);
 }
 #endif // WLAN_WAKEUP_EVENTS
 
 void dump_pmc_deviceUpdateRoutine (void *callbackContext, tPmcState pmcState)
 {
     tpAniSirGlobal pMac = (tpAniSirGlobal)callbackContext;
-    smsLog(pMac, LOGW, "*********Received msg from PMC: Device is in %s state\n*********", pmcGetPmcStateStr(pmcState));
+    pmcLog(pMac, LOGW, "*********Received msg from PMC: Device is in %s state\n*********", pmcGetPmcStateStr(pmcState));
 }
 
 static char *
@@ -89,7 +89,7 @@
     p += log_sprintf( pMac,p, " PMC: UapsdSessionRequired = %d\n", pMac->pmc.uapsdSessionRequired);
     p += log_sprintf( pMac,p, " PMC: wowlModeRequired = %d\n\n", pMac->pmc.wowlModeRequired);
 
-    smsLog(pMac, LOGW, "\n%s", ptr);
+    pmcLog(pMac, LOGW, "\n%s", ptr);
 
     return p;
 }
@@ -222,11 +222,12 @@
 
     (void) arg4;
 
-    palZeroMemory(pMac->hHdd, &wowlEnterParams, sizeof(tSirSmeWowlEnterParams));
+    vos_mem_set(&wowlEnterParams, sizeof(tSirSmeWowlEnterParams), 0);
 
     if (arg1 == 0 && arg2 == 0)
     {
-        smsLog(pMac, LOGE, "Requesting WoWL but neither magic pkt and ptrn byte matching is being enabled\n");
+        pmcLog(pMac, LOGE,
+               "Requesting WoWL but neither magic pkt and ptrn byte matching is being enabled\n");
         return p;
     }
     if(arg1 == 1)
@@ -237,7 +238,8 @@
         status = wlan_cfgGetStr(pMac, WNI_CFG_STA_ID, (tANI_U8 *)wowlEnterParams.magicPtrn, &length); 
         if (eSIR_SUCCESS != status)
         {
-            smsLog(pMac, LOGE, "Reading of WNI_CFG_STA_ID from CFG failed. Using hardcoded STA MAC Addr\n");
+            pmcLog(pMac, LOGE,
+                   "Reading of WNI_CFG_STA_ID from CFG failed. Using hardcoded STA MAC Addr\n");
             wowlEnterParams.magicPtrn[0] = 0x00;
             wowlEnterParams.magicPtrn[1] = 0x0a;
             wowlEnterParams.magicPtrn[2] = 0xf5;
@@ -253,7 +255,7 @@
 
     if(arg3 == CSR_ROAM_SESSION_MAX )
     {
-        smsLog(pMac, LOGE, "Enter valid sessionId\n");
+        pmcLog(pMac, LOGE, "Enter valid sessionId\n");
         return p;
     }
     pMac->pmc.bmpsEnabled = TRUE;
@@ -286,7 +288,7 @@
     tANI_U8  sessionId = 0;
     (void) arg3; (void) arg4;
  
-    palZeroMemory(pMac->hHdd, &delPattern, sizeof(tSirWowlDelBcastPtrn));
+    vos_mem_set(&delPattern, sizeof(tSirWowlDelBcastPtrn), 0);
 
     if((arg1 <= 7) || (arg2 == CSR_ROAM_SESSION_MAX))
     {
@@ -294,7 +296,7 @@
     }
     else
     {
-        smsLog(pMac, LOGE, "dump_pmc_remove_ptrn: Invalid pattern Id %d\n",arg1);
+        pmcLog(pMac, LOGE, "dump_pmc_remove_ptrn: Invalid pattern Id %d\n",arg1);
         return p;
     }
 
@@ -337,15 +339,15 @@
     tANI_U8            sessionId = 0;
 
     smeRsp.statusCode = eSIR_SME_SUCCESS;
-    palZeroMemory(pMac->hHdd, &addPattern, sizeof(tSirWowlAddBcastPtrn));
-    palZeroMemory(pMac->hHdd, &delPattern, sizeof(tSirWowlDelBcastPtrn));
-    palZeroMemory(pMac->hHdd, &wowlEnterParams, sizeof(tSirSmeWowlEnterParams));
+    vos_mem_set(&addPattern, sizeof(tSirWowlAddBcastPtrn), 0);
+    vos_mem_set(&delPattern, sizeof(tSirWowlDelBcastPtrn), 0);
+    vos_mem_set(&wowlEnterParams, sizeof(tSirSmeWowlEnterParams), 0);
 
     (void) arg2; (void) arg3; (void) arg4;
 
     if(arg1 == CSR_ROAM_SESSION_MAX)
     {
-        smsLog(pMac, LOGE, "dump_pmc_test_Wowl: Invalid sessionId\n");
+        pmcLog(pMac, LOGE, "dump_pmc_test_Wowl: Invalid sessionId\n");
         return p;
     }
 
diff --git a/CORE/SME/src/rrm/sme_rrm.c b/CORE/SME/src/rrm/sme_rrm.c
index b770cb6..afb2797 100644
--- a/CORE/SME/src/rrm/sme_rrm.c
+++ b/CORE/SME/src/rrm/sme_rrm.c
@@ -58,7 +58,7 @@
 
 #include "rrmGlobal.h"
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 #include "csrCcx.h"
 #endif
 
@@ -131,7 +131,7 @@
     /* Stop the timer if it is already running. The timer should be running only in the SUCCESS case. */
     if (VOS_TIMER_STATE_RUNNING == vos_timer_getCurrentState(&pMac->rrm.rrmSmeContext.neighborReqControlInfo.neighborRspWaitTimer))
     {
-        VOS_ASSERT(VOS_STATUS_SUCCESS == vosStatus);
+        smsLog( pMac, LOG1, FL("No entry in neighbor report cache"));
         vos_timer_stop(&pMac->rrm.rrmSmeContext.neighborReqControlInfo.neighborRspWaitTimer);
     }
     callback = pMac->rrm.rrmSmeContext.neighborReqControlInfo.neighborRspCallbackInfo.neighborRspCallback;
@@ -145,7 +145,7 @@
     /* Call the callback with the status received from caller */
     if (callback)
         callback(callbackContext, vosStatus);
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
     // We came here with IAPP AP List
     // Make sure we inform CSR of the neighbor list
     // for CCX Associations. First clear the cache.
@@ -215,7 +215,6 @@
        pBeaconRep->messageType = eWNI_SME_BEACON_REPORT_RESP_XMIT_IND;
        pBeaconRep->length = length;
        pBeaconRep->uDialogToken = pSmeRrmContext->token;
-       pBeaconRep->duration = pSmeRrmContext->duration;
        pBeaconRep->regClass = pSmeRrmContext->regClass;
        vos_mem_copy( pBeaconRep->bssId, pSmeRrmContext->sessionBssId, sizeof(tSirMacAddr) );
 
@@ -248,7 +247,7 @@
 
                pBeaconRep->numBssDesc++;
 
-               if (++msgCounter >= SIR_BCN_REPORT_MAX_BSS_DESC_PER_ACTION_FRAME)
+               if (++msgCounter >= SIR_BCN_REPORT_MAX_BSS_DESC)
                    break;
 
                pCurResult = pResultArr[bssCounter + msgCounter];
@@ -287,6 +286,156 @@
    return status;
 }
 
+#if defined(FEATURE_WLAN_CCX_UPLOAD)
+/**---------------------------------------------------------------------------
+
+  \brief sme_CcxSendBeaconReqScanResults()
+
+   This function sends up the scan results received as a part of
+   beacon request scanning.
+   This function is called after receiving the scan results per channel
+   Due to the limitation on the size of the IWEVCUSTOM buffer, we send 3 BSSIDs of
+   beacon report information in one custom event;
+
+  \param  - pMac -      Pointer to the Hal Handle.
+              - sessionId  - Session id
+              - channel     - scan results belongs to this channel
+              - pResultArr - scan result.
+              - measurementDone - flag to indicate that the measurement is done.
+              - bss_count - number of bss found
+  \return - 0 for success, non zero for failure
+
+  --------------------------------------------------------------------------*/
+static eHalStatus sme_CcxSendBeaconReqScanResults(tpAniSirGlobal pMac,
+                                                  tANI_U32       sessionId,
+                                                  tANI_U8        channel,
+                                                  tCsrScanResultInfo **pResultArr,
+                                                  tANI_U8        measurementDone,
+                                                  tANI_U8        bss_count)
+{
+   eHalStatus              status         = eHAL_STATUS_FAILURE;
+   tpSirBssDescription     pBssDesc       = NULL;
+   tANI_U32                ie_len         = 0;
+   tANI_U32                outIeLen       = 0;
+   tANI_U8                 bssCounter     = 0;
+   tCsrScanResultInfo     *pCurResult     = NULL;
+   tANI_U8                 msgCounter     = 0;
+   tpRrmSMEContext         pSmeRrmContext = &pMac->rrm.rrmSmeContext;
+   tCsrRoamInfo            roamInfo;
+   tSirCcxBcnReportRsp     bcnReport;
+   tpSirCcxBcnReportRsp    pBcnReport     = &bcnReport;
+   tpCsrCcxBeaconReqParams pCurMeasReqIe  = NULL;
+   tANI_U8                 i              = 0;
+
+   if (NULL == pSmeRrmContext)
+   {
+       smsLog( pMac, LOGE, "pSmeRrmContext is NULL");
+       return eHAL_STATUS_FAILURE;
+   }
+
+   if (NULL == pResultArr && !measurementDone)
+   {
+      smsLog( pMac, LOGE, "Beacon report xmit Ind to HDD Failed");
+      return eHAL_STATUS_FAILURE;
+   }
+
+   if (pResultArr)
+       pCurResult=pResultArr[bssCounter];
+
+   vos_mem_zero(&bcnReport, sizeof(tSirCcxBcnReportRsp));
+   do
+   {
+       pCurMeasReqIe = NULL;
+       for (i = 0; i < pSmeRrmContext->ccxBcnReqInfo.numBcnReqIe; i++)
+       {
+           if(pSmeRrmContext->ccxBcnReqInfo.bcnReq[i].channel == channel)
+           {
+               pCurMeasReqIe = &pSmeRrmContext->ccxBcnReqInfo.bcnReq[i];
+               break;
+           }
+       }
+       pBcnReport->measurementToken = pCurMeasReqIe->measurementToken;
+       smsLog( pMac, LOG1, "Channel(%d) MeasToken(%d)", channel, pBcnReport->measurementToken);
+
+       msgCounter=0;
+       while (pCurResult)
+       {
+           pBssDesc = &pCurResult->BssDescriptor;
+           if (NULL != pBssDesc)
+           {
+               ie_len = GET_IE_LEN_IN_BSS( pBssDesc->length );
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.ChanNum = pBssDesc->channelId;
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.Spare = 0;
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.MeasDuration = pCurMeasReqIe->measurementDuration;
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.PhyType = pBssDesc->nwType;
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.RecvSigPower = pBssDesc->rssi;
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.ParentTsf = pBssDesc->parentTSF;
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.TargetTsf[0] = pBssDesc->timeStamp[0];
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.TargetTsf[1] = pBssDesc->timeStamp[1];
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.BcnInterval = pBssDesc->beaconInterval;
+               pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.CapabilityInfo = pBssDesc->capabilityInfo;
+               vos_mem_copy(pBcnReport->bcnRepBssInfo[msgCounter].bcnReportFields.Bssid,
+                                      pBssDesc->bssId, sizeof(tSirMacAddr));
+
+               sirFillBeaconMandatoryIEforCcxBcnReport(pMac, (tANI_U8 *)pBssDesc->ieFields, ie_len,
+                                           &(pBcnReport->bcnRepBssInfo[msgCounter].pBuf), &outIeLen);
+               pBcnReport->bcnRepBssInfo[msgCounter].ieLen = outIeLen;
+
+               smsLog( pMac, LOG1,"Bssid(%02X:%02X:%02X:%02X:%02X:%02X) Channel=%d Rssi=%d",
+                       pBssDesc->bssId[0], pBssDesc->bssId[1], pBssDesc->bssId[2],
+                       pBssDesc->bssId[3], pBssDesc->bssId[4], pBssDesc->bssId[5],
+                       pBssDesc->channelId, (-1) * pBssDesc->rssi);
+
+               pBcnReport->numBss++;
+
+               if (++msgCounter >= SIR_BCN_REPORT_MAX_BSS_DESC)
+                   break;
+
+               pCurResult = pResultArr[msgCounter];
+           }
+           else
+           {
+               pCurResult = NULL;
+               break;
+           }
+       }
+
+       bssCounter += msgCounter;
+       if (!pResultArr || !pCurResult || (bssCounter >= SIR_BCN_REPORT_MAX_BSS_DESC))
+       {
+           pCurResult = NULL;
+           smsLog(pMac, LOGE,
+                  "Reached to the max/last BSS in pCurResult list");
+       }
+       else
+       {
+           pCurResult = pResultArr[bssCounter];
+           smsLog(pMac, LOGE,
+                  "Move to the next BSS set in pCurResult list");
+       }
+
+       pBcnReport->flag = (measurementDone << 1)|((pCurResult)?true:false);
+
+       smsLog(pMac, LOG1, "SME Sending BcnRep to HDD numBss(%d)"
+               " msgCounter(%d) bssCounter(%d)",
+                pBcnReport->numBss, msgCounter, bssCounter, pBcnReport->flag);
+
+       roamInfo.pCcxBcnReportRsp = pBcnReport;
+       status = csrRoamCallCallback(pMac, sessionId, &roamInfo,
+                           0, eCSR_ROAM_CCX_BCN_REPORT_IND, 0);
+
+       /* Free the memory allocated to IE */
+       for (i = 0; i < msgCounter; i++)
+       {
+           if (pBcnReport->bcnRepBssInfo[i].pBuf)
+               vos_mem_free(pBcnReport->bcnRepBssInfo[i].pBuf);
+       }
+   } while (pCurResult);
+   return status;
+}
+
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
+
 /**---------------------------------------------------------------------------
   
   \brief sme_RrmSendScanRequest() - 
@@ -309,7 +458,7 @@
    tCsrScanResultFilter filter;
    tScanResultHandle pResult;
    tCsrScanResultInfo *pScanResult, *pNextResult;
-   tCsrScanResultInfo *pScanResultsArr[SIR_BCN_REPORT_MAX_BSS_PER_CHANNEL];
+   tCsrScanResultInfo *pScanResultsArr[SIR_BCN_REPORT_MAX_BSS_DESC];
    eHalStatus status;
    tANI_U8 counter=0;
    tpRrmSMEContext pSmeRrmContext = &pMac->rrm.rrmSmeContext;
@@ -320,7 +469,7 @@
 #endif
 
    vos_mem_zero( &filter, sizeof(filter) );
-   vos_mem_zero( pScanResultsArr, sizeof(pNextResult)*SIR_BCN_REPORT_MAX_BSS_PER_CHANNEL );
+   vos_mem_zero( pScanResultsArr, sizeof(pNextResult)*SIR_BCN_REPORT_MAX_BSS_DESC );
 
    filter.BSSIDs.numOfBSSIDs = 1;
    filter.BSSIDs.bssid = &pSmeRrmContext->bssId;
@@ -378,14 +527,36 @@
       // send a xmit indication with moreToFollow set to MEASURMENT_DONE
       // so that PE can clean any context allocated.
       if( measurementDone )
-         status = sme_RrmSendBeaconReportXmitInd( pMac, NULL, measurementDone, 0 );
+      {
+#if defined(FEATURE_WLAN_CCX_UPLOAD)
+         status = sme_CcxSendBeaconReqScanResults(pMac,
+                                                  sessionId,
+                                                  chanList[0],
+                                                  NULL,
+                                                  measurementDone,
+                                                  0);
+#else
+         status = sme_RrmSendBeaconReportXmitInd( pMac, NULL, measurementDone, 0);
+#endif /*FEATURE_WLAN_CCX_UPLOAD*/
+      }
       return status;
    }
 
    pScanResult = sme_ScanResultGetFirst(pMac, pResult);
 
    if( NULL == pScanResult && measurementDone )
+   {
+#if defined(FEATURE_WLAN_CCX_UPLOAD)
+      status = sme_CcxSendBeaconReqScanResults(pMac,
+                                               sessionId,
+                                               chanList[0],
+                                               NULL,
+                                               measurementDone,
+                                               0);
+#else
       status = sme_RrmSendBeaconReportXmitInd( pMac, NULL, measurementDone, 0 );
+#endif /*FEATURE_WLAN_CCX_UPLOAD*/
+   }
 
    counter=0;
    while (pScanResult)
@@ -393,18 +564,26 @@
       pNextResult = sme_ScanResultGetNext(pMac, pResult);
       pScanResultsArr[counter++] = pScanResult;
       pScanResult = pNextResult; //sme_ScanResultGetNext(hHal, pResult);
-      if (counter >= SIR_BCN_REPORT_MAX_BSS_PER_CHANNEL)
+      if (counter >= SIR_BCN_REPORT_MAX_BSS_DESC)
          break;
       }
 
    if (counter)
    {
+          smsLog(pMac, LOG1, " Number of BSS Desc with RRM Scan %d ", counter);
+#if defined(FEATURE_WLAN_CCX_UPLOAD)
+       status = sme_CcxSendBeaconReqScanResults(pMac,
+                                                sessionId,
+                                                chanList[0],
+                                                pScanResultsArr,
+                                                measurementDone,
+                                                counter);
+#else
        status = sme_RrmSendBeaconReportXmitInd( pMac,
                                                 pScanResultsArr,
                                                 measurementDone,
                                                 counter);
-       smsLog(pMac, LOG1, " Number of BSS Desc with RRM Scan %d ",
-              counter);
+#endif /*FEATURE_WLAN_CCX_UPLOAD*/
    }
    sme_ScanResultPurge(pMac, pResult); 
 
@@ -476,7 +655,7 @@
   \brief sme_RrmIssueScanReq() - This is called to send a scan request as part 
          of beacon report request .
   
-  \param 
+  \param  pMac  - pMac global pointer
   
   \return eHAL_STATUS_SUCCESS - Validation is successful.
   
@@ -491,67 +670,101 @@
    eHalStatus status = eHAL_STATUS_SUCCESS;
    tpRrmSMEContext pSmeRrmContext = &pMac->rrm.rrmSmeContext;
    tANI_U32 sessionId;
+   tSirScanType scanType;
 
+   if ((pSmeRrmContext->currentIndex) >= pSmeRrmContext->channelList.numOfChannels)
+       return status;
+
+   scanType = pSmeRrmContext->measMode[pSmeRrmContext->currentIndex];
+   if ((eSIR_ACTIVE_SCAN == scanType) || (eSIR_PASSIVE_SCAN == scanType))
+   {
 #if defined WLAN_VOWIFI_DEBUG
    smsLog( pMac, LOGE, "Issue scan request " );
 #endif
 
-   vos_mem_zero( &scanRequest, sizeof(scanRequest));
+       vos_mem_zero( &scanRequest, sizeof(scanRequest));
 
-   /* set scanType, active or passive */
+       /* set scanType, active or passive */
+       scanRequest.bcnRptReqScan = TRUE;
+       scanRequest.scanType = scanType;
 
-   scanRequest.scanType = pSmeRrmContext->measMode;
+       vos_mem_copy(scanRequest.bssid,
+             pSmeRrmContext->bssId, sizeof(scanRequest.bssid) );
 
-   vos_mem_copy(scanRequest.bssid,
-         pSmeRrmContext->bssId, sizeof(scanRequest.bssid) );
-
-   if( pSmeRrmContext->ssId.length )
-   {
-      scanRequest.SSIDs.numOfSSIDs = 1;
-      scanRequest.SSIDs.SSIDList =( tCsrSSIDInfo *)vos_mem_malloc(sizeof(tCsrSSIDInfo));
-      if( scanRequest.SSIDs.SSIDList == NULL )
-      {
-         smsLog( pMac, LOGP, FL("vos_mem_malloc failed:") );
-         return eHAL_STATUS_FAILURE;
-      }
+       if (pSmeRrmContext->ssId.length)
+       {
+          scanRequest.SSIDs.numOfSSIDs = 1;
+          scanRequest.SSIDs.SSIDList =( tCsrSSIDInfo *)vos_mem_malloc(sizeof(tCsrSSIDInfo));
+          if (NULL == scanRequest.SSIDs.SSIDList)
+          {
+              smsLog( pMac, LOGP, FL("vos_mem_malloc failed:") );
+              return eHAL_STATUS_FAILURE;
+          }
 #if defined WLAN_VOWIFI_DEBUG
-      smsLog( pMac, LOGE, FL("Allocated memory for pSSIDList"));
+          smsLog( pMac, LOGE, FL("Allocated memory for pSSIDList"));
 #endif
-      vos_mem_zero( scanRequest.SSIDs.SSIDList, sizeof(tCsrSSIDInfo) );
-      scanRequest.SSIDs.SSIDList->SSID.length = pSmeRrmContext->ssId.length;
-      vos_mem_copy(scanRequest.SSIDs.SSIDList->SSID.ssId, pSmeRrmContext->ssId.ssId, pSmeRrmContext->ssId.length);
+          vos_mem_zero( scanRequest.SSIDs.SSIDList, sizeof(tCsrSSIDInfo) );
+          scanRequest.SSIDs.SSIDList->SSID.length = pSmeRrmContext->ssId.length;
+          vos_mem_copy(scanRequest.SSIDs.SSIDList->SSID.ssId, pSmeRrmContext->ssId.ssId, pSmeRrmContext->ssId.length);
+       }
+
+       /* set min and max channel time */
+       scanRequest.minChnTime = 0; //pSmeRrmContext->duration; Dont use min timeout.
+       scanRequest.maxChnTime = pSmeRrmContext->duration[pSmeRrmContext->currentIndex];
+       smsLog( pMac, LOG1, "Scan Type(%d) Max Dwell Time(%d)", scanRequest.scanType,
+                  scanRequest.maxChnTime );
+
+#if defined WLAN_VOWIFI_DEBUG
+       smsLog( pMac, LOGE, "For Duration %d ", scanRequest.maxChnTime );
+#endif
+
+       /* set BSSType to default type */
+       scanRequest.BSSType = eCSR_BSS_TYPE_ANY;
+
+       /*Scan all the channels */
+       scanRequest.ChannelInfo.numOfChannels = 1;
+
+       scanRequest.ChannelInfo.ChannelList = &pSmeRrmContext->channelList.ChannelList[pSmeRrmContext->currentIndex];
+#if defined WLAN_VOWIFI_DEBUG
+       smsLog( pMac, LOGE, "On channel %d ", pSmeRrmContext->channelList.ChannelList[pSmeRrmContext->currentIndex] );
+#endif
+
+       /* set requestType to full scan */
+       scanRequest.requestType = eCSR_SCAN_REQUEST_FULL_SCAN;
+
+       csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid*)pSmeRrmContext->sessionBssId, &sessionId );
+       status = sme_ScanRequest( pMac, (tANI_U8)sessionId, &scanRequest, &scanId, &sme_RrmScanRequestCallback, NULL );
+
+       if ( pSmeRrmContext->ssId.length )
+       {
+           vos_mem_free(scanRequest.SSIDs.SSIDList);
+#if defined WLAN_VOWIFI_DEBUG
+           smsLog( pMac, LOGE, FL("Free memory for SSIDList"));
+#endif
+       }
    }
-
-   /* set min and max channel time */
-   scanRequest.minChnTime = 0; //pSmeRrmContext->duration; Dont use min timeout.
-   scanRequest.maxChnTime = pSmeRrmContext->duration;
-#if defined WLAN_VOWIFI_DEBUG
-   smsLog( pMac, LOGE, "For Duration %d ", pSmeRrmContext->duration );
-#endif
-
-   /* set BSSType to default type */
-   scanRequest.BSSType = eCSR_BSS_TYPE_ANY;
-
-   /*Scan all the channels */
-   scanRequest.ChannelInfo.numOfChannels = 1;
-
-   scanRequest.ChannelInfo.ChannelList = &pSmeRrmContext->channelList.ChannelList[pSmeRrmContext->currentIndex];
-#if defined WLAN_VOWIFI_DEBUG
-   smsLog( pMac, LOGE, "On channel %d ", pSmeRrmContext->channelList.ChannelList[pSmeRrmContext->currentIndex] );
-#endif
-
-   /* set requestType to full scan */
-   scanRequest.requestType = eCSR_SCAN_REQUEST_FULL_SCAN;
-
-   csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid*)pSmeRrmContext->sessionBssId, &sessionId );
-   status = sme_ScanRequest( pMac, (tANI_U8)sessionId, &scanRequest, &scanId, &sme_RrmScanRequestCallback, NULL ); 
-
-   if ( pSmeRrmContext->ssId.length )
+   else if (eSIR_BEACON_TABLE == scanType)  /* beacon table */
    {
-      vos_mem_free(scanRequest.SSIDs.SSIDList);
-#if defined WLAN_VOWIFI_DEBUG
-      smsLog( pMac, LOGE, FL("Free memory for SSIDList"));
-#endif
+       if ((pSmeRrmContext->currentIndex + 1) < pSmeRrmContext->channelList.numOfChannels)
+       {
+           sme_RrmSendScanResult( pMac, 1, &pSmeRrmContext->channelList.ChannelList[pSmeRrmContext->currentIndex], false );
+           pSmeRrmContext->currentIndex++; //Advance the current index.
+           sme_RrmIssueScanReq(pMac);
+       }
+       else
+       {
+           //Done with the measurement. Clean up all context and send a message to PE with measurement done flag set.
+           sme_RrmSendScanResult( pMac, 1, &pSmeRrmContext->channelList.ChannelList[pSmeRrmContext->currentIndex], true );
+           vos_mem_free( pSmeRrmContext->channelList.ChannelList );
+       }
+   }
+   else
+   {
+       smsLog( pMac, LOGE, "Unknown beacon report request mode(%d)", scanType);
+                /* Indicate measurement completion to PE */
+                /* If this is not done, pCurrentReq pointer will not be freed and
+                   PE will not handle subsequent Beacon requests */
+        sme_RrmSendBeaconReportXmitInd(pMac, NULL, true, 0);
    }
 
    return status;
@@ -574,7 +787,7 @@
 {
    tpSirBeaconReportReqInd pBeaconReq = (tpSirBeaconReportReqInd) pMsgBuf;
    tpRrmSMEContext pSmeRrmContext = &pMac->rrm.rrmSmeContext;
-   tANI_U32 len,i;  
+   tANI_U32 len = 0, i = 0;
 
 #if defined WLAN_VOWIFI_DEBUG
    smsLog( pMac, LOGE, "Received Beacon report request ind Channel = %d", pBeaconReq->channelInfo.channelNum );
@@ -606,7 +819,7 @@
       len = 0;
       pSmeRrmContext->channelList.numOfChannels = 0;
 
-      //If valid channel is present. We firt Measure on the given channel. and
+      //If valid channel is present. We first Measure on the given channel. and
       //if there are additional channels present in APchannelreport, measure on these also.
       if ( pBeaconReq->channelInfo.channelNum != 255 )
          len = 1;
@@ -661,42 +874,12 @@
 
    pSmeRrmContext->token = pBeaconReq->uDialogToken;
    pSmeRrmContext->regClass = pBeaconReq->channelInfo.regulatoryClass;
-
-   switch( pBeaconReq->fMeasurementtype )
-   {
-      case 0: //Passive
-      case 1: //Active
-         pSmeRrmContext->measMode = pBeaconReq->fMeasurementtype? eSIR_ACTIVE_SCAN : eSIR_PASSIVE_SCAN ;
-         pSmeRrmContext->duration = pBeaconReq->measurementDuration;
          pSmeRrmContext->randnIntvl = VOS_MAX( pBeaconReq->randomizationInterval, pSmeRrmContext->rrmConfig.maxRandnInterval );
          pSmeRrmContext->currentIndex = 0;
-#if defined WLAN_VOWIFI_DEBUG
-         smsLog( pMac, LOGE, "Send beacon report after scan " );
-#endif
-         sme_RrmIssueScanReq( pMac ); 
-         break;
-      case 2: //Table
-         //Get the current scan results for the given channel and send it.
-#if defined WLAN_VOWIFI_DEBUG
-         smsLog( pMac, LOGE, "Send beacon report from table " );
-#endif
-         sme_RrmSendScanResult( pMac, pSmeRrmContext->channelList.numOfChannels, pSmeRrmContext->channelList.ChannelList, true );
-         vos_mem_free( pSmeRrmContext->channelList.ChannelList );
-#if defined WLAN_VOWIFI_DEBUG
-         smsLog( pMac, LOGE, FL("Free memory for ChannelList") );
-#endif
-         break;
-      default:
-#if defined WLAN_VOWIFI_DEBUG
-         smsLog( pMac, LOGE, "Unknown beacon report request mode");
-#endif
-         /* Indicate measurement completion to PE */
-         /* If this is not done, pCurrentReq pointer will not be freed and 
-            PE will not handle subsequent Beacon requests */
-         sme_RrmSendBeaconReportXmitInd(pMac, NULL, true, 0);
-         break;
+   vos_mem_copy((tANI_U8*)&pSmeRrmContext->measMode, (tANI_U8*)&pBeaconReq->fMeasurementtype, SIR_CCX_MAX_MEAS_IE_REQS);
+   vos_mem_copy((tANI_U8*)&pSmeRrmContext->duration, (tANI_U8*)&pBeaconReq->measurementDuration, SIR_CCX_MAX_MEAS_IE_REQS);
 
-   }
+   sme_RrmIssueScanReq( pMac );
 
    return;
 }
@@ -1336,7 +1519,7 @@
    return pTempBssEntry;
 }
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
 void csrCcxSendAdjacentApRepMsg(tpAniSirGlobal pMac, tCsrRoamSession *pSession)
 {
    tpSirAdjacentApRepInd pAdjRep;
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 4061eed..dd11e98 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -66,8 +66,10 @@
 #include "csrInternal.h"
 #include "wlan_qct_wda.h"
 #include "halMsgApi.h"
+#include "vos_trace.h"
+#include "sme_Trace.h"
+#include "limTrace.h"
 #include "vos_utils.h"
-
 #include "sapApi.h"
 
 
@@ -75,8 +77,12 @@
 extern tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 
 #include <wlan_qct_pal_api.h>
-
+#define LOG_SIZE 256
 #define READ_MEMORY_DUMP_CMD     9
+#define TL_INIT_STATE            0
+
+
+#define CSR_ACTIVE_LIST_CMD_TIMEOUT_VALUE 1000*30  //30s
 
 // TxMB Functions
 extern eHalStatus pmcPrepareCommand( tpAniSirGlobal pMac, tANI_U32 sessionId,
@@ -98,6 +104,8 @@
 
 eHalStatus sme_HandleChangeCountryCode(tpAniSirGlobal pMac,  void *pMsgBuf);
 
+eHalStatus sme_HandleGenericChangeCountryCode(tpAniSirGlobal pMac,  void *pMsgBuf);
+
 eHalStatus sme_HandlePreChannelSwitchInd(tHalHandle hHal);
 
 eHalStatus sme_HandlePostChannelSwitchInd(tHalHandle hHal);
@@ -149,7 +157,9 @@
 {
     eHalStatus status;
     tSmeCmd *pCmd;
-    tANI_U32 c;
+    tANI_U32 cmd_idx;
+    VOS_STATUS vosStatus;
+    vos_timer_t* cmdTimeoutTimer = NULL;
 
     pMac->sme.totalSmeCmd = SME_TOTAL_COMMAND;
     if (!HAL_STATUS_SUCCESS(status = csrLLOpen(pMac->hHdd,
@@ -172,21 +182,47 @@
                                              &pMac->sme.smeCmdFreeList)))
        goto end;
 
-    status = palAllocateMemory(pMac->hHdd,
-                               (void **)&pCmd,
-                               sizeof(tSmeCmd) * pMac->sme.totalSmeCmd);
-    if (!HAL_STATUS_SUCCESS(status))
-       goto end;
-
-    palZeroMemory(pMac->hHdd, pCmd,
-                  sizeof(tSmeCmd) * pMac->sme.totalSmeCmd);
-    pMac->sme.pSmeCmdBufAddr = pCmd;
-    for (c = 0; c < pMac->sme.totalSmeCmd; c++)
+    pCmd = vos_mem_malloc(sizeof(tSmeCmd) * pMac->sme.totalSmeCmd);
+    if ( NULL == pCmd )
+       status = eHAL_STATUS_FAILURE;
+    else
     {
-        csrLLInsertTail(&pMac->sme.smeCmdFreeList,
-                        &pCmd[c].Link, LL_ACCESS_LOCK);
+       status = eHAL_STATUS_SUCCESS;
+
+       vos_mem_set(pCmd, sizeof(tSmeCmd) * pMac->sme.totalSmeCmd, 0);
+       pMac->sme.pSmeCmdBufAddr = pCmd;
+
+       for (cmd_idx = 0; cmd_idx < pMac->sme.totalSmeCmd; cmd_idx++)
+       {
+           csrLLInsertTail(&pMac->sme.smeCmdFreeList,
+                        &pCmd[cmd_idx].Link, LL_ACCESS_LOCK);
+       }
     }
 
+    /* This timer is only to debug the active list command timeout */
+
+    cmdTimeoutTimer = (vos_timer_t*)vos_mem_malloc(sizeof(vos_timer_t));
+    if (cmdTimeoutTimer)
+    {
+        pMac->sme.smeCmdActiveList.cmdTimeoutTimer = cmdTimeoutTimer;
+       vosStatus =
+            vos_timer_init( pMac->sme.smeCmdActiveList.cmdTimeoutTimer,
+                              VOS_TIMER_TYPE_SW,
+                              activeListCmdTimeoutHandle,
+                              (void*) pMac);
+
+        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                "Init Timer fail for active list command process time out");
+            vos_mem_free(pMac->sme.smeCmdActiveList.cmdTimeoutTimer);
+        }
+        else
+        {
+            pMac->sme.smeCmdActiveList.cmdTimeoutDuration =
+                CSR_ACTIVE_LIST_CMD_TIMEOUT_VALUE;
+        }
+    }
 end:
     if (!HAL_STATUS_SUCCESS(status))
        smsLog(pMac, LOGE, "failed to initialize sme command list:%d\n",
@@ -279,6 +315,11 @@
     csrLLClose(&pMac->sme.smeScanCmdActiveList);
     csrLLClose(&pMac->sme.smeCmdFreeList);
 
+    /*destroy active list command time out timer */
+    vos_timer_destroy(pMac->sme.smeCmdActiveList.cmdTimeoutTimer);
+    vos_mem_free(pMac->sme.smeCmdActiveList.cmdTimeoutTimer);
+    pMac->sme.smeCmdActiveList.cmdTimeoutTimer = NULL;
+
     status = vos_lock_acquire(&pMac->sme.lkSmeGlobalLock);
     if(status != eHAL_STATUS_SUCCESS)
     {
@@ -289,7 +330,7 @@
 
     if(NULL != pMac->sme.pSmeCmdBufAddr)
     {
-        status = palFreeMemory(pMac->hHdd, pMac->sme.pSmeCmdBufAddr);
+        vos_mem_free(pMac->sme.pSmeCmdBufAddr);
         pMac->sme.pSmeCmdBufAddr = NULL;
     }
 
@@ -306,7 +347,6 @@
 
 void dumpCsrCommandInfo(tpAniSirGlobal pMac, tSmeCmd *pCmd)
 {
-#ifdef WLAN_DEBUG
     switch( pCmd->command )
     {
     case eSmeCommandScan:
@@ -332,9 +372,10 @@
         break;
 
     default:
+        smsLog( pMac, LOGE, " default: Unhandled command %d",
+                pCmd->command);
         break;
     }
-#endif  //#ifdef WLAN_DEBUG
 }
 
 tSmeCmd *smeGetCommandBuffer( tpAniSirGlobal pMac )
@@ -446,11 +487,11 @@
                     ( eSmeCommandDelTs ==  pCommand->command ) );
         if( fFullPowerNeeded ) break;
 #ifdef FEATURE_OEM_DATA_SUPPORT
-        fFullPowerNeeded = (pmcState == IMPS && 
+        fFullPowerNeeded = (pmcState == IMPS &&
                                        eSmeCommandOemDataReq == pCommand->command);
         if(fFullPowerNeeded) break;
 #endif
-        fFullPowerNeeded = (pmcState == IMPS && 
+        fFullPowerNeeded = (pmcState == IMPS &&
                             eSmeCommandRemainOnChannel == pCommand->command);
         if(fFullPowerNeeded) break;
     } while(0);
@@ -558,12 +599,12 @@
             case eSmeCommandRemainOnChannel:
                 if (NULL != pCommand->u.remainChlCmd.callback)
                 {
-                    remainOnChanCallback callback = 
+                    remainOnChanCallback callback =
                                             pCommand->u.remainChlCmd.callback;
                     /* process the msg */
                     if( callback )
                     {
-                        callback(pMac, pCommand->u.remainChlCmd.callbackCtx, 
+                        callback(pMac, pCommand->u.remainChlCmd.callbackCtx,
                                             eCSR_SCAN_ABORT );
                     }
                 }
@@ -829,6 +870,8 @@
 
                     // .... and process the command.
 
+                    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                       TRACE_CODE_SME_COMMAND, pCommand->sessionId, pCommand->command));
                     switch ( pCommand->command )
                     {
 
@@ -842,7 +885,7 @@
                             status  = csrRoamProcessCommand( pMac, pCommand );
                             if(!HAL_STATUS_SUCCESS(status))
                             {
-                                if( csrLLRemoveEntry( &pMac->sme.smeCmdActiveList, 
+                                if( csrLLRemoveEntry( &pMac->sme.smeCmdActiveList,
                                             &pCommand->Link, LL_ACCESS_LOCK ) )
                                 {
                                     csrReleaseCommandRoam( pMac, pCommand );
@@ -860,7 +903,7 @@
                             status = csrRoamProcessSetKeyCommand( pMac, pCommand );
                             if(!HAL_STATUS_SUCCESS(status))
                             {
-                                if( csrLLRemoveEntry( &pMac->sme.smeCmdActiveList, 
+                                if( csrLLRemoveEntry( &pMac->sme.smeCmdActiveList,
                                             &pCommand->Link, LL_ACCESS_LOCK ) )
                                 {
                                     csrReleaseCommandSetKey( pMac, pCommand );
@@ -873,7 +916,7 @@
                             status = csrRoamProcessRemoveKeyCommand( pMac, pCommand );
                             if(!HAL_STATUS_SUCCESS(status))
                             {
-                                if( csrLLRemoveEntry( &pMac->sme.smeCmdActiveList, 
+                                if( csrLLRemoveEntry( &pMac->sme.smeCmdActiveList,
                                             &pCommand->Link, LL_ACCESS_LOCK ) )
                                 {
                                     csrReleaseCommandRemoveKey( pMac, pCommand );
@@ -885,7 +928,7 @@
                             csrLLUnlock( &pMac->sme.smeCmdActiveList );
                             csrProcessAddStaSessionCommand( pMac, pCommand );
                             break;
-                        case eSmeCommandDelStaSession:    
+                        case eSmeCommandDelStaSession:
                             csrLLUnlock( &pMac->sme.smeCmdActiveList );
                             csrProcessDelStaSessionCommand( pMac, pCommand );
                             break;
@@ -1038,9 +1081,10 @@
 #endif
                             break;
 #ifdef FEATURE_WLAN_TDLS
-                        case eSmeCommandTdlsSendMgmt:     
+                        case eSmeCommandTdlsSendMgmt:
                         case eSmeCommandTdlsAddPeer:
                         case eSmeCommandTdlsDelPeer:
+                        case eSmeCommandTdlsLinkEstablish:
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
                         case eSmeCommandTdlsDiscovery:
                         case eSmeCommandTdlsLinkSetup:
@@ -1161,6 +1205,7 @@
 
    do {
       pMac->sme.state = SME_STATE_STOP;
+      pMac->sme.currDeviceMode = VOS_STA_MODE;
       if( !VOS_IS_STATUS_SUCCESS( vos_lock_init( &pMac->sme.lkSmeGlobalLock ) ) )
       {
           smsLog( pMac, LOGE, "sme_Open failed init lock" );
@@ -1262,23 +1307,10 @@
       sme_FTOpen(pMac);
 #endif
       sme_p2pOpen(pMac);
+      smeTraceInit(pMac);
 
    }while (0);
 
-   if (pMac->fScanOffload)
-   {
-       /* If scan offload is enabled then lim has allow the sending of
-       scan request to firmware even in powersave mode. The firmware has
-       to take care of exiting from power save mode */
-       status = ccmCfgSetInt(hHal, WNI_CFG_SCAN_IN_POWERSAVE,
-                   eANI_BOOLEAN_TRUE, NULL, eANI_BOOLEAN_FALSE);
-
-       if (eHAL_STATUS_SUCCESS != status)
-       {
-           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                   "Could not pass on WNI_CFG_SCAN_IN_POWERSAVE to CCM");
-       }
-   }
    return status;
 }
 
@@ -1314,6 +1346,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                      TRACE_CODE_SME_RX_HDD_MSG_SET_11DINFO, NO_SESSION, 0));
    if (NULL == pSmeConfigParams ) {
       smsLog( pMac, LOGE,
               "Empty config param structure for SME, nothing to update");
@@ -1348,10 +1382,12 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_MSG_GET_SOFTAP_DOMAIN, NO_SESSION, 0));
    if (NULL == domainIdSoftAp ) {
       smsLog( pMac, LOGE, "Uninitialized domain Id");
       return status;
-   }    
+   }
 
    *domainIdSoftAp = pMac->scan.domainIdCurrent;
    status = eHAL_STATUS_SUCCESS;
@@ -1365,6 +1401,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_MSG_SET_REGINFO, NO_SESSION, 0));
    if (NULL == apCntryCode ) {
       smsLog( pMac, LOGE, "Empty Country Code, nothing to update");
       return status;
@@ -1382,14 +1420,14 @@
 /*--------------------------------------------------------------------------
 
   \brief sme_UpdateChannelConfig() - Update channel configuration in RIVA.
- 
-  It is used at driver start up to inform RIVA of the default channel 
-  configuration. 
+
+  It is used at driver start up to inform RIVA of the default channel
+  configuration.
 
   This is a synchronous call
 
   \param hHal - The handle returned by macOpen.
-  
+
   \return eHAL_STATUS_SUCCESS - SME update the channel config successfully.
 
           Other status means SME is failed to update the channel config.
@@ -1400,7 +1438,9 @@
 {
   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
-  pmcUpdateScanParams( pMac, &(pMac->roam.configParam), 
+  MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+           TRACE_CODE_SME_RX_HDD_MSG_UPDATE_CHANNEL_CONFIG, NO_SESSION, 0));
+  pmcUpdateScanParams( pMac, &(pMac->roam.configParam),
                       &pMac->scan.base20MHzChannels, FALSE);
   return eHAL_STATUS_SUCCESS;
 }
@@ -1432,6 +1472,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                   TRACE_CODE_SME_RX_HDD_MSG_UPDATE_CONFIG, NO_SESSION, 0));
    if (NULL == pSmeConfigParams ) {
       smsLog( pMac, LOGE,
               "Empty config param structure for SME, nothing to update");
@@ -1471,15 +1513,29 @@
    /* update the directed scan offload setting */
    pMac->fScanOffload = pSmeConfigParams->fScanOffload;
 
+   if (pMac->fScanOffload)
+   {
+       /* If scan offload is enabled then lim has allow the sending of
+       scan request to firmware even in powersave mode. The firmware has
+       to take care of exiting from power save mode */
+       status = ccmCfgSetInt(hHal, WNI_CFG_SCAN_IN_POWERSAVE,
+                   eANI_BOOLEAN_TRUE, NULL, eANI_BOOLEAN_FALSE);
+
+       if (eHAL_STATUS_SUCCESS != status)
+       {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                   "Could not pass on WNI_CFG_SCAN_IN_POWERSAVE to CCM");
+       }
+   }
+   pMac->isCoalesingInIBSSAllowed =
+         pSmeConfigParams->csrConfig.isCoalesingInIBSSAllowed;
+
    /* update the p2p listen offload setting */
    pMac->fP2pListenOffload = pSmeConfigParams->fP2pListenOffload;
 
    /* update p2p offload status */
    pMac->pnoOffload = pSmeConfigParams->pnoOffload;
 
-   pMac->isCoalesingInIBSSAllowed =
-         pSmeConfigParams->csrConfig.isCoalesingInIBSSAllowed;
-
    return status;
 }
 
@@ -1514,6 +1570,8 @@
            ready to suspend indication.
 
   \param hHal - Handle returned by macOpen.
+         pReadyToSuspend - Parameter received along with ready to suspend
+                           indication from WMA.
 
   \return None
 
@@ -1521,7 +1579,7 @@
 
   --------------------------------------------------------------------------*/
 void sme_ProcessReadyToSuspend( tHalHandle hHal,
-                            tpSirReadyToSuspendInd pReadyToSuspend)
+                                tpSirReadyToSuspendInd pReadyToSuspend)
 {
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
@@ -1611,6 +1669,8 @@
    tPmcSwitchState swWlanSwitchState;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                  TRACE_CODE_SME_RX_HDD_MSG_HDDREADYIND, NO_SESSION, 0));
    do
    {
 
@@ -1843,6 +1903,129 @@
 }
 #endif
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+/*------------------------------------------------------------------
+ *
+ * Handle the tsm ie indication from  LIM and forward it to HDD.
+ *
+ *------------------------------------------------------------------*/
+eHalStatus sme_TsmIeInd(tHalHandle hHal, tSirSmeTsmIEInd *pSmeTsmIeInd)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus     status = eHAL_STATUS_SUCCESS;
+    tCsrRoamInfo   pRoamInfo = {0};
+    tANI_U32       SessionId = pSmeTsmIeInd->sessionId;
+    pRoamInfo.tsmIe.tsid= pSmeTsmIeInd->tsmIe.tsid;
+    pRoamInfo.tsmIe.state= pSmeTsmIeInd->tsmIe.state;
+    pRoamInfo.tsmIe.msmt_interval= pSmeTsmIeInd->tsmIe.msmt_interval;
+    /* forward the tsm ie information to HDD */
+    csrRoamCallCallback(pMac,
+                        SessionId,
+                        &pRoamInfo,
+                        0,
+                        eCSR_ROAM_TSM_IE_IND,
+                        0);
+    return status;
+}
+/* ---------------------------------------------------------------------------
+    \fn sme_SetCCKMIe
+    \brief  function to store the CCKM IE passed from supplicant and use
+    it while packing reassociation request
+    \param  hHal - HAL handle for device
+    \param  pCckmIe - pointer to CCKM IE data
+    \param  pCckmIeLen - length of the CCKM IE
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_SetCCKMIe(tHalHandle hHal, tANI_U8 sessionId,
+                              tANI_U8 *pCckmIe, tANI_U8 cckmIeLen)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus     status  = eHAL_STATUS_SUCCESS;
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        csrSetCCKMIe(pMac, sessionId, pCckmIe, cckmIeLen);
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    return status;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_SetCcxBeaconRequest
+    \brief  function to set CCX beacon request parameters
+    \param  hHal       - HAL handle for device
+    \param  sessionId  - Session id
+    \param  pCcxBcnReq - pointer to CCX beacon request
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_SetCcxBeaconRequest(tHalHandle hHal, const tANI_U8 sessionId,
+                                   const tCsrCcxBeaconReq* pCcxBcnReq)
+{
+   eHalStatus               status           = eSIR_SUCCESS;
+   tpAniSirGlobal           pMac             = PMAC_STRUCT( hHal );
+   tpSirBeaconReportReqInd  pSmeBcnReportReq = NULL;
+   tCsrCcxBeaconReqParams  *pBeaconReq       = NULL;
+   tANI_U8                  counter          = 0;
+   tCsrRoamSession         *pSession         = CSR_GET_SESSION(pMac, sessionId);
+   tpRrmSMEContext          pSmeRrmContext   = &pMac->rrm.rrmSmeContext;
+
+   /* Store the info in RRM context */
+   vos_mem_copy(&pSmeRrmContext->ccxBcnReqInfo, pCcxBcnReq, sizeof(tCsrCcxBeaconReq));
+
+   //Prepare the request to send to SME.
+   pSmeBcnReportReq = vos_mem_malloc(sizeof( tSirBeaconReportReqInd ));
+   if(NULL == pSmeBcnReportReq)
+   {
+      smsLog(pMac, LOGP, "Memory Allocation Failure!!! CCX  BcnReq Ind to SME");
+      return eSIR_FAILURE;
+   }
+
+   smsLog(pMac, LOGE, "Sending Beacon Report Req to SME");
+   vos_mem_zero( pSmeBcnReportReq, sizeof( tSirBeaconReportReqInd ));
+
+   pSmeBcnReportReq->messageType = eWNI_SME_BEACON_REPORT_REQ_IND;
+   pSmeBcnReportReq->length = sizeof( tSirBeaconReportReqInd );
+   vos_mem_copy( pSmeBcnReportReq->bssId, pSession->connectedProfile.bssid, sizeof(tSirMacAddr) );
+   pSmeBcnReportReq->channelInfo.channelNum = 255;
+   pSmeBcnReportReq->channelList.numChannels = pCcxBcnReq->numBcnReqIe;
+
+   for (counter = 0; counter < pCcxBcnReq->numBcnReqIe; counter++)
+   {
+        pBeaconReq = (tCsrCcxBeaconReqParams *)&pCcxBcnReq->bcnReq[counter];
+        pSmeBcnReportReq->fMeasurementtype[counter] = pBeaconReq->scanMode;
+        pSmeBcnReportReq->measurementDuration[counter] = SYS_TU_TO_MS(pBeaconReq->measurementDuration);
+        pSmeBcnReportReq->channelList.channelNumber[counter] = pBeaconReq->channel;
+   }
+
+   sme_RrmProcessBeaconReportReqInd(pMac, pSmeBcnReportReq);
+   return status;
+}
+
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+eHalStatus sme_IbssPeerInfoResponseHandleer( tHalHandle hHal,
+                                      tpSirIbssGetPeerInfoRspParams pIbssPeerInfoParams)
+{
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+
+   if (NULL == pMac)
+   {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL,
+           "%s: pMac is null", __func__);
+       return eHAL_STATUS_FAILURE;
+   }
+   if (pMac->sme.peerInfoParams.peerInfoCbk == NULL)
+   {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+           "%s: HDD callback is null", __func__);
+       return eHAL_STATUS_FAILURE;
+   }
+   pMac->sme.peerInfoParams.peerInfoCbk(pMac->sme.peerInfoParams.pUserData,
+                                        &pIbssPeerInfoParams->ibssPeerInfoRspParams);
+   return eHAL_STATUS_SUCCESS;
+}
+#endif /* FEATURE_CESIUM_PROPRIETARY */
 
 /*--------------------------------------------------------------------------
 
@@ -1899,7 +2082,7 @@
                     pmcOffloadMessageProcessor(hHal, pMsg->bodyptr);
                 }
                 status = eHAL_STATUS_SUCCESS;
-                vos_mem_free( pMsg->bodyptr );
+                vos_mem_free(pMsg->bodyptr);
              } else {
                 smsLog( pMac, LOGE, "Empty rsp message for PMC, nothing to process");
              }
@@ -1915,7 +2098,7 @@
              {
                 ccmCfgCnfMsgHandler(hHal, pMsg->bodyptr);
                 status = eHAL_STATUS_SUCCESS;
-                vos_mem_free( pMsg->bodyptr );
+                vos_mem_free(pMsg->bodyptr);
              } else {
                 smsLog( pMac, LOGE, "Empty rsp message for CCM, nothing to process");
              }
@@ -1926,13 +2109,13 @@
           case eWNI_SME_DELTS_IND:
 #ifdef WLAN_FEATURE_VOWIFI_11R
           case eWNI_SME_FT_AGGR_QOS_RSP:
-#endif             
+#endif
              //QoS
              if (pMsg->bodyptr)
              {
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
                 status = sme_QosMsgProcessor(pMac, pMsg->type, pMsg->bodyptr);
-                vos_mem_free( pMsg->bodyptr );
+                vos_mem_free(pMsg->bodyptr);
 #endif
              } else {
                 smsLog( pMac, LOGE, "Empty rsp message for QoS, nothing to process");
@@ -1947,7 +2130,7 @@
              if ( pMsg->bodyptr )
              {
                 status = sme_RrmMsgProcessor( pMac, pMsg->type, pMsg->bodyptr );
-                vos_mem_free( pMsg->bodyptr );
+                vos_mem_free(pMsg->bodyptr);
              }
              else
              {
@@ -2023,7 +2206,7 @@
                     vos_mem_free(pMsg->bodyptr);
                 }
                 else
-                { 
+                {
                     smsLog( pMac, LOGE, "Empty rsp message for meas (eWNI_SME_MGMT_FRM_IND), nothing to process");
                 }
                 break;
@@ -2048,7 +2231,7 @@
                 {
                    smsLog(pMac, LOGE, "Empty rsp message for meas (eWNI_SME_COEX_IND), nothing to process");
                 }
-                break;    
+                break;
 
 #ifdef FEATURE_WLAN_SCAN_PNO
           case eWNI_SME_PREF_NETWORK_FOUND_IND:
@@ -2063,7 +2246,7 @@
                 }
                 break;
 #endif // FEATURE_WLAN_SCAN_PNO
-          
+
           case eWNI_SME_TX_PER_HIT_IND:
                 if (pMac->sme.pTxPerHitCallback)
                 {
@@ -2072,14 +2255,26 @@
                 break;
 
           case eWNI_SME_CHANGE_COUNTRY_CODE:
-                if(pMsg->bodyptr)
+              if(pMsg->bodyptr)
                 {
                    status = sme_HandleChangeCountryCode((void *)pMac, pMsg->bodyptr);
                    vos_mem_free(pMsg->bodyptr);
                 }
                 else
                 {
-                   smsLog(pMac, LOGE, "Empty rsp message for meas (eWNI_SME_COEX_IND), nothing to process");
+                    smsLog(pMac, LOGE, "Empty rsp message for message (eWNI_SME_CHANGE_COUNTRY_CODE), nothing to process");
+                }
+                break;
+
+          case eWNI_SME_GENERIC_CHANGE_COUNTRY_CODE:
+              if (pMsg->bodyptr)
+                {
+                    status = sme_HandleGenericChangeCountryCode((void *)pMac, pMsg->bodyptr);
+                    vos_mem_free(pMsg->bodyptr);
+                }
+                else
+                {
+                   smsLog(pMac, LOGE, "Empty rsp message for message (eWNI_SME_GENERIC_CHANGE_COUNTRY_CODE), nothing to process");
                 }
                 break;
 
@@ -2102,7 +2297,7 @@
                 status = sme_HandlePreChannelSwitchInd(pMac);
                 break;
              }
-                
+
           case eWNI_SME_POST_SWITCH_CHL_IND:
              {
                 status = sme_HandlePostChannelSwitchInd(pMac);
@@ -2128,12 +2323,13 @@
            * command rescived from PE, SME tdls msg processor shall be called
            * to process commands recieved from PE
            */
-          case eWNI_SME_TDLS_SEND_MGMT_RSP:    
-          case eWNI_SME_TDLS_ADD_STA_RSP:    
+          case eWNI_SME_TDLS_SEND_MGMT_RSP:
+          case eWNI_SME_TDLS_ADD_STA_RSP:
           case eWNI_SME_TDLS_DEL_STA_RSP:
           case eWNI_SME_TDLS_DEL_STA_IND:
           case eWNI_SME_TDLS_DEL_ALL_PEER_IND:
           case eWNI_SME_MGMT_FRM_TX_COMPLETION_IND:
+          case eWNI_SME_TDLS_LINK_ESTABLISH_RSP:
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
           case eWNI_SME_TDLS_DISCOVERY_START_RSP:
           case eWNI_SME_TDLS_DISCOVERY_START_IND:
@@ -2148,7 +2344,7 @@
                     if (pMsg->bodyptr)
                     {
                         status = tdlsMsgProcessor(pMac, pMsg->type, pMsg->bodyptr);
-                        vos_mem_free( pMsg->bodyptr );
+                        vos_mem_free(pMsg->bodyptr);
                     }
                     else
                     {
@@ -2172,6 +2368,27 @@
                 }
                 break;
 #endif
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+       case eWNI_SME_TSM_IE_IND:
+       {
+        if (pMsg->bodyptr)
+        {
+            sme_TsmIeInd(pMac, pMsg->bodyptr);
+            vos_mem_free(pMsg->bodyptr);
+        }
+        else
+        {
+            smsLog(pMac, LOGE,
+            "Empty rsp message for (eWNI_SME_TSM_IE_IND), nothing to process");
+        }
+        break;
+       }
+#endif /* FEATURE_WLAN_CCX && FEATURE_WLAN_CCX_UPLOAD */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+          case eWNI_SME_ROAM_SCAN_OFFLOAD_RSP:
+                status = csrRoamOffloadScanRspHdlr((void *)pMac, pMsg->bodyval);
+                break;
+#endif // WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
            case eWNI_PMC_GTK_OFFLOAD_GETINFO_RSP:
@@ -2186,6 +2403,36 @@
                 }
                 break ;
 #endif
+
+#ifdef FEATURE_WLAN_LPHB
+          /* LPHB timeout indication arrived, send IND to client */
+          case eWNI_SME_LPHB_IND:
+                if (pMac->sme.pLphbIndCb)
+                {
+                   pMac->sme.pLphbIndCb(pMac->pAdapter, pMsg->bodyptr);
+                }
+                vos_mem_free(pMsg->bodyptr);
+
+                break;
+#endif /* FEATURE_WLAN_LPHB */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+          case eWNI_SME_IBSS_PEER_INFO_RSP:
+              if (pMsg->bodyptr)
+              {
+                  sme_IbssPeerInfoResponseHandleer(pMac, pMsg->bodyptr);
+                  vos_mem_free(pMsg->bodyptr);
+              }
+              else
+              {
+                  smsLog(pMac, LOGE,
+                         "Empty rsp message for (eWNI_SME_IBSS_PEER_INFO_RSP),"
+                         " nothing to process");
+              }
+              break ;
+
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
            case eWNI_SME_READY_TO_SUSPEND_IND:
                 if (pMsg->bodyptr)
                 {
@@ -2207,7 +2454,7 @@
                 if (pMsg->bodyptr)
                 {
                    status = csrMsgProcessor(hHal, pMsg->bodyptr);
-                   vos_mem_free( pMsg->bodyptr );
+                   vos_mem_free(pMsg->bodyptr);
                 }
                 else
                 {
@@ -2220,7 +2467,7 @@
                         pMsg->type);
                 if (pMsg->bodyptr)
                 {
-                   vos_mem_free( pMsg->bodyptr );
+                   vos_mem_free(pMsg->bodyptr);
                 }
              }
           }//switch
@@ -2230,7 +2477,7 @@
          smsLog( pMac, LOGW, "message type %d in stop state ignored", pMsg->type);
          if (pMsg->bodyptr)
          {
-            vos_mem_free( pMsg->bodyptr );
+            vos_mem_free(pMsg->bodyptr);
          }
       }
       sme_ReleaseGlobalLock( &pMac->sme );
@@ -2240,7 +2487,7 @@
       smsLog( pMac, LOGW, "Locking failed, bailing out");
       if (pMsg->bodyptr)
       {
-          vos_mem_free( pMsg->bodyptr );
+          vos_mem_free(pMsg->bodyptr);
       }
    }
 
@@ -2256,7 +2503,7 @@
    {
       if (pMsg->bodyptr)
       {
-         vos_mem_free( pMsg->bodyptr );
+         vos_mem_free(pMsg->bodyptr);
       }
    }
 
@@ -2272,6 +2519,7 @@
 
   This is a synchronous call
   \param hHal - The handle returned by macOpen
+  \param tHalStopType - reason for stopping
 
   \return eHAL_STATUS_SUCCESS - SME is stopped.
 
@@ -2280,7 +2528,7 @@
   \sa
 
   --------------------------------------------------------------------------*/
-eHalStatus sme_Stop(tHalHandle hHal, tANI_BOOLEAN pmcFlag)
+eHalStatus sme_Stop(tHalHandle hHal, tHalStopType stopType)
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
    eHalStatus fail_status = eHAL_STATUS_SUCCESS;
@@ -2295,31 +2543,28 @@
 
    p2pStop(hHal);
 
-   if(pmcFlag)
+   if(!pMac->psOffloadEnabled)
    {
-        if(!pMac->psOffloadEnabled)
-        {
-            status = pmcStop(hHal);
-            if ( ! HAL_STATUS_SUCCESS( status ) ) {
-                smsLog( pMac, LOGE,
-                        "pmcStop failed during smeStop with status=%d",
-                        status );
-                fail_status = status;
-            }
-        }
-        else
-        {
-            status = pmcOffloadStop(hHal);
-            if ( ! HAL_STATUS_SUCCESS( status ) ) {
-                smsLog( pMac, LOGE,
-                       "pmcOffloadStop failed during smeStop with status=%d",
-                       status );
-                fail_status = status;
-            }
-        }
+       status = pmcStop(hHal);
+       if ( ! HAL_STATUS_SUCCESS( status ) ) {
+           smsLog( pMac, LOGE,
+                   "pmcStop failed during smeStop with status=%d",
+                   status );
+           fail_status = status;
+       }
+   }
+   else
+   {
+       status = pmcOffloadStop(hHal);
+       if ( ! HAL_STATUS_SUCCESS( status ) ) {
+           smsLog( pMac, LOGE,
+                   "pmcOffloadStop failed during smeStop with status=%d",
+                   status );
+           fail_status = status;
+       }
    }
 
-   status = csrStop(pMac);
+   status = csrStop(pMac, stopType);
    if ( ! HAL_STATUS_SUCCESS( status ) ) {
       smsLog( pMac, LOGE, "csrStop failed during smeStop with status=%d",
               status );
@@ -2489,13 +2734,14 @@
     \param pContext - a pointer passed in for the callback
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus sme_ScanRequest(tHalHandle hHal, tANI_U8 sessionId, tCsrScanRequest *pscanReq, 
-                           tANI_U32 *pScanRequestID, 
+eHalStatus sme_ScanRequest(tHalHandle hHal, tANI_U8 sessionId, tCsrScanRequest *pscanReq,
+                           tANI_U32 *pScanRequestID,
                            csrScanCompleteCallback callback, void *pContext)
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+           TRACE_CODE_SME_RX_HDD_MSG_SCAN_REQ, sessionId, pscanReq->scanType));
     smsLog(pMac, LOG2, FL("enter"));
     do
     {
@@ -2506,14 +2752,14 @@
             {
                 {
 #ifdef FEATURE_WLAN_LFR
-                    if(csrIsScanAllowed(pMac)) 
+                    if(csrIsScanAllowed(pMac))
                     {
 #endif
                         status = csrScanRequest( hHal, sessionId, pscanReq,
                                                  pScanRequestID, callback, pContext );
 #ifdef FEATURE_WLAN_LFR
-                    } 
-                    else 
+                    }
+                    else
                     {
                         smsLog(pMac, LOGE, FL("Scan denied in state %d (sub-state %d)"),
                                 pMac->roam.neighborRoamInfo.neighborRoamState,
@@ -2523,7 +2769,7 @@
                     }
 #endif
                 }
-                  
+
                 sme_ReleaseGlobalLock( &pMac->sme );
             } //sme_AcquireGlobalLock success
             else
@@ -2556,6 +2802,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+              TRACE_CODE_SME_RX_HDD_MSG_SCAN_GET_RESULTS, sessionId,0 ));
    smsLog(pMac, LOG2, FL("enter"));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
@@ -2580,6 +2828,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+          TRACE_CODE_SME_RX_HDD_MSG_SCAN_FLUSH_RESULTS, sessionId,0 ));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -2595,6 +2845,8 @@
         eHalStatus status = eHAL_STATUS_FAILURE;
         tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+        MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+           TRACE_CODE_SME_RX_HDD_MSG_SCAN_FLUSH_P2PRESULTS, sessionId,0 ));
         status = sme_AcquireGlobalLock( &pMac->sme );
         if ( HAL_STATUS_SUCCESS( status ) )
         {
@@ -2620,6 +2872,8 @@
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
    tCsrScanResultInfo *pRet = NULL;
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+          TRACE_CODE_SME_RX_HDD_MSG_SCAN_RESULT_GETFIRST, NO_SESSION,0 ));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -2647,6 +2901,8 @@
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     tCsrScanResultInfo *pRet = NULL;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME ,
+        TRACE_CODE_SME_RX_HDD_MSG_SCAN_RESULT_GETNEXT, NO_SESSION,0 ));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
@@ -2699,6 +2955,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_MSG_SCAN_RESULT_PURGE, NO_SESSION,0 ));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -2726,7 +2984,7 @@
            not sizeof(tPmkidCandidateInfo) * something
   ---------------------------------------------------------------------------*/
 eHalStatus sme_ScanGetPMKIDCandidateList(tHalHandle hHal, tANI_U8 sessionId,
-                                        tPmkidCandidateInfo *pPmkidList, 
+                                        tPmkidCandidateInfo *pPmkidList,
                                         tANI_U32 *pNumItems )
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
@@ -2806,6 +3064,8 @@
     eHalStatus status = eHAL_STATUS_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                   TRACE_CODE_SME_RX_HDD_MSG_CONNECT, sessionId, 0));
     smsLog(pMac, LOG2, FL("enter"));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
@@ -2880,13 +3140,15 @@
     eHalStatus status = eHAL_STATUS_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                      TRACE_CODE_SME_RX_HDD_ROAM_REASSOC, sessionId, 0));
     smsLog(pMac, LOG2, FL("enter"));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
         if( CSR_IS_SESSION_VALID( pMac, sessionId ) )
         {
-            if((NULL == pProfile) && (fForce == 1)) 
+            if((NULL == pProfile) && (fForce == 1))
             { 
                 tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
                 /* to force the AP initiate fresh 802.1x authentication need to clear
@@ -2898,7 +3160,7 @@
             else
             {
                 status = csrRoamReassoc( pMac, sessionId, pProfile, modProfileFields, pRoamId );
-            }        
+            }
         }
         else
         {
@@ -2922,6 +3184,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                TRACE_CODE_SME_RX_HDD_ROAM_GET_CONNECTPROFILE, sessionId, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -2952,6 +3216,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                        TRACE_CODE_SME_RX_HDD_ROAM_DISCONNECT, sessionId, reason));
    smsLog(pMac, LOG2, FL("enter"));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
@@ -3025,7 +3291,7 @@
    {
       if( CSR_IS_SESSION_VALID( pMac, sessionId ) )
       {
-         status = csrRoamIssueDisassociateStaCmd( pMac, sessionId, pPeerMacAddr, 
+         status = csrRoamIssueDisassociateStaCmd( pMac, sessionId, pPeerMacAddr,
                                                   eSIR_MAC_DEAUTH_LEAVING_BSS_REASON);
       }
       else
@@ -3063,7 +3329,7 @@
    {
       if( CSR_IS_SESSION_VALID( pMac, sessionId ) )
       {
-         status = csrRoamIssueDeauthStaCmd( pMac, sessionId, pPeerMacAddr, 
+         status = csrRoamIssueDeauthStaCmd( pMac, sessionId, pPeerMacAddr,
                      eSIR_MAC_DEAUTH_LEAVING_BSS_REASON);
       }
       else
@@ -3165,7 +3431,7 @@
     \return eHalStatus
   -------------------------------------------------------------------------------*/
 eHalStatus sme_RoamGetWpsSessionOverlap(tHalHandle hHal, tANI_U8 sessionId,
-                                        void *pUsrContext, void 
+                                        void *pUsrContext, void
                                         *pfnSapEventCallback, v_MACADDR_t pRemoveMac)
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
@@ -3240,6 +3506,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+            TRACE_CODE_SME_RX_HDD_ROAM_FREE_CONNECTPROFILE, NO_SESSION, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3272,6 +3540,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+          TRACE_CODE_SME_RX_HDD_ROAM_SET_PMKIDCACHE, NO_SESSION, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3303,6 +3573,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+            TRACE_CODE_SME_RX_HDD_GET_CONFIGPARAM, NO_SESSION, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3462,6 +3734,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+              TRACE_CODE_SME_RX_HDD_GET_MODPROFFIELDS, sessionId, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3493,6 +3767,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+          TRACE_CODE_SME_RX_HDD_ENABLE_PWRSAVE, NO_SESSION, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3580,6 +3856,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+              TRACE_CODE_SME_RX_HDD_DISABLE_PWRSAVE, sessionId, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3616,6 +3894,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_RX_HDD_SET_CONFIG_PWRSAVE, NO_SESSION, 0));
    if (NULL == pConfigParams ) {
       smsLog( pMac, LOGE, "Empty config param structure for PMC, "
               "nothing to update");
@@ -3647,6 +3927,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+            TRACE_CODE_SME_RX_HDD_GET_CONFIG_PWRSAVE, NO_SESSION, 0));
    if (NULL == pConfigParams ) {
       smsLog( pMac, LOGE, "Empty config param structure for PMC, "
               "nothing to update");
@@ -3676,6 +3958,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_START_AUTO_BMPSTIMER, NO_SESSION, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3701,6 +3985,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+          TRACE_CODE_SME_RX_HDD_STOP_AUTO_BMPSTIMER, NO_SESSION, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3725,6 +4011,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+         TRACE_CODE_SME_RX_HDD_REQUEST_FULLPOWER, NO_SESSION, psMode));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3767,6 +4055,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+           TRACE_CODE_SME_RX_HDD_REQUEST_BMPS, NO_SESSION, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3838,6 +4128,8 @@
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
    tANI_BOOLEAN result = false;
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+               TRACE_CODE_SME_RX_HDD_IS_PWRSAVE_ENABLED, NO_SESSION, psMode));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -3918,13 +4210,15 @@
 /* ---------------------------------------------------------------------------
     \fn  sme_SetDHCPTillPowerActiveFlag
     \brief  Sets/Clears DHCP related flag in PMC to disable/enable auto BMPS 
-            entry by PMC 
+            entry by PMC
     \param  hHal - The handle returned by macOpen.
   ---------------------------------------------------------------------------*/
 void  sme_SetDHCPTillPowerActiveFlag(tHalHandle hHal, tANI_U8 flag)
 {
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+          TRACE_CODE_SME_RX_HDD_SET_DHCP_FLAG, NO_SESSION, flag));
    // Set/Clear the DHCP flag which will disable/enable auto BMPS entery by PMC
    pMac->pmc.remainInPowerActiveTillDHCP = flag;
 }
@@ -4005,6 +4299,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_REQUEST_STANDBY, NO_SESSION, 0));
    smsLog( pMac, LOG1, FL("") );
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
@@ -4143,6 +4439,8 @@
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+           TRACE_CODE_SME_RX_HDD_WOWL_ADDBCAST_PATTERN, sessionId, 0));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
@@ -4169,6 +4467,8 @@
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+           TRACE_CODE_SME_RX_HDD_WOWL_DELBCAST_PATTERN, sessionId, 0));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
@@ -4221,12 +4521,14 @@
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+           TRACE_CODE_SME_RX_HDD_ENTER_WOWL, sessionId, 0));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
-       status = pmcEnterWowl (hHal, enterWowlCallbackRoutine, enterWowlCallbackContext, 
+       status = pmcEnterWowl (hHal, enterWowlCallbackRoutine, enterWowlCallbackContext,
 #ifdef WLAN_WAKEUP_EVENTS
-                              wakeIndicationCB, wakeIndicationCBContext, 
+                              wakeIndicationCB, wakeIndicationCBContext,
 #endif // WLAN_WAKEUP_EVENTS
                               wowlEnterParams, sessionId);
        sme_ReleaseGlobalLock( &pMac->sme );
@@ -4249,6 +4551,8 @@
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+           TRACE_CODE_SME_RX_HDD_EXIT_WOWL, NO_SESSION, 0));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
@@ -4283,6 +4587,8 @@
    tANI_U32 i;
    tCsrRoamSession *pSession = NULL;
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+          TRACE_CODE_SME_RX_HDD_SET_KEY, sessionId, 0));
    if (pSetKey->keyLength > CSR_MAX_KEY_LEN)
    {
       smsLog(pMac, LOGE, FL("Invalid key length %d"), pSetKey->keyLength);
@@ -4361,6 +4667,8 @@
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
    tANI_U32 roamId;
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+          TRACE_CODE_SME_RX_HDD_REMOVE_KEY, sessionId, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -4388,12 +4696,14 @@
   ---------------------------------------------------------------------------*/
 eHalStatus sme_GetRssi(tHalHandle hHal,
                              tCsrRssiCallback callback,
-                             tANI_U8 staId, tCsrBssid bssId, 
+                             tANI_U8 staId, tCsrBssid bssId,
                              void *pContext, void* pVosContext)
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                TRACE_CODE_SME_RX_HDD_GET_STATS, NO_SESSION,  0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -4403,6 +4713,35 @@
    }
    return (status);
 }
+
+/* ---------------------------------------------------------------------------
+    \fn sme_GetSnr
+    \brief a wrapper function that client calls to register a callback to
+           get SNR
+
+    \param callback - SME sends back the requested stats using the callback
+    \param staId - The station ID for which the stats is requested for
+    \param pContext - user context to be passed back along with the callback
+    \param pVosContext - vos context
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_GetSnr(tHalHandle hHal,
+                      tCsrSnrCallback callback,
+                      tANI_U8 staId, tCsrBssid bssId,
+                      void *pContext)
+{
+   eHalStatus status = eHAL_STATUS_FAILURE;
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+
+   status = sme_AcquireGlobalLock( &pMac->sme );
+   if ( HAL_STATUS_SUCCESS( status ) )
+   {
+      status = csrGetSnr(pMac, callback,
+                          staId, bssId, pContext);
+      sme_ReleaseGlobalLock( &pMac->sme );
+   }
+   return status;
+}
 #if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_CCX || defined(FEATURE_WLAN_LFR)
 /* ---------------------------------------------------------------------------
     \fn sme_GetRoamRssi
@@ -4433,6 +4772,34 @@
 }
 #endif
 
+#if defined(FEATURE_WLAN_CCX) && defined(FEATURE_WLAN_CCX_UPLOAD)
+/* ---------------------------------------------------------------------------
+    \fn sme_GetTsmStats
+    \brief a wrapper function that client calls to register a callback to
+     get TSM Stats
+    \param callback - SME sends back the requested stats using the callback
+    \param staId - The station ID for which the stats is requested for
+    \param pContext - user context to be passed back along with the callback
+    \param pVosContext - vos context
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_GetTsmStats(tHalHandle hHal,
+                             tCsrTsmStatsCallback callback,
+                             tANI_U8 staId, tCsrBssid bssId,
+                             void *pContext, void* pVosContext, tANI_U8 tid)
+{
+   eHalStatus     status = eHAL_STATUS_FAILURE;
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+   status = sme_AcquireGlobalLock( &pMac->sme );
+   if ( HAL_STATUS_SUCCESS( status ) )
+   {
+      status = csrGetTsmStats( pMac, callback,
+                                 staId, bssId, pContext, pVosContext, tid);
+      sme_ReleaseGlobalLock( &pMac->sme );
+   }
+   return (status);
+}
+#endif
 
 /* ---------------------------------------------------------------------------
     \fn sme_GetStatistics
@@ -4471,6 +4838,30 @@
 }
 
 /* ---------------------------------------------------------------------------
+    \fn smeGetTLSTAState
+    \helper function to get the TL STA State whenever the function is called.
+
+    \param staId - The staID to be passed to the TL
+            to get the relevant TL STA State
+    \return the state as tANI_U16
+  ---------------------------------------------------------------------------*/
+tANI_U16 smeGetTLSTAState(tHalHandle hHal, tANI_U8 staId)
+{
+   tANI_U16 tlSTAState = TL_INIT_STATE;
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+   eHalStatus status = eHAL_STATUS_FAILURE;
+
+   status = sme_AcquireGlobalLock( &pMac->sme );
+   if ( HAL_STATUS_SUCCESS( status ) )
+   {
+      tlSTAState = csrGetTLSTAState( pMac, staId);
+      sme_ReleaseGlobalLock( &pMac->sme );
+   }
+
+   return tlSTAState;
+}
+
+/* ---------------------------------------------------------------------------
 
     \fn sme_GetCountryCode
 
@@ -4495,6 +4886,9 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_RX_HDD_GET_CNTRYCODE, NO_SESSION, 0));
+
     return ( csrGetCountryCode( pMac, pBuf, pbLen ) );
 }
 
@@ -4521,6 +4915,8 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+              TRACE_CODE_SME_RX_HDD_SET_CNTRYCODE, NO_SESSION, 0));
     return ( csrSetCountryCode( pMac, pCountry, pfRestartNeeded ) );
 }
 
@@ -4630,7 +5026,8 @@
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
-    return ( csrGetRegulatoryDomainForCountry( pMac, pCountry, pDomainId ) );
+    return csrGetRegulatoryDomainForCountry(pMac, pCountry, pDomainId,
+                                            COUNTRY_QUERY);
 }
 
 
@@ -4734,6 +5131,8 @@
 
     \param pCountry New Country Code String
 
+    \param sendRegHint If we want to send reg hint to nl80211
+
     \return eHalStatus  SUCCESS.
 
                          FAILURE or RESOURCES  The API finished and failed.
@@ -4743,28 +5142,46 @@
                                           tSmeChangeCountryCallback callback,
                                           tANI_U8 *pCountry,
                                           void *pContext,
-                                          void* pVosContext )
+                                          void* pVosContext,
+                                          tAniBool countryFromUserSpace,
+                                          tAniBool sendRegHint )
 {
    eHalStatus                status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal            pMac = PMAC_STRUCT( hHal );
    vos_msg_t                 msg;
    tAniChangeCountryCodeReq *pMsg;
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+            TRACE_CODE_SME_RX_HDD_CHANGE_CNTRYCODE, NO_SESSION, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
       smsLog(pMac, LOG1, FL(" called"));
-      status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, sizeof(tAniChangeCountryCodeReq));
-      if ( !HAL_STATUS_SUCCESS(status) ) 
+
+      if ((csrGetInfraSessionId(pMac) != -1) &&
+          (!pMac->roam.configParam.fSupplicantCountryCodeHasPriority))
+      {
+
+          smsLog(pMac, LOGW, "Set Country Code Fail since the STA is associated and userspace does not have priority ");
+
+	  sme_ReleaseGlobalLock( &pMac->sme );
+          status = eHAL_STATUS_FAILURE;
+          return status;
+      }
+
+      pMsg = vos_mem_malloc(sizeof(tAniChangeCountryCodeReq));
+      if ( NULL == pMsg )
       {
          smsLog(pMac, LOGE, " csrChangeCountryCode: failed to allocate mem for req");
          sme_ReleaseGlobalLock( &pMac->sme );
-         return status;
+         return eHAL_STATUS_FAILURE;
       }
 
       pMsg->msgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_CHANGE_COUNTRY_CODE);
       pMsg->msgLen = (tANI_U16)sizeof(tAniChangeCountryCodeReq);
-      palCopyMemory(pMac->hHdd, pMsg->countryCode, pCountry, 3);
+      vos_mem_copy(pMsg->countryCode, pCountry, 3);
+      pMsg->countryFromUserSpace = countryFromUserSpace;
+      pMsg->sendRegHint = sendRegHint;
       pMsg->changeCCCallback = callback;
       pMsg->pDevContext = pContext;
       pMsg->pVosContext = pVosContext;
@@ -4776,7 +5193,7 @@
       if(VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MQ_ID_SME, &msg))
       {
           smsLog(pMac, LOGE, " sme_ChangeCountryCode failed to post msg to self ");
-          palFreeMemory(pMac->hHdd, (void *)pMsg);
+          vos_mem_free((void *)pMsg);
           status = eHAL_STATUS_FAILURE;
       }
       smsLog(pMac, LOG1, FL(" returned"));
@@ -4786,6 +5203,249 @@
    return (status);
 }
 
+/*--------------------------------------------------------------------------
+
+    \fn sme_GenericChangeCountryCode
+
+    \brief Change Country code from upperlayer during WLAN driver operation.
+           This is a synchronous API.
+
+    \param hHal - The handle returned by macOpen.
+
+    \param pCountry New Country Code String
+
+    \param reg_domain regulatory domain
+
+    \return eHalStatus  SUCCESS.
+
+                         FAILURE or RESOURCES  The API finished and failed.
+
+-----------------------------------------------------------------------------*/
+eHalStatus sme_GenericChangeCountryCode( tHalHandle hHal,
+                                         tANI_U8 *pCountry,
+                                         v_REGDOMAIN_t reg_domain)
+{
+    eHalStatus                status = eHAL_STATUS_FAILURE;
+    tpAniSirGlobal            pMac = PMAC_STRUCT( hHal );
+    vos_msg_t                 msg;
+    tAniGenericChangeCountryCodeReq *pMsg;
+
+    if (NULL == pMac)
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL,
+            "%s: pMac is null", __func__);
+        return status;
+    }
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        smsLog(pMac, LOG1, FL(" called"));
+        pMsg = vos_mem_malloc(sizeof(tAniGenericChangeCountryCodeReq));
+
+        if (NULL == pMsg)
+        {
+            smsLog(pMac, LOGE, " sme_GenericChangeCountryCode: failed to allocate mem for req");
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_FAILURE;
+        }
+
+        pMsg->msgType = pal_cpu_to_be16((tANI_U16)eWNI_SME_GENERIC_CHANGE_COUNTRY_CODE);
+        pMsg->msgLen = (tANI_U16)sizeof(tAniGenericChangeCountryCodeReq);
+        vos_mem_copy(pMsg->countryCode, pCountry, 3);
+        pMsg->domain_index = reg_domain;
+
+        msg.type = eWNI_SME_GENERIC_CHANGE_COUNTRY_CODE;
+        msg.bodyptr = pMsg;
+        msg.reserved = 0;
+
+        if (VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MQ_ID_SME, &msg))
+        {
+            smsLog(pMac, LOGE, "sme_GenericChangeCountryCode failed to post msg to self");
+            vos_mem_free(pMsg);
+            status = eHAL_STATUS_FAILURE;
+        }
+        smsLog(pMac, LOG1, FL(" returned"));
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return (status);
+}
+/* ---------------------------------------------------------------------------
+
+    \fn sme_DHCPStartInd
+
+    \brief API to signal the FW about the DHCP Start event.
+
+    \param hHal - HAL handle for device.
+
+    \param device_mode - mode(AP,SAP etc) of the device.
+
+    \param macAddr  - MAC address of the device.
+
+    \return eHalStatus  SUCCESS.
+
+                         FAILURE or RESOURCES  The API finished and failed.
+  --------------------------------------------------------------------------*/
+eHalStatus sme_DHCPStartInd( tHalHandle hHal,
+                                   tANI_U8 device_mode,
+                                   tANI_U8 *macAddr )
+{
+    eHalStatus          status;
+    VOS_STATUS          vosStatus;
+    tpAniSirGlobal      pMac = PMAC_STRUCT( hHal );
+    vos_msg_t           vosMessage;
+    tAniDHCPInd         *pMsg;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if ( eHAL_STATUS_SUCCESS == status)
+    {
+        pMsg = (tAniDHCPInd*)vos_mem_malloc(sizeof(tAniDHCPInd));
+        if (NULL == pMsg)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                   "%s: Not able to allocate memory for dhcp start", __func__);
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_FAILURE;
+        }
+        pMsg->msgType = WDA_DHCP_START_IND;
+        pMsg->msgLen = (tANI_U16)sizeof(tAniDHCPInd);
+        pMsg->device_mode = device_mode;
+        vos_mem_copy( pMsg->macAddr, macAddr, sizeof(tSirMacAddr));
+
+        vosMessage.type = WDA_DHCP_START_IND;
+        vosMessage.bodyptr = pMsg;
+        vosMessage.reserved = 0;
+
+        vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage );
+        if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
+        {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                         "%s: Post DHCP Start MSG fail", __func__);
+           vos_mem_free(pMsg);
+           status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    return (status);
+}
+/* ---------------------------------------------------------------------------
+    \fn sme_DHCPStopInd
+
+    \brief API to signal the FW about the DHCP complete event.
+
+    \param hHal - HAL handle for device.
+
+    \param device_mode - mode(AP, SAP etc) of the device.
+
+    \param macAddr  - MAC address of the device.
+
+    \return eHalStatus  SUCCESS.
+                         FAILURE or RESOURCES  The API finished and failed.
+  --------------------------------------------------------------------------*/
+eHalStatus sme_DHCPStopInd( tHalHandle hHal,
+                              tANI_U8 device_mode,
+                              tANI_U8 *macAddr )
+{
+    eHalStatus          status;
+    VOS_STATUS          vosStatus;
+    tpAniSirGlobal      pMac = PMAC_STRUCT( hHal );
+    vos_msg_t           vosMessage;
+    tAniDHCPInd         *pMsg;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if ( eHAL_STATUS_SUCCESS == status)
+    {
+        pMsg = (tAniDHCPInd*)vos_mem_malloc(sizeof(tAniDHCPInd));
+        if (NULL == pMsg)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                     "%s: Not able to allocate memory for dhcp stop", __func__);
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_FAILURE;
+       }
+
+       pMsg->msgType = WDA_DHCP_STOP_IND;
+       pMsg->msgLen = (tANI_U16)sizeof(tAniDHCPInd);
+       pMsg->device_mode = device_mode;
+       vos_mem_copy( pMsg->macAddr, macAddr, sizeof(tSirMacAddr));
+
+       vosMessage.type = WDA_DHCP_STOP_IND;
+       vosMessage.bodyptr = pMsg;
+       vosMessage.reserved = 0;
+
+       vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage );
+       if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
+       {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                        "%s: Post DHCP Stop MSG fail", __func__);
+           vos_mem_free(pMsg);
+           status = eHAL_STATUS_FAILURE;
+       }
+
+       sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    return (status);
+}
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/*---------------------------------------------------------------------------
+
+    \fn sme_TXFailMonitorStopInd
+
+    \brief API to signal the FW to start monitoring TX failures
+
+    \return eHalStatus  SUCCESS.
+
+                         FAILURE or RESOURCES  The API finished and failed.
+ --------------------------------------------------------------------------*/
+eHalStatus sme_TXFailMonitorStartStopInd(tHalHandle hHal, tANI_U8 tx_fail_count,
+                                         void * txFailIndCallback)
+{
+    eHalStatus            status;
+    VOS_STATUS            vosStatus;
+    tpAniSirGlobal        pMac = PMAC_STRUCT(hHal);
+    vos_msg_t             vosMessage;
+    tAniTXFailMonitorInd  *pMsg;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if ( eHAL_STATUS_SUCCESS == status)
+    {
+        pMsg = (tAniTXFailMonitorInd*)
+                   vos_mem_malloc(sizeof(tAniTXFailMonitorInd));
+        if (NULL == pMsg)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                   "%s: Failed to allocate memory", __func__);
+            sme_ReleaseGlobalLock( &pMac->sme );
+            return eHAL_STATUS_FAILURE;
+        }
+
+        pMsg->msgType = WDA_TX_FAIL_MONITOR_IND;
+        pMsg->msgLen = (tANI_U16)sizeof(tAniTXFailMonitorInd);
+
+        //tx_fail_count = 0 should disable the Monitoring in FW
+        pMsg->tx_fail_count = tx_fail_count;
+        pMsg->txFailIndCallback = txFailIndCallback;
+
+        vosMessage.type = WDA_TX_FAIL_MONITOR_IND;
+        vosMessage.bodyptr = pMsg;
+        vosMessage.reserved = 0;
+
+        vosStatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage );
+        if ( !VOS_IS_STATUS_SUCCESS(vosStatus) )
+        {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                         "%s: Post TX Fail monitor Start MSG fail", __func__);
+           vos_mem_free(pMsg);
+           status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    return (status);
+}
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
 /* ---------------------------------------------------------------------------
     \fn sme_BtcSignalBtEvent
     \brief  API to signal Bluetooth (BT) event to the WLAN driver. Based on the
@@ -4804,9 +5464,12 @@
 VOS_STATUS sme_BtcSignalBtEvent (tHalHandle hHal, tpSmeBtEvent pBtEvent)
 {
     VOS_STATUS status = VOS_STATUS_E_FAILURE;
+
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+           TRACE_CODE_SME_RX_HDD_BTC_SIGNALEVENT, NO_SESSION, 0));
     if ( eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock( &pMac->sme ) )
     {
         status = btcSignalBTEvent (hHal, pBtEvent);
@@ -4833,6 +5496,8 @@
     VOS_STATUS status = VOS_STATUS_E_FAILURE;
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_RX_HDD_BTC_SETCONFIG, NO_SESSION, 0));
     if ( eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock( &pMac->sme ) )
     {
         status = btcSetConfig (hHal, pSmeBtcConfig);
@@ -4859,6 +5524,8 @@
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_BTC_GETCONFIG, NO_SESSION, 0));
     if ( eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock( &pMac->sme ) )
     {
         status = btcGetConfig (hHal, pSmeBtcConfig);
@@ -4872,7 +5539,7 @@
     \brief  API to set configure privacy parameters
     \param  hHal - The handle returned by macOpen.
     \param  pProfile - Pointer CSR Roam profile.
-    \param  fPrivacy - This parameter indicates status of privacy 
+    \param  fPrivacy - This parameter indicates status of privacy
 
     \return void
   ---------------------------------------------------------------------------*/
@@ -4882,6 +5549,8 @@
                         )
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+               TRACE_CODE_SME_RX_HDD_SET_CFGPRIVACY, NO_SESSION, 0));
     if ( eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock( &pMac->sme ) )
     {
         csrSetCfgPrivacy(pMac, pProfile, fPrivacy);
@@ -4906,6 +5575,8 @@
 {
     VOS_STATUS status = VOS_STATUS_E_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_RX_HDD_NEIGHBOR_REPORTREQ, NO_SESSION, 0));
 
     if ( eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock( &pMac->sme ) )
     {
@@ -4929,6 +5600,8 @@
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
    tPmcPowerState PowerState;
    tANI_U32  sessionId = 0;
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+               TRACE_CODE_SME_RX_HDD_DBG_READREG, NO_SESSION, 0));
 
    /* 1) To make Quarky work in FTM mode **************************************/
 
@@ -4959,7 +5632,7 @@
             status = VOS_STATUS_SUCCESS;
          }
          else
-         {  
+         {
             status = VOS_STATUS_E_FAILURE;
          }
       }
@@ -4976,10 +5649,10 @@
       *pRegValue = 0xDEADBEEF;
        status = VOS_STATUS_SUCCESS;
    }
-        
+
    /* Release SME global lock */
    sme_ReleaseGlobalLock(&pMac->sme);
-    
+
    return (status);
 }
 
@@ -4995,6 +5668,8 @@
 
    /* 1) To make Quarky work in FTM mode **************************************/
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                    TRACE_CODE_SME_RX_HDD_DBG_WRITEREG, NO_SESSION, 0));
    if(eDRIVER_TYPE_MFG == pMac->gDriverType)
    {
       if (eWLAN_PAL_STATUS_SUCCESS == wpalDbgWriteRegister(regAddr, regValue))
@@ -5031,10 +5706,10 @@
          status = VOS_STATUS_E_FAILURE;
       }
    }
-        
+
    /* Release SME global lock */
    sme_ReleaseGlobalLock(&pMac->sme);
-    
+
    return (status);
 }
 
@@ -5056,6 +5731,8 @@
    tANI_U32 arg4 = 0;
    /* 1) To make Quarky work in FTM mode **************************************/
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                       TRACE_CODE_SME_RX_HDD_DBG_READMEM, NO_SESSION, 0));
    if(eDRIVER_TYPE_MFG == pMac->gDriverType)
    {
       if (VOS_STATUS_SUCCESS == WDA_HALDumpCmdReq(pMac, cmd, arg1, arg2, arg3, arg4, (tANI_U8*)pBuf))
@@ -5104,7 +5781,7 @@
 
    /* Release SME lock */
    sme_ReleaseGlobalLock(&pMac->sme);
-    
+
    return (status);
 }
 
@@ -5120,6 +5797,8 @@
 
    /* 1) To make Quarky work in FTM mode **************************************/
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                      TRACE_CODE_SME_RX_HDD_DBG_WRITEMEM, NO_SESSION, 0));
    if(eDRIVER_TYPE_MFG == pMac->gDriverType)
    {
       {
@@ -5158,11 +5837,29 @@
 
    /* Release Global lock */
    sme_ReleaseGlobalLock(&pMac->sme);
-    
+
    return (status);
 }
 
 
+void pmcLog(tpAniSirGlobal pMac, tANI_U32 loglevel, const char *pString, ...)
+{
+    VOS_TRACE_LEVEL  vosDebugLevel;
+    char    logBuffer[LOG_SIZE];
+    va_list marker;
+
+    /* getting proper Debug level */
+    vosDebugLevel = getVosDebugLevel(loglevel);
+
+    /* extracting arguments from pstring */
+    va_start( marker, pString );
+    vsnprintf(logBuffer, LOG_SIZE, pString, marker);
+
+    VOS_TRACE(VOS_MODULE_ID_PMC, vosDebugLevel, "%s", logBuffer);
+    va_end( marker );
+}
+
+
 void smsLog(tpAniSirGlobal pMac, tANI_U32 loglevel, const char *pString,...)
 {
 #ifdef WLAN_DEBUG
@@ -5450,7 +6147,7 @@
     \brief a wrapper function to obtain the OEM DATA RSP
     \param pOemDataRsp - A pointer to the response object
     \param pContext - a pointer passed in for the callback
-    \return eHalStatus     
+    \return eHalStatus
   ---------------------------------------------------------------------------*/
 eHalStatus sme_getOemDataRsp(tHalHandle hHal, 
         tOemDataRsp **pOemDataRsp)
@@ -5492,7 +6189,7 @@
     \param pOemDataReqId - pointer to an object to get back the request ID
     \param callback - a callback function that is called upon finish
     \param pContext - a pointer passed in for the callback
-    \return eHalStatus     
+    \return eHalStatus
   ---------------------------------------------------------------------------*/
 eHalStatus sme_OemDataReq(tHalHandle hHal, 
         tANI_U8 sessionId,
@@ -5556,7 +6253,8 @@
   \sa
 
   --------------------------------------------------------------------------*/
-eHalStatus sme_OpenSession(tHalHandle hHal, csrRoamCompleteCallback callback, void *pContext,
+eHalStatus sme_OpenSession(tHalHandle hHal, csrRoamCompleteCallback callback,
+                           void *pContext,
                            tANI_U8 *pSelfMacAddr, tANI_U8 *pbSessionId,
                            tANI_U32 type, tANI_U32 subType)
 {
@@ -5573,11 +6271,14 @@
       if ( HAL_STATUS_SUCCESS( status ) )
       {
          status = csrRoamOpenSession( pMac, callback, pContext, pSelfMacAddr,
-                         pbSessionId, type, subType );
+                                      pbSessionId, type, subType );
 
          sme_ReleaseGlobalLock( &pMac->sme );
       }
    }
+   if( NULL != pbSessionId )
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_RX_HDD_OPEN_SESSION,*pbSessionId, 0));
 
    return ( status );
 }
@@ -5607,10 +6308,12 @@
    eHalStatus status;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_RX_HDD_CLOSE_SESSION, sessionId, 0));
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
-      status = csrRoamCloseSession( pMac, sessionId, FALSE, 
+      status = csrRoamCloseSession( pMac, sessionId, FALSE,
                                     callback, pContext );
 
       sme_ReleaseGlobalLock( &pMac->sme );
@@ -5685,14 +6388,14 @@
 
     \fn sme_ChangeMCCBeaconInterval
 
-    \brief To update P2P-GO beaconInterval. This function should be called after 
-    disassociating all the station is done 
+    \brief To update P2P-GO beaconInterval. This function should be called after
+    disassociating all the station is done
     This is an asynchronous API.
 
-    \param 
+    \param
 
-    \return eHalStatus  SUCCESS 
-                        FAILURE or RESOURCES 
+    \return eHalStatus  SUCCESS
+                        FAILURE or RESOURCES
                         The API finished and failed.
 
   -------------------------------------------------------------------------------*/
@@ -5760,18 +6463,89 @@
 }
 
 /* ---------------------------------------------------------------------------
+    \fn     smeIssueFastRoamNeighborAPEvent
+    \brief  API to trigger fast BSS roam independent of RSSI triggers
+    \param  hHal - The handle returned by macOpen.
+    \param  bssid -  Pointer to the BSSID to roam to.
+    \param  fastRoamTrig - Trigger to Scan or roam
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus smeIssueFastRoamNeighborAPEvent (tHalHandle hHal,
+                                            tANI_U8 *bssid,
+                                            tSmeFastRoamTrigger fastRoamTrig)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    tpCsrNeighborRoamControlInfo  pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
+    VOS_STATUS  vosStatus = VOS_STATUS_SUCCESS;
+    eHalStatus  status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                  "%s: invoked", __func__);
+
+        if (eSME_ROAM_TRIGGER_SCAN == fastRoamTrig)
+        {
+            smsLog(pMac, LOG1, FL("CFG Channel list scan... "));
+            pNeighborRoamInfo->cfgRoamEn = eSME_ROAM_TRIGGER_SCAN;
+            vos_mem_copy((void *)(&pNeighborRoamInfo->cfgRoambssId),
+                       (void *)bssid, sizeof(tSirMacAddr));
+            smsLog(pMac, LOG1, "Calling Roam Look Up down Event BSSID %x %x %x %x %x %x",
+                   pNeighborRoamInfo->cfgRoambssId[0], pNeighborRoamInfo->cfgRoambssId[1],
+                   pNeighborRoamInfo->cfgRoambssId[2], pNeighborRoamInfo->cfgRoambssId[3],
+                   pNeighborRoamInfo->cfgRoambssId[4], pNeighborRoamInfo->cfgRoambssId[5]);
+
+            vosStatus = csrNeighborRoamTransitToCFGChanScan(pMac);
+            if (VOS_STATUS_SUCCESS != vosStatus)
+            {
+                smsLog(pMac, LOGE,
+                       FL("CFG Channel list scan state failed with status %d "),
+                       vosStatus);
+            }
+        }
+        else if (eSME_ROAM_TRIGGER_FAST_ROAM == fastRoamTrig)
+        {
+             vos_mem_copy((void *)(&pNeighborRoamInfo->cfgRoambssId),
+                       (void *)bssid, sizeof(tSirMacAddr));
+             pNeighborRoamInfo->cfgRoamEn = eSME_ROAM_TRIGGER_FAST_ROAM;
+             smsLog(pMac, LOG1, "Roam to BSSID %x-%x-%x-%x-%x-%x",
+                 pNeighborRoamInfo->cfgRoambssId[0], pNeighborRoamInfo->cfgRoambssId[1],
+                 pNeighborRoamInfo->cfgRoambssId[2], pNeighborRoamInfo->cfgRoambssId[3],
+                 pNeighborRoamInfo->cfgRoambssId[4], pNeighborRoamInfo->cfgRoambssId[5]);
+
+             vosStatus = csrNeighborRoamReassocIndCallback(pMac->roam.gVosContext,
+                                                           0,
+                                                           pMac,
+                                                           0);
+
+             if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+             {
+                 smsLog(pMac,
+                        LOGE,
+                        FL(" Call to csrNeighborRoamReassocIndCallback failed, status = %d"),
+                        vosStatus);
+             }
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    return vosStatus;
+}
+/* ---------------------------------------------------------------------------
     \fn sme_SetHostOffload
     \brief  API to set the host offload feature.
     \param  hHal - The handle returned by macOpen.
     \param  pRequest -  Pointer to the offload request.
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus sme_SetHostOffload (tHalHandle hHal, tANI_U8 sessionId, 
+eHalStatus sme_SetHostOffload (tHalHandle hHal, tANI_U8 sessionId,
                                     tpSirHostOffloadReq pRequest)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus status = eHAL_STATUS_FAILURE;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+               TRACE_CODE_SME_RX_HDD_SET_HOSTOFFLOAD, sessionId, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
 #ifdef WLAN_NS_OFFLOAD
@@ -5798,12 +6572,14 @@
     \param  pRequest -  Pointer to the GTK offload request.
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus sme_SetGTKOffload (tHalHandle hHal, tpSirGtkOffloadParams pRequest, 
+eHalStatus sme_SetGTKOffload (tHalHandle hHal, tpSirGtkOffloadParams pRequest,
                                     tANI_U8 sessionId)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus status;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                    TRACE_CODE_SME_RX_HDD_SET_GTKOFFLOAD, sessionId, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         status = pmcSetGTKOffload( hHal, pRequest, sessionId );
@@ -5820,12 +6596,14 @@
     \param  pRequest -  Pointer to the GTK offload response.
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus sme_GetGTKOffload (tHalHandle hHal, GTKOffloadGetInfoCallback callbackRoutine, 
+eHalStatus sme_GetGTKOffload (tHalHandle hHal, GTKOffloadGetInfoCallback callbackRoutine,
                                     void *callbackContext, tANI_U8 sessionId )
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus status;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                TRACE_CODE_SME_RX_HDD_GET_GTKOFFLOAD, sessionId, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         pmcGetGTKOffload(hHal, callbackRoutine, callbackContext, sessionId);
@@ -5843,7 +6621,7 @@
     \param  pRequest -  Pointer to the Keep Alive request.
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-eHalStatus sme_SetKeepAlive (tHalHandle hHal, tANI_U8 sessionId, 
+eHalStatus sme_SetKeepAlive (tHalHandle hHal, tANI_U8 sessionId,
                                  tpSirKeepAliveReq pRequest)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
@@ -5900,6 +6678,8 @@
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus status;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                       TRACE_CODE_SME_RX_HDD_SET_POWERPARAMS, NO_SESSION, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         pmcSetPowerParams(hHal, pwParams, forced);
@@ -5923,14 +6703,16 @@
     eHalStatus status;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+               TRACE_CODE_SME_RX_HDD_ABORT_MACSCAN, NO_SESSION, 0));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
        status = csrScanAbortMacScan(pMac, sessionId);
-    
+
        sme_ReleaseGlobalLock( &pMac->sme );
     }
-    
+
     return ( status );
 }
 
@@ -5951,7 +6733,7 @@
     {
        pSession = CSR_GET_SESSION( pMac, sessionId );
 
-       if(( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_INFRASTRUCTURE ) || 
+       if(( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_INFRASTRUCTURE ) ||
           ( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_IBSS ) ||
           ( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_INFRA_AP ) ||
           ( pSession->connectedProfile.BSSType == eCSR_BSS_TYPE_START_IBSS ))
@@ -5967,53 +6749,57 @@
 
     \fn sme_RegisterMgtFrame
 
-    \brief To register managment frame of specified type and subtype. 
+    \brief To register managment frame of specified type and subtype.
     \param frameType - type of the frame that needs to be passed to HDD.
     \param matchData - data which needs to be matched before passing frame 
-                       to HDD. 
+                       to HDD.
     \param matchDataLen - Length of matched data.
-    \return eHalStatus 
+    \return eHalStatus
   -------------------------------------------------------------------------------*/
-eHalStatus sme_RegisterMgmtFrame(tHalHandle hHal, tANI_U8 sessionId, 
+eHalStatus sme_RegisterMgmtFrame(tHalHandle hHal, tANI_U8 sessionId,
                      tANI_U16 frameType, tANI_U8* matchData, tANI_U16 matchLen)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                          TRACE_CODE_SME_RX_HDD_REGISTER_MGMTFR, sessionId, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         tSirRegisterMgmtFrame *pMsg;
         tANI_U16 len;
         tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
 
-        if(!pSession)
+        if(!CSR_IS_SESSION_ANY(sessionId) && !pSession)
         {
             smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
             sme_ReleaseGlobalLock( &pMac->sme );
             return eHAL_STATUS_FAILURE;
         }
-        
-        if( !pSession->sessionActive )
+
+        if( !CSR_IS_SESSION_ANY(sessionId) && !pSession->sessionActive )
         {
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
                         "%s Invalid Sessionid", __func__);
             sme_ReleaseGlobalLock( &pMac->sme );
             return eHAL_STATUS_FAILURE;
         }
-        
+
         len = sizeof(tSirRegisterMgmtFrame) + matchLen;
-        
-        status = palAllocateMemory(pMac->hHdd, (void**)&pMsg, len );
-        if(HAL_STATUS_SUCCESS(status))
+
+        pMsg = vos_mem_malloc(len);
+        if ( NULL == pMsg )
+           status = eHAL_STATUS_FAILURE;
+        else
         {
-            palZeroMemory(pMac->hHdd, pMsg, len);
+            vos_mem_set(pMsg, len, 0);
             pMsg->messageType     = eWNI_SME_REGISTER_MGMT_FRAME_REQ;
             pMsg->length          = len;
             pMsg->sessionId       = sessionId;
             pMsg->registerFrame   = VOS_TRUE;
             pMsg->frameType       = frameType;
             pMsg->matchLen        = matchLen;
-            palCopyMemory( pMac, pMsg->matchData, matchData, matchLen); 
+            vos_mem_copy(pMsg->matchData, matchData, matchLen);
             status = palSendMBMessage(pMac->hHdd, pMsg);
         }
         sme_ReleaseGlobalLock( &pMac->sme );
@@ -6025,33 +6811,35 @@
 
     \fn sme_DeregisterMgtFrame
 
-    \brief To De-register managment frame of specified type and subtype. 
+    \brief To De-register managment frame of specified type and subtype.
     \param frameType - type of the frame that needs to be passed to HDD.
-    \param matchData - data which needs to be matched before passing frame 
-                       to HDD. 
+    \param matchData - data which needs to be matched before passing frame
+                       to HDD.
     \param matchDataLen - Length of matched data.
-    \return eHalStatus 
+    \return eHalStatus
   -------------------------------------------------------------------------------*/
-eHalStatus sme_DeregisterMgmtFrame(tHalHandle hHal, tANI_U8 sessionId, 
+eHalStatus sme_DeregisterMgmtFrame(tHalHandle hHal, tANI_U8 sessionId,
                      tANI_U16 frameType, tANI_U8* matchData, tANI_U16 matchLen)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+              TRACE_CODE_SME_RX_HDD_DEREGISTER_MGMTFR, sessionId, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         tSirRegisterMgmtFrame *pMsg;
         tANI_U16 len;
         tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
 
-        if(!pSession)
+        if(!CSR_IS_SESSION_ANY(sessionId) && !pSession)
         {
             smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
             sme_ReleaseGlobalLock( &pMac->sme );
             return eHAL_STATUS_FAILURE;
         }
-        
-        if( !pSession->sessionActive ) 
+
+        if( !CSR_IS_SESSION_ANY(sessionId) && !pSession->sessionActive )
         {
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
                         "%s Invalid Sessionid", __func__);
@@ -6060,17 +6848,19 @@
         }
 
         len = sizeof(tSirRegisterMgmtFrame) + matchLen;
-        
-        status = palAllocateMemory(pMac->hHdd, (void**)&pMsg, len );
-        if(HAL_STATUS_SUCCESS(status))
+
+        pMsg = vos_mem_malloc(len);
+        if ( NULL == pMsg )
+           status = eHAL_STATUS_FAILURE;
+        else
         {
-            palZeroMemory(pMac->hHdd, pMsg, len);
+            vos_mem_set(pMsg, len, 0);
             pMsg->messageType     = eWNI_SME_REGISTER_MGMT_FRAME_REQ;
-            pMsg->length          = len; 
+            pMsg->length          = len;
             pMsg->registerFrame   = VOS_FALSE;
             pMsg->frameType       = frameType;
             pMsg->matchLen        = matchLen;
-            palCopyMemory( pMac, pMsg->matchData, matchData, matchLen); 
+            vos_mem_copy(pMsg->matchData, matchData, matchLen);
             status = palSendMBMessage(pMac->hHdd, pMsg);
         }
         sme_ReleaseGlobalLock( &pMac->sme );
@@ -6088,18 +6878,21 @@
     \param context - HDD Callback param
     \return eHalStatus
   ---------------------------------------------------------------------------*/
-
 eHalStatus sme_RemainOnChannel(tHalHandle hHal, tANI_U8 sessionId,
                                tANI_U8 channel, tANI_U32 duration,
-                               remainOnChanCallback callback, 
-                               void *pContext)
+                               remainOnChanCallback callback,
+                               void *pContext,
+                               tANI_U8 isP2PProbeReqAllowed)
 {
   eHalStatus status = eHAL_STATUS_SUCCESS;
   tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
+  MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+            TRACE_CODE_SME_RX_HDD_REMAIN_ONCHAN, sessionId, 0));
   if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
   {
-    status = p2pRemainOnChannel (hHal, sessionId, channel, duration, callback, pContext
+    status = p2pRemainOnChannel (hHal, sessionId, channel, duration, callback, pContext,
+                                 isP2PProbeReqAllowed
 #ifdef WLAN_FEATURE_P2P_INTERNAL
                                 , eP2PRemainOnChnReasonUnknown
 #endif
@@ -6155,6 +6948,8 @@
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+               TRACE_CODE_SME_RX_HDD_SEND_ACTION, NO_SESSION, 0));
     //acquire the lock for the sme object
     status = sme_AcquireGlobalLock(&pMac->sme);
     if(HAL_STATUS_SUCCESS(status))
@@ -6177,7 +6972,7 @@
 
             sirDumpBuf( pMac, SIR_LIM_MODULE_ID, LOG2,
                         pMac->p2pContext.probeRspIe,
-                        pMac->p2pContext.probeRspIeLength ); 
+                        pMac->p2pContext.probeRspIeLength );
             vos_mem_copy((tANI_U8 *)pMac->p2pContext.probeRspIe, p2pIe,
                          p2pIeLength);
         }
@@ -6185,7 +6980,7 @@
         //release the lock for the sme object
         sme_ReleaseGlobalLock( &pMac->sme );
     }
-   
+
     smsLog(pMac, LOG2, "exiting function %s", __func__);
 
     return(status);
@@ -6225,6 +7020,8 @@
   eHalStatus status = eHAL_STATUS_SUCCESS;
   tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
+  MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_CANCEL_REMAIN_ONCHAN, sessionId, 0));
   if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
   {
     status = p2pCancelRemainOnChannel (hHal, sessionId);
@@ -6252,14 +7049,14 @@
 
   \fn    sme_ConfigureRxpFilter
 
-  \brief 
+  \brief
     SME will pass this request to lower mac to set/reset the filter on RXP for
     multicast & broadcast traffic.
 
-  \param 
+  \param
 
-    hHal - The handle returned by macOpen. 
- 
+    hHal - The handle returned by macOpen.
+
     filterMask- Currently the API takes a 1 or 0 (set or reset) as filter.
     Basically to enable/disable the filter (to filter "all" mcbc traffic) based
     on this param. In future we can use this as a mask to set various types of
@@ -6268,12 +7065,12 @@
     FILTER_ALL_BROADCAST:
     FILTER_ALL_MULTICAST_BROADCAST:
 
-   
-  \return eHalStatus    
-  
-  
+
+  \return eHalStatus
+
+
 --------------------------------------------------------------------------- */
-eHalStatus sme_ConfigureRxpFilter( tHalHandle hHal, 
+eHalStatus sme_ConfigureRxpFilter( tHalHandle hHal,
                             tpSirWlanSetRxpFilters  wlanRxpFilterParam)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -6281,6 +7078,8 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     vos_msg_t       vosMessage;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                    TRACE_CODE_SME_RX_HDD_CONFIG_RXPFIL, NO_SESSION, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         /* serialize the req through MC thread */
@@ -6300,16 +7099,19 @@
 
   \fn    sme_ConfigureSuspendInd
 
-  \brief 
+  \brief
     SME will pass this request to lower mac to Indicate that the wlan needs to 
     be suspended
 
-  \param 
+  \param
 
-    hHal - The handle returned by macOpen. 
+    hHal - The handle returned by macOpen.
  
     wlanSuspendParam- Depicts the wlan suspend params
 
+    csrReadyToSuspendCallback - Callback to be called when ready to suspend
+                                event is received.
+    callbackContext  - Context associated with csrReadyToSuspendCallback.
    
   \return eHalStatus    
   
@@ -6325,6 +7127,8 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     vos_msg_t       vosMessage;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                  TRACE_CODE_SME_RX_HDD_CONFIG_SUSPENDIND, NO_SESSION, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         /* serialize the req through MC thread */
@@ -6351,22 +7155,22 @@
 
   \fn    sme_ConfigureResumeReq
 
-  \brief 
+  \brief
     SME will pass this request to lower mac to Indicate that the wlan needs to 
     be Resumed
 
-  \param 
+  \param
 
-    hHal - The handle returned by macOpen. 
+    hHal - The handle returned by macOpen.
  
     wlanResumeParam- Depicts the wlan resume params
 
-   
-  \return eHalStatus    
-  
-  
+
+  \return eHalStatus
+
+
 --------------------------------------------------------------------------- */
-eHalStatus sme_ConfigureResumeReq( tHalHandle hHal, 
+eHalStatus sme_ConfigureResumeReq( tHalHandle hHal,
                              tpSirWlanResumeParam  wlanResumeParam)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -6374,6 +7178,8 @@
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     vos_msg_t       vosMessage;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                     TRACE_CODE_SME_RX_HDD_CONFIG_RESUMEREQ, NO_SESSION, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         /* serialize the req through MC thread */
@@ -6406,7 +7212,7 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tANI_S8 sessionid = -1;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-                   
+
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -6450,11 +7256,11 @@
 }
 
 //This routine will return poerating channel on which other BSS is operating to be used for concurrency mode.
-//If other BSS is not up or not connected it will return 0 
+//If other BSS is not up or not connected it will return 0
 tANI_U8 sme_GetConcurrentOperationChannel( tHalHandle hHal )
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
-   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );   
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
    tANI_U8 channel = 0;
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
@@ -6475,7 +7281,7 @@
 * Name: sme_PreferredNetworkFoundInd
 *
 * Description:
-*    Invoke Preferred Network Found Indication 
+*    Invoke Preferred Network Found Indication
 *
 * Parameters:
 *    hHal - HAL handle for device
@@ -6504,8 +7310,8 @@
       if (pMac->pmc.prefNetwFoundCB != NULL)
       {
          pMac->pmc.prefNetwFoundCB(
-              pMac->pmc.preferredNetworkFoundIndCallbackContext,
-              pPrefNetworkFoundInd);
+             pMac->pmc.preferredNetworkFoundIndCallbackContext,
+             pPrefNetworkFoundInd);
       }
       return status;
    }
@@ -6524,7 +7330,7 @@
        {
           //we may have a frame
           status = csrScanSavePreferredNetworkFound(pMac,
-                      pPrefNetworkFoundInd);
+                                    pPrefNetworkFoundInd);
           if (!HAL_STATUS_SUCCESS(status))
           {
              smsLog(pMac, LOGE, FL(" fail to save preferred network"));
@@ -6543,12 +7349,12 @@
               pMac->pmc.preferredNetworkFoundIndCallbackContext,
               pPrefNetworkFoundInd);
        }
-    }
-    else
-    {
+   }
+   else
+   {
        smsLog(pMac, LOGE, "%s: callback failed - SSID is NULL", __func__);
        status = eHAL_STATUS_FAILURE;
-    }
+   }
 
    return(status);
 }
@@ -6560,14 +7366,14 @@
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-           
+
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
         status = csrGetCfgValidChannels(pMac, aValidChannels, len);
         sme_ReleaseGlobalLock( &pMac->sme );
     }
-    
+
     return (status);
 }
 
@@ -6584,8 +7390,8 @@
     \return eHalStatus
 
   -------------------------------------------------------------------------------*/
-eHalStatus sme_SetTxPerTracking(tHalHandle hHal, 
-                                void (*pCallbackfn) (void *pCallbackContext), 
+eHalStatus sme_SetTxPerTracking(tHalHandle hHal,
+                                void (*pCallbackfn) (void *pCallbackContext),
                                 void *pCallbackContext,
                                 tpSirTxPerTrackingParam pTxPerTrackingParam)
 {
@@ -6599,7 +7405,7 @@
         pMac->sme.pTxPerHitCbContext = pCallbackContext;
         sme_ReleaseGlobalLock( &pMac->sme );
     }
-    
+
     // free this memory in failure case or WDA request callback function
     pTxPerTrackingParamReq = vos_mem_malloc(sizeof(tSirTxPerTrackingParam));
     if (NULL == pTxPerTrackingParamReq)
@@ -6608,7 +7414,8 @@
         return eHAL_STATUS_FAILURE;
     }
 
-    vos_mem_copy(pTxPerTrackingParamReq, (void*)pTxPerTrackingParam, sizeof(tSirTxPerTrackingParam));
+    vos_mem_copy(pTxPerTrackingParamReq, (void*)pTxPerTrackingParam,
+                 sizeof(tSirTxPerTrackingParam));
     msg.type = WDA_SET_TX_PER_TRACKING_REQ;
     msg.reserved = 0;
     msg.bodyptr = pTxPerTrackingParamReq;
@@ -6652,7 +7459,7 @@
 {
    eHalStatus  status = eHAL_STATUS_SUCCESS;
    tAniChangeCountryCodeReq *pMsg;
-   v_REGDOMAIN_t domainIdIoctl; 
+   v_REGDOMAIN_t domainIdIoctl;
    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
    static uNvTables nvTables;
    pMsg = (tAniChangeCountryCodeReq *)pMsgBuf;
@@ -6668,7 +7475,9 @@
        /* read the country code from NV and use it */
        if ( VOS_IS_STATUS_SUCCESS(vosStatus) )
        {
-           palCopyMemory( pMac->hHdd, pMsg->countryCode , nvTables.defaultCountryTable.countryCode, WNI_CFG_COUNTRY_CODE_LEN );
+           vos_mem_copy(pMsg->countryCode,
+                        nvTables.defaultCountryTable.countryCode,
+                        WNI_CFG_COUNTRY_CODE_LEN);
        }
        else
        {
@@ -6679,7 +7488,8 @@
    else
    {
        /* if Supplicant country code has priority, disable 11d */
-       if(pMac->roam.configParam.fSupplicantCountryCodeHasPriority)
+       if(pMac->roam.configParam.fSupplicantCountryCodeHasPriority &&
+         pMsg->countryFromUserSpace)
        {
            pMac->roam.configParam.Is11dSupportEnabled = eANI_BOOLEAN_FALSE;
        }
@@ -6710,7 +7520,7 @@
        /* Supplicant country code failed. So give 11D priority */
        pMac->roam.configParam.Is11dSupportEnabled = pMac->roam.configParam.Is11dSupportEnabledOriginal;
        smsLog(pMac, LOGE, "Set Country Code Fail %d", status);
-       return status;  
+       return status;
    }
 
    status = WDA_SetCountryCode(pMac, pMsg->countryCode);
@@ -6721,31 +7531,49 @@
       return status;
    }
 
-   /* purge current scan results
-    if i don't do this than I still get old ap's (of different country code) as available (even if they are powered off). 
-    Looks like a bug in current scan sequence. 
-   */
-   csrScanFlushResult(pMac);
-
    /* overwrite the defualt country code */
-   palCopyMemory(pMac->hHdd, pMac->scan.countryCodeDefault, pMac->scan.countryCodeCurrent, WNI_CFG_COUNTRY_CODE_LEN);
+   vos_mem_copy(pMac->scan.countryCodeDefault,
+                pMac->scan.countryCodeCurrent,
+                WNI_CFG_COUNTRY_CODE_LEN);
 
    /* Get Domain ID from country code */
-   status = csrGetRegulatoryDomainForCountry( pMac, pMac->scan.countryCodeCurrent,(v_REGDOMAIN_t *) &domainIdIoctl );
+   status = csrGetRegulatoryDomainForCountry(pMac,
+                   pMac->scan.countryCodeCurrent,
+                   (v_REGDOMAIN_t *) &domainIdIoctl,
+                   COUNTRY_QUERY);
    if ( status != eHAL_STATUS_SUCCESS )
    {
        smsLog( pMac, LOGE, FL("  fail to get regId %d"), domainIdIoctl );
        return status;
    }
+   else if (REGDOMAIN_WORLD == domainIdIoctl)
+   {
+       /* Supplicant country code is invalid, so we are on world mode now. So
+          give 11D chance to update */
+       pMac->roam.configParam.Is11dSupportEnabled = pMac->roam.configParam.Is11dSupportEnabledOriginal;
+       smsLog(pMac, LOG1, FL("Country Code unrecognized by driver"));
+   }
 
-   status = WDA_SetRegDomain(pMac, domainIdIoctl);
+
+   status = WDA_SetRegDomain(pMac, domainIdIoctl, pMsg->sendRegHint);
 
    if ( status != eHAL_STATUS_SUCCESS )
    {
        smsLog( pMac, LOGE, FL("  fail to set regId %d"), domainIdIoctl );
        return status;
    }
-
+   else
+   {
+       //if 11d has priority, clear currentCountryBssid & countryCode11d to get
+       //set again if we find AP with 11d info during scan
+       if (!pMac->roam.configParam.fSupplicantCountryCodeHasPriority)
+       {
+           smsLog( pMac, LOGW, FL("Clearing currentCountryBssid, countryCode11d"));
+           vos_mem_zero(&pMac->scan.currentCountryBssid, sizeof(tCsrBssid));
+           vos_mem_zero( pMac->scan.countryCode11d, sizeof( pMac->scan.countryCode11d ) );
+       }
+   }
+#ifndef CONFIG_ENABLE_LINUX_REG
    /* set to default domain ID */
    pMac->scan.domainIdDefault = pMac->scan.domainIdCurrent;
 
@@ -6760,6 +7588,7 @@
 
    /* reset info based on new cc, and we are done */
    csrResetCountryInformation(pMac, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_TRUE);
+#endif
    if( pMsg->changeCCCallback )
    {
       ((tSmeChangeCountryCallback)(pMsg->changeCCCallback))((void *)pMsg->pDevContext);
@@ -6768,6 +7597,211 @@
    return eHAL_STATUS_SUCCESS;
 }
 
+/* ---------------------------------------------------------------------------
+
+    \fn sme_HandleChangeCountryCodeByUser
+
+    \brief Change Country code, Reg Domain and channel list
+
+    If Supplicant country code is priority than 11d is disabled.
+    If 11D is enabled, we update the country code after every scan.
+    Hence when Supplicant country code is priority, we don't need 11D info.
+    Country code from Supplicant is set as current country code.
+
+    \param pMac - The handle returned by macOpen.
+    \param pMsg - Carrying new CC & domain set in kernel by user
+
+    \return eHalStatus
+
+  -------------------------------------------------------------------------------*/
+eHalStatus sme_HandleChangeCountryCodeByUser(tpAniSirGlobal pMac,
+                                             tAniGenericChangeCountryCodeReq *pMsg)
+{
+    eHalStatus  status = eHAL_STATUS_SUCCESS;
+    v_REGDOMAIN_t reg_domain_id;
+    v_BOOL_t is11dCountry = VOS_FALSE;
+
+    smsLog(pMac, LOG1, FL(" called"));
+    reg_domain_id =  (v_REGDOMAIN_t)pMsg->domain_index;
+
+    if (memcmp(pMsg->countryCode, pMac->scan.countryCode11d,
+               VOS_COUNTRY_CODE_LEN) == 0)
+    {
+        is11dCountry = VOS_TRUE;
+    }
+
+    if ((!is11dCountry) && (!pMac->roam.configParam.fSupplicantCountryCodeHasPriority) &&
+        (csrGetInfraSessionId(pMac) != -1 ))
+    {
+
+        smsLog( pMac, LOGW, FL(" incorrect country being set, nullify this request"));
+
+        /* we have got a request for a country that should not have been added since the
+           STA is associated; nullify this request */
+        status = csrGetRegulatoryDomainForCountry(pMac,
+                                                  pMac->scan.countryCode11d,
+                                                  (v_REGDOMAIN_t *) &reg_domain_id,
+                                                  COUNTRY_IE);
+
+        return eHAL_STATUS_FAILURE;
+    }
+
+    /* if Supplicant country code has priority, disable 11d */
+    if (!is11dCountry && pMac->roam.configParam.fSupplicantCountryCodeHasPriority)
+    {
+        pMac->roam.configParam.Is11dSupportEnabled = eANI_BOOLEAN_FALSE;
+    }
+
+    vos_mem_copy(pMac->scan.countryCodeCurrent, pMsg->countryCode,
+                  WNI_CFG_COUNTRY_CODE_LEN);
+
+    status = WDA_SetRegDomain(pMac, reg_domain_id, eSIR_TRUE);
+
+    if (VOS_FALSE == is11dCountry )
+    {
+        /* overwrite the defualt country code */
+        vos_mem_copy(pMac->scan.countryCodeDefault,
+                      pMac->scan.countryCodeCurrent, WNI_CFG_COUNTRY_CODE_LEN);
+        /* set to default domain ID */
+        pMac->scan.domainIdDefault = pMac->scan.domainIdCurrent;
+    }
+
+    if ( status != eHAL_STATUS_SUCCESS )
+    {
+        smsLog( pMac, LOGE, FL("  fail to set regId %d"), reg_domain_id );
+        return status;
+    }
+    else
+    {
+        //if 11d has priority, clear currentCountryBssid & countryCode11d to get
+        //set again if we find AP with 11d info during scan
+        if((!pMac->roam.configParam.fSupplicantCountryCodeHasPriority) &&
+           (VOS_FALSE == is11dCountry ))
+        {
+            smsLog( pMac, LOGW, FL("Clearing currentCountryBssid, countryCode11d"));
+            vos_mem_zero(&pMac->scan.currentCountryBssid, sizeof(tCsrBssid));
+            vos_mem_zero( pMac->scan.countryCode11d, sizeof( pMac->scan.countryCode11d ) );
+        }
+    }
+
+    /* get the channels based on new cc */
+    status = csrInitGetChannels(pMac);
+
+    if ( status != eHAL_STATUS_SUCCESS )
+    {
+        smsLog( pMac, LOGE, FL("  fail to get Channels "));
+        return status;
+    }
+
+    /* reset info based on new cc, and we are done */
+    csrResetCountryInformation(pMac, eANI_BOOLEAN_TRUE, eANI_BOOLEAN_TRUE);
+    if (VOS_TRUE == is11dCountry)
+    {
+        pMac->scan.f11dInfoApplied = eANI_BOOLEAN_TRUE;
+        pMac->scan.f11dInfoReset = eANI_BOOLEAN_FALSE;
+    }
+
+    // Do active scans after the country is set by User hints or Country IE
+    pMac->scan.curScanType = eSIR_ACTIVE_SCAN;
+
+    smsLog(pMac, LOG1, FL(" returned"));
+    return eHAL_STATUS_SUCCESS;
+}
+
+/* ---------------------------------------------------------------------------
+
+    \fn sme_HandleChangeCountryCodeByCore
+
+    \brief Update Country code in the driver if set by kernel as world
+
+    If 11D is enabled, we update the country code after every scan & notify kernel.
+    This is to make sure kernel & driver are in sync in case of CC found in
+    driver but not in kernel database
+
+    \param pMac - The handle returned by macOpen.
+    \param pMsg - Carrying new CC set in kernel
+
+    \return eHalStatus
+
+  -------------------------------------------------------------------------------*/
+eHalStatus sme_HandleChangeCountryCodeByCore(tpAniSirGlobal pMac, tAniGenericChangeCountryCodeReq *pMsg)
+{
+    eHalStatus  status;
+
+    smsLog(pMac, LOG1, FL(" called"));
+
+    //this is to make sure kernel & driver are in sync in case of CC found in
+    //driver but not in kernel database
+    if (('0' == pMsg->countryCode[0]) && ('0' == pMsg->countryCode[1]))
+    {
+        smsLog( pMac, LOGW, FL("Setting countryCode11d & countryCodeCurrent to world CC"));
+        vos_mem_copy(pMac->scan.countryCode11d, pMsg->countryCode,
+                      WNI_CFG_COUNTRY_CODE_LEN);
+        vos_mem_copy(pMac->scan.countryCodeCurrent, pMsg->countryCode,
+                      WNI_CFG_COUNTRY_CODE_LEN);
+    }
+
+    status = WDA_SetRegDomain(pMac, REGDOMAIN_WORLD, eSIR_TRUE);
+
+    if ( status != eHAL_STATUS_SUCCESS )
+    {
+        smsLog( pMac, LOGE, FL("  fail to set regId") );
+        return status;
+    }
+    else
+    {
+        status = csrInitGetChannels(pMac);
+        if ( status != eHAL_STATUS_SUCCESS )
+        {
+            smsLog( pMac, LOGE, FL("  fail to get Channels "));
+        }
+        else
+        {
+            csrInitChannelList(pMac);
+        }
+    }
+    smsLog(pMac, LOG1, FL(" returned"));
+    return eHAL_STATUS_SUCCESS;
+}
+
+/* ---------------------------------------------------------------------------
+
+    \fn sme_HandleGenericChangeCountryCode
+
+    \brief Change Country code, Reg Domain and channel list
+
+    If Supplicant country code is priority than 11d is disabled.
+    If 11D is enabled, we update the country code after every scan.
+    Hence when Supplicant country code is priority, we don't need 11D info.
+    Country code from kernel is set as current country code.
+
+    \param pMac - The handle returned by macOpen.
+    \param pMsgBuf - message buffer
+
+    \return eHalStatus
+
+  -------------------------------------------------------------------------------*/
+eHalStatus sme_HandleGenericChangeCountryCode(tpAniSirGlobal pMac,  void *pMsgBuf)
+{
+    tAniGenericChangeCountryCodeReq *pMsg;
+    v_REGDOMAIN_t reg_domain_id;
+
+    smsLog(pMac, LOG1, FL(" called"));
+    pMsg = (tAniGenericChangeCountryCodeReq *)pMsgBuf;
+    reg_domain_id =  (v_REGDOMAIN_t)pMsg->domain_index;
+
+    if (REGDOMAIN_COUNT == reg_domain_id)
+    {
+        sme_HandleChangeCountryCodeByCore(pMac, pMsg);
+    }
+    else
+    {
+        sme_HandleChangeCountryCodeByUser(pMac, pMsg);
+    }
+    smsLog(pMac, LOG1, FL(" returned"));
+    return eHAL_STATUS_SUCCESS;
+}
+
 #ifdef WLAN_FEATURE_PACKET_FILTERING
 eHalStatus sme_8023MulticastList (tHalHandle hHal, tANI_U8 sessionId, tpSirRcvFltMcAddrList pMulticastAddrs)
 {
@@ -6815,8 +7849,9 @@
 
     vos_mem_copy(pRequestBuf, pMulticastAddrs, sizeof(tSirRcvFltMcAddrList));
 
-    vos_mem_copy(pRequestBuf->selfMacAddr, pSession->selfMacAddr, sizeof(tSirMacAddr));
-    vos_mem_copy(pRequestBuf->bssId, pSession->connectedProfile.bssid, 
+    vos_mem_copy(pRequestBuf->selfMacAddr, pSession->selfMacAddr,
+                 sizeof(tSirMacAddr));
+    vos_mem_copy(pRequestBuf->bssId, pSession->connectedProfile.bssid,
                  sizeof(tSirMacAddr));
 
     msg.type = WDA_8023_MULTICAST_LIST_REQ;
@@ -6833,7 +7868,7 @@
     return eHAL_STATUS_SUCCESS;
 }
 
-eHalStatus sme_ReceiveFilterSetFilter(tHalHandle hHal, tpSirRcvPktFilterCfgType pRcvPktFilterCfg, 
+eHalStatus sme_ReceiveFilterSetFilter(tHalHandle hHal, tpSirRcvPktFilterCfgType pRcvPktFilterCfg,
                                            tANI_U8 sessionId)
 {
     tpSirRcvPktFilterCfgType    pRequestBuf;
@@ -6846,9 +7881,9 @@
     VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s: filterType=%d, "
                "filterId = %d", __func__,
                pRcvPktFilterCfg->filterType, pRcvPktFilterCfg->filterId);
-  
+
     allocSize = sizeof(tSirRcvPktFilterCfgType);
-    
+
     pRequestBuf = vos_mem_malloc(allocSize);
 
     if (NULL == pRequestBuf)
@@ -6864,11 +7899,11 @@
         vos_mem_free(pRequestBuf);
         return eHAL_STATUS_FAILURE;
     }
-    
-    vos_mem_copy( pRcvPktFilterCfg->selfMacAddr, pSession->selfMacAddr, sizeof(tSirMacAddr));
-    vos_mem_copy( pRcvPktFilterCfg->bssId, pSession->connectedProfile.bssid, 
-                          sizeof(tSirMacAddr));
 
+    vos_mem_copy(pRcvPktFilterCfg->selfMacAddr, pSession->selfMacAddr,
+                 sizeof(tSirMacAddr));
+    vos_mem_copy(pRcvPktFilterCfg->bssId, pSession->connectedProfile.bssid,
+                 sizeof(tSirMacAddr));
     vos_mem_copy(pRequestBuf, pRcvPktFilterCfg, allocSize);
 
     msg.type = WDA_RECEIVE_FILTER_SET_FILTER_REQ;
@@ -6876,12 +7911,12 @@
     msg.bodyptr = pRequestBuf;
 
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "Pkt Flt Req : "
-           "FT %d FID %d ", 
-           pRequestBuf->filterType, pRequestBuf->filterId);    
+           "FT %d FID %d ",
+           pRequestBuf->filterType, pRequestBuf->filterId);
 
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "Pkt Flt Req : "
-           "params %d CT %d", 
-           pRequestBuf->numFieldParams, pRequestBuf->coalesceTime);    
+           "params %d CT %d",
+           pRequestBuf->numFieldParams, pRequestBuf->coalesceTime);
 
     for (idx=0; idx<pRequestBuf->numFieldParams; idx++)
     {
@@ -6899,7 +7934,7 @@
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
           "CData: %d:%d:%d:%d:%d:%d",
            pRequestBuf->paramsData[idx].compareData[0],
-           pRequestBuf->paramsData[idx].compareData[1], 
+           pRequestBuf->paramsData[idx].compareData[1],
            pRequestBuf->paramsData[idx].compareData[2],
            pRequestBuf->paramsData[idx].compareData[3],
            pRequestBuf->paramsData[idx].compareData[4],
@@ -6908,7 +7943,7 @@
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, 
            "MData: %d:%d:%d:%d:%d:%d",
            pRequestBuf->paramsData[idx].dataMask[0],
-           pRequestBuf->paramsData[idx].dataMask[1], 
+           pRequestBuf->paramsData[idx].dataMask[1],
            pRequestBuf->paramsData[idx].dataMask[2],
            pRequestBuf->paramsData[idx].dataMask[3],
            pRequestBuf->paramsData[idx].dataMask[4],
@@ -6927,9 +7962,9 @@
     return eHAL_STATUS_SUCCESS;
 }
 
-eHalStatus sme_GetFilterMatchCount(tHalHandle hHal, 
+eHalStatus sme_GetFilterMatchCount(tHalHandle hHal,
                                    FilterMatchCountCallback callbackRoutine,
-                                   void *callbackContext, 
+                                   void *callbackContext,
                                    tANI_U8 sessionId)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
@@ -6948,7 +7983,7 @@
     return (status);
 }
 
-eHalStatus sme_ReceiveFilterClearFilter(tHalHandle hHal, tpSirRcvFltPktClearParam pRcvFltPktClearParam, 
+eHalStatus sme_ReceiveFilterClearFilter(tHalHandle hHal, tpSirRcvFltPktClearParam pRcvFltPktClearParam,
                                              tANI_U8 sessionId)
 {
     tpSirRcvFltPktClearParam pRequestBuf;
@@ -6958,7 +7993,7 @@
 
     VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s: filterId = %d", __func__,
                pRcvFltPktClearParam->filterId);
-  
+
     pRequestBuf = vos_mem_malloc(sizeof(tSirRcvFltPktClearParam));
     if (NULL == pRequestBuf)
     {
@@ -6975,9 +8010,10 @@
         return eHAL_STATUS_FAILURE;
     }
 
-    vos_mem_copy( pRcvFltPktClearParam->selfMacAddr, pSession->selfMacAddr, sizeof(tSirMacAddr));
-    vos_mem_copy( pRcvFltPktClearParam->bssId, pSession->connectedProfile.bssid, 
-                          sizeof(tSirMacAddr));
+    vos_mem_copy(pRcvFltPktClearParam->selfMacAddr, pSession->selfMacAddr,
+                 sizeof(tSirMacAddr));
+    vos_mem_copy(pRcvFltPktClearParam->bssId, pSession->connectedProfile.bssid,
+                 sizeof(tSirMacAddr));
 
     vos_mem_copy(pRequestBuf, pRcvFltPktClearParam, sizeof(tSirRcvFltPktClearParam));
 
@@ -6998,12 +8034,12 @@
 
 /* ---------------------------------------------------------------------------
     \fn sme_PreChannelSwitchIndFullPowerCB
-    \brief  call back function for the PMC full power request because of pre 
+    \brief  call back function for the PMC full power request because of pre
              channel switch.
     \param callbackContext
     \param status
   ---------------------------------------------------------------------------*/
-void sme_PreChannelSwitchIndFullPowerCB(void *callbackContext, 
+void sme_PreChannelSwitchIndFullPowerCB(void *callbackContext,
                 eHalStatus status)
 {
     tpAniSirGlobal pMac = (tpAniSirGlobal)callbackContext;
@@ -7011,14 +8047,14 @@
     tANI_U16 msgLen;
 
     msgLen = (tANI_U16)(sizeof( tSirMbMsg ));
-    status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-    if(HAL_STATUS_SUCCESS(status))
+    pMsg = vos_mem_malloc(msgLen);
+    if ( NULL != pMsg )
     {
-        palZeroMemory(pMac->hHdd, (void *)pMsg, msgLen);
+        vos_mem_set(pMsg, msgLen, 0);
         pMsg->type = pal_cpu_to_be16((tANI_U16)eWNI_SME_PRE_CHANNEL_SWITCH_FULL_POWER);
         pMsg->msgLen = pal_cpu_to_be16(msgLen);
         status = palSendMBMessage(pMac->hHdd, pMsg);
-    }                             
+    }
 
     return;
 }
@@ -7036,8 +8072,8 @@
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
-       status = pmcRequestFullPower(hHal, sme_PreChannelSwitchIndFullPowerCB, 
-                            pMac, eSME_FULL_PWR_NEEDED_BY_CHANNEL_SWITCH); 
+       status = pmcRequestFullPower(hHal, sme_PreChannelSwitchIndFullPowerCB,
+                            pMac, eSME_FULL_PWR_NEEDED_BY_CHANNEL_SWITCH);
        sme_ReleaseGlobalLock( &pMac->sme );
    }
 
@@ -7083,7 +8119,7 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tANI_BOOLEAN valid = FALSE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-                   
+
    status = sme_AcquireGlobalLock( &pMac->sme );
    if ( HAL_STATUS_SUCCESS( status ) )
    {
@@ -7148,7 +8184,7 @@
   \param hHal - HAL handle for device
   \param pMsg - Message body passed from WDA; includes Wake Reason Indication parameter
 
-  \return eHalStatus  
+  \return eHalStatus
 ******************************************************************************/
 eHalStatus sme_WakeReasonIndCallback (tHalHandle hHal, void* pMsg)
 {
@@ -7168,7 +8204,7 @@
       /* Call Wake Reason Indication callback routine. */
       if (pMac->pmc.wakeReasonIndCB != NULL)
           pMac->pmc.wakeReasonIndCB(pMac->pmc.wakeReasonIndCBContext, pWakeReasonInd);
-        
+
       pMac->pmc.wakeReasonIndCB = NULL;
       pMac->pmc.wakeReasonIndCBContext = NULL;
 
@@ -7181,6 +8217,50 @@
 
 
 /* ---------------------------------------------------------------------------
+    \fn sme_SetMaxTxPowerPerBand
+
+    \brief Set the Maximum Transmit Power specific to band dynamically.
+    Note: this setting will not persist over reboots.
+
+    \param band
+    \param power to set in dB
+    \- return eHalStatus
+
+  ----------------------------------------------------------------------------*/
+eHalStatus sme_SetMaxTxPowerPerBand(eCsrBand band, v_S7_t dB)
+{
+    vos_msg_t msg;
+    tpMaxTxPowerPerBandParams pMaxTxPowerPerBandParams = NULL;
+
+    pMaxTxPowerPerBandParams = vos_mem_malloc(sizeof(tMaxTxPowerPerBandParams));
+    if (NULL == pMaxTxPowerPerBandParams)
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                  "%s:Not able to allocate memory for pMaxTxPowerPerBandParams",
+                  __func__);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    pMaxTxPowerPerBandParams->power = dB;
+    pMaxTxPowerPerBandParams->bandInfo = band;
+
+    msg.type = WDA_SET_MAX_TX_POWER_PER_BAND_REQ;
+    msg.reserved = 0;
+    msg.bodyptr = pMaxTxPowerPerBandParams;
+
+    if (VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MODULE_ID_WDA, &msg))
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                  "%s:Not able to post WDA_SET_MAX_TX_POWER_PER_BAND_REQ",
+                  __func__);
+        vos_mem_free(pMaxTxPowerPerBandParams);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    return eHAL_STATUS_SUCCESS;
+}
+
+/* ---------------------------------------------------------------------------
 
     \fn sme_SetMaxTxPower
 
@@ -7194,12 +8274,16 @@
     \- return eHalStatus
 
   -------------------------------------------------------------------------------*/
-eHalStatus sme_SetMaxTxPower(tHalHandle hHal, tSirMacAddr pBssid, 
+eHalStatus sme_SetMaxTxPower(tHalHandle hHal, tSirMacAddr pBssid,
                              tSirMacAddr pSelfMacAddress, v_S7_t dB)
 {
     vos_msg_t msg;
     tpMaxTxPowerParams pMaxTxParams = NULL;
-
+#ifdef LIM_TRACE_RECORD
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+#endif
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                     TRACE_CODE_SME_RX_HDD_SET_MAXTXPOW, NO_SESSION, 0));
     pMaxTxParams = vos_mem_malloc(sizeof(tMaxTxPowerParams));
     if (NULL == pMaxTxParams)
     {
@@ -7208,7 +8292,7 @@
     }
 
     vos_mem_copy(pMaxTxParams->bssId, pBssid, SIR_MAC_ADDR_LENGTH);
-    vos_mem_copy(pMaxTxParams->selfStaMacAddr , pSelfMacAddress, 
+    vos_mem_copy(pMaxTxParams->selfStaMacAddr, pSelfMacAddress,
                  SIR_MAC_ADDR_LENGTH);
     pMaxTxParams->power = dB;
 
@@ -7245,6 +8329,8 @@
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
+   MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                 TRACE_CODE_SME_RX_HDD_SET_TXPOW, NO_SESSION, 0));
    smsLog(pMac, LOG1, FL("set tx power %dmW"), mW);
    status = sme_AcquireGlobalLock(&pMac->sme);
    if (HAL_STATUS_SUCCESS(status))
@@ -7286,20 +8372,22 @@
             return eHAL_STATUS_FAILURE;
         }
         
-        if( !pSession->sessionActive ) 
+        if( !pSession->sessionActive )
             VOS_ASSERT(0);
 
         /* Create the message and send to lim */
         len = sizeof(tSirUpdateParams); 
-        status = palAllocateMemory( pMac->hHdd, (void **)&pMsg, len );
-        if(HAL_STATUS_SUCCESS(status))
+        pMsg = vos_mem_malloc(len);
+        if ( NULL == pMsg )
+           status = eHAL_STATUS_FAILURE;
+        else
         {
-            palZeroMemory(pMac->hHdd, pMsg, sizeof(tSirUpdateParams) );
+            vos_mem_set(pMsg, sizeof(tSirUpdateParams), 0);
             pMsg->messageType     = eWNI_SME_HIDE_SSID_REQ;
             pMsg->length          = len;
             /* Data starts from here */
             pMsg->sessionId       = sessionId;
-            pMsg->ssidHidden      = ssidHidden; 
+            pMsg->ssidHidden      = ssidHidden;
             status = palSendMBMessage(pMac->hHdd, pMsg);
         }
         sme_ReleaseGlobalLock( &pMac->sme );
@@ -7314,7 +8402,7 @@
     \param  hHal - The handle returned by macOpen.
     \param  newTMLevel - new Thermal Mitigation Level
     \param  tmMode - Thermal Mitigation handle mode, default 0
-    \return eHalStatus     
+    \return eHalStatus
   ---------------------------------------------------------------------------*/
 eHalStatus sme_SetTmLevel(tHalHandle hHal, v_U16_t newTMLevel, v_U16_t tmMode)
 {
@@ -7324,10 +8412,12 @@
     vos_msg_t           vosMessage;
     tAniSetTmLevelReq  *setTmLevelReq = NULL;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                         TRACE_CODE_SME_RX_HDD_SET_TMLEVEL, NO_SESSION, 0));
     if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme ) ) )
     {
         setTmLevelReq = (tAniSetTmLevelReq *)vos_mem_malloc(sizeof(tAniSetTmLevelReq));
-        if(NULL == setTmLevelReq)
+        if (NULL == setTmLevelReq)
         {
            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
                      "%s: Not able to allocate memory for sme_SetTmLevel", __func__);
@@ -7367,6 +8457,11 @@
 void sme_featureCapsExchange( tHalHandle hHal)
 {
     v_CONTEXT_t vosContext = vos_get_global_context(VOS_MODULE_ID_SME, NULL);
+#ifdef LIM_TRACE_RECORD
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+#endif
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                     TRACE_CODE_SME_RX_HDD_CAPS_EXCH, NO_SESSION, 0));
     WDA_featureCapsExchange(vosContext);
 }
 
@@ -7401,6 +8496,8 @@
 eHalStatus sme_GetDefaultCountryCodeFrmNv(tHalHandle hHal, tANI_U8 *pCountry)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_GET_DEFCCNV, NO_SESSION, 0));
     return csrGetDefaultCountryCodeFrmNv(pMac, pCountry);
 }
 
@@ -7418,6 +8515,8 @@
 eHalStatus sme_GetCurrentCountryCode(tHalHandle hHal, tANI_U8 *pCountry)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+              TRACE_CODE_SME_RX_HDD_GET_CURCC, NO_SESSION, 0));
     return csrGetCurrentCountryCode(pMac, pCountry);
 }
 
@@ -7454,6 +8553,8 @@
 void sme_ResetPowerValuesFor5G (tHalHandle hHal)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT (hHal);
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_RESET_PW5G, NO_SESSION, 0));
     csrSaveChannelPowerForBand(pMac, eANI_BOOLEAN_TRUE);
     csrApplyPower2Current(pMac);     // Store the channel+power info in the global place: Cfg
 }
@@ -7474,6 +8575,8 @@
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus          status    = eHAL_STATUS_SUCCESS;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+                       TRACE_CODE_SME_RX_HDD_UPDATE_RP5G, NO_SESSION, 0));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
@@ -7502,6 +8605,8 @@
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus          status    = eHAL_STATUS_SUCCESS;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+              TRACE_CODE_SME_RX_HDD_SET_ROAMIBAND, NO_SESSION, 0));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
@@ -7517,6 +8622,83 @@
 }
 
 /* ---------------------------------------------------------------------------
+    \fn sme_UpdateRoamScanNProbes
+    \brief  function to update roam scan N probes
+            This function is called through dynamic setConfig callback function
+            to update roam scan N probes
+    \param  hHal - HAL handle for device
+    \param  nProbes number of probe requests to be sent out
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_UpdateRoamScanNProbes(tHalHandle hHal, const v_U8_t nProbes)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_UPDATE_IMMRSSIDIFF, NO_SESSION, 0));
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                     "%s: gRoamScanNProbes is changed from %d to %d", __func__,
+                      pMac->roam.configParam.nProbes,
+                      nProbes);
+        pMac->roam.configParam.nProbes = nProbes;
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+    {
+        csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG,
+                           REASON_NPROBES_CHANGED);
+    }
+#endif
+    return status ;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_UpdateRoamScanHomeAwayTime
+    \brief  function to update roam scan Home away time
+            This function is called through dynamic setConfig callback function
+            to update roam scan home away time
+    \param  hHal - HAL handle for device
+    \param  nRoamScanAwayTime Scan home away time
+    \param  bSendOffloadCmd If TRUE then send offload command to firmware
+                            If FALSE then command is not sent to firmware
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_UpdateRoamScanHomeAwayTime(tHalHandle hHal, const v_U16_t nRoamScanHomeAwayTime,
+                                          const eAniBoolean bSendOffloadCmd)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+             TRACE_CODE_SME_RX_HDD_SET_SCANCTRL, NO_SESSION, 0));
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                     "%s: gRoamScanHomeAwayTime is changed from %d to %d", __func__,
+                      pMac->roam.configParam.nRoamScanHomeAwayTime,
+                      nRoamScanHomeAwayTime);
+        pMac->roam.configParam.nRoamScanHomeAwayTime = nRoamScanHomeAwayTime;
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    if (pMac->roam.configParam.isRoamOffloadScanEnabled && bSendOffloadCmd)
+    {
+        csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG,
+                           REASON_HOME_AWAY_TIME_CHANGED);
+    }
+#endif
+    return status;
+}
+
+
+/* ---------------------------------------------------------------------------
     \fn sme_getRoamIntraBand
     \brief  get Intra band roaming
     \param  hHal - HAL handle for device
@@ -7525,9 +8707,35 @@
 v_BOOL_t sme_getRoamIntraBand(tHalHandle hHal)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+              TRACE_CODE_SME_RX_HDD_GET_ROAMIBAND, NO_SESSION, 0));
     return pMac->roam.configParam.nRoamIntraBand;
 }
 
+/* ---------------------------------------------------------------------------
+    \fn sme_getRoamScanNProbes
+    \brief  get N Probes
+    \param  hHal - HAL handle for device
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+v_U8_t sme_getRoamScanNProbes(tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    return pMac->roam.configParam.nProbes;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_getRoamScanHomeAwayTime
+    \brief  get Roam scan home away time
+    \param  hHal - HAL handle for device
+    \- return Success or failure
+    -------------------------------------------------------------------------*/
+v_U16_t sme_getRoamScanHomeAwayTime(tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    return pMac->roam.configParam.nRoamScanHomeAwayTime;
+}
+
 
 /* ---------------------------------------------------------------------------
     \fn sme_UpdateImmediateRoamRssiDiff
@@ -7536,7 +8744,7 @@
             to configure nImmediateRoamRssiDiff
             Usage: adb shell iwpriv wlan0 setConfig gImmediateRoamRssiDiff=[0 .. 125]
     \param  hHal - HAL handle for device
-    \param  nImmediateRoamRssiDiff - minimum rssi difference between potential 
+    \param  nImmediateRoamRssiDiff - minimum rssi difference between potential
             candidate and current AP.
     \- return Success or failure
     -------------------------------------------------------------------------*/
@@ -7547,6 +8755,8 @@
     eHalStatus          status    = eHAL_STATUS_SUCCESS;
 
     status = sme_AcquireGlobalLock( &pMac->sme );
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+               TRACE_CODE_SME_RX_HDD_UPDATE_RSSIDIFF, NO_SESSION, 0));
     if ( HAL_STATUS_SUCCESS( status ) )
     {
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
@@ -7600,7 +8810,7 @@
 
 /*--------------------------------------------------------------------------
   \brief sme_UpdateFastTransitionEnabled() - enable/disable Fast Transition support at runtime
-  It is used at in the REG_DYNAMIC_VARIABLE macro definition of 
+  It is used at in the REG_DYNAMIC_VARIABLE macro definition of
   isFastTransitionEnabled.
   This is a synchronous call
   \param hHal - The handle returned by macOpen.
@@ -7608,12 +8818,14 @@
           Other status means SME is failed to update isFastTransitionEnabled.
   \sa
   --------------------------------------------------------------------------*/
-eHalStatus sme_UpdateFastTransitionEnabled(tHalHandle hHal, 
+eHalStatus sme_UpdateFastTransitionEnabled(tHalHandle hHal,
         v_BOOL_t isFastTransitionEnabled)
 {
   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     eHalStatus          status    = eHAL_STATUS_SUCCESS;
 
+    MTRACE(macTraceNew(pMac, VOS_MODULE_ID_SME,
+            TRACE_CODE_SME_RX_HDD_UPDATE_FTENABLED, NO_SESSION, 0));
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
@@ -7686,7 +8898,7 @@
         {
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
                      "LFR runtime successfully cleared roam scan cache");
-            csrFlushBgScanRoamChannelList(pMac);
+            csrFlushCfgBgScanRoamChannelList(pMac);
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
            if (pMac->roam.configParam.isRoamOffloadScanEnabled)
            {
@@ -7703,7 +8915,7 @@
 #ifdef FEATURE_WLAN_LFR
 /*--------------------------------------------------------------------------
   \brief sme_UpdateIsFastRoamIniFeatureEnabled() - enable/disable LFR support at runtime
-  It is used at in the REG_DYNAMIC_VARIABLE macro definition of 
+  It is used at in the REG_DYNAMIC_VARIABLE macro definition of
   isFastRoamIniFeatureEnabled.
   This is a synchronous call
   \param hHal - The handle returned by macOpen.
@@ -7711,7 +8923,7 @@
           Other status means SME is failed to update isFastRoamIniFeatureEnabled.
   \sa
   --------------------------------------------------------------------------*/
-eHalStatus sme_UpdateIsFastRoamIniFeatureEnabled(tHalHandle hHal, 
+eHalStatus sme_UpdateIsFastRoamIniFeatureEnabled(tHalHandle hHal,
         const v_BOOL_t isFastRoamIniFeatureEnabled)
 {
   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
@@ -7732,26 +8944,72 @@
   pMac->roam.configParam.isFastRoamIniFeatureEnabled = isFastRoamIniFeatureEnabled;
   csrNeighborRoamUpdateFastRoamingEnabled(pMac, isFastRoamIniFeatureEnabled);
 
-  if(TRUE == isFastRoamIniFeatureEnabled)
-  {
-      sme_UpdateConfigFwRssiMonitoring(hHal, TRUE);
-  }
-  else
-  {
-      /* CCX also depend on FW Monitoring.
-         Hence Disabling LFR should check for CCX enable before disabling FW Monitoring */
-#ifdef FEATURE_WLAN_CCX
-      if(FALSE == pMac->roam.configParam.isCcxIniFeatureEnabled)
-#endif
-      {
-          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                     "%s: Turn off FW Monitoring", __func__);
-          sme_UpdateConfigFwRssiMonitoring(hHal, FALSE);
-      }
-  }
-
   return eHAL_STATUS_SUCCESS;
 }
+
+/*--------------------------------------------------------------------------
+  \brief sme_UpdateIsMAWCIniFeatureEnabled() -
+  Enable/disable LFR MAWC support at runtime
+  It is used at in the REG_DYNAMIC_VARIABLE macro definition of
+  isMAWCIniFeatureEnabled.
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS - SME update MAWCEnabled config successfully.
+          Other status means SME is failed to update MAWCEnabled.
+  \sa
+  --------------------------------------------------------------------------*/
+eHalStatus sme_UpdateIsMAWCIniFeatureEnabled(tHalHandle hHal,
+        const v_BOOL_t MAWCEnabled)
+{
+  tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+  eHalStatus status = eHAL_STATUS_SUCCESS;
+
+  status = sme_AcquireGlobalLock( &pMac->sme );
+  if ( HAL_STATUS_SUCCESS( status ) )
+  {
+      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                "%s: MAWCEnabled is changed from %d to %d", __func__,
+                pMac->roam.configParam.MAWCEnabled,
+                MAWCEnabled);
+      pMac->roam.configParam.MAWCEnabled = MAWCEnabled;
+      sme_ReleaseGlobalLock( &pMac->sme );
+  }
+
+  return status ;
+
+}
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+/*--------------------------------------------------------------------------
+  \brief sme_UpdateEnableFastRoamInConcurrency() - enable/disable LFR if Concurrent session exists
+  This is a synchronuous call
+  \param hHal - The handle returned by macOpen.
+  \return eHAL_STATUS_SUCCESS
+          Other status means SME is failed
+  \sa
+  --------------------------------------------------------------------------*/
+
+eHalStatus sme_UpdateEnableFastRoamInConcurrency(tHalHandle hHal,
+                          v_BOOL_t bFastRoamInConIniFeatureEnabled)
+{
+
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus  status  = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        pMac->roam.configParam.bFastRoamInConIniFeatureEnabled = bFastRoamInConIniFeatureEnabled;
+        if (0 == pMac->roam.configParam.isRoamOffloadScanEnabled)
+        {
+            pMac->roam.configParam.bFastRoamInConIniFeatureEnabled = 0;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status;
+}
+#endif
 #endif /* FEATURE_WLAN_LFR */
 
 #ifdef FEATURE_WLAN_CCX
@@ -7790,22 +9048,8 @@
   if(TRUE == isCcxIniFeatureEnabled)
   {
       sme_UpdateFastTransitionEnabled(hHal, TRUE);
-      sme_UpdateConfigFwRssiMonitoring(hHal, TRUE);
   }
-  else
-  {
-      /* LFR also depend on FW Monitoring.
-         Hence Disabling CCX should check for LFR enable before disabling FW Monitoring and Fast Transition */
-#ifdef FEATURE_WLAN_LFR
-      if(FALSE == pMac->roam.configParam.isFastRoamIniFeatureEnabled)
-#endif
-      {
-          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                     "%s: Turn off FW Monitoring/Fast Transition", __func__);
-          sme_UpdateFastTransitionEnabled(hHal, FALSE);
-          sme_UpdateConfigFwRssiMonitoring(hHal, FALSE);
-      }
-  }
+
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
     if (pMac->roam.configParam.isRoamOffloadScanEnabled)
     {
@@ -7874,13 +9118,6 @@
         }
         sme_ReleaseGlobalLock( &pMac->sme );
     }
-
-#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-    if (pMac->roam.configParam.isRoamOffloadScanEnabled)
-    {
-       csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG, REASON_LOOKUP_THRESH_CHANGED);
-    }
-#endif
     return status;
 }
 
@@ -8060,6 +9297,13 @@
         sme_ReleaseGlobalLock( &pMac->sme );
     }
 
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+    {
+       csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG,
+                          REASON_EMPTY_SCAN_REF_PERIOD_CHANGED);
+    }
+#endif
     return status ;
 }
 
@@ -8121,6 +9365,13 @@
         pMac->roam.neighborRoamInfo.cfgParams.maxChannelScanTime = nNeighborScanMaxChanTime;
         sme_ReleaseGlobalLock( &pMac->sme );
     }
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+    {
+       csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG,
+                          REASON_SCAN_CH_TIME_CHANGED);
+    }
+#endif
 
     return status ;
 }
@@ -8154,7 +9405,7 @@
     \brief  Update nNeighborScanPeriod
             This function is called through dynamic setConfig callback function
             to configure nNeighborScanPeriod
-            Usage: adb shell iwpriv wlan0 setConfig nNeighborScanPeriod=[0 .. 60]
+            Usage: adb shell iwpriv wlan0 setConfig nNeighborScanPeriod=[0 .. 1000]
     \param  hHal - HAL handle for device
     \param  nNeighborScanPeriod - neighbor scan period
     \- return Success or failure
@@ -8176,6 +9427,13 @@
         pMac->roam.neighborRoamInfo.cfgParams.neighborScanPeriod = nNeighborScanPeriod;
         sme_ReleaseGlobalLock( &pMac->sme );
     }
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+    {
+       csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG,
+                          REASON_SCAN_HOME_TIME_CHANGED);
+    }
+#endif
 
     return status ;
 }
@@ -8238,7 +9496,7 @@
                 pNeighborRoamInfo->cfgParams.channelInfo.ChannelList[i]);
             }
         }
-        csrFlushBgScanRoamChannelList(pMac);
+        csrFlushCfgBgScanRoamChannelList(pMac);
         csrCreateBgScanRoamChannelList(pMac, pChannelList, numChannels);
         status = csrUpdateBgScanConfigIniChannelList(pMac, csrGetCurrentBand(hHal));
 
@@ -8272,43 +9530,74 @@
     return status ;
 }
 
+#ifdef FEATURE_WLAN_CCX_UPLOAD
 /*--------------------------------------------------------------------------
-  \brief sme_ChangeCountryValidChannelListByRevision() - Change Korea valid channel list
-  based on country revision number
-  This is a synchronous call
+  \brief sme_SetCcxRoamScanChannelList() - set ccx roam scan channel list
+  This is a synchronuous call
   \param hHal - The handle returned by macOpen.
   \return eHAL_STATUS_SUCCESS - SME update config successful.
           Other status means SME is failed to update
   \sa
   --------------------------------------------------------------------------*/
-eHalStatus sme_ChangeCountryValidChannelListByRevision(tHalHandle hHal,
-                                         tANI_U8 Revision)
+eHalStatus sme_SetCcxRoamScanChannelList(tHalHandle hHal,
+                                         tANI_U8 *pChannelList,
+                                         tANI_U8 numChannels)
 {
-    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    tpAniSirGlobal      pMac = PMAC_STRUCT( hHal );
     eHalStatus          status    = eHAL_STATUS_SUCCESS;
-
+    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo
+       = &pMac->roam.neighborRoamInfo;
+    tpCsrChannelInfo    currChannelListInfo
+       = &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo;
+    tANI_U8             oldChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN*2] = {0};
+    tANI_U8             newChannelList[128] = {0};
+    tANI_U8             i = 0, j = 0;
     status = sme_AcquireGlobalLock( &pMac->sme );
     if ( HAL_STATUS_SUCCESS( status ) )
     {
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
-                     "LFR runtime successfully set country/revision to %s/%d - old value is %s/%d - roam state is %d",
-                     "KR", Revision, "KR",
-                     pMac->roam.neighborRoamInfo.cfgParams.countryChannelInfo.revision,
-                     pMac->roam.neighborRoamInfo.neighborRoamState);
-        csr_SetRevision(pMac, Revision);
-        csrInitCountryValidChannelList(pMac, Revision);
+        if (NULL != currChannelListInfo->ChannelList)
+        {
+            for (i = 0; i < currChannelListInfo->numOfChannels; i++)
+            {
+                j += snprintf(oldChannelList + j,
+                              sizeof(oldChannelList) - j,
+                              " %d",
+                              currChannelListInfo->ChannelList[i]);
+            }
+        }
+        status = csrCreateRoamScanChannelList(pMac, pChannelList,
+                   numChannels, csrGetCurrentBand(hHal));
+        if ( HAL_STATUS_SUCCESS( status ))
+        {
+            if (NULL != currChannelListInfo->ChannelList)
+            {
+                j = 0;
+                for (i = 0; i < currChannelListInfo->numOfChannels; i++)
+                {
+                    j += snprintf(newChannelList + j,
+                                  sizeof(newChannelList) - j,
+                                  " %d",
+                    currChannelListInfo->ChannelList[i]);
+                }
+            }
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+"CCX roam scan channel list successfully set to \
+%s - old value is %s - roam state is %d",
+                      newChannelList, oldChannelList,
+                      pMac->roam.neighborRoamInfo.neighborRoamState);
+        }
         sme_ReleaseGlobalLock( &pMac->sme );
     }
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-    if (pMac->roam.configParam.isRoamOffloadScanEnabled)
-    {
-       csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG, REASON_VALID_CHANNEL_LIST_CHANGED);
-    }
+        if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+        {
+           csrRoamOffloadScan(pMac, ROAM_SCAN_OFFLOAD_UPDATE_CFG,
+                              REASON_CHANNEL_LIST_CHANGED);
+        }
 #endif
-
     return status ;
 }
-
+#endif
 
 /*--------------------------------------------------------------------------
   \brief csrUpdateBgScanConfigIniChannelList() - Update bgscan roam cache
@@ -8366,26 +9655,6 @@
 }
 
 /*--------------------------------------------------------------------------
-  \brief sme_GetCountryRevision() - get Country revision index
-  This is a synchronous call
-  \param hHal - The handle returned by macOpen.
-  \return eHAL_STATUS_SUCCESS - SME update config successful.
-          Other status means SME is failed to update
-  \sa
-  --------------------------------------------------------------------------*/
-eHalStatus sme_GetCountryRevision(tHalHandle hHal, tANI_U8 *pRevision)
-{
-    /* this is valid for Country KR only now */
-    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-    tpCsrNeighborRoamControlInfo    pNeighborRoamInfo = &pMac->roam.neighborRoamInfo;
-    eHalStatus          status    = eHAL_STATUS_SUCCESS;
-
-    *pRevision = pNeighborRoamInfo->cfgParams.countryChannelInfo.revision;
-
-    return status;
-}
-
-/*--------------------------------------------------------------------------
   \brief sme_getIsCcxFeatureEnabled() - get CCX feature enabled or not
   This is a synchronuous call
   \param hHal - The handle returned by macOpen.
@@ -8397,7 +9666,7 @@
 {
 #ifdef FEATURE_WLAN_CCX
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-    return pMac->roam.configParam.isCcxIniFeatureEnabled;
+    return csrRoamIsCcxIniFeatureEnabled(pMac);
 #else
     return eANI_BOOLEAN_FALSE;
 #endif
@@ -8470,19 +9739,46 @@
 /* ---------------------------------------------------------------------------
     \fn sme_IsFeatureSupportedByFW
     \brief  Check if an feature is enabled by FW
-            
+
     \param  feattEnumValue - Enumeration value from placeHolderInCapBitmap
-    \- return 1/0 (TRUE/FALSE) 
+    \- return 1/0 (TRUE/FALSE)
     -------------------------------------------------------------------------*/
 tANI_U8 sme_IsFeatureSupportedByFW(tANI_U8 featEnumValue)
 {
    return IS_FEATURE_SUPPORTED_BY_FW(featEnumValue);
 }
 #ifdef FEATURE_WLAN_TDLS
+
 /* ---------------------------------------------------------------------------
     \fn sme_SendTdlsMgmtFrame
     \brief  API to send TDLS management frames.
-            
+
+    \param  peerMac - peer's Mac Adress.
+    \param  tdlsLinkEstablishParams - TDLS Peer Link Establishment Parameters
+    \- return VOS_STATUS_SUCCES
+    -------------------------------------------------------------------------*/
+VOS_STATUS sme_SendTdlsLinkEstablishParams(tHalHandle hHal,
+                                                   tANI_U8 sessionId,
+                                                   tSirMacAddr peerMac,
+                                                   tCsrTdlsLinkEstablishParams *tdlsLinkEstablishParams)
+{
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+    tpAniSirGlobal      pMac      = PMAC_STRUCT(hHal);
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        status = csrTdlsSendLinkEstablishParams(hHal, sessionId, peerMac, tdlsLinkEstablishParams) ;
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+   return status ;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_SendTdlsMgmtFrame
+    \brief  API to send TDLS management frames.
+
     \param  peerMac - peer's Mac Adress.
     \param frame_type - Type of TDLS mgmt frame to be sent.
     \param dialog - dialog token used in the frame.
@@ -8547,7 +9843,7 @@
 /* ---------------------------------------------------------------------------
     \fn sme_AddTdlsPeerSta
     \brief  API to Add TDLS peer sta entry.
-            
+
     \param  peerMac - peer's Mac Adress.
     \- return VOS_STATUS_SUCCES
     -------------------------------------------------------------------------*/
@@ -8591,16 +9887,6 @@
 
 }
 /* ---------------------------------------------------------------------------
-    \fn sme_IsPmcBmps
-    \API to Check if PMC state is BMPS.
-
-    \- return v_BOOL_t
-    -------------------------------------------------------------------------*/
-v_BOOL_t sme_IsPmcBmps(tHalHandle hHal)
-{
-    return (BMPS == pmcGetPmcState(hHal));
-}
-/* ---------------------------------------------------------------------------
     \fn sme_SetTdlsPowerSaveProhibited
     \API to set/reset the isTdlsPowerSaveProhibited.
 
@@ -8621,6 +9907,17 @@
     return;
 }
 #endif
+/* ---------------------------------------------------------------------------
+    \fn sme_IsPmcBmps
+    \API to Check if PMC state is BMPS.
+
+    \- return v_BOOL_t
+    -------------------------------------------------------------------------*/
+v_BOOL_t sme_IsPmcBmps(tHalHandle hHal)
+{
+    return (BMPS == pmcGetPmcState(hHal));
+}
+
 #ifdef FEATURE_WLAN_TDLS_INTERNAL
 /*
  * SME API to start TDLS discovery Procedure
@@ -8665,8 +9962,8 @@
                 {
                     if(TDLS_LINK_SETUP_STATE == peerInfo->tdlsPeerState)
                     {
-                        palCopyMemory(pMac->hHdd, disResult[peerCnt].tdlsPeerMac,
-                                peerInfo->peerMac, sizeof(tSirMacAddr)) ;
+                        vos_mem_copy(disResult[peerCnt].tdlsPeerMac,
+                                     peerInfo->peerMac, sizeof(tSirMacAddr));
                         disResult[peerCnt].tdlsPeerRssi = peerInfo->tdlsPeerRssi ;
                         peerCnt++ ;
                     }
@@ -8674,8 +9971,8 @@
                 }
             case TDLS_DIS_LIST:
                 {
-                    palCopyMemory(pMac->hHdd, disResult[peerCnt].tdlsPeerMac,
-                            peerInfo->peerMac, sizeof(tSirMacAddr)) ;
+                    vos_mem_copy(disResult[peerCnt].tdlsPeerMac,
+                                 peerInfo->peerMac, sizeof(tSirMacAddr));
                     disResult[peerCnt].tdlsPeerRssi = peerInfo->tdlsPeerRssi ;
                     peerCnt++ ;
                     break ;
@@ -8848,7 +10145,7 @@
       }
    }
    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-         "cbmode selected=%ld\n", smeConfig.csrConfig.channelBondingMode5GHz);
+         "cbmode selected=%d", smeConfig.csrConfig.channelBondingMode5GHz);
 
    sme_UpdateConfig (pMac, &smeConfig);
    return VOS_STATUS_SUCCESS;
@@ -8859,6 +10156,500 @@
 {
    return(csrConvertCBIniValueToPhyCBState(cb_ini_value));
 }
+/*--------------------------------------------------------------------------
+
+  \brief sme_SetCurrDeviceMode() - Sets the current operating device mode.
+  \param hHal - The handle returned by macOpen.
+  \param currDeviceMode - Current operating device mode.
+  --------------------------------------------------------------------------*/
+
+void sme_SetCurrDeviceMode (tHalHandle hHal, tVOS_CON_MODE currDeviceMode)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    pMac->sme.currDeviceMode = currDeviceMode;
+    return;
+}
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+/*--------------------------------------------------------------------------
+  \brief sme_HandoffRequest() - a wrapper function to Request a handoff
+  from CSR.
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen
+  \param pHandoffInfo - info provided by HDD with the handoff request (namely:
+  BSSID, channel etc.)
+  \return eHAL_STATUS_SUCCESS - SME passed the request to CSR successfully.
+          Other status means SME is failed to send the request.
+  \sa
+  --------------------------------------------------------------------------*/
+
+eHalStatus sme_HandoffRequest(tHalHandle hHal,
+                              tCsrHandoffRequest *pHandoffInfo)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                     "%s: invoked", __func__);
+        status = csrHandoffRequest(pMac, pHandoffInfo);
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status ;
+}
+#endif
+
+/*
+ * SME API to check if there is any infra station or
+ * P2P client is connected
+ */
+VOS_STATUS sme_isSta_p2p_clientConnected(tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    if(csrIsInfraConnected(pMac))
+    {
+        return VOS_STATUS_SUCCESS;
+    }
+    return VOS_STATUS_E_FAILURE;
+}
+
+
+#ifdef FEATURE_WLAN_LPHB
+/* ---------------------------------------------------------------------------
+    \fn sme_LPHBConfigReq
+    \API to make configuration LPHB within FW.
+    \param hHal - The handle returned by macOpen
+    \param lphdReq - LPHB request argument by client
+    \param pCallbackfn - LPHB timeout notification callback function pointer
+    \- return Configuration message posting status, SUCCESS or Fail
+    -------------------------------------------------------------------------*/
+eHalStatus sme_LPHBConfigReq
+(
+   tHalHandle hHal,
+   tSirLPHBReq *lphdReq,
+   void (*pCallbackfn)(void *pAdapter, void *indParam)
+)
+{
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+    VOS_STATUS          vosStatus = VOS_STATUS_SUCCESS;
+    tpAniSirGlobal      pMac      = PMAC_STRUCT(hHal);
+    vos_msg_t           vosMessage;
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if (eHAL_STATUS_SUCCESS == status)
+    {
+        if ((LPHB_SET_EN_PARAMS_INDID == lphdReq->cmd) &&
+            (NULL == pCallbackfn) &&
+            (NULL == pMac->sme.pLphbIndCb))
+        {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                     "%s: Indication Call back did not registered", __func__);
+           sme_ReleaseGlobalLock(&pMac->sme);
+           return eHAL_STATUS_FAILURE;
+        }
+        else if (NULL != pCallbackfn)
+        {
+           pMac->sme.pLphbIndCb = pCallbackfn;
+        }
+
+        /* serialize the req through MC thread */
+        vosMessage.bodyptr = lphdReq;
+        vosMessage.type    = WDA_LPHB_CONF_REQ;
+        vosStatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage);
+        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+        {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                     "%s: Post Config LPHB MSG fail", __func__);
+           status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+
+    return(status);
+}
+#endif /* FEATURE_WLAN_LPHB */
+/*--------------------------------------------------------------------------
+  \brief sme_enable_disable_split_scan() - a wrapper function to set the split
+                                          scan parameter.
+  This is a synchronous call
+  \param hHal - The handle returned by macOpen
+  \return NONE.
+  \sa
+  --------------------------------------------------------------------------*/
+void sme_enable_disable_split_scan (tHalHandle hHal, tANI_U8 nNumStaChan,
+                                          tANI_U8 nNumP2PChan)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+
+    pMac->roam.configParam.nNumStaChanCombinedConc = nNumStaChan;
+    pMac->roam.configParam.nNumP2PChanCombinedConc = nNumP2PChan;
+
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                 "%s: SCAN nNumStaChanCombinedConc : %d,"
+                           "nNumP2PChanCombinedConc : %d ",
+                 __func__, nNumStaChan, nNumP2PChan);
+
+    return;
+
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_AddPeriodicTxPtrn
+    \brief  API to Periodic TX Pattern Offload feature
+    \param  hHal - The handle returned by macOpen
+    \param  addPeriodicTxPtrnParams - Pointer to the add pattern structure
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_AddPeriodicTxPtrn(tHalHandle hHal, tSirAddPeriodicTxPtrn
+                                 *addPeriodicTxPtrnParams)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    eHalStatus status;
+    vos_msg_t msg;
+
+    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme)))
+    {
+        msg.type     = WDA_ADD_PERIODIC_TX_PTRN_IND;
+        msg.bodyptr  = addPeriodicTxPtrnParams;
+
+        if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
+        {
+            VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,"%s: Not able "
+                       "to post WDA_ADD_PERIODIC_TX_PTRN_IND to WDA!",
+                       __func__);
+
+            sme_ReleaseGlobalLock(&pMac->sme);
+            return eHAL_STATUS_FAILURE;
+        }
+
+        sme_ReleaseGlobalLock(&pMac->sme);
+        return eHAL_STATUS_SUCCESS;
+    }
+
+    return status;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_DelPeriodicTxPtrn
+    \brief  API to Periodic TX Pattern Offload feature
+    \param  hHal - The handle returned by macOpen
+    \param  delPeriodicTxPtrnParams - Pointer to the delete pattern structure
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_DelPeriodicTxPtrn(tHalHandle hHal, tSirDelPeriodicTxPtrn
+                                 *delPeriodicTxPtrnParams)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    eHalStatus status;
+    vos_msg_t msg;
+
+    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme)))
+    {
+        msg.type     = WDA_DEL_PERIODIC_TX_PTRN_IND;
+        msg.bodyptr  = delPeriodicTxPtrnParams;
+
+        if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
+        {
+            VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,"%s: Not able "
+                       "to post WDA_DEL_PERIODIC_TX_PTRN_IND to WDA!",
+                       __func__);
+
+            sme_ReleaseGlobalLock(&pMac->sme);
+            return eHAL_STATUS_FAILURE;
+        }
+
+        sme_ReleaseGlobalLock(&pMac->sme);
+        return eHAL_STATUS_SUCCESS;
+    }
+
+    return status;
+}
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+/* ---------------------------------------------------------------------------
+    \fn sme_EnableReliableMcast
+    \brief  Used to enable Reliable Multicast using Leader Based Protocol
+    setting will not persist over reboots
+    \param  hHal
+    \param  sessionId
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_EnableReliableMcast(tHalHandle hHal, tANI_U32 sessionId)
+{
+    eHalStatus status = eHAL_STATUS_FAILURE;
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+
+    smsLog(pMac, LOG1, FL("enable RMC"));
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if (HAL_STATUS_SUCCESS(status))
+    {
+        status = csrEnableRMC(pMac, sessionId);
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    return status;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_DisableReliableMcast
+    \brief  Used to disable Reliable Multicast using Leader Based Protocol
+    setting will not persist over reboots
+    \param  hHal
+    \param  sessionId
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_DisableReliableMcast(tHalHandle hHal, tANI_U32 sessionId)
+{
+   eHalStatus status = eHAL_STATUS_FAILURE;
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+
+   smsLog(pMac, LOG1, FL("disable RMC"));
+   status = sme_AcquireGlobalLock(&pMac->sme);
+   if (HAL_STATUS_SUCCESS(status))
+   {
+      status = csrDisableRMC(pMac, sessionId);
+      sme_ReleaseGlobalLock(&pMac->sme);
+   }
+   return status;
+}
+#endif /* defined WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/* ---------------------------------------------------------------------------
+    \fn sme_GetIBSSPeerInfo
+    \brief  Used to disable Reliable Multicast using Leader Based Protocol
+    setting will not persist over reboots
+    \param  hHal
+    \param  ibssPeerInfoReq  multicast Group IP address
+    \- return eHalStatus
+    -------------------------------------------------------------------------*/
+eHalStatus sme_RequestIBSSPeerInfo(tHalHandle hHal, void *pUserData,
+                                            pIbssPeerInfoCb peerInfoCbk,
+                                            tANI_BOOLEAN allPeerInfoReqd,
+                                            tANI_U8 staIdx)
+{
+   eHalStatus status = eHAL_STATUS_FAILURE;
+   VOS_STATUS vosStatus = VOS_STATUS_E_FAILURE;
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+   vos_msg_t vosMessage;
+   tSirIbssGetPeerInfoReqParams *pIbssInfoReqParams;
+
+   status = sme_AcquireGlobalLock(&pMac->sme);
+   if ( eHAL_STATUS_SUCCESS == status)
+   {
+       pMac->sme.peerInfoParams.peerInfoCbk = peerInfoCbk;
+       pMac->sme.peerInfoParams.pUserData = pUserData;
+
+       pIbssInfoReqParams = (tSirIbssGetPeerInfoReqParams *)
+                        vos_mem_malloc(sizeof(tSirIbssGetPeerInfoReqParams));
+       if (NULL == pIbssInfoReqParams)
+       {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                  "%s: Not able to allocate memory for dhcp start", __func__);
+           sme_ReleaseGlobalLock( &pMac->sme );
+           return eHAL_STATUS_FAILURE;
+       }
+       pIbssInfoReqParams->allPeerInfoReqd = allPeerInfoReqd;
+       pIbssInfoReqParams->staIdx = staIdx;
+
+       vosMessage.type = WDA_GET_IBSS_PEER_INFO_REQ;
+       vosMessage.bodyptr = pIbssInfoReqParams;
+       vosMessage.reserved = 0;
+
+       vosStatus = vos_mq_post_message( VOS_MQ_ID_WDA, &vosMessage );
+       if ( VOS_STATUS_SUCCESS != vosStatus )
+       {
+          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                        "%s: Post WDA_GET_IBSS_PEER_INFO_REQ MSG failed", __func__);
+          vos_mem_free(pIbssInfoReqParams);
+          vosStatus = eHAL_STATUS_FAILURE;
+       }
+       sme_ReleaseGlobalLock( &pMac->sme );
+   }
+
+   return (vosStatus);
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_IBSSRouteTableUpdateInd
+    \API to update IBSS Route table in FW.
+    \param hHal - The handle returned by macOpen
+    \param pIbssTable - ptr to IBSS table struct
+    \- returns Success or Failiure
+    -------------------------------------------------------------------------*/
+eHalStatus sme_IBSSRouteTableUpdateInd(tHalHandle hHal,
+                                       tAniIbssRouteTable *pIbssTable)
+{
+    eHalStatus status = eHAL_STATUS_SUCCESS;
+    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    vos_msg_t vosMessage;
+
+    if (!pIbssTable)
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                  "%s: IBSS route table ptr null", __func__);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    status = sme_AcquireGlobalLock(&pMac->sme);
+    if (eHAL_STATUS_SUCCESS == status)
+    {
+        vosMessage.bodyptr = pIbssTable;
+        vosMessage.type = WDA_IBSS_ROUTE_TABLE_UPDATE_IND;
+        vosStatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosMessage);
+        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+        {
+           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                     "%s: failed to post message to WDA", __func__);
+           status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+
+    return(status);
+}
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+void smeGetCommandQStatus( tHalHandle hHal )
+{
+    tSmeCmd *pTempCmd = NULL;
+    tListElem *pEntry;
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+
+    if (NULL == pMac)
+    {
+        smsLog( pMac, LOGE, "smeGetCommandQStatus: pMac is NULL" );
+        return;
+    }
+
+    pEntry = csrLLPeekHead( &pMac->sme.smeCmdActiveList, LL_ACCESS_LOCK );
+    if( pEntry )
+    {
+        pTempCmd = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
+    }
+    smsLog( pMac, LOGE, "Currently smeCmdActiveList has command (0x%X)",
+            (pTempCmd) ? pTempCmd->command : eSmeNoCommand );
+    if(pTempCmd)
+    {
+        if( eSmeCsrCommandMask & pTempCmd->command )
+        {
+            //CSR command is stuck. See what the reason code is for that command
+            dumpCsrCommandInfo(pMac, pTempCmd);
+        }
+    } //if(pTempCmd)
+
+    smsLog( pMac, LOGE, "Currently smeCmdPendingList has %d commands",
+            csrLLCount(&pMac->sme.smeCmdPendingList));
+
+    smsLog( pMac, LOGE, "Currently roamCmdPendingList has %d commands",
+            csrLLCount(&pMac->roam.roamCmdPendingList));
+
+    return;
+}
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/* ---------------------------------------------------------------------------
+    \fn sme_SetBatchScanReq
+    \brief  API to set batch scan request in FW
+    \param  hHal - The handle returned by macOpen.
+    \param  pRequest -  Pointer to the batch request.
+    \param  sessionId - session ID
+    \param  callbackRoutine - HDD callback which needs to be invoked after
+            getting set batch scan response from FW
+    \param  callbackContext - pAdapter context
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_SetBatchScanReq
+(
+    tHalHandle hHal, tSirSetBatchScanReq *pRequest, tANI_U8 sessionId,
+    void (*callbackRoutine) (void *callbackCtx, tSirSetBatchScanRsp *pRsp),
+    void *callbackContext
+)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus status;
+
+    if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme )))
+    {
+       status = pmcSetBatchScanReq(hHal, pRequest, sessionId, callbackRoutine,
+                  callbackContext);
+       sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn sme_TriggerBatchScanResultInd
+    \brief  API to trigger batch scan result indications from FW
+    \param  hHal - The handle returned by macOpen.
+    \param  pRequest -  Pointer to get batch request.
+    \param  sessionId - session ID
+    \param  callbackRoutine - HDD callback which needs to be invoked after
+            getting batch scan result indication from FW
+    \param  callbackContext - pAdapter context
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_TriggerBatchScanResultInd
+(
+    tHalHandle hHal, tSirTriggerBatchScanResultInd *pRequest, tANI_U8 sessionId,
+    void (*callbackRoutine) (void *callbackCtx, void *pRsp),
+    void *callbackContext
+)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus status;
+
+    if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme )))
+    {
+       status = pmcTriggerBatchScanResultInd(hHal, pRequest, sessionId,
+                   callbackRoutine, callbackContext);
+       sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status;
+}
+
+
+/* ---------------------------------------------------------------------------
+    \fn sme_StopBatchScanInd
+    \brief  API to stop batch scan request in FW
+    \param  hHal - The handle returned by macOpen.
+    \param  pRequest -  Pointer to the batch request.
+    \param  sessionId - session ID
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_StopBatchScanInd
+(
+    tHalHandle hHal, tSirStopBatchScanInd *pRequest, tANI_U8 sessionId
+)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    eHalStatus status;
+
+    if ( eHAL_STATUS_SUCCESS == ( status = sme_AcquireGlobalLock( &pMac->sme )))
+    {
+       status = pmcStopBatchScanInd(hHal, pRequest, sessionId);
+       sme_ReleaseGlobalLock( &pMac->sme );
+    }
+
+    return status;
+}
+
+#endif
+
+void activeListCmdTimeoutHandle(void *userData)
+{
+    if (NULL == userData)
+        return;
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+        "%s: Active List command timeout Cmd List Count %d", __func__,
+        csrLLCount(&((tpAniSirGlobal) userData)->sme.smeCmdActiveList) );
+    smeGetCommandQStatus((tHalHandle) userData);
+}
 
 /*
  * SME API to enable/disable idle mode powersave
@@ -9018,6 +10809,41 @@
 }
 #endif
 
+/* ---------------------------------------------------------------------------
+    \fn sme_SendRateUpdateInd
+    \brief  API to Update rate
+    \param  hHal - The handle returned by macOpen
+    \param  rateUpdateParams - Pointer to rate update params
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateParams)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    eHalStatus status;
+    vos_msg_t msg;
+
+    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme)))
+    {
+        msg.type     = WDA_RATE_UPDATE_IND;
+        msg.bodyptr  = rateUpdateParams;
+
+        if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
+        {
+            VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,"%s: Not able "
+                       "to post WDA_SET_RMC_RATE_IND to WDA!",
+                       __func__);
+
+            sme_ReleaseGlobalLock(&pMac->sme);
+            return eHAL_STATUS_FAILURE;
+        }
+
+        sme_ReleaseGlobalLock(&pMac->sme);
+        return eHAL_STATUS_SUCCESS;
+    }
+
+    return status;
+}
+
 eHalStatus sme_getValidChannelList(tHalHandle hHal, tANI_U8 *numChannels,
                                    tANI_U8 **chanList)
 {
@@ -9089,38 +10915,3 @@
     return status;
 }
 #endif /* QCA_WIFI_2_0 */
-
-/* ---------------------------------------------------------------------------
-    \fn sme_SendRateUpdateInd
-    \brief  API to Update rate
-    \param  hHal - The handle returned by macOpen
-    \param  rateUpdateParams - Pointer to rate update params
-    \return eHalStatus
-  ---------------------------------------------------------------------------*/
-eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateParams)
-{
-    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-    eHalStatus status;
-    vos_msg_t msg;
-
-    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme)))
-    {
-        msg.type     = WDA_RATE_UPDATE_IND;
-        msg.bodyptr  = rateUpdateParams;
-
-        if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
-        {
-            VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,"%s: Not able "
-                       "to post WDA_SET_RMC_RATE_IND to WDA!",
-                       __func__);
-
-            sme_ReleaseGlobalLock(&pMac->sme);
-            return eHAL_STATUS_FAILURE;
-        }
-
-        sme_ReleaseGlobalLock(&pMac->sme);
-        return eHAL_STATUS_SUCCESS;
-    }
-
-    return status;
-}
diff --git a/CORE/SME/src/sme_common/sme_FTApi.c b/CORE/SME/src/sme_common/sme_FTApi.c
index 6497f29..de4ceb5 100644
--- a/CORE/SME/src/sme_common/sme_FTApi.c
+++ b/CORE/SME/src/sme_common/sme_FTApi.c
@@ -25,6 +25,7 @@
  * to the Linux Foundation.
  */
 
+
 #ifdef WLAN_FEATURE_VOWIFI_11R
 /**=========================================================================
 
@@ -58,7 +59,7 @@
     pMac->ft.ftSmeContext.reassoc_ft_ies_length = 0;       
     pMac->ft.ftSmeContext.setFTPreAuthState = FALSE;
     pMac->ft.ftSmeContext.setFTPTKState = FALSE;
-    status = palTimerAlloc(pMac->hHdd, &pMac->ft.ftSmeContext.preAuthReassocIntvlTimer, 
+    status = vos_timer_init(&pMac->ft.ftSmeContext.preAuthReassocIntvlTimer,VOS_TIMER_TYPE_SW,
                             sme_PreauthReassocIntvlTimerCallback, (void *)pMac);
 
     if (eHAL_STATUS_SUCCESS != status)
@@ -108,14 +109,14 @@
     if (pMac->ft.ftSmeContext.psavedFTPreAuthRsp != NULL)
     {
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-        smsLog( pMac, LOGE, FL("%s: Freeing %p and setting to NULL"),
+        smsLog( pMac, LOGE, FL("Freeing %p and setting to NULL"),
             pMac->ft.ftSmeContext.psavedFTPreAuthRsp);
 #endif
         vos_mem_free(pMac->ft.ftSmeContext.psavedFTPreAuthRsp);
         pMac->ft.ftSmeContext.psavedFTPreAuthRsp = NULL;                        
     }
 
-    palTimerFree(pMac->hHdd, pMac->ft.ftSmeContext.preAuthReassocIntvlTimer);
+    vos_timer_destroy(&pMac->ft.ftSmeContext.preAuthReassocIntvlTimer);
 }
 
 void sme_SetFTPreAuthState(tHalHandle hHal, v_BOOL_t state)
@@ -171,7 +172,7 @@
 
             // Save the FT IEs
             pMac->ft.ftSmeContext.auth_ft_ies = vos_mem_malloc(ft_ies_length);
-            if(pMac->ft.ftSmeContext.auth_ft_ies == NULL)
+            if ( NULL == pMac->ft.ftSmeContext.auth_ft_ies )
             {
                smsLog( pMac, LOGE, FL("Memory allocation failed for "
                                       "auth_ft_ies"));
@@ -179,9 +180,8 @@
                return;
             }
             pMac->ft.ftSmeContext.auth_ft_ies_length = ft_ies_length;
-            vos_mem_copy((tANI_U8 *)pMac->ft.ftSmeContext.auth_ft_ies, ft_ies,
-                ft_ies_length);
-                
+            vos_mem_copy((tANI_U8 *)pMac->ft.ftSmeContext.auth_ft_ies,
+                          ft_ies,ft_ies_length);
             pMac->ft.ftSmeContext.FTState = eFT_AUTH_REQ_READY;
 
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
@@ -225,7 +225,7 @@
 
             // Save the FT IEs
             pMac->ft.ftSmeContext.reassoc_ft_ies = vos_mem_malloc(ft_ies_length);
-            if(pMac->ft.ftSmeContext.reassoc_ft_ies == NULL)
+            if ( NULL == pMac->ft.ftSmeContext.reassoc_ft_ies )
             {
                smsLog( pMac, LOGE, FL("Memory allocation failed for "
                                       "reassoc_ft_ies"));
@@ -234,7 +234,7 @@
             }
             pMac->ft.ftSmeContext.reassoc_ft_ies_length = ft_ies_length;
             vos_mem_copy((tANI_U8 *)pMac->ft.ftSmeContext.reassoc_ft_ies, ft_ies,
-                ft_ies_length);
+                          ft_ies_length);
                 
             pMac->ft.ftSmeContext.FTState = eFT_SET_KEY_WAIT;
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
@@ -274,13 +274,13 @@
        sizeof( pMsg->keyMaterial.length ) + sizeof( pMsg->keyMaterial.edType ) + 
        sizeof( pMsg->keyMaterial.numKeys ) + sizeof( pMsg->keyMaterial.key );
                      
-    status = palAllocateMemory(pMac->hHdd, (void **)&pMsg, msgLen);
-    if ( !HAL_STATUS_SUCCESS(status) )
+    pMsg = vos_mem_malloc(msgLen);
+    if ( NULL == pMsg )
     {
        return eHAL_STATUS_FAILURE;
     }
 
-    palZeroMemory(pMac->hHdd, pMsg, msgLen);
+    vos_mem_set(pMsg, msgLen, 0);
     pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_FT_UPDATE_KEY);
     pMsg->length = pal_cpu_to_be16(msgLen);
 
@@ -304,17 +304,14 @@
     keymaterial->key[ 0 ].unicast = (tANI_U8)eANI_BOOLEAN_TRUE;
     keymaterial->key[ 0 ].keyDirection = pFTKeyInfo->keyDirection;
 
-    palCopyMemory( pMac->hHdd, &keymaterial->key[ 0 ].keyRsc,
-                   pFTKeyInfo->keyRsc, CSR_MAX_RSC_LEN );
-
+    vos_mem_copy(&keymaterial->key[ 0 ].keyRsc, pFTKeyInfo->keyRsc, CSR_MAX_RSC_LEN);
     keymaterial->key[ 0 ].paeRole = pFTKeyInfo->paeRole;
 
     keymaterial->key[ 0 ].keyLength = pFTKeyInfo->keyLength;
 
     if ( pFTKeyInfo->keyLength && pFTKeyInfo->Key )
     {
-        palCopyMemory( pMac->hHdd, &keymaterial->key[ 0 ].key,
-                       pFTKeyInfo->Key, pFTKeyInfo->keyLength );
+        vos_mem_copy(&keymaterial->key[ 0 ].key, pFTKeyInfo->Key, pFTKeyInfo->keyLength);
         if(pFTKeyInfo->keyLength == 16)
         {
           smsLog(pMac, LOG1, "SME Set Update Ind keyIdx (%d) encType(%d) key = "
@@ -383,8 +380,29 @@
     switch(pMac->ft.ftSmeContext.FTState)
     {
     case eFT_SET_KEY_WAIT:
-
+#ifdef QCA_WIFI_ISOC
+    if (sme_GetFTPreAuthState (hHal) == TRUE)
+      {
+          status = sme_FTSendUpdateKeyInd(pMac, pFTKeyInfo);
+          if (status != 0 )
+          {
+              smsLog( pMac, LOGE, "%s: Key set failure %d", __func__,
+                      status);
+              pMac->ft.ftSmeContext.setFTPTKState = FALSE;
+              status = eHAL_STATUS_FT_PREAUTH_KEY_FAILED;
+          }
+          else
+          {
+              pMac->ft.ftSmeContext.setFTPTKState = TRUE;
+              status = eHAL_STATUS_FT_PREAUTH_KEY_SUCCESS;
+              smsLog( pMac, LOG1, "%s: Key set success", __func__);
+          }
+          sme_SetFTPreAuthState(hHal, FALSE);
+      }
+#else
       status = eHAL_STATUS_FT_PREAUTH_KEY_FAILED;
+#endif /* QCA_WIFI_ISOC */
+
       pMac->ft.ftSmeContext.FTState = eFT_START_READY;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
       smsLog( pMac, LOG1, "%s: state changed to %d status %d", __func__,
diff --git a/CORE/SVC/inc/wlan_nlink_srv.h b/CORE/SVC/inc/wlan_nlink_srv.h
index 64c8dc5..05ed4e8 100644
--- a/CORE/SVC/inc/wlan_nlink_srv.h
+++ b/CORE/SVC/inc/wlan_nlink_srv.h
@@ -49,10 +49,17 @@
 typedef int (* nl_srv_msg_callback)(struct sk_buff * skb);
 
 int nl_srv_init(void);
+#ifdef WLAN_KD_READY_NOTIFIER
+void nl_srv_exit(int dst_pid);
+#else
 void nl_srv_exit(void);
+#endif /* WLAN_KD_READY_NOTIFIER */
 int nl_srv_register(tWlanNlModTypes msg_type, nl_srv_msg_callback msg_handler);
 int nl_srv_unregister(tWlanNlModTypes msg_type, nl_srv_msg_callback msg_handler);
 int nl_srv_ucast(struct sk_buff * skb, int dst_pid);
 int nl_srv_bcast(struct sk_buff * skb);
-
+#ifdef WLAN_KD_READY_NOTIFIER
+void nl_srv_nl_ready_indication(void);
+void nl_srv_nl_close_indication(int pid);
+#endif /* WLAN_KD_READY_NOTIFIER */
 #endif
diff --git a/CORE/SVC/src/nlink/wlan_nlink_srv.c b/CORE/SVC/src/nlink/wlan_nlink_srv.c
index 68c14c1..70ed984 100644
--- a/CORE/SVC/src/nlink/wlan_nlink_srv.c
+++ b/CORE/SVC/src/nlink/wlan_nlink_srv.c
@@ -48,6 +48,11 @@
 static struct sock *nl_srv_sock;
 static nl_srv_msg_callback nl_srv_msg_handler[NLINK_MAX_CALLBACKS];
 
+#ifdef WLAN_KD_READY_NOTIFIER
+const char driverLoaded[]   = "KNLREADY";
+const char driverUnLoaded[] = "KNLCLOSE";
+#endif /* WLAN_KD_READY_NOTIFIER */
+
 //Forward declaration
 static void nl_srv_rcv (struct sk_buff *sk);
 static void nl_srv_rcv_skb (struct sk_buff *skb);
@@ -92,8 +97,18 @@
  * Deinit the netlink service.
  * Netlink service is unusable after this.
  */
+#ifdef WLAN_KD_READY_NOTIFIER
+void nl_srv_exit(int dst_pid)
+#else
 void nl_srv_exit(void)
+#endif /* WLAN_KD_READY_NOTIFIER */
 {
+#ifdef WLAN_KD_READY_NOTIFIER
+   if (0 != dst_pid)
+   {
+      nl_srv_nl_close_indication(dst_pid);
+   }
+#endif /* WLAN_KD_READY_NOTIFIER */
    netlink_kernel_release(nl_srv_sock);
 }
 
@@ -218,8 +233,8 @@
 
       if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) {
          VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN, "NLINK: Invalid "
-            "Netlink message: skb[0x%X], len[%d], nlhdr[0x%X], nlmsg_len[%d]",
-            (u32)skb, skb->len, (u32)nlh, nlh->nlmsg_len);
+            "Netlink message: skb[%p], len[%d], nlhdr[%p], nlmsg_len[%d]",
+            skb, skb->len, nlh, nlh->nlmsg_len);
          return;
       }
 
@@ -280,3 +295,93 @@
    }
 }
 
+#ifdef WLAN_KD_READY_NOTIFIER
+/*
+ * Send Net Link interface ready indication to application daemon
+ * Each netlink message will have a message of type tAniMsgHdr inside.
+ */
+void nl_srv_nl_ready_indication
+(
+   void
+)
+{
+   struct sk_buff *skb = NULL;
+   struct nlmsghdr *nlh;
+   int    err;
+
+   skb = alloc_skb(NLMSG_SPACE(sizeof(driverLoaded)), GFP_KERNEL);
+   if (NULL == skb)
+   {
+      VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "NLINK: skb alloc fail %s", __func__);
+      return;
+   }
+
+   nlh = (struct nlmsghdr *)skb->data;
+   nlh->nlmsg_pid = 0;  /* from kernel */
+   nlh->nlmsg_flags = 0;
+   nlh->nlmsg_seq = 0;
+   nlh->nlmsg_len = sizeof(driverLoaded);
+   memcpy(((char *)nlh) + sizeof(struct nlmsghdr),
+          driverLoaded,
+          sizeof(driverLoaded));
+   skb_put(skb, NLMSG_SPACE(sizeof(driverLoaded)));
+
+   /* sender is in group 1<<0 */
+   NETLINK_CB(skb).dst_group = WLAN_NLINK_MCAST_GRP_ID;
+
+   /*multicast the message to all listening processes*/
+   err = netlink_broadcast(nl_srv_sock, skb, 0, 1, GFP_KERNEL);
+   if (err)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_LOW,
+                "NLINK: Ready Indication Send Fail %s, err %d",
+                __func__, err);
+   }
+   return;
+}
+
+/*
+ * Send Net Link interface close indication to application daemon
+ * Each netlink message will have a message of type tAniMsgHdr inside.
+ */
+void nl_srv_nl_close_indication
+(
+   int pid
+)
+{
+   struct sk_buff *skb = NULL;
+   struct nlmsghdr *nlh;
+   int err;
+
+   skb = alloc_skb(sizeof(driverUnLoaded),GFP_KERNEL);
+   if (NULL == skb)
+   {
+      VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "NLINK: skb alloc fail %s", __func__);
+      return;
+   }
+
+   nlh = (struct nlmsghdr *)skb->data;
+   nlh->nlmsg_pid = 0;  /* from kernel */
+   nlh->nlmsg_flags = 0;
+   nlh->nlmsg_seq = 0;
+   nlh->nlmsg_len = sizeof(driverUnLoaded);
+   memcpy(((char *)nlh) + sizeof(struct nlmsghdr),
+          driverUnLoaded,
+          sizeof(driverUnLoaded));
+   skb_put(skb, NLMSG_SPACE(sizeof(driverUnLoaded)));
+
+   /* sender is in group 1<<0 */
+   NETLINK_CB(skb).dst_group = 0;
+   err = netlink_unicast(nl_srv_sock, skb, pid, MSG_DONTWAIT);
+   if (err)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_LOW,
+                "NLINK: Close Indication Send Fail %s", __func__);
+   }
+
+   return;
+}
+#endif /* WLAN_KD_READY_NOTIFIER */
+
diff --git a/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c b/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
index 6a4782d..f2035bb 100644
--- a/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
+++ b/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
@@ -134,6 +134,11 @@
    //send reg response message to the application
    rspmsg.ret = ANI_NL_MSG_OK;
    rspmsg.regReq.type = reg_req->type;
+#ifdef WLAN_KD_READY_NOTIFIER
+   /* NL client try to registration
+    * to make sure connection, broadcast READY notification */
+   nl_srv_nl_ready_indication();
+#endif /* WLAN_KD_READY_NOTIFIER */
    /*Save the pid*/    
    pAdapterHandle->ptt_pid = reg_req->pid;   
    rspmsg.regReq.pid= reg_req->pid;
@@ -300,6 +305,9 @@
    pAdapterHandle = (struct hdd_context_s*)pAdapter;
    nl_srv_register(ANI_NL_MSG_PUMAC, ptt_sock_rx_nlink_msg);
    nl_srv_register(ANI_NL_MSG_PTT, ptt_sock_rx_nlink_msg);
+#ifdef WLAN_KD_READY_NOTIFIER
+   nl_srv_nl_ready_indication();
+#endif /* WLAN_KD_READY_NOTIFIER */
    return 0;
 }
 #endif //PTT_SOCK_SVC_ENABLE
diff --git a/CORE/SYS/common/inc/wlan_qct_sys.h b/CORE/SYS/common/inc/wlan_qct_sys.h
index 524750e..9a8c3d4 100644
--- a/CORE/SYS/common/inc/wlan_qct_sys.h
+++ b/CORE/SYS/common/inc/wlan_qct_sys.h
@@ -423,6 +423,7 @@
   --------------------------------------------------------------------------*/
 
 void wlan_sys_ftm(void *pMsgPtr);
+void wlan_sys_probe(void);
 
 
 #endif  // WLAN_QCT_SYS_H__
diff --git a/CORE/SYS/common/src/wlan_qct_sys.c b/CORE/SYS/common/src/wlan_qct_sys.c
index 5deb897..8134a6f 100644
--- a/CORE/SYS/common/src/wlan_qct_sys.c
+++ b/CORE/SYS/common/src/wlan_qct_sys.c
@@ -359,7 +359,7 @@
             }
             else
             {
-               vosStatus = sme_Stop( hHal, TRUE );
+               vosStatus = sme_Stop( hHal, HAL_STOP_TYPE_SYS_DEEP_SLEEP);
                VOS_ASSERT( VOS_IS_STATUS_SUCCESS( vosStatus ) );
 
                vosStatus = macStop( hHal, HAL_STOP_TYPE_SYS_DEEP_SLEEP );
@@ -376,12 +376,9 @@
          // function that is in the message.
          case SYS_MSG_ID_MC_THR_PROBE:
          {
-            /* Handling for this message is not needed now so adding 
-             *debug print and VOS_ASSERT*/
-            VOS_TRACE( VOS_MODULE_ID_SYS, VOS_TRACE_LEVEL_ERROR,
-                       " Received SYS_MSG_ID_MC_THR_PROBE message msgType= %d [0x%08lx]",
-                       pMsg->type, pMsg->type );
-            VOS_ASSERT(0);
+            VOS_TRACE(VOS_MODULE_ID_SYS, VOS_TRACE_LEVEL_ERROR,
+                       " Received SYS_MSG_ID_MC_THR_PROBE message msgType = %d [0x%08lx]",
+                       pMsg->type, pMsg->type);
             break;
          }
 
@@ -713,7 +710,7 @@
     /* free the mem and return */
     if(pMsg->bodyptr)
     {
-      palFreeMemory( pMac->hHdd, pMsg->bodyptr);
+      vos_mem_free( pMsg->bodyptr);
     }
   }
 
@@ -763,3 +760,16 @@
 
 
 
+void wlan_sys_probe(void)
+{
+    vos_msg_t  vosMessage;
+
+    vosMessage.reserved = FTM_SYS_MSG_COOKIE;
+    vosMessage.type     = SYS_MSG_ID_MC_THR_PROBE;
+    vosMessage.bodyptr  = NULL;
+
+    vos_mq_post_message(VOS_MQ_ID_SYS, &vosMessage);
+
+    return;
+}
+
diff --git a/CORE/SYS/legacy/src/pal/inc/palApi.h b/CORE/SYS/legacy/src/pal/inc/palApi.h
index e8bb0a2..654cfbc 100644
--- a/CORE/SYS/legacy/src/pal/inc/palApi.h
+++ b/CORE/SYS/legacy/src/pal/inc/palApi.h
@@ -212,6 +212,8 @@
     try to use it unless the status returns success).
     
   -------------------------------------------------------------------------------*/
+#ifndef FEATURE_WLAN_PAL_MEM_DISABLE
+
 #ifdef MEMORY_DEBUG
 #define palAllocateMemory(hHdd, ppMemory, numBytes) palAllocateMemory_debug(hHdd, ppMemory, numBytes, __FILE__, __LINE__)
 eHalStatus palAllocateMemory_debug( tHddHandle hHdd, void **ppMemory, tANI_U32 numBytes, char* fileName, tANI_U32 lineNum );
@@ -332,8 +334,8 @@
     locations are equal or now equal. 
     
   -------------------------------------------------------------------------------*/
-tANI_BOOLEAN palEqualMemory( tHddHandle hHdd, void *pMemory1, void *pMemory2, tANI_U32 numBytes ); 
-
+tANI_BOOLEAN palEqualMemory( tHddHandle hHdd, void *pMemory1, void *pMemory2, tANI_U32 numBytes );
+#endif
 /** ---------------------------------------------------------------------------
 
     \fn palFillDeviceMemory
diff --git a/CORE/SYS/legacy/src/pal/inc/palTimer.h b/CORE/SYS/legacy/src/pal/inc/palTimer.h
index cfaecb2..1f56bc5 100644
--- a/CORE/SYS/legacy/src/pal/inc/palTimer.h
+++ b/CORE/SYS/legacy/src/pal/inc/palTimer.h
@@ -25,7 +25,6 @@
  * to the Linux Foundation.
  */
 
-
 /** ------------------------------------------------------------------------- * 
     ------------------------------------------------------------------------- *  
 
@@ -36,7 +35,6 @@
   
     $Id$ 
   
-  
     Copyright (C) 2006 Airgo Networks, Incorporated
     ... description...
   
@@ -61,7 +59,7 @@
 #define PAL_TIMER_TO_MS_UNIT      1000
 #define PAL_TIMER_TO_SEC_UNIT     1000000
 
-
+#ifndef FEATURE_WLAN_PAL_TIMER_DISABLE
 //PAL timer functions
 //pPalTimer is a pointer to a caller allocated tPalTimer object
 //pContext is a pointer to an object that will be passed in when callback is called
@@ -84,6 +82,6 @@
 //palTimerStop will cancel the timer but doesn't guarrantee the callback will not called afterwards
 //For Windows, if the driver is halting, the callback is not called after this function returns. 
 eHalStatus palTimerStop(tHddHandle, tPalTimerHandle); 
-
+#endif
 
 #endif
diff --git a/CORE/SYS/legacy/src/pal/src/palApiComm.c b/CORE/SYS/legacy/src/pal/src/palApiComm.c
index c91c450..dc99f46 100644
--- a/CORE/SYS/legacy/src/pal/src/palApiComm.c
+++ b/CORE/SYS/legacy/src/pal/src/palApiComm.c
@@ -35,6 +35,8 @@
 #include "adf_nbuf.h"
 #endif
 
+#ifndef FEATURE_WLAN_PAL_MEM_DISABLE
+
 #ifdef MEMORY_DEBUG
 eHalStatus palAllocateMemory_debug( tHddHandle hHdd, void **ppMemory, tANI_U32 numBytes, char* fileName, tANI_U32 lineNum )
 {
@@ -94,6 +96,7 @@
 {
    return( vos_mem_compare( pMemory1, pMemory2, numBytes ) );
 }   
+#endif
 
 #ifndef QCA_WIFI_2_0
 eHalStatus palPktAlloc(tHddHandle hHdd, eFrameType frmType, tANI_U16 size, void **data, void **ppPacket)
@@ -339,7 +342,7 @@
       }
    }
 
-   palFreeMemory( hHdd, pBuf );
+   vos_mem_free( pBuf );
 
    return( halStatus );
 }
diff --git a/CORE/SYS/legacy/src/pal/src/palTimer.c b/CORE/SYS/legacy/src/pal/src/palTimer.c
index 404db7d..458ad63 100644
--- a/CORE/SYS/legacy/src/pal/src/palTimer.c
+++ b/CORE/SYS/legacy/src/pal/src/palTimer.c
@@ -33,7 +33,6 @@
 
     $Id$
 
-
     Copyright (C) 2006 Airgo Networks, Incorporated
 
     This file contains function implementations for the Platform
@@ -46,6 +45,7 @@
 #include <vos_timer.h>
 #include <vos_memory.h>
 
+#ifndef FEATURE_WLAN_PAL_TIMER_DISABLE
 typedef struct sPalTimer
 {   
     palTimerCallback timerCallback;
@@ -58,8 +58,6 @@
     
 } tPalTimer, *tpPalTimer;
 
-
-
 v_VOID_t internalTimerCallback( v_PVOID_t userData )
 {
     tPalTimer *pPalTimer = (tPalTimer *)userData;
@@ -239,7 +237,7 @@
    return( status );
 }   
 
-
+#endif
 
 
 
diff --git a/CORE/SYS/legacy/src/system/src/macInitApi.c b/CORE/SYS/legacy/src/system/src/macInitApi.c
index dff85ee..570a0ff 100644
--- a/CORE/SYS/legacy/src/system/src/macInitApi.c
+++ b/CORE/SYS/legacy/src/system/src/macInitApi.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * macInitApi.c - This file has all the mac level init functions
  *                   for all the defined threads at system level.
@@ -70,15 +69,15 @@
 
    for(i=0; i<MAX_DUMP_TABLE_ENTRY; i++)
    {
-      if(palAllocateMemory(pMac->hHdd, ((void *)&pMac->dumpTableEntry[i]), sizeof(tDumpModuleEntry))
-          != eHAL_STATUS_SUCCESS)
+      pMac->dumpTableEntry[i] = vos_mem_malloc(sizeof(tDumpModuleEntry));
+      if ( NULL == pMac->dumpTableEntry[i] )
       {
          memAllocFailed = eANI_BOOLEAN_TRUE;
          break;
       }
       else
       {
-         palZeroMemory(pMac->hHdd, pMac->dumpTableEntry[i], sizeof(tSirMbMsg));
+         vos_mem_set(pMac->dumpTableEntry[i], sizeof(tSirMbMsg), 0);
       }
    }
    if( memAllocFailed )
@@ -86,7 +85,7 @@
       while(i>0)
       {
          i--;
-         palFreeMemory(pMac, pMac->dumpTableEntry[i]);
+         vos_mem_free(pMac->dumpTableEntry[i]);
       }
       sysLog(pMac, LOGE, FL("pMac->dumpTableEntry is NULL\n"));
       status = eSIR_FAILURE;
@@ -124,7 +123,8 @@
       macTraceInit(pMac);
 #endif
 
-      if (!HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, ((void *)&pMac->pResetMsg), sizeof(tSirMbMsg))))
+      pMac->pResetMsg = vos_mem_malloc(sizeof(tSirMbMsg));
+      if ( NULL == pMac->pResetMsg )
       {
          sysLog(pMac, LOGE, FL("pMac->pResetMsg is NULL\n"));
          status = eSIR_FAILURE;
@@ -132,7 +132,7 @@
       }
       else
       {
-         palZeroMemory(pMac->hHdd, pMac->pResetMsg, sizeof(tSirMbMsg));
+         vos_mem_set(pMac->pResetMsg, sizeof(tSirMbMsg), 0);
       }
 
       if (pMac->gDriverType != eDRIVER_TYPE_MFG)
@@ -166,13 +166,13 @@
     // in reset context this memory will be freed by HDD.
     if(false == pMac->sys.abort)
     {
-        palFreeMemory(pMac->hHdd, pMac->pResetMsg);
+        vos_mem_free(pMac->pResetMsg);
         pMac->pResetMsg = NULL;
     }
     /* Free the DumpTableEntry */
     for(i=0; i<MAX_DUMP_TABLE_ENTRY; i++)
     {
-        palFreeMemory(pMac, pMac->dumpTableEntry[i]);
+        vos_mem_free(pMac->dumpTableEntry[i]);
     }
 
     return eSIR_SUCCESS;
@@ -203,11 +203,12 @@
      */
 
     /* Allocate pMac */
-    if (palAllocateMemory(hHdd, ((void **)&pMac), sizeof(tAniSirGlobal)) != eHAL_STATUS_SUCCESS)
+    pMac = vos_mem_malloc(sizeof(tAniSirGlobal));
+    if ( NULL == pMac )
         return eSIR_FAILURE;
 
     /* Initialize the pMac structure */
-    palZeroMemory(hHdd, pMac, sizeof(tAniSirGlobal));
+    vos_mem_set(pMac, sizeof(tAniSirGlobal), 0);
 
     /** Store the Driver type in pMac Global.*/
     //pMac->gDriverType = pMacOpenParms->driverType;
@@ -268,7 +269,7 @@
     logDeinit(pMac);
 
     // Finally, de-allocate the global MAC datastructure:
-    palFreeMemory( pMac->hHdd, pMac );
+    vos_mem_free( pMac );
 
     return eSIR_SUCCESS;
 }
diff --git a/CORE/SYS/legacy/src/system/src/sysEntryFunc.c b/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
index 56eb748..f95d1f2 100644
--- a/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
+++ b/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
@@ -82,7 +82,7 @@
 sysInitGlobals(tpAniSirGlobal pMac)
 {
 
-    palZeroMemory(pMac->hHdd, (tANI_U8 *) &pMac->sys, sizeof(pMac->sys));
+    vos_mem_set((tANI_U8 *) &pMac->sys, sizeof(pMac->sys), 0);
 
     pMac->sys.gSysEnableScanMode        = 1;
     pMac->sys.gSysEnableLinkMonitorMode = 0;
diff --git a/CORE/SYS/legacy/src/utils/inc/dot11fdefs.h b/CORE/SYS/legacy/src/utils/inc/dot11fdefs.h
index e0d552c..15fdf89 100644
--- a/CORE/SYS/legacy/src/utils/inc/dot11fdefs.h
+++ b/CORE/SYS/legacy/src/utils/inc/dot11fdefs.h
@@ -33,7 +33,6 @@
  * \brief C defines customizing our framesc-generated code
  *
  *
- *
  * Copyright (C) 2006 Airgo Networks, Incorporated
  *
  * 'framesc' generates code written in terms of a number of macros
@@ -46,11 +45,11 @@
 
 // This controls how the "dot11f" code copies memory
 #define DOT11F_MEMCPY(ctx, dst, src, len) \
-    palCopyMemory( ( ctx )->hHdd, ( tANI_U8* )( dst ), ( tANI_U8* )( src ), ( len ) )
+    vos_mem_copy( ( tANI_U8* )( dst ), ( tANI_U8* )( src ), ( len ) )
 
 // This controls how the "dot11f" code compares memory
 #define DOT11F_MEMCMP(ctx, lhs, rhs, len) \
-    ( ! palEqualMemory( ( ctx )->hHdd, ( tANI_U8* )( lhs ), ( tANI_U8* )( rhs ), ( len ) ) )
+    ( ! vos_mem_compare( ( tANI_U8* )( lhs ), ( tANI_U8* )( rhs ), ( len ) ) )
 
 #   if defined ( DBG ) && ( DBG != 0 )
 
diff --git a/CORE/SYS/legacy/src/utils/inc/utilsParser.h b/CORE/SYS/legacy/src/utils/inc/utilsParser.h
index 087e453..d0bd287 100644
--- a/CORE/SYS/legacy/src/utils/inc/utilsParser.h
+++ b/CORE/SYS/legacy/src/utils/inc/utilsParser.h
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file utilsParser.h contains the utility function protos
  * used internally by the parser
@@ -47,6 +46,7 @@
 
 void          ConvertSSID           (tpAniSirGlobal, tSirMacSSid*,               tDot11fIESSID*);
 void          ConvertSuppRates      (tpAniSirGlobal, tSirMacRateSet*,            tDot11fIESuppRates*);
+void          ConvertFHParams       (tpAniSirGlobal, tSirMacFHParamSet*,         tDot11fIEFHParamSet*);
 void          ConvertExtSuppRates   (tpAniSirGlobal, tSirMacRateSet*,            tDot11fIEExtSuppRates*);
 void          ConvertQOSCaps        (tpAniSirGlobal, tSirMacQosCapabilityIE*,    tDot11fIEQOSCapsAp*);
 void          ConvertQOSCapsStation (tpAniSirGlobal, tSirMacQosCapabilityStaIE*, tDot11fIEQOSCapsStation*);
diff --git a/CORE/SYS/legacy/src/utils/src/dot11f.c b/CORE/SYS/legacy/src/utils/src/dot11f.c
index 71822f4..9fee77b 100644
--- a/CORE/SYS/legacy/src/utils/src/dot11f.c
+++ b/CORE/SYS/legacy/src/utils/src/dot11f.c
@@ -1,4 +1,4 @@
-/*
+/**
  * Copyright (c) 2013, The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
@@ -25,7 +25,6 @@
  * to the Linux Foundation.
  */
 
-
 /**
   * \file dot11f.c
   *
@@ -37,10 +36,10 @@
   *
   *
   * This file was automatically generated by 'framesc'
-  * Fri Sep 27 20:26:57 2013 from the following file(s):
+  * Tue Dec  3 15:04:59 2013 from the following file(s):
   *
   * dot11f.frms
-  * 
+  *
   * PLEASE DON'T EDIT THIS FILE BY HAND!
   *
   *
@@ -501,7 +500,7 @@
 
     *pnConsumed = len;
     return DOT11F_PARSE_SUCCESS;
-   
+
 }
 
 
@@ -548,7 +547,7 @@
     return status;
 
 } /* End dot11fUnpackTlvCommonFunc2. */
-                                           
+
 void dot11fUnpackFfCommonFunc(tpAniSirGlobal pCtx,
                             tANI_U8 *pBuf, tANI_U16 *pDstField)
 {
@@ -561,7 +560,7 @@
 {
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
     (void)ielen;
-    (void)pBuf; 
+    (void)pBuf;
     if ((*pDstPresent)) status = DOT11F_DUPLICATE_IE;
     *pDstPresent = 1;
     *pDstField = *pBuf;
@@ -760,6 +759,16 @@
 
 #define SigFfDialogToken ( 0x000d )
 
+void dot11fUnpackFfLeader(tpAniSirGlobal pCtx,
+                          tANI_U8 *pBuf,
+                          tDot11fFfLeader *pDst)
+{
+    DOT11F_MEMCPY(pCtx, pDst->mac, pBuf, 6);
+    (void)pCtx;
+} /* End dot11fUnpackFfLeader. */
+
+#define SigFfLeader ( 0x000e )
+
 void dot11fUnpackFfLinkMargin(tpAniSirGlobal pCtx,
                               tANI_U8 *pBuf,
                               tDot11fFfLinkMargin *pDst)
@@ -768,9 +777,19 @@
     (void)pCtx;
 } /* End dot11fUnpackFfLinkMargin. */
 
-#define SigFfLinkMargin ( 0x000e )
+#define SigFfLinkMargin ( 0x000f )
 
-#define SigFfListenInterval ( 0x000f )
+#define SigFfListenInterval ( 0x0010 )
+
+void dot11fUnpackFfMagicCode(tpAniSirGlobal pCtx,
+                             tANI_U8 *pBuf,
+                             tDot11fFfMagicCode *pDst)
+{
+    DOT11F_MEMCPY(pCtx, pDst->magic, pBuf, 6);
+    (void)pCtx;
+} /* End dot11fUnpackFfMagicCode. */
+
+#define SigFfMagicCode ( 0x0011 )
 
 void dot11fUnpackFfMaxTxPower(tpAniSirGlobal pCtx,
                               tANI_U8 *pBuf,
@@ -780,7 +799,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfMaxTxPower. */
 
-#define SigFfMaxTxPower ( 0x0010 )
+#define SigFfMaxTxPower ( 0x0012 )
 
 void dot11fUnpackFfNumOfRepetitions(tpAniSirGlobal pCtx,
                                     tANI_U8 *pBuf,
@@ -790,7 +809,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfNumOfRepetitions. */
 
-#define SigFfNumOfRepetitions ( 0x0011 )
+#define SigFfNumOfRepetitions ( 0x0013 )
 
 void dot11fUnpackFfOperatingMode(tpAniSirGlobal pCtx,
                                  tANI_U8 *pBuf,
@@ -805,7 +824,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfOperatingMode. */
 
-#define SigFfOperatingMode ( 0x0012 )
+#define SigFfOperatingMode ( 0x0014 )
 
 void dot11fUnpackFfP2POUI(tpAniSirGlobal pCtx,
                           tANI_U8 *pBuf,
@@ -815,7 +834,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfP2POUI. */
 
-#define SigFfP2POUI ( 0x0013 )
+#define SigFfP2POUI ( 0x0015 )
 
 void dot11fUnpackFfP2POUISubType(tpAniSirGlobal pCtx,
                                  tANI_U8 *pBuf,
@@ -825,7 +844,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfP2POUISubType. */
 
-#define SigFfP2POUISubType ( 0x0014 )
+#define SigFfP2POUISubType ( 0x0016 )
 
 void dot11fUnpackFfRCPI(tpAniSirGlobal pCtx,
                         tANI_U8 *pBuf,
@@ -835,7 +854,37 @@
     (void)pCtx;
 } /* End dot11fUnpackFfRCPI. */
 
-#define SigFfRCPI ( 0x0015 )
+#define SigFfRCPI ( 0x0017 )
+
+void dot11fUnpackFfRMCDialogToken(tpAniSirGlobal pCtx,
+                                  tANI_U8 *pBuf,
+                                  tDot11fFfRMCDialogToken *pDst)
+{
+    framesntohl(pCtx, &pDst->token, pBuf, 0);
+    (void)pCtx;
+} /* End dot11fUnpackFfRMCDialogToken. */
+
+#define SigFfRMCDialogToken ( 0x0018 )
+
+void dot11fUnpackFfRMCOUI(tpAniSirGlobal pCtx,
+                          tANI_U8 *pBuf,
+                          tDot11fFfRMCOUI *pDst)
+{
+    DOT11F_MEMCPY(pCtx, pDst->oui, pBuf, 3);
+    (void)pCtx;
+} /* End dot11fUnpackFfRMCOUI. */
+
+#define SigFfRMCOUI ( 0x0019 )
+
+void dot11fUnpackFfRMCVersion(tpAniSirGlobal pCtx,
+                              tANI_U8 *pBuf,
+                              tDot11fFfRMCVersion *pDst)
+{
+    pDst->version = *pBuf;
+    (void)pCtx;
+} /* End dot11fUnpackFfRMCVersion. */
+
+#define SigFfRMCVersion ( 0x001a )
 
 void dot11fUnpackFfRSNI(tpAniSirGlobal pCtx,
                         tANI_U8 *pBuf,
@@ -845,9 +894,9 @@
     (void)pCtx;
 } /* End dot11fUnpackFfRSNI. */
 
-#define SigFfRSNI ( 0x0016 )
+#define SigFfRSNI ( 0x001b )
 
-#define SigFfReason ( 0x0017 )
+#define SigFfReason ( 0x001c )
 
 void dot11fUnpackFfRxAntennaId(tpAniSirGlobal pCtx,
                                tANI_U8 *pBuf,
@@ -857,7 +906,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfRxAntennaId. */
 
-#define SigFfRxAntennaId ( 0x0018 )
+#define SigFfRxAntennaId ( 0x001d )
 
 void dot11fUnpackFfSMPowerModeSet(tpAniSirGlobal pCtx,
                                   tANI_U8 *pBuf,
@@ -871,9 +920,9 @@
     (void)pCtx;
 } /* End dot11fUnpackFfSMPowerModeSet. */
 
-#define SigFfSMPowerModeSet ( 0x0019 )
+#define SigFfSMPowerModeSet ( 0x001e )
 
-#define SigFfStatus ( 0x001a )
+#define SigFfStatus ( 0x001f )
 
 void dot11fUnpackFfStatusCode(tpAniSirGlobal pCtx,
                               tANI_U8 *pBuf,
@@ -883,7 +932,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfStatusCode. */
 
-#define SigFfStatusCode ( 0x001b )
+#define SigFfStatusCode ( 0x0020 )
 
 void dot11fUnpackFfTPCEleID(tpAniSirGlobal pCtx,
                             tANI_U8 *pBuf,
@@ -893,7 +942,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTPCEleID. */
 
-#define SigFfTPCEleID ( 0x001c )
+#define SigFfTPCEleID ( 0x0021 )
 
 void dot11fUnpackFfTPCEleLen(tpAniSirGlobal pCtx,
                              tANI_U8 *pBuf,
@@ -903,7 +952,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTPCEleLen. */
 
-#define SigFfTPCEleLen ( 0x001d )
+#define SigFfTPCEleLen ( 0x0022 )
 
 void dot11fUnpackFfTSInfo(tpAniSirGlobal pCtx,
                           tANI_U8 *pBuf,
@@ -924,7 +973,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTSInfo. */
 
-#define SigFfTSInfo ( 0x001e )
+#define SigFfTSInfo ( 0x0023 )
 
 void dot11fUnpackFfTimeStamp(tpAniSirGlobal pCtx,
                              tANI_U8 *pBuf,
@@ -934,7 +983,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTimeStamp. */
 
-#define SigFfTimeStamp ( 0x001f )
+#define SigFfTimeStamp ( 0x0024 )
 
 void dot11fUnpackFfTransactionId(tpAniSirGlobal pCtx,
                                  tANI_U8 *pBuf,
@@ -944,7 +993,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTransactionId. */
 
-#define SigFfTransactionId ( 0x0020 )
+#define SigFfTransactionId ( 0x0025 )
 
 void dot11fUnpackFfTxAntennaId(tpAniSirGlobal pCtx,
                                tANI_U8 *pBuf,
@@ -954,7 +1003,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTxAntennaId. */
 
-#define SigFfTxAntennaId ( 0x0021 )
+#define SigFfTxAntennaId ( 0x0026 )
 
 void dot11fUnpackFfTxPower(tpAniSirGlobal pCtx,
                            tANI_U8 *pBuf,
@@ -964,7 +1013,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfTxPower. */
 
-#define SigFfTxPower ( 0x0022 )
+#define SigFfTxPower ( 0x0027 )
 
 void dot11fUnpackFfVhtMembershipStatusArray(tpAniSirGlobal pCtx,
                                             tANI_U8 *pBuf,
@@ -974,7 +1023,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfVhtMembershipStatusArray. */
 
-#define SigFfVhtMembershipStatusArray ( 0x0023 )
+#define SigFfVhtMembershipStatusArray ( 0x0028 )
 
 void dot11fUnpackFfVhtUserPositionArray(tpAniSirGlobal pCtx,
                                         tANI_U8 *pBuf,
@@ -984,7 +1033,7 @@
     (void)pCtx;
 } /* End dot11fUnpackFfVhtUserPositionArray. */
 
-#define SigFfVhtUserPositionArray ( 0x0024 )
+#define SigFfVhtUserPositionArray ( 0x0029 )
 
 tANI_U32 dot11fUnpackTlvAuthorizedMACs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U16 tlvlen, tDot11fTLVAuthorizedMACs *pDst)
 {
@@ -1632,6 +1681,29 @@
 #define SigIeHCF ( 0x0005 )
 
 
+tANI_U32 dot11fUnpackIeIGTK(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEIGTK *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    DOT11F_MEMCPY(pCtx, pDst->keyID, pBuf, 2);
+    pBuf += 2;
+    ielen -= (tANI_U8)2;
+    DOT11F_MEMCPY(pCtx, pDst->IPN, pBuf, 6);
+    pBuf += 6;
+    ielen -= (tANI_U8)6;
+    pDst->keyLength = *pBuf;
+    pBuf += 1;
+    ielen -= (tANI_U8)1;
+    DOT11F_MEMCPY(pCtx, pDst->key, pBuf, 24);
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIeIGTK. */
+
+#define SigIeIGTK ( 0x0006 )
+
+
 tANI_U32 dot11fUnpackIeLLAttr(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIELLAttr *pDst)
 {
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
@@ -1643,7 +1715,7 @@
     return status;
 } /* End dot11fUnpackIeLLAttr. */
 
-#define SigIeLLAttr ( 0x0006 )
+#define SigIeLLAttr ( 0x0007 )
 
 
 tANI_U32 dot11fUnpackIeLoadBalance(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIELoadBalance *pDst)
@@ -1660,7 +1732,7 @@
     return status;
 } /* End dot11fUnpackIeLoadBalance. */
 
-#define SigIeLoadBalance ( 0x0007 )
+#define SigIeLoadBalance ( 0x0008 )
 
 
 tANI_U32 dot11fUnpackIeLoadInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIELoadInfo *pDst)
@@ -1677,10 +1749,10 @@
     return status;
 } /* End dot11fUnpackIeLoadInfo. */
 
-#define SigIeLoadInfo ( 0x0008 )
+#define SigIeLoadInfo ( 0x0009 )
 
 
-#define SigIePropAssocType ( 0x0009 )
+#define SigIePropAssocType ( 0x000a )
 
 
 tANI_U32 dot11fUnpackIePropCapability(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPropCapability *pDst)
@@ -1694,7 +1766,7 @@
     return status;
 } /* End dot11fUnpackIePropCapability. */
 
-#define SigIePropCapability ( 0x000a )
+#define SigIePropCapability ( 0x000b )
 
 
 tANI_U32 dot11fUnpackIePropChannSwitchAnn(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPropChannSwitchAnn *pDst)
@@ -1717,7 +1789,7 @@
     return status;
 } /* End dot11fUnpackIePropChannSwitchAnn. */
 
-#define SigIePropChannSwitchAnn ( 0x000b )
+#define SigIePropChannSwitchAnn ( 0x000c )
 
 
 tANI_U32 dot11fUnpackIePropEDCAParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPropEDCAParams *pDst)
@@ -1802,7 +1874,7 @@
     return status;
 } /* End dot11fUnpackIePropEDCAParams. */
 
-#define SigIePropEDCAParams ( 0x000c )
+#define SigIePropEDCAParams ( 0x000d )
 
 
 tANI_U32 dot11fUnpackIePropQuietBSS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPropQuietBSS *pDst)
@@ -1825,7 +1897,7 @@
     return status;
 } /* End dot11fUnpackIePropQuietBSS. */
 
-#define SigIePropQuietBSS ( 0x000d )
+#define SigIePropQuietBSS ( 0x000e )
 
 
 tANI_U32 dot11fUnpackIePropSuppRates(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPropSuppRates *pDst)
@@ -1837,7 +1909,7 @@
     if (pDst->present) status = DOT11F_DUPLICATE_IE;
     pDst->present = 1;
     for (i = 0; i < ielen; i++) {
-        if ((DOT11F_IS_BG_RATE(pBuf[i] & 0x7F)) && 
+        if ((DOT11F_IS_BG_RATE(pBuf[i] & 0x7F)) &&
             (rate_indx < 12)) {
             pDst->rates[rate_indx++] = pBuf[i];
         }
@@ -1853,7 +1925,7 @@
     return status;
 } /* End dot11fUnpackIePropSuppRates. */
 
-#define SigIePropSuppRates ( 0x000e )
+#define SigIePropSuppRates ( 0x000f )
 
 
 tANI_U32 dot11fUnpackIeR0KH_ID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIER0KH_ID *pDst)
@@ -1873,7 +1945,7 @@
     return status;
 } /* End dot11fUnpackIeR0KH_ID. */
 
-#define SigIeR0KH_ID ( 0x000f )
+#define SigIeR0KH_ID ( 0x0010 )
 
 
 tANI_U32 dot11fUnpackIeR1KH_ID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIER1KH_ID *pDst)
@@ -1887,7 +1959,7 @@
     return status;
 } /* End dot11fUnpackIeR1KH_ID. */
 
-#define SigIeR1KH_ID ( 0x0010 )
+#define SigIeR1KH_ID ( 0x0011 )
 
 
 tANI_U32 dot11fUnpackIeTSFInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETSFInfo *pDst)
@@ -1904,7 +1976,7 @@
     return status;
 } /* End dot11fUnpackIeTSFInfo. */
 
-#define SigIeTSFInfo ( 0x0011 )
+#define SigIeTSFInfo ( 0x0012 )
 
 
 tANI_U32 dot11fUnpackIeTaurus(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETaurus *pDst)
@@ -1927,7 +1999,7 @@
     return status;
 } /* End dot11fUnpackIeTaurus. */
 
-#define SigIeTaurus ( 0x0012 )
+#define SigIeTaurus ( 0x0013 )
 
 
 tANI_U32 dot11fUnpackIeTitan(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETitan *pDst)
@@ -1950,10 +2022,10 @@
     return status;
 } /* End dot11fUnpackIeTitan. */
 
-#define SigIeTitan ( 0x0013 )
+#define SigIeTitan ( 0x0014 )
 
 
-#define SigIeTriggerStaBgScan ( 0x0014 )
+#define SigIeTriggerStaBgScan ( 0x0015 )
 
 
 tANI_U32 dot11fUnpackIeVersion(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEVersion *pDst)
@@ -1979,7 +2051,7 @@
     return status;
 } /* End dot11fUnpackIeVersion. */
 
-#define SigIeVersion ( 0x0015 )
+#define SigIeVersion ( 0x0016 )
 
 
 tANI_U32 dot11fUnpackIeWDS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWDS *pDst)
@@ -1999,7 +2071,7 @@
     return status;
 } /* End dot11fUnpackIeWDS. */
 
-#define SigIeWDS ( 0x0016 )
+#define SigIeWDS ( 0x0017 )
 
 
 tANI_U32 dot11fUnpackIeAPChannelReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEAPChannelReport *pDst)
@@ -2022,7 +2094,7 @@
     return status;
 } /* End dot11fUnpackIeAPChannelReport. */
 
-#define SigIeAPChannelReport ( 0x0017 )
+#define SigIeAPChannelReport ( 0x0018 )
 
 
 tANI_U32 dot11fUnpackIeBcnReportingDetail(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEBcnReportingDetail *pDst)
@@ -2036,7 +2108,7 @@
     return status;
 } /* End dot11fUnpackIeBcnReportingDetail. */
 
-#define SigIeBcnReportingDetail ( 0x0018 )
+#define SigIeBcnReportingDetail ( 0x0019 )
 
 
 tANI_U32 dot11fUnpackIeBeaconReportFrmBody(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEBeaconReportFrmBody *pDst)
@@ -2056,7 +2128,7 @@
     return status;
 } /* End dot11fUnpackIeBeaconReportFrmBody. */
 
-#define SigIeBeaconReportFrmBody ( 0x0019 )
+#define SigIeBeaconReportFrmBody ( 0x001a )
 
 
 tANI_U32 dot11fUnpackIeBeaconReporting(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEBeaconReporting *pDst)
@@ -2073,7 +2145,7 @@
     return status;
 } /* End dot11fUnpackIeBeaconReporting. */
 
-#define SigIeBeaconReporting ( 0x001a )
+#define SigIeBeaconReporting ( 0x001b )
 
 
 tANI_U32 dot11fUnpackIeMeasurementPilot(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEMeasurementPilot *pDst)
@@ -2091,7 +2163,7 @@
     return status;
 } /* End dot11fUnpackIeMeasurementPilot. */
 
-#define SigIeMeasurementPilot ( 0x001b )
+#define SigIeMeasurementPilot ( 0x001c )
 
 
 tANI_U32 dot11fUnpackIeMultiBssid(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEMultiBssid *pDst)
@@ -2109,7 +2181,7 @@
     return status;
 } /* End dot11fUnpackIeMultiBssid. */
 
-#define SigIeMultiBssid ( 0x001c )
+#define SigIeMultiBssid ( 0x001d )
 
 
 tANI_U32 dot11fUnpackIeRICData(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERICData *pDst)
@@ -2129,7 +2201,7 @@
     return status;
 } /* End dot11fUnpackIeRICData. */
 
-#define SigIeRICData ( 0x001d )
+#define SigIeRICData ( 0x001e )
 
 
 tANI_U32 dot11fUnpackIeRICDescriptor(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERICDescriptor *pDst)
@@ -2147,7 +2219,7 @@
     return status;
 } /* End dot11fUnpackIeRICDescriptor. */
 
-#define SigIeRICDescriptor ( 0x001e )
+#define SigIeRICDescriptor ( 0x001f )
 
 
 tANI_U32 dot11fUnpackIeRRMEnabledCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERRMEnabledCap *pDst)
@@ -2207,7 +2279,7 @@
     return status;
 } /* End dot11fUnpackIeRRMEnabledCap. */
 
-#define SigIeRRMEnabledCap ( 0x001f )
+#define SigIeRRMEnabledCap ( 0x0020 )
 
 
 tANI_U32 dot11fUnpackIeRequestedInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERequestedInfo *pDst)
@@ -2222,7 +2294,7 @@
     return status;
 } /* End dot11fUnpackIeRequestedInfo. */
 
-#define SigIeRequestedInfo ( 0x0020 )
+#define SigIeRequestedInfo ( 0x0021 )
 
 
 tANI_U32 dot11fUnpackIeSSID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESSID *pDst)
@@ -2246,7 +2318,7 @@
     return status;
 } /* End dot11fUnpackIeSSID. */
 
-#define SigIeSSID ( 0x0021 )
+#define SigIeSSID ( 0x0022 )
 
 
 tANI_U32 dot11fUnpackIeSchedule(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESchedule *pDst)
@@ -2277,7 +2349,7 @@
     return status;
 } /* End dot11fUnpackIeSchedule. */
 
-#define SigIeSchedule ( 0x0022 )
+#define SigIeSchedule ( 0x0023 )
 
 
 tANI_U32 dot11fUnpackIeTCLAS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETCLAS *pDst)
@@ -2366,10 +2438,10 @@
     return status;
 } /* End dot11fUnpackIeTCLAS. */
 
-#define SigIeTCLAS ( 0x0023 )
+#define SigIeTCLAS ( 0x0024 )
 
 
-#define SigIeTCLASSPROC ( 0x0024 )
+#define SigIeTCLASSPROC ( 0x0025 )
 
 
 tANI_U32 dot11fUnpackIeTSDelay(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETSDelay *pDst)
@@ -2383,7 +2455,7 @@
     return status;
 } /* End dot11fUnpackIeTSDelay. */
 
-#define SigIeTSDelay ( 0x0025 )
+#define SigIeTSDelay ( 0x0026 )
 
 
 tANI_U32 dot11fUnpackIeTSPEC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETSPEC *pDst)
@@ -2460,7 +2532,7 @@
     return status;
 } /* End dot11fUnpackIeTSPEC. */
 
-#define SigIeTSPEC ( 0x0026 )
+#define SigIeTSPEC ( 0x0027 )
 
 
 tANI_U32 dot11fUnpackIeWMMSchedule(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMSchedule *pDst)
@@ -2499,7 +2571,7 @@
     return status;
 } /* End dot11fUnpackIeWMMSchedule. */
 
-#define SigIeWMMSchedule ( 0x0027 )
+#define SigIeWMMSchedule ( 0x0028 )
 
 
 tANI_U32 dot11fUnpackIeWMMTCLAS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMTCLAS *pDst)
@@ -2596,7 +2668,7 @@
     return status;
 } /* End dot11fUnpackIeWMMTCLAS. */
 
-#define SigIeWMMTCLAS ( 0x0028 )
+#define SigIeWMMTCLAS ( 0x0029 )
 
 
 tANI_U32 dot11fUnpackIeWMMTCLASPROC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMTCLASPROC *pDst)
@@ -2618,7 +2690,7 @@
     return status;
 } /* End dot11fUnpackIeWMMTCLASPROC. */
 
-#define SigIeWMMTCLASPROC ( 0x0029 )
+#define SigIeWMMTCLASPROC ( 0x002a )
 
 
 tANI_U32 dot11fUnpackIeWMMTSDelay(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMTSDelay *pDst)
@@ -2640,7 +2712,7 @@
     return status;
 } /* End dot11fUnpackIeWMMTSDelay. */
 
-#define SigIeWMMTSDelay ( 0x002a )
+#define SigIeWMMTSDelay ( 0x002b )
 
 
 tANI_U32 dot11fUnpackIeWMMTSPEC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMTSPEC *pDst)
@@ -2725,7 +2797,7 @@
     return status;
 } /* End dot11fUnpackIeWMMTSPEC. */
 
-#define SigIeWMMTSPEC ( 0x002b )
+#define SigIeWMMTSPEC ( 0x002c )
 
 
 tANI_U32 dot11fUnpackIeAID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEAID *pDst)
@@ -2739,7 +2811,7 @@
     return status;
 } /* End dot11fUnpackIeAID. */
 
-#define SigIeAID ( 0x002c )
+#define SigIeAID ( 0x002d )
 
 
     static const tFFDefn FFS_Airgo[ ] = {
@@ -2784,7 +2856,7 @@
     return status;
 } /* End dot11fUnpackIeAirgo. */
 
-#define SigIeAirgo ( 0x002d )
+#define SigIeAirgo ( 0x002e )
 
 
 tANI_U32 dot11fUnpackIeCCXCckmOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECCXCckmOpaque *pDst)
@@ -2804,7 +2876,7 @@
     return status;
 } /* End dot11fUnpackIeCCXCckmOpaque. */
 
-#define SigIeCCXCckmOpaque ( 0x002e )
+#define SigIeCCXCckmOpaque ( 0x002f )
 
 
 tANI_U32 dot11fUnpackIeCCXRadMgmtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECCXRadMgmtCap *pDst)
@@ -2824,7 +2896,7 @@
     return status;
 } /* End dot11fUnpackIeCCXRadMgmtCap. */
 
-#define SigIeCCXRadMgmtCap ( 0x002f )
+#define SigIeCCXRadMgmtCap ( 0x0030 )
 
 
 tANI_U32 dot11fUnpackIeCCXTrafStrmMet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECCXTrafStrmMet *pDst)
@@ -2844,7 +2916,7 @@
     return status;
 } /* End dot11fUnpackIeCCXTrafStrmMet. */
 
-#define SigIeCCXTrafStrmMet ( 0x0030 )
+#define SigIeCCXTrafStrmMet ( 0x0031 )
 
 
 tANI_U32 dot11fUnpackIeCCXTrafStrmRateSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECCXTrafStrmRateSet *pDst)
@@ -2867,7 +2939,7 @@
     return status;
 } /* End dot11fUnpackIeCCXTrafStrmRateSet. */
 
-#define SigIeCCXTrafStrmRateSet ( 0x0031 )
+#define SigIeCCXTrafStrmRateSet ( 0x0032 )
 
 
 tANI_U32 dot11fUnpackIeCCXTxmitPower(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECCXTxmitPower *pDst)
@@ -2884,7 +2956,7 @@
     return status;
 } /* End dot11fUnpackIeCCXTxmitPower. */
 
-#define SigIeCCXTxmitPower ( 0x0032 )
+#define SigIeCCXTxmitPower ( 0x0033 )
 
 
 tANI_U32 dot11fUnpackIeCCXVersion(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECCXVersion *pDst)
@@ -2898,7 +2970,7 @@
     return status;
 } /* End dot11fUnpackIeCCXVersion. */
 
-#define SigIeCCXVersion ( 0x0033 )
+#define SigIeCCXVersion ( 0x0034 )
 
 
 tANI_U32 dot11fUnpackIeCFParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECFParams *pDst)
@@ -2921,7 +2993,7 @@
     return status;
 } /* End dot11fUnpackIeCFParams. */
 
-#define SigIeCFParams ( 0x0034 )
+#define SigIeCFParams ( 0x0035 )
 
 
 tANI_U32 dot11fUnpackIeChallengeText(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEChallengeText *pDst)
@@ -2941,7 +3013,7 @@
     return status;
 } /* End dot11fUnpackIeChallengeText. */
 
-#define SigIeChallengeText ( 0x0035 )
+#define SigIeChallengeText ( 0x0036 )
 
 
 tANI_U32 dot11fUnpackIeChanSwitchAnn(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEChanSwitchAnn *pDst)
@@ -2961,7 +3033,7 @@
     return status;
 } /* End dot11fUnpackIeChanSwitchAnn. */
 
-#define SigIeChanSwitchAnn ( 0x0036 )
+#define SigIeChanSwitchAnn ( 0x0037 )
 
 
 tANI_U32 dot11fUnpackIeCountry(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECountry *pDst)
@@ -2981,7 +3053,7 @@
     else
     {
         pDst->num_triplets = (tANI_U8)( ielen / 3 );
-        if (ielen / 3 > 84){
+        if (ielen > 84 * 3){
                 pDst->present = 0;
                 return DOT11F_SKIPPED_BAD_IE;
         }
@@ -2992,10 +3064,10 @@
     return status;
 } /* End dot11fUnpackIeCountry. */
 
-#define SigIeCountry ( 0x0037 )
+#define SigIeCountry ( 0x0038 )
 
 
-#define SigIeDSParams ( 0x0038 )
+#define SigIeDSParams ( 0x0039 )
 
 
 tANI_U32 dot11fUnpackIeEDCAParamSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEEDCAParamSet *pDst)
@@ -3080,7 +3152,7 @@
     return status;
 } /* End dot11fUnpackIeEDCAParamSet. */
 
-#define SigIeEDCAParamSet ( 0x0039 )
+#define SigIeEDCAParamSet ( 0x003a )
 
 
 tANI_U32 dot11fUnpackIeERPInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEERPInfo *pDst)
@@ -3099,7 +3171,7 @@
     return status;
 } /* End dot11fUnpackIeERPInfo. */
 
-#define SigIeERPInfo ( 0x003a )
+#define SigIeERPInfo ( 0x003b )
 
 
 tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEExtCap *pDst)
@@ -3173,10 +3245,10 @@
     return status;
 } /* End dot11fUnpackIeExtCap. */
 
-#define SigIeExtCap ( 0x003b )
+#define SigIeExtCap ( 0x003c )
 
 
-#define SigIeExtChanSwitchAnn ( 0x003c )
+#define SigIeExtChanSwitchAnn ( 0x003d )
 
 
 tANI_U32 dot11fUnpackIeExtSuppRates(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEExtSuppRates *pDst)
@@ -3188,7 +3260,7 @@
     if (pDst->present) status = DOT11F_DUPLICATE_IE;
     pDst->present = 1;
     for (i = 0; i < ielen; i++) {
-        if ((DOT11F_IS_BG_RATE(pBuf[i] & 0x7F)) && 
+        if ((DOT11F_IS_BG_RATE(pBuf[i] & 0x7F)) &&
             (rate_indx < 12)) {
             pDst->rates[rate_indx++] = pBuf[i];
         }
@@ -3204,7 +3276,7 @@
     return status;
 } /* End dot11fUnpackIeExtSuppRates. */
 
-#define SigIeExtSuppRates ( 0x003d )
+#define SigIeExtSuppRates ( 0x003e )
 
 
 tANI_U32 dot11fUnpackIeFHParamSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEFHParamSet *pDst)
@@ -3227,7 +3299,7 @@
     return status;
 } /* End dot11fUnpackIeFHParamSet. */
 
-#define SigIeFHParamSet ( 0x003e )
+#define SigIeFHParamSet ( 0x003f )
 
 
 tANI_U32 dot11fUnpackIeFHParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEFHParams *pDst)
@@ -3244,7 +3316,7 @@
     return status;
 } /* End dot11fUnpackIeFHParams. */
 
-#define SigIeFHParams ( 0x003f )
+#define SigIeFHParams ( 0x0040 )
 
 
 tANI_U32 dot11fUnpackIeFHPattTable(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEFHPattTable *pDst)
@@ -3276,7 +3348,7 @@
     return status;
 } /* End dot11fUnpackIeFHPattTable. */
 
-#define SigIeFHPattTable ( 0x0040 )
+#define SigIeFHPattTable ( 0x0041 )
 
 
     static const tFFDefn FFS_FTInfo[ ] = {
@@ -3287,6 +3359,7 @@
         {offsetof(tDot11fIEFTInfo, R1KH_ID), offsetof(tDot11fIER1KH_ID, present), 0, "R1KH_ID" , 0, 8, 8, SigIeR1KH_ID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_R1KH_ID, 0, },
         {offsetof(tDot11fIEFTInfo, GTK), offsetof(tDot11fIEGTK, present), 0, "GTK" , 0, 18, 45, SigIeGTK, {0, 0, 0, 0, 0}, 0, DOT11F_EID_GTK, 0, },
         {offsetof(tDot11fIEFTInfo, R0KH_ID), offsetof(tDot11fIER0KH_ID, present), 0, "R0KH_ID" , 0, 3, 50, SigIeR0KH_ID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_R0KH_ID, 0, },
+        {offsetof(tDot11fIEFTInfo, IGTK), offsetof(tDot11fIEIGTK, present), 0, "IGTK" , 0, 35, 35, SigIeIGTK, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IGTK, 0, },
         {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },
     };
 
@@ -3322,7 +3395,7 @@
     return status;
 } /* End dot11fUnpackIeFTInfo. */
 
-#define SigIeFTInfo ( 0x0041 )
+#define SigIeFTInfo ( 0x0042 )
 
 
 tANI_U32 dot11fUnpackIeFTTimeoutInterval(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEFTTimeoutInterval *pDst)
@@ -3339,7 +3412,7 @@
     return status;
 } /* End dot11fUnpackIeFTTimeoutInterval. */
 
-#define SigIeFTTimeoutInterval ( 0x0042 )
+#define SigIeFTTimeoutInterval ( 0x0043 )
 
 
 tANI_U32 dot11fUnpackIeHTCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEHTCaps *pDst)
@@ -3428,7 +3501,7 @@
     return status;
 } /* End dot11fUnpackIeHTCaps. */
 
-#define SigIeHTCaps ( 0x0043 )
+#define SigIeHTCaps ( 0x0044 )
 
 
 tANI_U32 dot11fUnpackIeHTInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEHTInfo *pDst)
@@ -3483,7 +3556,7 @@
     return status;
 } /* End dot11fUnpackIeHTInfo. */
 
-#define SigIeHTInfo ( 0x0044 )
+#define SigIeHTInfo ( 0x0045 )
 
 
 tANI_U32 dot11fUnpackIeIBSSParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEIBSSParams *pDst)
@@ -3497,7 +3570,7 @@
     return status;
 } /* End dot11fUnpackIeIBSSParams. */
 
-#define SigIeIBSSParams ( 0x0045 )
+#define SigIeIBSSParams ( 0x0046 )
 
 
 tANI_U32 dot11fUnpackIeLinkIdentifier(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIELinkIdentifier *pDst)
@@ -3517,7 +3590,7 @@
     return status;
 } /* End dot11fUnpackIeLinkIdentifier. */
 
-#define SigIeLinkIdentifier ( 0x0046 )
+#define SigIeLinkIdentifier ( 0x0047 )
 
 
 static const tFFDefn FFS_reportBeacon[ ] = {
@@ -3675,7 +3748,7 @@
     return status;
 } /* End dot11fUnpackIeMeasurementReport. */
 
-#define SigIeMeasurementReport ( 0x0047 )
+#define SigIeMeasurementReport ( 0x0048 )
 
 
 static const tFFDefn FFS_measurement_requestBeacon[ ] = {
@@ -3780,7 +3853,7 @@
     return status;
 } /* End dot11fUnpackIeMeasurementRequest. */
 
-#define SigIeMeasurementRequest ( 0x0048 )
+#define SigIeMeasurementRequest ( 0x0049 )
 
 
 tANI_U32 dot11fUnpackIeMobilityDomain(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEMobilityDomain *pDst)
@@ -3801,7 +3874,7 @@
     return status;
 } /* End dot11fUnpackIeMobilityDomain. */
 
-#define SigIeMobilityDomain ( 0x0049 )
+#define SigIeMobilityDomain ( 0x004a )
 
 
     static const tFFDefn FFS_NeighborReport[ ] = {
@@ -3868,7 +3941,7 @@
     return status;
 } /* End dot11fUnpackIeNeighborReport. */
 
-#define SigIeNeighborReport ( 0x004a )
+#define SigIeNeighborReport ( 0x004b )
 
 
 tANI_U32 dot11fUnpackIeOperatingMode(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEOperatingMode *pDst)
@@ -3887,7 +3960,21 @@
     return status;
 } /* End dot11fUnpackIeOperatingMode. */
 
-#define SigIeOperatingMode ( 0x004b )
+#define SigIeOperatingMode ( 0x004c )
+
+
+tANI_U32 dot11fUnpackIeOxygenNetwork(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEOxygenNetwork *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    framesntohs(pCtx, &pDst->data, pBuf, 0);
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIeOxygenNetwork. */
+
+#define SigIeOxygenNetwork ( 0x004d )
 
 
     static const tTLVDefn TLVS_P2PAssocReq[ ] = {
@@ -3906,7 +3993,7 @@
     return status;
 } /* End dot11fUnpackIeP2PAssocReq. */
 
-#define SigIeP2PAssocReq ( 0x004c )
+#define SigIeP2PAssocReq ( 0x004e )
 
 
     static const tTLVDefn TLVS_P2PAssocRes[ ] = {
@@ -3924,7 +4011,7 @@
     return status;
 } /* End dot11fUnpackIeP2PAssocRes. */
 
-#define SigIeP2PAssocRes ( 0x004d )
+#define SigIeP2PAssocRes ( 0x004f )
 
 
     static const tTLVDefn TLVS_P2PBeacon[ ] = {
@@ -3943,7 +4030,7 @@
     return status;
 } /* End dot11fUnpackIeP2PBeacon. */
 
-#define SigIeP2PBeacon ( 0x004e )
+#define SigIeP2PBeacon ( 0x0050 )
 
 
     static const tTLVDefn TLVS_P2PBeaconProbeRes[ ] = {
@@ -3965,7 +4052,7 @@
     return status;
 } /* End dot11fUnpackIeP2PBeaconProbeRes. */
 
-#define SigIeP2PBeaconProbeRes ( 0x004f )
+#define SigIeP2PBeaconProbeRes ( 0x0051 )
 
 
     static const tTLVDefn TLVS_P2PDeAuth[ ] = {
@@ -3982,7 +4069,7 @@
     return status;
 } /* End dot11fUnpackIeP2PDeAuth. */
 
-#define SigIeP2PDeAuth ( 0x0050 )
+#define SigIeP2PDeAuth ( 0x0052 )
 
 
     static const tTLVDefn TLVS_P2PDeviceDiscoverabilityReq[ ] = {
@@ -4000,7 +4087,7 @@
     return status;
 } /* End dot11fUnpackIeP2PDeviceDiscoverabilityReq. */
 
-#define SigIeP2PDeviceDiscoverabilityReq ( 0x0051 )
+#define SigIeP2PDeviceDiscoverabilityReq ( 0x0053 )
 
 
     static const tTLVDefn TLVS_P2PDeviceDiscoverabilityRes[ ] = {
@@ -4017,7 +4104,7 @@
     return status;
 } /* End dot11fUnpackIeP2PDeviceDiscoverabilityRes. */
 
-#define SigIeP2PDeviceDiscoverabilityRes ( 0x0052 )
+#define SigIeP2PDeviceDiscoverabilityRes ( 0x0054 )
 
 
     static const tTLVDefn TLVS_P2PDisAssoc[ ] = {
@@ -4034,7 +4121,7 @@
     return status;
 } /* End dot11fUnpackIeP2PDisAssoc. */
 
-#define SigIeP2PDisAssoc ( 0x0053 )
+#define SigIeP2PDisAssoc ( 0x0055 )
 
 
     static const tTLVDefn TLVS_P2PGONegCnf[ ] = {
@@ -4055,7 +4142,7 @@
     return status;
 } /* End dot11fUnpackIeP2PGONegCnf. */
 
-#define SigIeP2PGONegCnf ( 0x0054 )
+#define SigIeP2PGONegCnf ( 0x0056 )
 
 
     static const tTLVDefn TLVS_P2PGONegReq[ ] = {
@@ -4080,7 +4167,7 @@
     return status;
 } /* End dot11fUnpackIeP2PGONegReq. */
 
-#define SigIeP2PGONegReq ( 0x0055 )
+#define SigIeP2PGONegReq ( 0x0057 )
 
 
     static const tTLVDefn TLVS_P2PGONegRes[ ] = {
@@ -4105,7 +4192,7 @@
     return status;
 } /* End dot11fUnpackIeP2PGONegRes. */
 
-#define SigIeP2PGONegRes ( 0x0056 )
+#define SigIeP2PGONegRes ( 0x0058 )
 
 
     static const tTLVDefn TLVS_P2PGONegWPS[ ] = {
@@ -4123,7 +4210,7 @@
     return status;
 } /* End dot11fUnpackIeP2PGONegWPS. */
 
-#define SigIeP2PGONegWPS ( 0x0057 )
+#define SigIeP2PGONegWPS ( 0x0059 )
 
 
 tANI_U32 dot11fUnpackIeP2PIEOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEP2PIEOpaque *pDst)
@@ -4143,7 +4230,7 @@
     return status;
 } /* End dot11fUnpackIeP2PIEOpaque. */
 
-#define SigIeP2PIEOpaque ( 0x0058 )
+#define SigIeP2PIEOpaque ( 0x005a )
 
 
     static const tTLVDefn TLVS_P2PInvitationReq[ ] = {
@@ -4166,7 +4253,7 @@
     return status;
 } /* End dot11fUnpackIeP2PInvitationReq. */
 
-#define SigIeP2PInvitationReq ( 0x0059 )
+#define SigIeP2PInvitationReq ( 0x005b )
 
 
     static const tTLVDefn TLVS_P2PInvitationRes[ ] = {
@@ -4187,7 +4274,7 @@
     return status;
 } /* End dot11fUnpackIeP2PInvitationRes. */
 
-#define SigIeP2PInvitationRes ( 0x005a )
+#define SigIeP2PInvitationRes ( 0x005c )
 
 
     static const tTLVDefn TLVS_P2PNoticeOfAbsence[ ] = {
@@ -4204,7 +4291,7 @@
     return status;
 } /* End dot11fUnpackIeP2PNoticeOfAbsence. */
 
-#define SigIeP2PNoticeOfAbsence ( 0x005b )
+#define SigIeP2PNoticeOfAbsence ( 0x005d )
 
 
     static const tTLVDefn TLVS_P2PPresenceResponse[ ] = {
@@ -4222,7 +4309,7 @@
     return status;
 } /* End dot11fUnpackIeP2PPresenceResponse. */
 
-#define SigIeP2PPresenceResponse ( 0x005c )
+#define SigIeP2PPresenceResponse ( 0x005e )
 
 
     static const tTLVDefn TLVS_P2PProbeReq[ ] = {
@@ -4243,7 +4330,7 @@
     return status;
 } /* End dot11fUnpackIeP2PProbeReq. */
 
-#define SigIeP2PProbeReq ( 0x005d )
+#define SigIeP2PProbeReq ( 0x005f )
 
 
     static const tTLVDefn TLVS_P2PProbeRes[ ] = {
@@ -4264,7 +4351,7 @@
     return status;
 } /* End dot11fUnpackIeP2PProbeRes. */
 
-#define SigIeP2PProbeRes ( 0x005e )
+#define SigIeP2PProbeRes ( 0x0060 )
 
 
     static const tTLVDefn TLVS_P2PProvisionDiscoveryReq[ ] = {
@@ -4283,7 +4370,7 @@
     return status;
 } /* End dot11fUnpackIeP2PProvisionDiscoveryReq. */
 
-#define SigIeP2PProvisionDiscoveryReq ( 0x005f )
+#define SigIeP2PProvisionDiscoveryReq ( 0x0061 )
 
 
     static const tTLVDefn TLVS_P2PWSCProvisionDiscoveryRes[ ] = {
@@ -4300,7 +4387,7 @@
     return status;
 } /* End dot11fUnpackIeP2PWSCProvisionDiscoveryRes. */
 
-#define SigIeP2PWSCProvisionDiscoveryRes ( 0x0060 )
+#define SigIeP2PWSCProvisionDiscoveryRes ( 0x0062 )
 
 
 tANI_U32 dot11fUnpackIePTIControl(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPTIControl *pDst)
@@ -4317,7 +4404,7 @@
     return status;
 } /* End dot11fUnpackIePTIControl. */
 
-#define SigIePTIControl ( 0x0061 )
+#define SigIePTIControl ( 0x0063 )
 
 
 tANI_U32 dot11fUnpackIePUBufferStatus(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPUBufferStatus *pDst)
@@ -4337,7 +4424,7 @@
     return status;
 } /* End dot11fUnpackIePUBufferStatus. */
 
-#define SigIePUBufferStatus ( 0x0062 )
+#define SigIePUBufferStatus ( 0x0064 )
 
 
 tANI_U32 dot11fUnpackIePowerCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPowerCaps *pDst)
@@ -4354,7 +4441,7 @@
     return status;
 } /* End dot11fUnpackIePowerCaps. */
 
-#define SigIePowerCaps ( 0x0063 )
+#define SigIePowerCaps ( 0x0065 )
 
 
 tANI_U32 dot11fUnpackIePowerConstraints(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPowerConstraints *pDst)
@@ -4368,7 +4455,7 @@
     return status;
 } /* End dot11fUnpackIePowerConstraints. */
 
-#define SigIePowerConstraints ( 0x0064 )
+#define SigIePowerConstraints ( 0x0066 )
 
 
 tANI_U32 dot11fUnpackIeQBSSLoad(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQBSSLoad *pDst)
@@ -4388,7 +4475,7 @@
     return status;
 } /* End dot11fUnpackIeQBSSLoad. */
 
-#define SigIeQBSSLoad ( 0x0065 )
+#define SigIeQBSSLoad ( 0x0067 )
 
 
 tANI_U32 dot11fUnpackIeQOSCapsAp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQOSCapsAp *pDst)
@@ -4399,16 +4486,16 @@
     if (pDst->present) status = DOT11F_DUPLICATE_IE;
     pDst->present = 1;
     tmp63__ = *pBuf;
-    pDst->reserved = tmp63__ >> 0 & 0x1;
-    pDst->txopreq = tmp63__ >> 1 & 0x1;
-    pDst->qreq = tmp63__ >> 2 & 0x1;
-    pDst->qack = tmp63__ >> 3 & 0x1;
-    pDst->count = tmp63__ >> 4 & 0xf;
+    pDst->count = tmp63__ >> 0 & 0xf;
+    pDst->qack = tmp63__ >> 4 & 0x1;
+    pDst->qreq = tmp63__ >> 5 & 0x1;
+    pDst->txopreq = tmp63__ >> 6 & 0x1;
+    pDst->reserved = tmp63__ >> 7 & 0x1;
     (void)pCtx;
     return status;
 } /* End dot11fUnpackIeQOSCapsAp. */
 
-#define SigIeQOSCapsAp ( 0x0066 )
+#define SigIeQOSCapsAp ( 0x0068 )
 
 
 tANI_U32 dot11fUnpackIeQOSCapsStation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQOSCapsStation *pDst)
@@ -4419,18 +4506,18 @@
     if (pDst->present) status = DOT11F_DUPLICATE_IE;
     pDst->present = 1;
     tmp64__ = *pBuf;
-    pDst->more_data_ack = tmp64__ >> 0 & 0x1;
-    pDst->max_sp_length = tmp64__ >> 1 & 0x3;
-    pDst->qack = tmp64__ >> 3 & 0x1;
-    pDst->acbe_uapsd = tmp64__ >> 4 & 0x1;
-    pDst->acbk_uapsd = tmp64__ >> 5 & 0x1;
-    pDst->acvi_uapsd = tmp64__ >> 6 & 0x1;
-    pDst->acvo_uapsd = tmp64__ >> 7 & 0x1;
+    pDst->acvo_uapsd = tmp64__ >> 0 & 0x1;
+    pDst->acvi_uapsd = tmp64__ >> 1 & 0x1;
+    pDst->acbk_uapsd = tmp64__ >> 2 & 0x1;
+    pDst->acbe_uapsd = tmp64__ >> 3 & 0x1;
+    pDst->qack = tmp64__ >> 4 & 0x1;
+    pDst->max_sp_length = tmp64__ >> 5 & 0x3;
+    pDst->more_data_ack = tmp64__ >> 7 & 0x1;
     (void)pCtx;
     return status;
 } /* End dot11fUnpackIeQOSCapsStation. */
 
-#define SigIeQOSCapsStation ( 0x0067 )
+#define SigIeQOSCapsStation ( 0x0069 )
 
 
 tANI_U32 dot11fUnpackIeQuiet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQuiet *pDst)
@@ -4453,7 +4540,7 @@
     return status;
 } /* End dot11fUnpackIeQuiet. */
 
-#define SigIeQuiet ( 0x0068 )
+#define SigIeQuiet ( 0x006a )
 
 
 tANI_U32 dot11fUnpackIeRCPIIE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERCPIIE *pDst)
@@ -4467,7 +4554,7 @@
     return status;
 } /* End dot11fUnpackIeRCPIIE. */
 
-#define SigIeRCPIIE ( 0x0069 )
+#define SigIeRCPIIE ( 0x006b )
 
 
     static const tFFDefn FFS_RICDataDesc[ ] = {
@@ -4507,7 +4594,7 @@
     return status;
 } /* End dot11fUnpackIeRICDataDesc. */
 
-#define SigIeRICDataDesc ( 0x006a )
+#define SigIeRICDataDesc ( 0x006c )
 
 
 tANI_U32 dot11fUnpackIeRSN(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERSN *pDst)
@@ -4596,11 +4683,21 @@
     }
 
     DOT11F_MEMCPY(pCtx, pDst->pmkid, pBuf, ( pDst->pmkid_count * 16 ) );
+    pBuf += ( pDst->pmkid_count * 16 );
+    ielen -= ( pDst->pmkid_count * 16 );
+    if ( ! ielen )
+    {
+        return 0U;
+    }
+    else
+    {
+        DOT11F_MEMCPY(pCtx, pDst->gp_mgmt_cipher_suite, pBuf, 4);
+    }
     (void)pCtx;
     return status;
 } /* End dot11fUnpackIeRSN. */
 
-#define SigIeRSN ( 0x006b )
+#define SigIeRSN ( 0x006d )
 
 
 tANI_U32 dot11fUnpackIeRSNIIE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERSNIIE *pDst)
@@ -4614,7 +4711,7 @@
     return status;
 } /* End dot11fUnpackIeRSNIIE. */
 
-#define SigIeRSNIIE ( 0x006c )
+#define SigIeRSNIIE ( 0x006e )
 
 
 tANI_U32 dot11fUnpackIeRSNOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERSNOpaque *pDst)
@@ -4634,7 +4731,7 @@
     return status;
 } /* End dot11fUnpackIeRSNOpaque. */
 
-#define SigIeRSNOpaque ( 0x006d )
+#define SigIeRSNOpaque ( 0x006f )
 
 
 tANI_U32 dot11fUnpackIeSuppChannels(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESuppChannels *pDst)
@@ -4644,7 +4741,7 @@
     if (pDst->present) status = DOT11F_DUPLICATE_IE;
     pDst->present = 1;
     pDst->num_bands = (tANI_U8)( ielen / 2 );
-    if (ielen / 2 > 48){
+    if (ielen > 48 * 2){
         pDst->present = 0;
         return DOT11F_SKIPPED_BAD_IE;
     }
@@ -4654,7 +4751,7 @@
     return status;
 } /* End dot11fUnpackIeSuppChannels. */
 
-#define SigIeSuppChannels ( 0x006e )
+#define SigIeSuppChannels ( 0x0070 )
 
 
 tANI_U32 dot11fUnpackIeSuppRates(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESuppRates *pDst)
@@ -4666,7 +4763,7 @@
     if (pDst->present) status = DOT11F_DUPLICATE_IE;
     pDst->present = 1;
     for (i = 0; i < ielen; i++) {
-        if ((DOT11F_IS_BG_RATE(pBuf[i] & 0x7F)) && 
+        if ((DOT11F_IS_BG_RATE(pBuf[i] & 0x7F)) &&
             (rate_indx < 12)) {
             pDst->rates[rate_indx++] = pBuf[i];
         }
@@ -4682,7 +4779,7 @@
     return status;
 } /* End dot11fUnpackIeSuppRates. */
 
-#define SigIeSuppRates ( 0x006f )
+#define SigIeSuppRates ( 0x0071 )
 
 
 tANI_U32 dot11fUnpackIeTIM(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETIM *pDst)
@@ -4711,7 +4808,7 @@
     return status;
 } /* End dot11fUnpackIeTIM. */
 
-#define SigIeTIM ( 0x0070 )
+#define SigIeTIM ( 0x0072 )
 
 
 tANI_U32 dot11fUnpackIeTPCReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETPCReport *pDst)
@@ -4728,7 +4825,7 @@
     return status;
 } /* End dot11fUnpackIeTPCReport. */
 
-#define SigIeTPCReport ( 0x0071 )
+#define SigIeTPCReport ( 0x0073 )
 
 
 tANI_U32 dot11fUnpackIeTPCRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETPCRequest *pDst)
@@ -4741,7 +4838,7 @@
     return status;
 } /* End dot11fUnpackIeTPCRequest. */
 
-#define SigIeTPCRequest ( 0x0072 )
+#define SigIeTPCRequest ( 0x0074 )
 
 
 tANI_U32 dot11fUnpackIeVHTCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEVHTCaps *pDst)
@@ -4794,7 +4891,7 @@
     return status;
 } /* End dot11fUnpackIeVHTCaps. */
 
-#define SigIeVHTCaps ( 0x0073 )
+#define SigIeVHTCaps ( 0x0075 )
 
 
 tANI_U32 dot11fUnpackIeVHTExtBssLoad(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEVHTExtBssLoad *pDst)
@@ -4820,7 +4917,7 @@
     return status;
 } /* End dot11fUnpackIeVHTExtBssLoad. */
 
-#define SigIeVHTExtBssLoad ( 0x0074 )
+#define SigIeVHTExtBssLoad ( 0x0076 )
 
 
 tANI_U32 dot11fUnpackIeVHTOperation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEVHTOperation *pDst)
@@ -4843,7 +4940,7 @@
     return status;
 } /* End dot11fUnpackIeVHTOperation. */
 
-#define SigIeVHTOperation ( 0x0075 )
+#define SigIeVHTOperation ( 0x0077 )
 
 
 tANI_U32 dot11fUnpackIeWAPI(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWAPI *pDst)
@@ -4912,7 +5009,7 @@
     return status;
 } /* End dot11fUnpackIeWAPI. */
 
-#define SigIeWAPI ( 0x0076 )
+#define SigIeWAPI ( 0x0078 )
 
 
 tANI_U32 dot11fUnpackIeWAPIOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWAPIOpaque *pDst)
@@ -4932,7 +5029,7 @@
     return status;
 } /* End dot11fUnpackIeWAPIOpaque. */
 
-#define SigIeWAPIOpaque ( 0x0077 )
+#define SigIeWAPIOpaque ( 0x0079 )
 
 
 tANI_U32 dot11fUnpackIeWFATPC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWFATPC *pDst)
@@ -4949,7 +5046,7 @@
     return status;
 } /* End dot11fUnpackIeWFATPC. */
 
-#define SigIeWFATPC ( 0x0078 )
+#define SigIeWFATPC ( 0x007a )
 
 
 tANI_U32 dot11fUnpackIeWFDIEOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWFDIEOpaque *pDst)
@@ -4969,7 +5066,7 @@
     return status;
 } /* End dot11fUnpackIeWFDIEOpaque. */
 
-#define SigIeWFDIEOpaque ( 0x0079 )
+#define SigIeWFDIEOpaque ( 0x007b )
 
 
 tANI_U32 dot11fUnpackIeWMMCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMCaps *pDst)
@@ -4997,7 +5094,7 @@
     return status;
 } /* End dot11fUnpackIeWMMCaps. */
 
-#define SigIeWMMCaps ( 0x007a )
+#define SigIeWMMCaps ( 0x007c )
 
 
 tANI_U32 dot11fUnpackIeWMMInfoAp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMInfoAp *pDst)
@@ -5018,7 +5115,7 @@
     return status;
 } /* End dot11fUnpackIeWMMInfoAp. */
 
-#define SigIeWMMInfoAp ( 0x007b )
+#define SigIeWMMInfoAp ( 0x007d )
 
 
 tANI_U32 dot11fUnpackIeWMMInfoStation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMInfoStation *pDst)
@@ -5043,7 +5140,7 @@
     return status;
 } /* End dot11fUnpackIeWMMInfoStation. */
 
-#define SigIeWMMInfoStation ( 0x007c )
+#define SigIeWMMInfoStation ( 0x007e )
 
 
 tANI_U32 dot11fUnpackIeWMMParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMParams *pDst)
@@ -5136,7 +5233,7 @@
     return status;
 } /* End dot11fUnpackIeWMMParams. */
 
-#define SigIeWMMParams ( 0x007d )
+#define SigIeWMMParams ( 0x007f )
 
 
 tANI_U32 dot11fUnpackIeWPA(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWPA *pDst)
@@ -5218,7 +5315,7 @@
     return status;
 } /* End dot11fUnpackIeWPA. */
 
-#define SigIeWPA ( 0x007e )
+#define SigIeWPA ( 0x0080 )
 
 
 tANI_U32 dot11fUnpackIeWPAOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWPAOpaque *pDst)
@@ -5238,7 +5335,7 @@
     return status;
 } /* End dot11fUnpackIeWPAOpaque. */
 
-#define SigIeWPAOpaque ( 0x007f )
+#define SigIeWPAOpaque ( 0x0081 )
 
 
     static const tTLVDefn TLVS_WSC[ ] = {
@@ -5276,7 +5373,7 @@
     return status;
 } /* End dot11fUnpackIeWSC. */
 
-#define SigIeWSC ( 0x0080 )
+#define SigIeWSC ( 0x0082 )
 
 
 tANI_U32 dot11fUnpackIeWiderBWChanSwitchAnn(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWiderBWChanSwitchAnn *pDst)
@@ -5296,7 +5393,7 @@
     return status;
 } /* End dot11fUnpackIeWiderBWChanSwitchAnn. */
 
-#define SigIeWiderBWChanSwitchAnn ( 0x0081 )
+#define SigIeWiderBWChanSwitchAnn ( 0x0083 )
 
 
     static const tTLVDefn TLVS_WscAssocReq[ ] = {
@@ -5315,7 +5412,7 @@
     return status;
 } /* End dot11fUnpackIeWscAssocReq. */
 
-#define SigIeWscAssocReq ( 0x0082 )
+#define SigIeWscAssocReq ( 0x0084 )
 
 
     static const tTLVDefn TLVS_WscAssocRes[ ] = {
@@ -5334,7 +5431,7 @@
     return status;
 } /* End dot11fUnpackIeWscAssocRes. */
 
-#define SigIeWscAssocRes ( 0x0083 )
+#define SigIeWscAssocRes ( 0x0085 )
 
 
     static const tTLVDefn TLVS_WscBeacon[ ] = {
@@ -5359,7 +5456,7 @@
     return status;
 } /* End dot11fUnpackIeWscBeacon. */
 
-#define SigIeWscBeacon ( 0x0084 )
+#define SigIeWscBeacon ( 0x0086 )
 
 
     static const tTLVDefn TLVS_WscBeaconProbeRes[ ] = {
@@ -5392,7 +5489,7 @@
     return status;
 } /* End dot11fUnpackIeWscBeaconProbeRes. */
 
-#define SigIeWscBeaconProbeRes ( 0x0085 )
+#define SigIeWscBeaconProbeRes ( 0x0087 )
 
 
 tANI_U32 dot11fUnpackIeWscIEOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWscIEOpaque *pDst)
@@ -5412,7 +5509,7 @@
     return status;
 } /* End dot11fUnpackIeWscIEOpaque. */
 
-#define SigIeWscIEOpaque ( 0x0086 )
+#define SigIeWscIEOpaque ( 0x0088 )
 
 
     static const tTLVDefn TLVS_WscProbeReq[ ] = {
@@ -5443,7 +5540,7 @@
     return status;
 } /* End dot11fUnpackIeWscProbeReq. */
 
-#define SigIeWscProbeReq ( 0x0087 )
+#define SigIeWscProbeReq ( 0x0089 )
 
 
     static const tTLVDefn TLVS_WscProbeRes[ ] = {
@@ -5476,7 +5573,7 @@
     return status;
 } /* End dot11fUnpackIeWscProbeRes. */
 
-#define SigIeWscProbeRes ( 0x0088 )
+#define SigIeWscProbeRes ( 0x008a )
 
 
     static const tTLVDefn TLVS_WscReassocRes[ ] = {
@@ -5495,7 +5592,7 @@
     return status;
 } /* End dot11fUnpackIeWscReassocRes. */
 
-#define SigIeWscReassocRes ( 0x0089 )
+#define SigIeWscReassocRes ( 0x008b )
 
 
     static const tFFDefn FFS_AddBAReq[] = {
@@ -6255,13 +6352,13 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acvo_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvo_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("RRMEnabledCap:\n"));
         if (!pFrm->RRMEnabledCap.present)
@@ -6806,7 +6903,7 @@
         {offsetof(tDot11fAssocResponse, RSNIIE), offsetof(tDot11fIERSNIIE, present), 0, "RSNIIE" , 0, 3, 3, SigIeRSNIIE, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNIIE, 0, },
         {offsetof(tDot11fAssocResponse, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
         {offsetof(tDot11fAssocResponse, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fAssocResponse, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 187, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
+        {offsetof(tDot11fAssocResponse, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
         {offsetof(tDot11fAssocResponse, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fAssocResponse, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, },
         {offsetof(tDot11fAssocResponse, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, },
         {offsetof(tDot11fAssocResponse, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
@@ -7029,6 +7126,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         for (i = 0; i < pFrm->num_RICDataDesc; ++i)
         {
@@ -7946,7 +8055,7 @@
         {offsetof(tDot11fAuthentication, ChallengeText), offsetof(tDot11fIEChallengeText, present), 0, "ChallengeText" , 0, 3, 255, SigIeChallengeText, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHALLENGETEXT, 0, },
         {offsetof(tDot11fAuthentication, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
         {offsetof(tDot11fAuthentication, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fAuthentication, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 187, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
+        {offsetof(tDot11fAuthentication, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
         {offsetof(tDot11fAuthentication, FTTimeoutInterval), offsetof(tDot11fIEFTTimeoutInterval, present), 0, "FTTimeoutInterval" , 0, 7, 7, SigIeFTTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTTIMEOUTINTERVAL, 0, },
         {offsetof(tDot11fAuthentication, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fAuthentication, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
@@ -8047,6 +8156,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -8356,7 +8477,7 @@
         {offsetof(tDot11fBeacon, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, },
         {offsetof(tDot11fBeacon, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, },
         {offsetof(tDot11fBeacon, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fBeacon, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 112, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
+        {offsetof(tDot11fBeacon, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
         {offsetof(tDot11fBeacon, QBSSLoad), offsetof(tDot11fIEQBSSLoad, present), 0, "QBSSLoad" , 0, 7, 7, SigIeQBSSLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QBSSLOAD, 0, },
         {offsetof(tDot11fBeacon, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
         {offsetof(tDot11fBeacon, QOSCapsAp), offsetof(tDot11fIEQOSCapsAp, present), 0, "QOSCapsAp" , 0, 3, 3, SigIeQOSCapsAp, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSAP, 0, },
@@ -8383,6 +8504,7 @@
         {offsetof(tDot11fBeacon, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 10, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
         {offsetof(tDot11fBeacon, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
         {offsetof(tDot11fBeacon, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, },
+        {offsetof(tDot11fBeacon, OxygenNetwork), offsetof(tDot11fIEOxygenNetwork, present), 0, "OxygenNetwork" , 0, 7, 7, SigIeOxygenNetwork, {0, 22, 50, 0, 0}, 3, DOT11F_EID_OXYGENNETWORK, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackBeacon(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fBeacon *pFrm)
@@ -8609,6 +8731,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("QBSSLoad:\n"));
         if (!pFrm->QBSSLoad.present)
@@ -8666,11 +8789,11 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("reserved (1): %d\n"), pFrm->QOSCapsAp.reserved);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("txopreq (1): %d\n"), pFrm->QOSCapsAp.txopreq);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("qreq (1): %d\n"), pFrm->QOSCapsAp.qreq);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("qack (1): %d\n"), pFrm->QOSCapsAp.qack);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("count (4): %d\n"), pFrm->QOSCapsAp.count);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("qack (1): %d\n"), pFrm->QOSCapsAp.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("qreq (1): %d\n"), pFrm->QOSCapsAp.qreq);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("txopreq (1): %d\n"), pFrm->QOSCapsAp.txopreq);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("reserved (1): %d\n"), pFrm->QOSCapsAp.reserved);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("APChannelReport:\n"));
         if (!pFrm->APChannelReport.present)
@@ -9466,6 +9589,15 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("OxygenNetwork:\n"));
+        if (!pFrm->OxygenNetwork.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->OxygenNetwork.data, 2);
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -9576,7 +9708,7 @@
         {offsetof(tDot11fBeacon2, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, },
         {offsetof(tDot11fBeacon2, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, },
         {offsetof(tDot11fBeacon2, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fBeacon2, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 112, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
+        {offsetof(tDot11fBeacon2, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
         {offsetof(tDot11fBeacon2, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
         {offsetof(tDot11fBeacon2, APChannelReport), offsetof(tDot11fIEAPChannelReport, present), 0, "APChannelReport" , 0, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, },
         {offsetof(tDot11fBeacon2, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
@@ -9601,6 +9733,7 @@
         {offsetof(tDot11fBeacon2, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 10, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
         {offsetof(tDot11fBeacon2, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
         {offsetof(tDot11fBeacon2, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, },
+        {offsetof(tDot11fBeacon2, OxygenNetwork), offsetof(tDot11fIEOxygenNetwork, present), 0, "OxygenNetwork" , 0, 7, 7, SigIeOxygenNetwork, {0, 22, 50, 0, 0}, 3, DOT11F_EID_OXYGENNETWORK, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackBeacon2(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fBeacon2 *pFrm)
@@ -9691,22 +9824,15 @@
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("num_rates: %d.\n"), pFrm->ExtSuppRates.num_rates);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->ExtSuppRates.rates, pFrm->ExtSuppRates.num_rates);
         }
-        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("RSN:\n"));
-        if (!pFrm->RSN.present)
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("RSNOpaque:\n"));
+        if (!pFrm->RSNOpaque.present)
         {
             FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.version, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.gp_cipher_suite, 4);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.pwise_cipher_suite_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->RSN.pwise_cipher_suites, 4 * pFrm->RSN.pwise_cipher_suite_count);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.akm_suite_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->RSN.akm_suites, 4 * pFrm->RSN.akm_suite_count);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("num_data: %d.\n"), pFrm->RSNOpaque.num_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->RSNOpaque.data, pFrm->RSNOpaque.num_data);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("EDCAParamSet:\n"));
         if (!pFrm->EDCAParamSet.present)
@@ -10540,6 +10666,15 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("OxygenNetwork:\n"));
+        if (!pFrm->OxygenNetwork.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->OxygenNetwork.data, 2);
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -10567,7 +10702,7 @@
         {offsetof(tDot11fBeaconIEs, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, },
         {offsetof(tDot11fBeaconIEs, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, },
         {offsetof(tDot11fBeaconIEs, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fBeaconIEs, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 112, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
+        {offsetof(tDot11fBeaconIEs, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
         {offsetof(tDot11fBeaconIEs, QBSSLoad), offsetof(tDot11fIEQBSSLoad, present), 0, "QBSSLoad" , 0, 7, 7, SigIeQBSSLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QBSSLOAD, 0, },
         {offsetof(tDot11fBeaconIEs, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
         {offsetof(tDot11fBeaconIEs, QOSCapsAp), offsetof(tDot11fIEQOSCapsAp, present), 0, "QOSCapsAp" , 0, 3, 3, SigIeQOSCapsAp, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSAP, 0, },
@@ -10595,6 +10730,7 @@
         {offsetof(tDot11fBeaconIEs, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 10, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
         {offsetof(tDot11fBeaconIEs, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
         {offsetof(tDot11fBeaconIEs, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, },
+        {offsetof(tDot11fBeaconIEs, OxygenNetwork), offsetof(tDot11fIEOxygenNetwork, present), 0, "OxygenNetwork" , 0, 7, 7, SigIeOxygenNetwork, {0, 22, 50, 0, 0}, 3, DOT11F_EID_OXYGENNETWORK, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackBeaconIEs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fBeaconIEs *pFrm)
@@ -10800,6 +10936,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("QBSSLoad:\n"));
         if (!pFrm->QBSSLoad.present)
@@ -10857,11 +10994,11 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("reserved (1): %d\n"), pFrm->QOSCapsAp.reserved);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("txopreq (1): %d\n"), pFrm->QOSCapsAp.txopreq);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("qreq (1): %d\n"), pFrm->QOSCapsAp.qreq);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("qack (1): %d\n"), pFrm->QOSCapsAp.qack);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("count (4): %d\n"), pFrm->QOSCapsAp.count);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("qack (1): %d\n"), pFrm->QOSCapsAp.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("qreq (1): %d\n"), pFrm->QOSCapsAp.qreq);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("txopreq (1): %d\n"), pFrm->QOSCapsAp.txopreq);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("reserved (1): %d\n"), pFrm->QOSCapsAp.reserved);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("APChannelReport:\n"));
         if (!pFrm->APChannelReport.present)
@@ -11786,6 +11923,15 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("OxygenNetwork:\n"));
+        if (!pFrm->OxygenNetwork.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->OxygenNetwork.data, 2);
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -14035,7 +14181,7 @@
         {offsetof(tDot11fProbeResponse, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, },
         {offsetof(tDot11fProbeResponse, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, },
         {offsetof(tDot11fProbeResponse, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fProbeResponse, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 112, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
+        {offsetof(tDot11fProbeResponse, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
         {offsetof(tDot11fProbeResponse, QBSSLoad), offsetof(tDot11fIEQBSSLoad, present), 0, "QBSSLoad" , 0, 7, 7, SigIeQBSSLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QBSSLOAD, 0, },
         {offsetof(tDot11fProbeResponse, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
         {offsetof(tDot11fProbeResponse, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
@@ -14059,6 +14205,7 @@
         {offsetof(tDot11fProbeResponse, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
         {offsetof(tDot11fProbeResponse, VHTExtBssLoad), offsetof(tDot11fIEVHTExtBssLoad, present), 0, "VHTExtBssLoad" , 0, 7, 7, SigIeVHTExtBssLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTEXTBSSLOAD, 0, },
         {offsetof(tDot11fProbeResponse, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 10, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
+        {offsetof(tDot11fProbeResponse, OxygenNetwork), offsetof(tDot11fIEOxygenNetwork, present), 0, "OxygenNetwork" , 0, 7, 7, SigIeOxygenNetwork, {0, 22, 50, 0, 0}, 3, DOT11F_EID_OXYGENNETWORK, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackProbeResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fProbeResponse *pFrm)
@@ -14256,22 +14403,15 @@
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("num_rates: %d.\n"), pFrm->ExtSuppRates.num_rates);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->ExtSuppRates.rates, pFrm->ExtSuppRates.num_rates);
         }
-        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("RSN:\n"));
-        if (!pFrm->RSN.present)
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("RSNOpaque:\n"));
+        if (!pFrm->RSNOpaque.present)
         {
             FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.version, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.gp_cipher_suite, 4);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.pwise_cipher_suite_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->RSN.pwise_cipher_suites, 4 * pFrm->RSN.pwise_cipher_suite_count);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.akm_suite_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->RSN.akm_suites, 4 * pFrm->RSN.akm_suite_count);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("num_data: %d.\n"), pFrm->RSNOpaque.num_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->RSNOpaque.data, pFrm->RSNOpaque.num_data);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("QBSSLoad:\n"));
         if (!pFrm->QBSSLoad.present)
@@ -15204,6 +15344,15 @@
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("operModeNotification (1): %d\n"), pFrm->ExtCap.operModeNotification);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("reserved7 (1): %d\n"), pFrm->ExtCap.reserved7);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("OxygenNetwork:\n"));
+        if (!pFrm->OxygenNetwork.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->OxygenNetwork.data, 2);
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -15361,6 +15510,53 @@
 
 } /* End dot11fUnpackProvisionDiscoveryRes. */
 
+    static const tFFDefn FFS_RMC[] = {
+        { "Category", offsetof(tDot11fRMC, Category), SigFfCategory , DOT11F_FF_CATEGORY_LEN, },
+        { "RMCOUI", offsetof(tDot11fRMC, RMCOUI), SigFfRMCOUI , DOT11F_FF_RMCOUI_LEN, },
+        { "MagicCode", offsetof(tDot11fRMC, MagicCode), SigFfMagicCode , DOT11F_FF_MAGICCODE_LEN, },
+        { "RMCVersion", offsetof(tDot11fRMC, RMCVersion), SigFfRMCVersion , DOT11F_FF_RMCVERSION_LEN, },
+        { "Action", offsetof(tDot11fRMC, Action), SigFfAction , DOT11F_FF_ACTION_LEN, },
+        { "RMCDialogToken", offsetof(tDot11fRMC, RMCDialogToken), SigFfRMCDialogToken , DOT11F_FF_RMCDIALOGTOKEN_LEN, },
+        { "Leader", offsetof(tDot11fRMC, Leader), SigFfLeader , DOT11F_FF_LEADER_LEN, },
+    { NULL, 0, 0, 0,},
+    };
+
+    static const tIEDefn IES_RMC[] = {
+    {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
+
+tANI_U32 dot11fUnpackRMC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fRMC *pFrm)
+{
+    tANI_U32 i = 0;
+    tANI_U32 status = 0;
+    status = UnpackCore(pCtx, pBuf, nBuf, FFS_RMC, IES_RMC, ( tANI_U8* )pFrm, sizeof(*pFrm));
+
+    (void)i;
+#   ifdef DOT11F_DUMP_FRAMES
+    if (!DOT11F_FAILED(status))
+    {
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Unpacked the RMC:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), pBuf, nBuf);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("to:\n"));
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Category:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Category.category, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCOUI:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCOUI.oui, 3);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("MagicCode:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->MagicCode.magic, 6);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCVersion:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCVersion.version, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Action:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Action.action, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCDialogToken:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCDialogToken.token, 4);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Leader:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Leader.mac, 6);
+    }
+#   endif // DOT11F_DUMP_FRAMES
+    return status;
+
+} /* End dot11fUnpackRMC. */
+
     static const tFFDefn FFS_RadioMeasurementReport[] = {
         { "Category", offsetof(tDot11fRadioMeasurementReport, Category), SigFfCategory , DOT11F_FF_CATEGORY_LEN, },
         { "Action", offsetof(tDot11fRadioMeasurementReport, Action), SigFfAction , DOT11F_FF_ACTION_LEN, },
@@ -15561,7 +15757,7 @@
         {offsetof(tDot11fReAssocRequest, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, },
         {offsetof(tDot11fReAssocRequest, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
         {offsetof(tDot11fReAssocRequest, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fReAssocRequest, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 187, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
+        {offsetof(tDot11fReAssocRequest, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
         {offsetof(tDot11fReAssocRequest, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fReAssocRequest, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, },
         {offsetof(tDot11fReAssocRequest, WPAOpaque), offsetof(tDot11fIEWPAOpaque, present), 0, "WPAOpaque" , 0, 8, 255, SigIeWPAOpaque, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPAOPAQUE, 0, },
         {offsetof(tDot11fReAssocRequest, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
@@ -15683,13 +15879,13 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acvo_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvo_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("RRMEnabledCap:\n"));
         if (!pFrm->RRMEnabledCap.present)
@@ -15785,6 +15981,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         for (i = 0; i < pFrm->num_RICDataDesc; ++i)
         {
@@ -16608,7 +16816,7 @@
         {offsetof(tDot11fReAssocResponse, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
         {offsetof(tDot11fReAssocResponse, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
         {offsetof(tDot11fReAssocResponse, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fReAssocResponse, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 187, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
+        {offsetof(tDot11fReAssocResponse, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
         {offsetof(tDot11fReAssocResponse, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fReAssocResponse, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, },
         {offsetof(tDot11fReAssocResponse, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, },
         {offsetof(tDot11fReAssocResponse, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
@@ -16841,6 +17049,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         for (i = 0; i < pFrm->num_RICDataDesc; ++i)
         {
@@ -17875,9 +18095,9 @@
         {offsetof(tDot11fTDLSDisRsp, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
         {offsetof(tDot11fTDLSDisRsp, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
         {offsetof(tDot11fTDLSDisRsp, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, },
-        {offsetof(tDot11fTDLSDisRsp, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 112, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
+        {offsetof(tDot11fTDLSDisRsp, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
         {offsetof(tDot11fTDLSDisRsp, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 10, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fTDLSDisRsp, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 187, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
+        {offsetof(tDot11fTDLSDisRsp, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
         {offsetof(tDot11fTDLSDisRsp, FTTimeoutInterval), offsetof(tDot11fIEFTTimeoutInterval, present), 0, "FTTimeoutInterval" , 0, 7, 7, SigIeFTTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTTIMEOUTINTERVAL, 0, },
         {offsetof(tDot11fTDLSDisRsp, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, },
         {offsetof(tDot11fTDLSDisRsp, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
@@ -17967,6 +18187,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("ExtCap:\n"));
         if (!pFrm->ExtCap.present)
@@ -18072,6 +18293,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -18330,14 +18563,15 @@
     };
 
     static const tIEDefn IES_TDLSSetupCnf[] = {
-        {offsetof(tDot11fTDLSSetupCnf, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 112, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
         {offsetof(tDot11fTDLSSetupCnf, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
-        {offsetof(tDot11fTDLSSetupCnf, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 187, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
         {offsetof(tDot11fTDLSSetupCnf, FTTimeoutInterval), offsetof(tDot11fIEFTTimeoutInterval, present), 0, "FTTimeoutInterval" , 0, 7, 7, SigIeFTTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTTIMEOUTINTERVAL, 0, },
         {offsetof(tDot11fTDLSSetupCnf, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, },
         {offsetof(tDot11fTDLSSetupCnf, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, },
         {offsetof(tDot11fTDLSSetupCnf, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, },
         {offsetof(tDot11fTDLSSetupCnf, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSSetupCnf(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSSetupCnf *pFrm)
@@ -18377,6 +18611,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("EDCAParamSet:\n"));
         if (!pFrm->EDCAParamSet.present)
@@ -18461,6 +18696,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -18540,6 +18787,18 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->VHTOperation.chanCenterFreqSeg2, 1);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->VHTOperation.basicMCSSet, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("OperatingMode:\n"));
+        if (!pFrm->OperatingMode.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("chanWidth (2): %d\n"), pFrm->OperatingMode.chanWidth);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("reserved (2): %d\n"), pFrm->OperatingMode.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("rxNSS (3): %d\n"), pFrm->OperatingMode.rxNSS);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("rxNSSType (1): %d\n"), pFrm->OperatingMode.rxNSSType);
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -18559,10 +18818,10 @@
         {offsetof(tDot11fTDLSSetupReq, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, },
         {offsetof(tDot11fTDLSSetupReq, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
         {offsetof(tDot11fTDLSSetupReq, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, },
-        {offsetof(tDot11fTDLSSetupReq, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 112, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
+        {offsetof(tDot11fTDLSSetupReq, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
         {offsetof(tDot11fTDLSSetupReq, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 10, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
         {offsetof(tDot11fTDLSSetupReq, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, },
-        {offsetof(tDot11fTDLSSetupReq, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 187, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
+        {offsetof(tDot11fTDLSSetupReq, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
         {offsetof(tDot11fTDLSSetupReq, FTTimeoutInterval), offsetof(tDot11fIEFTTimeoutInterval, present), 0, "FTTimeoutInterval" , 0, 7, 7, SigIeFTTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTTIMEOUTINTERVAL, 0, },
         {offsetof(tDot11fTDLSSetupReq, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, },
         {offsetof(tDot11fTDLSSetupReq, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
@@ -18665,6 +18924,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("ExtCap:\n"));
         if (!pFrm->ExtCap.present)
@@ -18732,13 +18992,13 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acvo_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvo_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("FTInfo:\n"));
         if (!pFrm->FTInfo.present)
@@ -18785,6 +19045,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -18954,10 +19226,10 @@
         {offsetof(tDot11fTDLSSetupRsp, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, },
         {offsetof(tDot11fTDLSSetupRsp, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
         {offsetof(tDot11fTDLSSetupRsp, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 112, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
         {offsetof(tDot11fTDLSSetupRsp, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 10, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
         {offsetof(tDot11fTDLSSetupRsp, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 187, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
         {offsetof(tDot11fTDLSSetupRsp, FTTimeoutInterval), offsetof(tDot11fIEFTTimeoutInterval, present), 0, "FTTimeoutInterval" , 0, 7, 7, SigIeFTTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTTIMEOUTINTERVAL, 0, },
         {offsetof(tDot11fTDLSSetupRsp, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, },
         {offsetof(tDot11fTDLSSetupRsp, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
@@ -18965,6 +19237,7 @@
         {offsetof(tDot11fTDLSSetupRsp, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, },
         {offsetof(tDot11fTDLSSetupRsp, AID), offsetof(tDot11fIEAID, present), 0, "AID" , 0, 4, 4, SigIeAID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_AID, 0, },
         {offsetof(tDot11fTDLSSetupRsp, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSSetupRsp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSSetupRsp *pFrm)
@@ -19062,6 +19335,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("ExtCap:\n"));
         if (!pFrm->ExtCap.present)
@@ -19129,13 +19403,13 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acvo_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvo_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("FTInfo:\n"));
         if (!pFrm->FTInfo.present)
@@ -19182,6 +19456,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -19331,6 +19617,18 @@
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("txSupDataRate (13): %d\n"), pFrm->VHTCaps.txSupDataRate);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("reserved3 (3): %d\n"), pFrm->VHTCaps.reserved3);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("OperatingMode:\n"));
+        if (!pFrm->OperatingMode.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("chanWidth (2): %d\n"), pFrm->OperatingMode.chanWidth);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("reserved (2): %d\n"), pFrm->OperatingMode.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("rxNSS (3): %d\n"), pFrm->OperatingMode.rxNSS);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("rxNSSType (1): %d\n"), pFrm->OperatingMode.rxNSSType);
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -19345,7 +19643,7 @@
     };
 
     static const tIEDefn IES_TDLSTeardown[] = {
-        {offsetof(tDot11fTDLSTeardown, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 187, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
+        {offsetof(tDot11fTDLSTeardown, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
         {offsetof(tDot11fTDLSTeardown, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
@@ -19413,6 +19711,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), FRFL("LinkIdentifier:\n"));
         if (!pFrm->LinkIdentifier.present)
@@ -19832,7 +20142,7 @@
     pIe = &IEs[0];
     while (0xff != pIe->eid)
     {
-        pfFound = (tFRAMES_BOOL*)(pFrm + pIe->offset + 
+        pfFound = (tFRAMES_BOOL*)(pFrm + pIe->offset +
                                   pIe->presenceOffset);
         *pfFound = 0U;
         if (pIe->countOffset)
@@ -19897,12 +20207,18 @@
         case SigFfDialogToken:
             dot11fUnpackFfDialogToken(pCtx, pBufRemaining, ( tDot11fFfDialogToken* )(pFrm + pFf->offset ));
             break;
+        case SigFfLeader:
+            dot11fUnpackFfLeader(pCtx, pBufRemaining, ( tDot11fFfLeader* )(pFrm + pFf->offset ));
+            break;
         case SigFfLinkMargin:
             dot11fUnpackFfLinkMargin(pCtx, pBufRemaining, ( tDot11fFfLinkMargin* )(pFrm + pFf->offset ));
             break;
         case SigFfListenInterval:
             dot11fUnpackFfCommonFunc(pCtx, pBufRemaining, (tANI_U16*)&((( tDot11fFfListenInterval* )(pFrm + pFf->offset ))->interval));
             break;
+        case SigFfMagicCode:
+            dot11fUnpackFfMagicCode(pCtx, pBufRemaining, ( tDot11fFfMagicCode* )(pFrm + pFf->offset ));
+            break;
         case SigFfMaxTxPower:
             dot11fUnpackFfMaxTxPower(pCtx, pBufRemaining, ( tDot11fFfMaxTxPower* )(pFrm + pFf->offset ));
             break;
@@ -19921,6 +20237,15 @@
         case SigFfRCPI:
             dot11fUnpackFfRCPI(pCtx, pBufRemaining, ( tDot11fFfRCPI* )(pFrm + pFf->offset ));
             break;
+        case SigFfRMCDialogToken:
+            dot11fUnpackFfRMCDialogToken(pCtx, pBufRemaining, ( tDot11fFfRMCDialogToken* )(pFrm + pFf->offset ));
+            break;
+        case SigFfRMCOUI:
+            dot11fUnpackFfRMCOUI(pCtx, pBufRemaining, ( tDot11fFfRMCOUI* )(pFrm + pFf->offset ));
+            break;
+        case SigFfRMCVersion:
+            dot11fUnpackFfRMCVersion(pCtx, pBufRemaining, ( tDot11fFfRMCVersion* )(pFrm + pFf->offset ));
+            break;
         case SigFfRSNI:
             dot11fUnpackFfRSNI(pCtx, pBufRemaining, ( tDot11fFfRSNI* )(pFrm + pFf->offset ));
             break;
@@ -20070,6 +20395,9 @@
                                                 (tANI_U8*) &(((  tDot11fIEHCF* )(pFrm + pIe->offset + sizeof( tDot11fIEHCF)*countOffset ) )->present),
                                                 (tANI_U8*) &((( tDot11fIEHCF* )(pFrm + pIe->offset + sizeof(tDot11fIEHCF)*countOffset ) )->enabled) );
                             break;
+                case SigIeIGTK:
+                        status |= dot11fUnpackIeIGTK(pCtx, pBufRemaining, len, ( tDot11fIEIGTK* )(pFrm + pIe->offset + sizeof(tDot11fIEIGTK)*countOffset) );
+                            break;
                 case SigIeLLAttr:
                         status |= dot11fUnpackIeLLAttr(pCtx, pBufRemaining, len, ( tDot11fIELLAttr* )(pFrm + pIe->offset + sizeof(tDot11fIELLAttr)*countOffset) );
                             break;
@@ -20290,6 +20618,9 @@
                 case SigIeOperatingMode:
                         status |= dot11fUnpackIeOperatingMode(pCtx, pBufRemaining, len, ( tDot11fIEOperatingMode* )(pFrm + pIe->offset + sizeof(tDot11fIEOperatingMode)*countOffset) );
                             break;
+                case SigIeOxygenNetwork:
+                        status |= dot11fUnpackIeOxygenNetwork(pCtx, pBufRemaining, len, ( tDot11fIEOxygenNetwork* )(pFrm + pIe->offset + sizeof(tDot11fIEOxygenNetwork)*countOffset) );
+                            break;
                 case SigIeP2PAssocReq:
                         status |= dot11fUnpackIeP2PAssocReq(pCtx, pBufRemaining, len, ( tDot11fIEP2PAssocReq* )(pFrm + pIe->offset + sizeof(tDot11fIEP2PAssocReq)*countOffset) );
                             break;
@@ -20383,12 +20714,12 @@
                 case SigIeRICDataDesc:
                         //reset the pointers back since this is a container IE and it doesnt have its own EID and Len.
                         pBufRemaining -= 2; nBufRemaining += 2;
-                        if ( pIe && pIe->noui ) 
-                            { 
+                        if ( pIe && pIe->noui )
+                            {
                                 pBufRemaining -= pIe->noui;
                                 nBufRemaining += pIe->noui;
                                 len += pIe->noui;
-                            } 
+                            }
                         status |= GetContainerIesLen(pCtx, pBufRemaining, nBufRemaining, &len, IES_RICDataDesc);
                         if (status != DOT11F_PARSE_SUCCESS && status != DOT11F_UNKNOWN_IES ) break;
                         status |= dot11fUnpackIeRICDataDesc(pCtx, pBufRemaining, len, ( tDot11fIERICDataDesc* )(pFrm + pIe->offset + sizeof(tDot11fIERICDataDesc)*countOffset) );
@@ -20530,7 +20861,7 @@
     {
         if (pIe->fMandatory)
         {
-            pfFound = (tFRAMES_BOOL*)(pFrm + pIe->offset + 
+            pfFound = (tFRAMES_BOOL*)(pFrm + pIe->offset +
                                       pIe->presenceOffset);
             if (!*pfFound)
             {
@@ -20583,8 +20914,8 @@
         // Look for a matching TLV definition,
         pTlv = FindTLVDefn( pCtx, pBufRemaining, nBufRemaining, TLVs );
         // consume the type,
-        if ( pTlv ) 
-        { 
+        if ( pTlv )
+        {
            if ( pTlv->sType == 2)
            {
               framesntohs(pCtx, &id, pBufRemaining, pTlv->fMsb);
@@ -20600,12 +20931,12 @@
            if ( pTlv->sLen == 2)
            {
               framesntohs(pCtx, &len, pBufRemaining, pTlv->fMsb);
-              if ( 2 > nBufRemaining ) 
+              if ( 2 > nBufRemaining )
               {
                   FRAMES_LOG0( pCtx, FRLOGE, FRFL("This frame reports "
                                                   "fewer two byte(s) remaining.\n") );
-                  status |= DOT11F_INCOMPLETE_TLV; 
-                  FRAMES_DBG_BREAK(); 
+                  status |= DOT11F_INCOMPLETE_TLV;
+                  FRAMES_DBG_BREAK();
                   goto MandatoryCheck;
               }
               pBufRemaining += 2;
@@ -20617,8 +20948,8 @@
               nBufRemaining -= 1;
            }
         }
-        else 
-        { 
+        else
+        {
            pBufRemaining += TLVs[0].sType;
            nBufRemaining -= TLVs[0].sType;
            framesntohs(pCtx, &len, pBufRemaining, (TLVs[0].sType == 2));
@@ -20632,7 +20963,7 @@
            }
            pBufRemaining += 2;
            nBufRemaining -= 2;
-        } 
+        }
 
         if ( pTlv && pTlv->pec )
         {
@@ -20674,6 +21005,17 @@
         // Now, *if* we found a hit...
         if ( pTlv )
         {
+            if ( len < pTlv->minSize - npec )
+            {
+                FRAMES_LOG3( pCtx, FRLOGW, FRFL("The IE %s must be "
+                    "at least %d bytes in size, but the size is only "
+                    "%d bytes.\n"),
+                     pTlv->name, pTlv->minSize, len );
+                FRAMES_DUMP( pCtx, FRLOG1, pBuf, nBuf );
+                status |= DOT11F_INCOMPLETE_TLV;
+                FRAMES_DBG_BREAK( );
+                goto MandatoryCheck;
+            }
             if ( nBufRemaining < pTlv->minSize - npec - (pTlv->sType + pTlv->sLen) )
             {
                 FRAMES_LOG3( pCtx, FRLOGW, FRFL("The IE %s must be "
@@ -21436,6 +21778,11 @@
         }
         else break;
         *pnNeeded += ( pIe->pmkid_count * 16 );
+        if ( pIe->gp_mgmt_cipher_suite )
+        {
+            *pnNeeded += 4;
+        }
+        else break;
         break;
     }
     return status;
@@ -21899,6 +22246,14 @@
     return status;
 } /* End dot11fGetPackedProvisionDiscoveryResSize. */
 
+tANI_U32 dot11fGetPackedRMCSize(tpAniSirGlobal pCtx, tDot11fRMC *pFrm, tANI_U32 *pnNeeded)
+{
+    tANI_U32 status = 0;
+    *pnNeeded = 22;
+    status = GetPackedSizeCore(pCtx, ( tANI_U8* )pFrm, pnNeeded, IES_RMC);
+    return status;
+} /* End dot11fGetPackedRMCSize. */
+
 tANI_U32 dot11fGetPackedRadioMeasurementReportSize(tpAniSirGlobal pCtx, tDot11fRadioMeasurementReport *pFrm, tANI_U32 *pnNeeded)
 {
     tANI_U32 status = 0;
@@ -22072,7 +22427,7 @@
     tANI_U32 byteCount = 0;
     tANI_U8  pIePresent = 0;
     tANI_U32 offset = 0;
-    
+
     status = DOT11F_PARSE_SUCCESS;
 
     (void)pCtx; /* Shutup the compiler if we have no FFs nor IEs... */
@@ -22116,6 +22471,11 @@
                             byteCount = 1;
                             pIePresent = ( (tDot11fIEHCF* )(pFrm + pIe->offset + offset * i  ))->present;
                             break;
+                case SigIeIGTK:
+                            offset = sizeof(tDot11fIEIGTK);
+                            byteCount = 33;
+                            pIePresent = ( (tDot11fIEIGTK* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
                 case SigIeLLAttr:
                             offset = sizeof(tDot11fIELLAttr);
                             byteCount = 4;
@@ -22458,6 +22818,11 @@
                             byteCount = 1;
                             pIePresent = ( (tDot11fIEOperatingMode* )(pFrm + pIe->offset + offset * i  ))->present;
                             break;
+                case SigIeOxygenNetwork:
+                            offset = sizeof(tDot11fIEOxygenNetwork);
+                            byteCount = 2;
+                            pIePresent = ( (tDot11fIEOxygenNetwork* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
                 case SigIeP2PAssocReq:
                             offset = sizeof(tDot11fIEP2PAssocReq);
                             status |= dot11fGetPackedIEP2PAssocReq(pCtx, ( tDot11fIEP2PAssocReq* )(pFrm + pIe->offset + offset * i ), pnNeeded);
@@ -23106,6 +23471,14 @@
     (void)pCtx;
 } /* End dot11fPackFfDialogToken. */
 
+void dot11fPackFfLeader(tpAniSirGlobal pCtx,
+                        tDot11fFfLeader *pSrc,
+                        tANI_U8 *pBuf)
+{
+    DOT11F_MEMCPY(pCtx, pBuf, pSrc->mac, 6);
+    (void)pCtx;
+} /* End dot11fPackFfLeader. */
+
 void dot11fPackFfLinkMargin(tpAniSirGlobal pCtx,
                             tDot11fFfLinkMargin *pSrc,
                             tANI_U8 *pBuf)
@@ -23122,6 +23495,14 @@
     (void)pCtx;
 } /* End dot11fPackFfListenInterval. */
 
+void dot11fPackFfMagicCode(tpAniSirGlobal pCtx,
+                           tDot11fFfMagicCode *pSrc,
+                           tANI_U8 *pBuf)
+{
+    DOT11F_MEMCPY(pCtx, pBuf, pSrc->magic, 6);
+    (void)pCtx;
+} /* End dot11fPackFfMagicCode. */
+
 void dot11fPackFfMaxTxPower(tpAniSirGlobal pCtx,
                             tDot11fFfMaxTxPower *pSrc,
                             tANI_U8 *pBuf)
@@ -23176,6 +23557,30 @@
     (void)pCtx;
 } /* End dot11fPackFfRCPI. */
 
+void dot11fPackFfRMCDialogToken(tpAniSirGlobal pCtx,
+                                tDot11fFfRMCDialogToken *pSrc,
+                                tANI_U8 *pBuf)
+{
+    frameshtonl(pCtx, pBuf, pSrc->token, 0);
+    (void)pCtx;
+} /* End dot11fPackFfRMCDialogToken. */
+
+void dot11fPackFfRMCOUI(tpAniSirGlobal pCtx,
+                        tDot11fFfRMCOUI *pSrc,
+                        tANI_U8 *pBuf)
+{
+    DOT11F_MEMCPY(pCtx, pBuf, pSrc->oui, 3);
+    (void)pCtx;
+} /* End dot11fPackFfRMCOUI. */
+
+void dot11fPackFfRMCVersion(tpAniSirGlobal pCtx,
+                            tDot11fFfRMCVersion *pSrc,
+                            tANI_U8 *pBuf)
+{
+    *pBuf = pSrc->version;
+    (void)pCtx;
+} /* End dot11fPackFfRMCVersion. */
+
 void dot11fPackFfRSNI(tpAniSirGlobal pCtx,
                       tDot11fFfRSNI *pSrc,
                       tANI_U8 *pBuf)
@@ -24738,7 +25143,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->name ), pSrc->num_name);
         *pnConsumed += pSrc->num_name;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -24771,7 +25176,7 @@
         pBuf += 1;
         *pBuf = pSrc->type;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -24801,7 +25206,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, pSrc->countryStr, 2);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -24845,7 +25250,7 @@
         pBuf += 8;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->key ), pSrc->num_key);
         *pnConsumed += pSrc->num_key;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -24875,7 +25280,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->enabled;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -24886,6 +25291,45 @@
     return DOT11F_PARSE_SUCCESS;
 } /* End dot11fPackIeHCF. */
 
+tANI_U32 dot11fPackIeIGTK(tpAniSirGlobal pCtx,
+                          tDot11fIEIGTK *pSrc,
+                          tANI_U8 *pBuf,
+                          tANI_U32 nBuf,
+                          tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  += 33;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 4;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        DOT11F_MEMCPY(pCtx, pBuf, pSrc->keyID, 2);
+        *pnConsumed += 2;
+        pBuf += 2;
+        DOT11F_MEMCPY(pCtx, pBuf, pSrc->IPN, 6);
+        *pnConsumed += 6;
+        pBuf += 6;
+        *pBuf = pSrc->keyLength;
+        *pnConsumed += 1;
+        pBuf += 1;
+        DOT11F_MEMCPY(pCtx, pBuf, pSrc->key, 24);
+        *pnConsumed += 24;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIeIGTK. */
+
 tANI_U32 dot11fPackIeLLAttr(tpAniSirGlobal pCtx,
                             tDot11fIELLAttr *pSrc,
                             tANI_U8 *pBuf,
@@ -24905,7 +25349,7 @@
         ++pBuf; ++(*pnConsumed);
         frameshtonl(pCtx, pBuf, pSrc->defer_threshold, 1);
         *pnConsumed += 4;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -24938,7 +25382,7 @@
         pBuf += 6;
         *pBuf = pSrc->channel;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -24971,7 +25415,7 @@
         pBuf += 2;
         frameshtons(pCtx, pBuf, pSrc->channel_util, 1);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25001,7 +25445,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->type;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25031,7 +25475,7 @@
         ++pBuf; ++(*pnConsumed);
         frameshtons(pCtx, pBuf, pSrc->capability, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25070,7 +25514,7 @@
         pBuf += 1;
         *pBuf = pSrc->channel_switch_count;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25187,7 +25631,7 @@
         nBuf -=  1 ;
         frameshtons(pCtx, pBuf, pSrc->acvo_txoplimit, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25226,7 +25670,7 @@
         pBuf += 2;
         frameshtons(pCtx, pBuf, pSrc->quiet_offset, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25256,7 +25700,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->rates ), pSrc->num_rates);
         *pnConsumed += pSrc->num_rates;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25286,7 +25730,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->PMK_R0_ID ), pSrc->num_PMK_R0_ID);
         *pnConsumed += pSrc->num_PMK_R0_ID;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25316,7 +25760,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, pSrc->PMK_R1_ID, 6);
         *pnConsumed += 6;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25349,7 +25793,7 @@
         pBuf += 2;
         frameshtons(pCtx, pBuf, pSrc->BeaconIntvl, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25389,7 +25833,7 @@
         tmp98__ |= ( pSrc->rsvd << 12 );
         frameshtons(pCtx, pBuf, tmp98__, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  2 ;
         break;
     }
@@ -25429,7 +25873,7 @@
         pBuf += 1;
         *pBuf = pSrc->rev_fcs_state;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25459,7 +25903,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->enable;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25495,7 +25939,7 @@
         pBuf += 1;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->build_version ), pSrc->num_build_version);
         *pnConsumed += pSrc->num_build_version;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25525,7 +25969,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->wdsData ), pSrc->num_wdsData);
         *pnConsumed += pSrc->num_wdsData;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25558,7 +26002,7 @@
         pBuf += 1;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->channelList ), pSrc->num_channelList);
         *pnConsumed += pSrc->num_channelList;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25588,7 +26032,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->reportingDetail;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25618,7 +26062,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->reportedFields ), pSrc->num_reportedFields);
         *pnConsumed += pSrc->num_reportedFields;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25651,7 +26095,7 @@
         pBuf += 1;
         *pBuf = pSrc->threshold;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25684,7 +26128,7 @@
         pBuf += 1;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->vendorSpecific ), pSrc->num_vendorSpecific);
         *pnConsumed += pSrc->num_vendorSpecific;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25717,7 +26161,7 @@
         pBuf += 1;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->vendorSpecific ), pSrc->num_vendorSpecific);
         *pnConsumed += pSrc->num_vendorSpecific;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25753,7 +26197,7 @@
         pBuf += 1;
         frameshtons(pCtx, pBuf, pSrc->statusCode, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25786,7 +26230,7 @@
         pBuf += 1;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->variableData ), pSrc->num_variableData);
         *pnConsumed += pSrc->num_variableData;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25871,7 +26315,7 @@
         tmp103__ |= ( pSrc->reserved << 2 );
         *pBuf = tmp103__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -25902,7 +26346,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->requested_eids ), pSrc->num_requested_eids);
         *pnConsumed += pSrc->num_requested_eids;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25932,7 +26376,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->ssid ), pSrc->num_ssid);
         *pnConsumed += pSrc->num_ssid;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -25981,7 +26425,7 @@
         pBuf += 2;
         frameshtons(pCtx, pBuf, pSrc->spec_interval, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26031,7 +26475,7 @@
                 pBuf += 6;
                 frameshtons(pCtx, pBuf, pSrc->info.EthParams.type, 0);
                 *pnConsumed += 2;
-                // fieldsEndFlag = 1 
+                // fieldsEndFlag = 1
             break;
             case 1:
                 *pBuf = pSrc->info.IpParams.version;
@@ -26060,7 +26504,7 @@
                         pBuf += 1;
                         *pBuf = pSrc->info.IpParams.params.IpV4Params.reserved;
                         *pnConsumed += 1;
-                        // fieldsEndFlag = 1 
+                        // fieldsEndFlag = 1
                     break;
                     case 6:
                         DOT11F_MEMCPY(pCtx, pBuf, pSrc->info.IpParams.params.IpV6Params.source, 16);
@@ -26077,14 +26521,14 @@
                         pBuf += 2;
                         DOT11F_MEMCPY(pCtx, pBuf, pSrc->info.IpParams.params.IpV6Params.flow_label, 3);
                         *pnConsumed += 3;
-                        // fieldsEndFlag = 1 
+                        // fieldsEndFlag = 1
                     break;
                 }
             break;
             case 2:
                 frameshtons(pCtx, pBuf, pSrc->info.Params8021dq.tag_type, 0);
                 *pnConsumed += 2;
-                // fieldsEndFlag = 1 
+                // fieldsEndFlag = 1
             break;
         }
         break;
@@ -26116,7 +26560,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->processing;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26146,7 +26590,7 @@
         ++pBuf; ++(*pnConsumed);
         frameshtonl(pCtx, pBuf, pSrc->delay, 0);
         *pnConsumed += 4;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26245,7 +26689,7 @@
         pBuf += 2;
         frameshtons(pCtx, pBuf, pSrc->medium_time, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26307,7 +26751,7 @@
         pBuf += 2;
         frameshtons(pCtx, pBuf, pSrc->spec_interval, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26370,7 +26814,7 @@
                 pBuf += 6;
                 frameshtons(pCtx, pBuf, pSrc->info.EthParams.type, 0);
                 *pnConsumed += 2;
-                // fieldsEndFlag = 1 
+                // fieldsEndFlag = 1
             break;
             case 1:
                 *pBuf = pSrc->info.IpParams.version;
@@ -26399,7 +26843,7 @@
                         pBuf += 1;
                         *pBuf = pSrc->info.IpParams.params.IpV4Params.reserved;
                         *pnConsumed += 1;
-                        // fieldsEndFlag = 1 
+                        // fieldsEndFlag = 1
                     break;
                     case 6:
                         DOT11F_MEMCPY(pCtx, pBuf, pSrc->info.IpParams.params.IpV6Params.source, 10);
@@ -26416,14 +26860,14 @@
                         pBuf += 2;
                         DOT11F_MEMCPY(pCtx, pBuf, pSrc->info.IpParams.params.IpV6Params.flow_label, 3);
                         *pnConsumed += 3;
-                        // fieldsEndFlag = 1 
+                        // fieldsEndFlag = 1
                     break;
                 }
             break;
             case 2:
                 frameshtons(pCtx, pBuf, pSrc->info.Params8021dq.tag_type, 0);
                 *pnConsumed += 2;
-                // fieldsEndFlag = 1 
+                // fieldsEndFlag = 1
             break;
         }
         break;
@@ -26468,7 +26912,7 @@
         pBuf += 1;
         *pBuf = pSrc->processing;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26511,7 +26955,7 @@
         pBuf += 1;
         frameshtonl(pCtx, pBuf, pSrc->delay, 0);
         *pnConsumed += 4;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26623,7 +27067,7 @@
         pBuf += 2;
         frameshtons(pCtx, pBuf, pSrc->medium_time, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26733,7 +27177,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->data ), pSrc->num_data);
         *pnConsumed += pSrc->num_data;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26778,7 +27222,7 @@
         tmp112__ |= ( pSrc->reserved << 3 );
         *pBuf = tmp112__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -26823,7 +27267,7 @@
         pBuf += 1;
         frameshtons(pCtx, pBuf, pSrc->msmt_interval, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26864,7 +27308,7 @@
         pBuf += 1;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->tsrates ), pSrc->num_tsrates);
         *pnConsumed += pSrc->num_tsrates;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26905,7 +27349,7 @@
         pBuf += 1;
         *pBuf = pSrc->reserved;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26943,7 +27387,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->version;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -26982,7 +27426,7 @@
         pBuf += 2;
         frameshtons(pCtx, pBuf, pSrc->cfp_durremaining, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27012,7 +27456,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->text ), pSrc->num_text);
         *pnConsumed += pSrc->num_text;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27048,7 +27492,7 @@
         pBuf += 1;
         *pBuf = pSrc->switchCount;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27084,7 +27528,7 @@
         if ( pSrc->num_triplets )        {
             DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->triplets ), ( pSrc->num_triplets * 3 ));
             *pnConsumed += ( pSrc->num_triplets * 3 );
-            // fieldsEndFlag = 1 
+            // fieldsEndFlag = 1
         }
         else break;
         break;
@@ -27116,7 +27560,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->curr_channel;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27233,7 +27677,7 @@
         nBuf -=  1 ;
         frameshtons(pCtx, pBuf, pSrc->acvo_txoplimit, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27269,7 +27713,7 @@
         tmp121__ |= ( pSrc->unused << 3 );
         *pBuf = tmp121__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -27365,7 +27809,7 @@
         tmp124__ |= ( pSrc->reserved7 << 15 );
         frameshtons(pCtx, pBuf, tmp124__, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  2 ;
         break;
     }
@@ -27396,7 +27840,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->secondaryChannelOffset;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27426,7 +27870,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->rates ), pSrc->num_rates);
         *pnConsumed += pSrc->num_rates;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27465,7 +27909,7 @@
         pBuf += 1;
         *pBuf = pSrc->hop_index;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27498,7 +27942,7 @@
         pBuf += 1;
         *pBuf = pSrc->nchannels;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27540,7 +27984,7 @@
         pBuf += 1;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->randtable ), pSrc->num_randtable);
         *pnConsumed += pSrc->num_randtable;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27626,7 +28070,7 @@
         pBuf += 1;
         frameshtonl(pCtx, pBuf, pSrc->timeoutValue, 0);
         *pnConsumed += 4;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27735,7 +28179,7 @@
         nBuf -=  1 ;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->rsvd ), pSrc->num_rsvd);
         *pnConsumed += pSrc->num_rsvd;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27806,7 +28250,7 @@
         pBuf += 16;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->rsvd ), pSrc->num_rsvd);
         *pnConsumed += pSrc->num_rsvd;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27836,7 +28280,7 @@
         ++pBuf; ++(*pnConsumed);
         frameshtons(pCtx, pBuf, pSrc->atim, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27872,7 +28316,7 @@
         pBuf += 6;
         DOT11F_MEMCPY(pCtx, pBuf, pSrc->RespStaAddr, 6);
         *pnConsumed += 6;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -27942,7 +28386,7 @@
                     tmp135__ |= ( pSrc->report.Basic.unused << 5 );
                     *pBuf = tmp135__;
                     *pnConsumed += 1;
-                    // fieldsEndFlag  = 1 
+                    // fieldsEndFlag  = 1
                     nBuf -=  1 ;
                 break;
                 case 1:
@@ -27957,7 +28401,7 @@
                     pBuf += 2;
                     *pBuf = pSrc->report.CCA.cca_busy_fraction;
                     *pnConsumed += 1;
-                    // fieldsEndFlag = 1 
+                    // fieldsEndFlag = 1
                 break;
                 case 2:
                     *pBuf = pSrc->report.RPIHistogram.channel;
@@ -27992,7 +28436,7 @@
                     pBuf += 1;
                     *pBuf = pSrc->report.RPIHistogram.rpi7_density;
                     *pnConsumed += 1;
-                    // fieldsEndFlag = 1 
+                    // fieldsEndFlag = 1
                 break;
                 case 5:
                     *pBuf = pSrc->report.Beacon.regClass;
@@ -28098,7 +28542,7 @@
                 pBuf += 8;
                 frameshtons(pCtx, pBuf, pSrc->measurement_request.Basic.meas_duration, 0);
                 *pnConsumed += 2;
-                // fieldsEndFlag = 1 
+                // fieldsEndFlag = 1
             break;
             case 1:
                 *pBuf = pSrc->measurement_request.CCA.channel_no;
@@ -28109,7 +28553,7 @@
                 pBuf += 8;
                 frameshtons(pCtx, pBuf, pSrc->measurement_request.CCA.meas_duration, 0);
                 *pnConsumed += 2;
-                // fieldsEndFlag = 1 
+                // fieldsEndFlag = 1
             break;
             case 2:
                 *pBuf = pSrc->measurement_request.RPIHistogram.channel_no;
@@ -28120,7 +28564,7 @@
                 pBuf += 8;
                 frameshtons(pCtx, pBuf, pSrc->measurement_request.RPIHistogram.meas_duration, 0);
                 *pnConsumed += 2;
-                // fieldsEndFlag = 1 
+                // fieldsEndFlag = 1
             break;
             case 5:
                 *pBuf = pSrc->measurement_request.Beacon.regClass;
@@ -28187,7 +28631,7 @@
         tmp138__ |= ( pSrc->reserved << 2 );
         *pBuf = tmp138__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -28298,7 +28742,7 @@
         tmp141__ |= ( pSrc->rxNSSType << 7 );
         *pBuf = tmp141__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -28310,6 +28754,42 @@
     return DOT11F_PARSE_SUCCESS;
 } /* End dot11fPackIeOperatingMode. */
 
+tANI_U32 dot11fPackIeOxygenNetwork(tpAniSirGlobal pCtx,
+                                   tDot11fIEOxygenNetwork *pSrc,
+                                   tANI_U8 *pBuf,
+                                   tANI_U32 nBuf,
+                                   tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  += 2;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 221;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 0x0;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 0x16;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 0x32;
+        ++pBuf; ++(*pnConsumed);
+        frameshtons(pCtx, pBuf, pSrc->data, 0);
+        *pnConsumed += 2;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIeOxygenNetwork. */
+
 tANI_U32 dot11fPackIeP2PAssocReq(tpAniSirGlobal pCtx,
                                  tDot11fIEP2PAssocReq *pSrc,
                                  tANI_U8 *pBuf,
@@ -28853,7 +29333,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->data ), pSrc->num_data);
         *pnConsumed += pSrc->num_data;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29230,7 +29710,7 @@
         pBuf += 1;
         frameshtons(pCtx, pBuf, pSrc->sequence_control, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29267,7 +29747,7 @@
         tmp142__ |= ( pSrc->reserved << 4 );
         *pBuf = tmp142__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -29301,7 +29781,7 @@
         pBuf += 1;
         *pBuf = pSrc->maxTxPower;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29331,7 +29811,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->localPowerConstraints;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29367,7 +29847,7 @@
         pBuf += 1;
         frameshtons(pCtx, pBuf, pSrc->avail, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29397,14 +29877,14 @@
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
         tmp143__ = 0U;
-        tmp143__ |= ( pSrc->reserved << 0 );
-        tmp143__ |= ( pSrc->txopreq << 1 );
-        tmp143__ |= ( pSrc->qreq << 2 );
-        tmp143__ |= ( pSrc->qack << 3 );
-        tmp143__ |= ( pSrc->count << 4 );
+        tmp143__ |= ( pSrc->count << 0 );
+        tmp143__ |= ( pSrc->qack << 4 );
+        tmp143__ |= ( pSrc->qreq << 5 );
+        tmp143__ |= ( pSrc->txopreq << 6 );
+        tmp143__ |= ( pSrc->reserved << 7 );
         *pBuf = tmp143__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -29435,16 +29915,16 @@
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
         tmp144__ = 0U;
-        tmp144__ |= ( pSrc->more_data_ack << 0 );
-        tmp144__ |= ( pSrc->max_sp_length << 1 );
-        tmp144__ |= ( pSrc->qack << 3 );
-        tmp144__ |= ( pSrc->acbe_uapsd << 4 );
-        tmp144__ |= ( pSrc->acbk_uapsd << 5 );
-        tmp144__ |= ( pSrc->acvi_uapsd << 6 );
-        tmp144__ |= ( pSrc->acvo_uapsd << 7 );
+        tmp144__ |= ( pSrc->acvo_uapsd << 0 );
+        tmp144__ |= ( pSrc->acvi_uapsd << 1 );
+        tmp144__ |= ( pSrc->acbk_uapsd << 2 );
+        tmp144__ |= ( pSrc->acbe_uapsd << 3 );
+        tmp144__ |= ( pSrc->qack << 4 );
+        tmp144__ |= ( pSrc->max_sp_length << 5 );
+        tmp144__ |= ( pSrc->more_data_ack << 7 );
         *pBuf = tmp144__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -29484,7 +29964,7 @@
         pBuf += 2;
         frameshtons(pCtx, pBuf, pSrc->offset, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29514,7 +29994,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->rcpi;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29608,7 +30088,13 @@
         else break;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->pmkid ), ( pSrc->pmkid_count * 16 ));
         *pnConsumed += ( pSrc->pmkid_count * 16 );
-        // fieldsEndFlag = 1 
+        pBuf += ( pSrc->pmkid_count * 16 );
+        if ( pSrc->gp_mgmt_cipher_suite )        {
+            DOT11F_MEMCPY(pCtx, pBuf, pSrc->gp_mgmt_cipher_suite, 4);
+            *pnConsumed += 4;
+            // fieldsEndFlag = 1
+        }
+        else break;
         break;
     }
     (void)pCtx;
@@ -29638,7 +30124,7 @@
         ++pBuf; ++(*pnConsumed);
         *pBuf = pSrc->rsni;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29668,7 +30154,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->data ), pSrc->num_data);
         *pnConsumed += pSrc->num_data;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29698,7 +30184,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->bands ), ( pSrc->num_bands * 2 ));
         *pnConsumed += ( pSrc->num_bands * 2 );
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29728,7 +30214,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->rates ), pSrc->num_rates);
         *pnConsumed += pSrc->num_rates;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29767,7 +30253,7 @@
         pBuf += 1;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->vbmp ), pSrc->num_vbmp);
         *pnConsumed += pSrc->num_vbmp;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29800,7 +30286,7 @@
         pBuf += 1;
         *pBuf = pSrc->link_margin;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29901,7 +30387,7 @@
         tmp147__ |= ( pSrc->reserved3 << 13 );
         frameshtons(pCtx, pBuf, tmp147__, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  2 ;
         break;
     }
@@ -29944,7 +30430,7 @@
         pBuf += 1;
         *pBuf = pSrc->OneSixtyMHzUtil;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -29983,7 +30469,7 @@
         pBuf += 1;
         frameshtons(pCtx, pBuf, pSrc->basicMCSSet, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -30047,7 +30533,7 @@
         else break;
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->bkid ), ( pSrc->bkid_count * 16 ));
         *pnConsumed += ( pSrc->bkid_count * 16 );
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -30077,7 +30563,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->data ), pSrc->num_data);
         *pnConsumed += pSrc->num_data;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -30120,7 +30606,7 @@
         pBuf += 1;
         *pBuf = pSrc->linkMargin;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -30158,7 +30644,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->data ), pSrc->num_data);
         *pnConsumed += pSrc->num_data;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -30208,7 +30694,7 @@
         tmp149__ |= ( pSrc->more_ack << 7 );
         *pBuf = tmp149__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -30257,7 +30743,7 @@
         tmp150__ |= ( pSrc->uapsd << 7 );
         *pBuf = tmp150__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -30310,7 +30796,7 @@
         tmp151__ |= ( pSrc->reserved2 << 7 );
         *pBuf = tmp151__;
         *pnConsumed += 1;
-        // fieldsEndFlag  = 1 
+        // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
     }
@@ -30441,7 +30927,7 @@
         nBuf -=  1 ;
         frameshtons(pCtx, pBuf, pSrc->acvo_txoplimit, 0);
         *pnConsumed += 2;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -30509,7 +30995,7 @@
         if ( pSrc->caps )        {
             frameshtons(pCtx, pBuf, pSrc->caps, 0);
             *pnConsumed += 2;
-            // fieldsEndFlag = 1 
+            // fieldsEndFlag = 1
         }
         else break;
         break;
@@ -30549,7 +31035,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->data ), pSrc->num_data);
         *pnConsumed += pSrc->num_data;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -30628,7 +31114,7 @@
         pBuf += 1;
         *pBuf = pSrc->newCenterChanFreq1;
         *pnConsumed += 1;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -30838,7 +31324,7 @@
         ++pBuf; ++(*pnConsumed);
         DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->data ), pSrc->num_data);
         *pnConsumed += pSrc->num_data;
-        // fieldsEndFlag = 1 
+        // fieldsEndFlag = 1
         break;
     }
     (void)pCtx;
@@ -31641,13 +32127,13 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acvo_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvo_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("RRMEnabledCap:\n"));
         if (!pFrm->RRMEnabledCap.present)
@@ -32382,6 +32868,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         for (i = 0; i < pFrm->num_RICDataDesc; ++i)
         {
@@ -33385,6 +33883,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -33895,6 +34405,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("QBSSLoad:\n"));
         if (!pFrm->QBSSLoad.present)
@@ -33952,11 +34463,11 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("reserved (1): %d\n"), pFrm->QOSCapsAp.reserved);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("txopreq (1): %d\n"), pFrm->QOSCapsAp.txopreq);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("qreq (1): %d\n"), pFrm->QOSCapsAp.qreq);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("qack (1): %d\n"), pFrm->QOSCapsAp.qack);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("count (4): %d\n"), pFrm->QOSCapsAp.count);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("qack (1): %d\n"), pFrm->QOSCapsAp.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("qreq (1): %d\n"), pFrm->QOSCapsAp.qreq);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("txopreq (1): %d\n"), pFrm->QOSCapsAp.txopreq);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("reserved (1): %d\n"), pFrm->QOSCapsAp.reserved);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("APChannelReport:\n"));
         if (!pFrm->APChannelReport.present)
@@ -34752,6 +35263,15 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("OxygenNetwork:\n"));
+        if (!pFrm->OxygenNetwork.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->OxygenNetwork.data, 2);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), pBuf, nBuf);
     }
@@ -34926,22 +35446,15 @@
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("num_rates: %d.\n"), pFrm->ExtSuppRates.num_rates);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->ExtSuppRates.rates, pFrm->ExtSuppRates.num_rates);
         }
-        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("RSN:\n"));
-        if (!pFrm->RSN.present)
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("RSNOpaque:\n"));
+        if (!pFrm->RSNOpaque.present)
         {
             FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.version, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.gp_cipher_suite, 4);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.pwise_cipher_suite_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->RSN.pwise_cipher_suites, 4 * pFrm->RSN.pwise_cipher_suite_count);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.akm_suite_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->RSN.akm_suites, 4 * pFrm->RSN.akm_suite_count);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("num_data: %d.\n"), pFrm->RSNOpaque.num_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->RSNOpaque.data, pFrm->RSNOpaque.num_data);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("EDCAParamSet:\n"));
         if (!pFrm->EDCAParamSet.present)
@@ -35775,6 +36288,15 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("OxygenNetwork:\n"));
+        if (!pFrm->OxygenNetwork.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->OxygenNetwork.data, 2);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), pBuf, nBuf);
     }
@@ -35985,6 +36507,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("QBSSLoad:\n"));
         if (!pFrm->QBSSLoad.present)
@@ -36042,11 +36565,11 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("reserved (1): %d\n"), pFrm->QOSCapsAp.reserved);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("txopreq (1): %d\n"), pFrm->QOSCapsAp.txopreq);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("qreq (1): %d\n"), pFrm->QOSCapsAp.qreq);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("qack (1): %d\n"), pFrm->QOSCapsAp.qack);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("count (4): %d\n"), pFrm->QOSCapsAp.count);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("qack (1): %d\n"), pFrm->QOSCapsAp.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("qreq (1): %d\n"), pFrm->QOSCapsAp.qreq);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("txopreq (1): %d\n"), pFrm->QOSCapsAp.txopreq);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("reserved (1): %d\n"), pFrm->QOSCapsAp.reserved);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("APChannelReport:\n"));
         if (!pFrm->APChannelReport.present)
@@ -36971,6 +37494,15 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("OxygenNetwork:\n"));
+        if (!pFrm->OxygenNetwork.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->OxygenNetwork.data, 2);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), pBuf, nBuf);
     }
@@ -39124,22 +39656,15 @@
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("num_rates: %d.\n"), pFrm->ExtSuppRates.num_rates);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->ExtSuppRates.rates, pFrm->ExtSuppRates.num_rates);
         }
-        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("RSN:\n"));
-        if (!pFrm->RSN.present)
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("RSNOpaque:\n"));
+        if (!pFrm->RSNOpaque.present)
         {
             FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.version, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.gp_cipher_suite, 4);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.pwise_cipher_suite_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->RSN.pwise_cipher_suites, 4 * pFrm->RSN.pwise_cipher_suite_count);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.akm_suite_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->RSN.akm_suites, 4 * pFrm->RSN.akm_suite_count);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("num_data: %d.\n"), pFrm->RSNOpaque.num_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->RSNOpaque.data, pFrm->RSNOpaque.num_data);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("QBSSLoad:\n"));
         if (!pFrm->QBSSLoad.present)
@@ -40072,6 +40597,15 @@
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("operModeNotification (1): %d\n"), pFrm->ExtCap.operModeNotification);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("reserved7 (1): %d\n"), pFrm->ExtCap.reserved7);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("OxygenNetwork:\n"));
+        if (!pFrm->OxygenNetwork.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->OxygenNetwork.data, 2);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), pBuf, nBuf);
     }
@@ -40207,6 +40741,40 @@
 
 } /* End dot11fUnpackProvisionDiscoveryRes. */
 
+tANI_U32 dot11fPackRMC(tpAniSirGlobal pCtx, tDot11fRMC *pFrm, tANI_U8 *pBuf, tANI_U32 nBuf, tANI_U32 *pnConsumed)
+{
+    tANI_U32 i = 0;
+    tANI_U32 status = 0;
+    (void)i;
+    *pnConsumed = 0U;
+    status = PackCore(pCtx, (tANI_U8*)pFrm, pBuf, nBuf, pnConsumed, FFS_RMC, IES_RMC);
+
+#   ifdef DOT11F_DUMP_FRAMES
+    if (!DOT11F_FAILED(status))
+    {
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Packed the RMC:\n"));
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Category:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Category.category, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCOUI:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCOUI.oui, 3);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("MagicCode:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->MagicCode.magic, 6);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCVersion:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCVersion.version, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Action:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Action.action, 1);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("RMCDialogToken:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->RMCDialogToken.token, 4);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("Leader:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), ( tANI_U8* )&pFrm->Leader.mac, 6);
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), FRFL("to:\n"));
+        FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_RMC), pBuf, nBuf);
+    }
+#   endif // DOT11F_DUMP_FRAMES
+    return status;
+
+} /* End dot11fUnpackRMC. */
+
 tANI_U32 dot11fPackRadioMeasurementReport(tpAniSirGlobal pCtx, tDot11fRadioMeasurementReport *pFrm, tANI_U8 *pBuf, tANI_U32 nBuf, tANI_U32 *pnConsumed)
 {
     tANI_U32 i = 0;
@@ -40469,13 +41037,13 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acvo_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvo_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("RRMEnabledCap:\n"));
         if (!pFrm->RRMEnabledCap.present)
@@ -40571,6 +41139,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         for (i = 0; i < pFrm->num_RICDataDesc; ++i)
         {
@@ -41593,6 +42173,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         for (i = 0; i < pFrm->num_RICDataDesc; ++i)
         {
@@ -42670,6 +43262,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("ExtCap:\n"));
         if (!pFrm->ExtCap.present)
@@ -42775,6 +43368,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSDISRSP), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -43040,6 +43645,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("EDCAParamSet:\n"));
         if (!pFrm->EDCAParamSet.present)
@@ -43124,6 +43730,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -43203,6 +43821,18 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->VHTOperation.chanCenterFreqSeg2, 1);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), ( tANI_U8* )&pFrm->VHTOperation.basicMCSSet, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("OperatingMode:\n"));
+        if (!pFrm->OperatingMode.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("chanWidth (2): %d\n"), pFrm->OperatingMode.chanWidth);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("reserved (2): %d\n"), pFrm->OperatingMode.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("rxNSS (3): %d\n"), pFrm->OperatingMode.rxNSS);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("rxNSSType (1): %d\n"), pFrm->OperatingMode.rxNSSType);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPCNF), pBuf, nBuf);
     }
@@ -43303,6 +43933,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("ExtCap:\n"));
         if (!pFrm->ExtCap.present)
@@ -43370,13 +44001,13 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acvo_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvo_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("FTInfo:\n"));
         if (!pFrm->FTInfo.present)
@@ -43423,6 +44054,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPREQ), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -43674,6 +44317,7 @@
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->RSN.RSN_Cap, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->RSN.pmkid_count, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* ) pFrm->RSN.pmkid, 16 * pFrm->RSN.pmkid_count);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->RSN.gp_mgmt_cipher_suite, 4);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("ExtCap:\n"));
         if (!pFrm->ExtCap.present)
@@ -43741,13 +44385,13 @@
         }
         else
         {
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
-            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acvo_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvo_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acvi_uapsd (1): %d\n"), pFrm->QOSCapsStation.acvi_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acbk_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbk_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("acbe_uapsd (1): %d\n"), pFrm->QOSCapsStation.acbe_uapsd);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("qack (1): %d\n"), pFrm->QOSCapsStation.qack);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("max_sp_length (2): %d\n"), pFrm->QOSCapsStation.max_sp_length);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("more_data_ack (1): %d\n"), pFrm->QOSCapsStation.more_data_ack);
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("FTInfo:\n"));
         if (!pFrm->FTInfo.present)
@@ -43794,6 +44438,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("FTTimeoutInterval:\n"));
         if (!pFrm->FTTimeoutInterval.present)
@@ -43943,6 +44599,18 @@
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("txSupDataRate (13): %d\n"), pFrm->VHTCaps.txSupDataRate);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("reserved3 (3): %d\n"), pFrm->VHTCaps.reserved3);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("OperatingMode:\n"));
+        if (!pFrm->OperatingMode.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("chanWidth (2): %d\n"), pFrm->OperatingMode.chanWidth);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("reserved (2): %d\n"), pFrm->OperatingMode.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("rxNSS (3): %d\n"), pFrm->OperatingMode.rxNSS);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("rxNSSType (1): %d\n"), pFrm->OperatingMode.rxNSSType);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSSETUPRSP), pBuf, nBuf);
     }
@@ -44014,6 +44682,18 @@
                 FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), FRFL("num_PMK_R0_ID: %d.\n"), pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* ) pFrm->FTInfo.R0KH_ID.PMK_R0_ID, pFrm->FTInfo.R0KH_ID.num_PMK_R0_ID);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), FRFL("IGTK:\n"));
+            if (!pFrm->FTInfo.IGTK.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyID, 2);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* )&pFrm->FTInfo.IGTK.IPN, 6);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* )&pFrm->FTInfo.IGTK.keyLength, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), ( tANI_U8* )&pFrm->FTInfo.IGTK.key, 24);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_TDLSTEARDOWN), FRFL("LinkIdentifier:\n"));
         if (!pFrm->LinkIdentifier.present)
@@ -44420,12 +45100,18 @@
             case SigFfDialogToken:
                 dot11fPackFfDialogToken(pCtx, (tDot11fFfDialogToken* )(pSrc + pFf->offset), pBufRemaining);
                 break;
+            case SigFfLeader:
+                dot11fPackFfLeader(pCtx, (tDot11fFfLeader* )(pSrc + pFf->offset), pBufRemaining);
+                break;
             case SigFfLinkMargin:
                 dot11fPackFfLinkMargin(pCtx, (tDot11fFfLinkMargin* )(pSrc + pFf->offset), pBufRemaining);
                 break;
             case SigFfListenInterval:
                 dot11fPackFfListenInterval(pCtx, (tDot11fFfListenInterval* )(pSrc + pFf->offset), pBufRemaining);
                 break;
+            case SigFfMagicCode:
+                dot11fPackFfMagicCode(pCtx, (tDot11fFfMagicCode* )(pSrc + pFf->offset), pBufRemaining);
+                break;
             case SigFfMaxTxPower:
                 dot11fPackFfMaxTxPower(pCtx, (tDot11fFfMaxTxPower* )(pSrc + pFf->offset), pBufRemaining);
                 break;
@@ -44444,6 +45130,15 @@
             case SigFfRCPI:
                 dot11fPackFfRCPI(pCtx, (tDot11fFfRCPI* )(pSrc + pFf->offset), pBufRemaining);
                 break;
+            case SigFfRMCDialogToken:
+                dot11fPackFfRMCDialogToken(pCtx, (tDot11fFfRMCDialogToken* )(pSrc + pFf->offset), pBufRemaining);
+                break;
+            case SigFfRMCOUI:
+                dot11fPackFfRMCOUI(pCtx, (tDot11fFfRMCOUI* )(pSrc + pFf->offset), pBufRemaining);
+                break;
+            case SigFfRMCVersion:
+                dot11fPackFfRMCVersion(pCtx, (tDot11fFfRMCVersion* )(pSrc + pFf->offset), pBufRemaining);
+                break;
             case SigFfRSNI:
                 dot11fPackFfRSNI(pCtx, (tDot11fFfRSNI* )(pSrc + pFf->offset), pBufRemaining);
                 break;
@@ -44506,7 +45201,7 @@
     pIe = &( IEs[0] );
     while ( 0xff != pIe->eid )
     {
-        pfFound = (tFRAMES_BOOL*)(pSrc + pIe->offset + 
+        pfFound = (tFRAMES_BOOL*)(pSrc + pIe->offset +
                                   pIe->presenceOffset);
         if ( *pfFound && pIe->minSize > nBufRemaining )
         {
@@ -44538,6 +45233,9 @@
                     case SigIeHCF:
                         status |= dot11fPackIeHCF(pCtx, ( tDot11fIEHCF* )(pSrc + pIe->offset + sizeof(tDot11fIEHCF) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
+                    case SigIeIGTK:
+                        status |= dot11fPackIeIGTK(pCtx, ( tDot11fIEIGTK* )(pSrc + pIe->offset + sizeof(tDot11fIEIGTK) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
                     case SigIeLLAttr:
                         status |= dot11fPackIeLLAttr(pCtx, ( tDot11fIELLAttr* )(pSrc + pIe->offset + sizeof(tDot11fIELLAttr) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
@@ -44748,6 +45446,9 @@
                     case SigIeOperatingMode:
                         status |= dot11fPackIeOperatingMode(pCtx, ( tDot11fIEOperatingMode* )(pSrc + pIe->offset + sizeof(tDot11fIEOperatingMode) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
+                    case SigIeOxygenNetwork:
+                        status |= dot11fPackIeOxygenNetwork(pCtx, ( tDot11fIEOxygenNetwork* )(pSrc + pIe->offset + sizeof(tDot11fIEOxygenNetwork) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
                     case SigIeP2PAssocReq:
                         status |= dot11fPackIeP2PAssocReq(pCtx, ( tDot11fIEP2PAssocReq* )(pSrc + pIe->offset + sizeof(tDot11fIEP2PAssocReq) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
diff --git a/CORE/SYS/legacy/src/utils/src/logApi.c b/CORE/SYS/legacy/src/utils/src/logApi.c
index 398c020..0723626 100644
--- a/CORE/SYS/legacy/src/utils/src/logApi.c
+++ b/CORE/SYS/legacy/src/utils/src/logApi.c
@@ -137,7 +137,7 @@
 #endif
 }
 
-static inline VOS_TRACE_LEVEL getVosDebugLevel(tANI_U32 debugLevel)
+ VOS_TRACE_LEVEL getVosDebugLevel(tANI_U32 debugLevel)
 {
     switch(debugLevel)
     {
@@ -167,10 +167,11 @@
         case SIR_HAL_MODULE_ID:
         case SIR_PHY_MODULE_ID:
             return VOS_MODULE_ID_WDA;
+       case SIR_PMM_MODULE_ID:
+             return VOS_MODULE_ID_PMC;
 
         case SIR_LIM_MODULE_ID:
         case SIR_SCH_MODULE_ID:
-        case SIR_PMM_MODULE_ID:
         case SIR_CFG_MODULE_ID:
         case SIR_MNT_MODULE_ID:
         case SIR_DPH_MODULE_ID:
diff --git a/CORE/SYS/legacy/src/utils/src/logDump.c b/CORE/SYS/legacy/src/utils/src/logDump.c
index 5aa15fb..a71ea22 100644
--- a/CORE/SYS/legacy/src/utils/src/logDump.c
+++ b/CORE/SYS/legacy/src/utils/src/logDump.c
@@ -24,7 +24,6 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
-
 /*============================================================================
 Copyright (c) 2007 Qualcomm Technologies, Inc.
 All Rights Reserved.
@@ -89,6 +88,10 @@
 #include "wlan_qct_wda.h"
 
 #define HAL_LOG_DUMP_CMD_START 0
+
+/* Dump command id for Host modules starts from 300 onwards,
+ * hence do not extend the HAL commands beyond 300.
+ */
 #define HAL_LOG_DUMP_CMD_END 299
 
 static int debug;
diff --git a/CORE/SYS/legacy/src/utils/src/macTrace.c b/CORE/SYS/legacy/src/utils/src/macTrace.c
index cb8e610..ba3e98a 100644
--- a/CORE/SYS/legacy/src/utils/src/macTrace.c
+++ b/CORE/SYS/legacy/src/utils/src/macTrace.c
@@ -45,6 +45,14 @@
 
 #include "macTrace.h"
 #include "wlan_qct_wda.h"
+
+#include "wlan_hdd_assoc.h"
+#include "wlan_hdd_main.h"
+#include "wlan_hdd_p2p.h"
+#include "csrNeighborRoam.h"
+#include "csrInternal.h"
+#include "limGlobal.h"
+#include "wlan_qct_tl.h"
 #include "vos_memory.h"
 
 #ifdef TRACE_RECORD
@@ -52,9 +60,262 @@
 static tTraceData gTraceData;
 static tpTraceCb traceCBTable[VOS_MODULE_ID_MAX];
 
+/* ---------------------------------------------------------------------------
+    \fn macTraceGetHDDWlanConnState
+    \function to get string equivalent of a value
+	 from the enum eConnectionState.
 
+    \param connState - the value from the enum
+    \return the string equivalent of connState
+  ---------------------------------------------------------------------------*/
+tANI_U8* macTraceGetHDDWlanConnState(tANI_U16 connState)
+{
+    switch(connState)
+    {
+        CASE_RETURN_STRING(eConnectionState_NotConnected);
+        CASE_RETURN_STRING(eConnectionState_Connecting);
+        CASE_RETURN_STRING(eConnectionState_Associated);
+        CASE_RETURN_STRING(eConnectionState_IbssDisconnected);
+        CASE_RETURN_STRING(eConnectionState_IbssConnected);
+        CASE_RETURN_STRING(eConnectionState_Disconnecting);
 
+        default:
+            return( (tANI_U8*)"UNKNOWN" );
+            break;
+    }
+}
 
+/* ---------------------------------------------------------------------------
+    \fn macTraceGetP2PConnState
+    \function to get string equivalent of a value
+	 from the enum tP2PConnectionStatus.
+
+    \param connState - the value from the enum
+    \return the string equivalent of connState
+  ---------------------------------------------------------------------------*/
+#ifdef WLAN_FEATURE_P2P_DEBUG
+tANI_U8* macTraceGetP2PConnState(tANI_U16 connState)
+{
+    switch(connState)
+    {
+        CASE_RETURN_STRING(P2P_NOT_ACTIVE);
+        CASE_RETURN_STRING(P2P_GO_NEG_PROCESS);
+        CASE_RETURN_STRING(P2P_GO_NEG_COMPLETED);
+        CASE_RETURN_STRING(P2P_CLIENT_CONNECTING_STATE_1);
+        CASE_RETURN_STRING(P2P_GO_COMPLETED_STATE);
+        CASE_RETURN_STRING(P2P_CLIENT_CONNECTED_STATE_1);
+        CASE_RETURN_STRING(P2P_CLIENT_DISCONNECTED_STATE);
+        CASE_RETURN_STRING(P2P_CLIENT_CONNECTING_STATE_2);
+        CASE_RETURN_STRING(P2P_CLIENT_COMPLETED_STATE);
+
+        default:
+            return( (tANI_U8*)"UNKNOWN" );
+            break;
+    }
+}
+#endif
+
+/* ---------------------------------------------------------------------------
+    \fn macTraceGetNeighbourRoamState
+    \function to get string equivalent of a value
+	 from the enum eCsrNeighborRoamState.
+
+    \param neighbourRoamState - the value from the enum
+    \return the string equivalent of neighbourRoamState
+  ---------------------------------------------------------------------------*/
+tANI_U8* macTraceGetNeighbourRoamState(tANI_U16 neighbourRoamState)
+{
+    switch(neighbourRoamState)
+    {
+        CASE_RETURN_STRING(eCSR_NEIGHBOR_ROAM_STATE_CLOSED);
+        CASE_RETURN_STRING(eCSR_NEIGHBOR_ROAM_STATE_INIT);
+        CASE_RETURN_STRING(eCSR_NEIGHBOR_ROAM_STATE_CONNECTED);
+        CASE_RETURN_STRING(eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN);
+        CASE_RETURN_STRING(eCSR_NEIGHBOR_ROAM_STATE_REASSOCIATING);
+        #ifdef WLAN_FEATURE_VOWIFI_11R
+        CASE_RETURN_STRING(eCSR_NEIGHBOR_ROAM_STATE_REPORT_QUERY);
+        CASE_RETURN_STRING(eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN);
+        CASE_RETURN_STRING(eCSR_NEIGHBOR_ROAM_STATE_PREAUTHENTICATING);
+        CASE_RETURN_STRING(eCSR_NEIGHBOR_ROAM_STATE_PREAUTH_DONE);
+        #endif /* WLAN_FEATURE_VOWIFI_11R */
+        CASE_RETURN_STRING(eNEIGHBOR_STATE_MAX);
+
+        default:
+            return( (tANI_U8*)"UNKNOWN" );
+            break;
+    }
+}
+
+/* ---------------------------------------------------------------------------
+    \fn macTraceGetcsrRoamState
+    \function to get string equivalent of a value
+	 from the enum eCsrRoamState.
+
+    \param csrRoamState - the value from the enum
+    \return the string equivalent of csrRoamState
+  ---------------------------------------------------------------------------*/
+tANI_U8* macTraceGetcsrRoamState(tANI_U16 csrRoamState)
+{
+    switch(csrRoamState)
+    {
+        CASE_RETURN_STRING(eCSR_ROAMING_STATE_STOP);
+        CASE_RETURN_STRING(eCSR_ROAMING_STATE_IDLE);
+        CASE_RETURN_STRING(eCSR_ROAMING_STATE_SCANNING);
+        CASE_RETURN_STRING(eCSR_ROAMING_STATE_JOINING);
+        CASE_RETURN_STRING(eCSR_ROAMING_STATE_JOINED);
+
+        default:
+            return( (tANI_U8*)"UNKNOWN" );
+            break;
+    }
+}
+
+/* ---------------------------------------------------------------------------
+    \fn macTraceGetcsrRoamSubState
+    \function to get string equivalent of a value
+	 from the enum eCsrRoamSubState.
+
+    \param csrRoamSubState - the value from the enum
+    \return the string equivalent of csrRoamSubState
+  ---------------------------------------------------------------------------*/
+tANI_U8* macTraceGetcsrRoamSubState(tANI_U16 csrRoamSubState)
+{
+    switch(csrRoamSubState)
+    {
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_NONE);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_START_BSS_REQ);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_JOIN_REQ);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_REASSOC_REQ);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_DISASSOC_REQ);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_STOP_BSS_REQ);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_AUTH_REQ);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_CONFIG);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_DEAUTH_REQ);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_DISASSOC_NOTHING_TO_JOIN);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_DISASSOC_REASSOC_FAILURE);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_DISASSOC_FORCED);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_WAIT_FOR_KEY);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_DISASSOC_HANDOFF);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_JOINED_NO_TRAFFIC);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_JOINED_NON_REALTIME_TRAFFIC);
+        CASE_RETURN_STRING(eCSR_ROAM_SUBSTATE_JOINED_REALTIME_TRAFFIC);
+
+        default:
+            return( (tANI_U8*)"UNKNOWN" );
+            break;
+    }
+}
+
+/* ---------------------------------------------------------------------------
+    \fn macTraceGetLimSmeState
+    \function to get string equivalent of a value
+	 from the enum tLimSmeStates.
+
+    \param limState - the value from the enum
+    \return the string equivalent of limState
+  ---------------------------------------------------------------------------*/
+tANI_U8* macTraceGetLimSmeState(tANI_U16 limState)
+{
+    switch(limState)
+    {
+        CASE_RETURN_STRING(eLIM_SME_OFFLINE_STATE);
+        CASE_RETURN_STRING(eLIM_SME_IDLE_STATE);
+        CASE_RETURN_STRING(eLIM_SME_SUSPEND_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_SCAN_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_JOIN_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_AUTH_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_ASSOC_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_REASSOC_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_REASSOC_LINK_FAIL_STATE);
+        CASE_RETURN_STRING(eLIM_SME_JOIN_FAILURE_STATE);
+        CASE_RETURN_STRING(eLIM_SME_ASSOCIATED_STATE);
+        CASE_RETURN_STRING(eLIM_SME_REASSOCIATED_STATE);
+        CASE_RETURN_STRING(eLIM_SME_LINK_EST_STATE);
+        CASE_RETURN_STRING(eLIM_SME_LINK_EST_WT_SCAN_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_PRE_AUTH_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_DISASSOC_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_DEAUTH_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_START_BSS_STATE);
+        CASE_RETURN_STRING(eLIM_SME_WT_STOP_BSS_STATE);
+        CASE_RETURN_STRING(eLIM_SME_NORMAL_STATE);
+        CASE_RETURN_STRING(eLIM_SME_CHANNEL_SCAN_STATE);
+        CASE_RETURN_STRING(eLIM_SME_NORMAL_CHANNEL_SCAN_STATE);
+
+        default:
+            return( (tANI_U8*)"UNKNOWN" );
+            break;
+    }
+}
+
+/* ---------------------------------------------------------------------------
+    \fn macTraceGetLimMlmState
+    \function to get string equivalent of a value
+	 from the enum tLimMlmStates.
+
+    \param mlmState - the value from the enum
+    \return the string equivalent of mlmState
+  ---------------------------------------------------------------------------*/
+tANI_U8* macTraceGetLimMlmState(tANI_U16 mlmState)
+{
+    switch(mlmState)
+    {
+        CASE_RETURN_STRING(eLIM_MLM_OFFLINE_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_IDLE_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_PROBE_RESP_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_PASSIVE_SCAN_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_JOIN_BEACON_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_JOINED_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_BSS_STARTED_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_AUTH_FRAME2_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_AUTH_FRAME3_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_AUTH_FRAME4_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_AUTH_RSP_TIMEOUT_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_AUTHENTICATED_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_ASSOC_RSP_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_REASSOC_RSP_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_ASSOCIATED_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_REASSOCIATED_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_LINK_ESTABLISHED_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_ASSOC_CNF_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_LEARN_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_ADD_BSS_RSP_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_DEL_BSS_RSP_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_ADD_BSS_RSP_ASSOC_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_ADD_BSS_RSP_REASSOC_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_ADD_BSS_RSP_PREASSOC_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_ADD_STA_RSP_STATE);
+        CASE_RETURN_STRING(eLIM_MLM_WT_DEL_STA_RSP_STATE);
+
+        default:
+            return( (tANI_U8*)"UNKNOWN" );
+            break;
+    }
+}
+
+/* ---------------------------------------------------------------------------
+    \fn macTraceGetTLState
+    \function to get string equivalent of a value
+	 from the enum WLANTL_STAStateType.
+
+    \param tlState - the value from the enum
+    \return the string equivalent of tlState
+  ---------------------------------------------------------------------------*/
+tANI_U8* macTraceGetTLState(tANI_U16 tlState)
+{
+   switch(tlState)
+    {
+        CASE_RETURN_STRING(WLANTL_STA_INIT);
+        CASE_RETURN_STRING(WLANTL_STA_CONNECTED);
+        CASE_RETURN_STRING(WLANTL_STA_AUTHENTICATED);
+        CASE_RETURN_STRING(WLANTL_STA_DISCONNECTED);
+        CASE_RETURN_STRING(WLANTL_STA_MAX_STATE);
+
+        default:
+            return( (tANI_U8*)"UNKNOWN" );
+            break;
+   }
+}
 
 tANI_U8* macTraceGetSmeMsgString( tANI_U16 smeMsg )
 {
@@ -181,7 +442,9 @@
         CASE_RETURN_STRING(eWNI_SME_ACTION_FRAME_SEND_CNF);
         CASE_RETURN_STRING(eWNI_SME_ABORT_REMAIN_ON_CHAN_IND);
         CASE_RETURN_STRING(eWNI_SME_UPDATE_NOA);
+        CASE_RETURN_STRING(eWNI_SME_CLEAR_DFS_CHANNEL_LIST);
         CASE_RETURN_STRING(eWNI_SME_PRE_CHANNEL_SWITCH_FULL_POWER);
+        CASE_RETURN_STRING(eWNI_SME_GET_SNR_REQ);
         CASE_RETURN_STRING(eWNI_PMC_MSG_TYPES_BEGIN);
 
         //General Power Save Messages
@@ -245,6 +508,7 @@
 #endif // FEATURE_WLAN_SCAN_PNO
         CASE_RETURN_STRING(eWNI_SME_TX_PER_HIT_IND);
         CASE_RETURN_STRING(eWNI_SME_CHANGE_COUNTRY_CODE);
+        CASE_RETURN_STRING(eWNI_SME_GENERIC_CHANGE_COUNTRY_CODE);
         CASE_RETURN_STRING(eWNI_SME_PRE_SWITCH_CHL_IND);
         CASE_RETURN_STRING(eWNI_SME_POST_SWITCH_CHL_IND);
         CASE_RETURN_STRING(eWNI_SME_MAX_ASSOC_EXCEEDED);
@@ -260,6 +524,8 @@
         CASE_RETURN_STRING(eWNI_SME_MSG_TYPES_END);
         CASE_RETURN_STRING(eWNI_SME_GET_ROAM_RSSI_REQ);
         CASE_RETURN_STRING(eWNI_SME_GET_ROAM_RSSI_RSP);
+        CASE_RETURN_STRING(eWNI_SME_GET_TSM_STATS_REQ);
+        CASE_RETURN_STRING(eWNI_SME_GET_TSM_STATS_RSP);
         default:
             return( (tANI_U8*)"UNKNOWN" );
             break;
@@ -486,7 +752,7 @@
         CASE_RETURN_STRING(WDA_SET_PNO_CHANGED_IND);
 #endif // FEATURE_WLAN_SCAN_PNO
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-        CASE_RETURN_STRING(WDA_START_ROAM_CANDIDATE_LOOKUP_REQ);
+        CASE_RETURN_STRING(WDA_ROAM_SCAN_OFFLOAD_REQ);
 #endif
 #ifdef WLAN_WAKEUP_EVENTS
         CASE_RETURN_STRING(WDA_WAKE_REASON_IND);
@@ -510,6 +776,10 @@
         CASE_RETURN_STRING(WDA_UPDATE_MEMBERSHIP);
         CASE_RETURN_STRING(WDA_UPDATE_USERPOS);
 #endif
+#ifdef FEATURE_WLAN_BATCH_SCAN
+        CASE_RETURN_STRING(WDA_SET_BATCH_SCAN_REQ);
+        CASE_RETURN_STRING(WDA_TRIGGER_BATCH_SCAN_RESULT_IND);
+#endif
         default:
             return((tANI_U8*) "UNKNOWN" );
             break;
@@ -561,6 +831,7 @@
 #endif
         CASE_RETURN_STRING(SIR_LIM_REMAIN_CHN_TIMEOUT);
         CASE_RETURN_STRING(SIR_LIM_INSERT_SINGLESHOT_NOA_TIMEOUT);
+        CASE_RETURN_STRING(SIR_LIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE);
 #ifdef WMM_APSD
         CASE_RETURN_STRING(SIR_LIM_WMM_APSD_SP_START_MSG_TYPE );
         CASE_RETURN_STRING(SIR_LIM_WMM_APSD_SP_END_MSG_TYPE );
diff --git a/CORE/SYS/legacy/src/utils/src/parserApi.c b/CORE/SYS/legacy/src/utils/src/parserApi.c
index 9d9a478..c195e94 100644
--- a/CORE/SYS/legacy/src/utils/src/parserApi.c
+++ b/CORE/SYS/legacy/src/utils/src/parserApi.c
@@ -346,7 +346,7 @@
         CFG_GET_STR( nSirStatus, pMac, WNI_CFG_COUNTRY_CODE,
                      code, codelen, 3 );
 
-        palCopyMemory( pMac->hHdd, pDot11f->country, code, codelen );
+        vos_mem_copy( pDot11f->country, code, codelen );
 
         if(len > MAX_SIZE_OF_TRIPLETS_IN_COUNTRY_IE)
         {
@@ -355,7 +355,7 @@
         }
 
         pDot11f->num_triplets = ( tANI_U8 ) ( len / 3 );
-        palCopyMemory( pMac->hHdd, ( tANI_U8* )pDot11f->triplets, temp, len );
+        vos_mem_copy( ( tANI_U8* )pDot11f->triplets, temp, len );
 
         pDot11f->present = 1;
     }
@@ -368,13 +368,7 @@
                        tDot11fIEDSParams *pDot11f, tANI_U8 channel,
                        tpPESession psessionEntry)
 {
-//    tSirRetStatus       nSirStatus;
-    tANI_U32            nPhyMode;
-
-    // Get PHY mode and based on that add DS Parameter Set IE
-    limGetPhyMode(pMac, &nPhyMode, psessionEntry);
-
-    if ( (WNI_CFG_PHY_MODE_11A != nPhyMode) || pMac->rrm.rrmPEContext.rrmEnable )
+    if ((IS_24G_CH(channel)) || pMac->rrm.rrmPEContext.rrmEnable)
     {
         // .11b/g mode PHY => Include the DS Parameter Set IE:
         pDot11f->curr_channel = channel;
@@ -502,7 +496,7 @@
         if(psessionEntry != NULL)
         {
             nRates = psessionEntry->extRateSet.numRates;
-            palCopyMemory(pMac->hHdd, rates, psessionEntry->extRateSet.rate, 
+            vos_mem_copy( rates, psessionEntry->extRateSet.rate,
                           nRates);
         }
         else
@@ -520,7 +514,7 @@
     if ( 0 != nRates )
     {
         pDot11f->num_rates = ( tANI_U8 )nRates;
-        palCopyMemory( pMac->hHdd, pDot11f->rates, rates, nRates );
+        vos_mem_copy( pDot11f->rates, rates, nRates );
         pDot11f->present   = 1;
     }
 
@@ -552,7 +546,7 @@
     if ( 0 != nRates )
     {
         pDot11f->num_rates = ( tANI_U8 ) nRates;
-        palCopyMemory( pMac->hHdd, pDot11f->rates, rates, nRates );
+        vos_mem_copy( pDot11f->rates, rates, nRates );
         pDot11f->present   = 1;
     }
 
@@ -642,6 +636,20 @@
                  pDot11f->supportedMCSSet, nCfgLen,
                  SIZE_OF_SUPPORTED_MCS_SET );
 
+    if (psessionEntry)
+    {
+        if (pMac->lteCoexAntShare && (IS_24G_CH(psessionEntry->currentOperChannel)))
+        {
+            if(!(IS_2X2_CHAIN(psessionEntry->chainMask)))
+            {
+                pDot11f->supportedMCSSet[1] = 0;
+                if (psessionEntry->limSystemRole == eLIM_STA_ROLE)
+                {
+                    pDot11f->mimoPowerSave = psessionEntry->smpsMode;
+                }
+            }
+        }
+    }
 
     CFG_GET_INT( nSirStatus, pMac, WNI_CFG_EXT_HT_CAP_INFO, nCfgValue );
 
@@ -780,35 +788,63 @@
 
     nCfgValue = 0;
     //With VHT it suffices if we just examine HT
-    if (psessionEntry->htConfig.ht_rx_ldpc)
+    if (psessionEntry)
+    {
+        if (psessionEntry->htConfig.ht_rx_ldpc)
+            CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_LDPC_CODING_CAP,
+                         nCfgValue );
+
+        pDot11f->ldpcCodingCap = (nCfgValue & 0x0001);
+
+        nCfgValue = 0;
+        if (psessionEntry->htConfig.ht_sgi)
+            CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_SHORT_GI_80MHZ,
+                         nCfgValue );
+
+        pDot11f->shortGI80MHz= (nCfgValue & 0x0001);
+
+        nCfgValue = 0;
+        if (psessionEntry->htConfig.ht_sgi)
+            CFG_GET_INT( nStatus, pMac,
+                         WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ,
+                         nCfgValue );
+
+        pDot11f->shortGI160and80plus80MHz = (nCfgValue & 0x0001);
+
+        nCfgValue = 0;
+        if (psessionEntry->htConfig.ht_rx_stbc)
+            CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_TXSTBC, nCfgValue );
+
+        pDot11f->txSTBC = (nCfgValue & 0x0001);
+
+        nCfgValue = 0;
+        if (psessionEntry->htConfig.ht_tx_stbc)
+            CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_RXSTBC, nCfgValue );
+
+        pDot11f->rxSTBC = (nCfgValue & 0x0007);
+    }
+    else
+    {
         CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_LDPC_CODING_CAP, nCfgValue );
+        pDot11f->ldpcCodingCap = (nCfgValue & 0x0001);
 
-    pDot11f->ldpcCodingCap = (nCfgValue & 0x0001);
-
-    nCfgValue = 0;
-    if (psessionEntry->htConfig.ht_sgi)
+        nCfgValue = 0;
         CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_SHORT_GI_80MHZ, nCfgValue );
+        pDot11f->shortGI80MHz= (nCfgValue & 0x0001);
 
-    pDot11f->shortGI80MHz= (nCfgValue & 0x0001);
-
-    nCfgValue = 0;
-    if (psessionEntry->htConfig.ht_sgi)
+        nCfgValue = 0;
         CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ,
-                                                                nCfgValue );
+                     nCfgValue );
+        pDot11f->shortGI160and80plus80MHz = (nCfgValue & 0x0001);
 
-    pDot11f->shortGI160and80plus80MHz = (nCfgValue & 0x0001);
-
-    nCfgValue = 0;
-    if (psessionEntry->htConfig.ht_rx_stbc)
+        nCfgValue = 0;
         CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_TXSTBC, nCfgValue );
+        pDot11f->txSTBC = (nCfgValue & 0x0001);
 
-    pDot11f->txSTBC = (nCfgValue & 0x0001);
-
-    nCfgValue = 0;
-    if (psessionEntry->htConfig.ht_tx_stbc)
+        nCfgValue = 0;
         CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_RXSTBC, nCfgValue );
-
-    pDot11f->rxSTBC = (nCfgValue & 0x0007);
+        pDot11f->rxSTBC = (nCfgValue & 0x0007);
+    }
 
     nCfgValue = 0;
     CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_SU_BEAMFORMER_CAP, nCfgValue );
@@ -876,6 +912,17 @@
     nCfgValue = 0;
     CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_TX_MCS_MAP, nCfgValue );
     pDot11f->txMCSMap = (nCfgValue & 0x0000FFFF);
+    if (psessionEntry)
+    {
+        if (pMac->lteCoexAntShare && (IS_24G_CH(psessionEntry->currentOperChannel)))
+        {
+            if(!(IS_2X2_CHAIN(psessionEntry->chainMask)))
+            {
+                pDot11f->txMCSMap |= DISABLE_NSS2_MCS;
+                pDot11f->rxMCSMap |= DISABLE_NSS2_MCS;
+            }
+        }
+    }
 
     nCfgValue = 0;
     CFG_GET_INT( nStatus, pMac, WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE,
@@ -1283,7 +1330,7 @@
         {
             pDot11f->present  = 1;
             pDot11f->num_data = pRsnIe->rsnIEdata[ idx + 1 ];
-            palCopyMemory( pMac->hHdd, pDot11f->data,
+            vos_mem_copy(  pDot11f->data,
                            pRsnIe->rsnIEdata + idx + 2,    // EID, len
                            pRsnIe->rsnIEdata[ idx + 1 ] );
         }
@@ -1339,7 +1386,7 @@
         {
         pDot11f->present  = 1;
         pDot11f->num_data = pRsnIe->rsnIEdata[ idx + 1 ];
-        palCopyMemory( pMac->hHdd, pDot11f->data,
+        vos_mem_copy ( pDot11f->data,
                        pRsnIe->rsnIEdata + idx + 2,    // EID, len
                        pRsnIe->rsnIEdata[ idx + 1 ] );
     }
@@ -1361,7 +1408,7 @@
     pDot11f->num_ssid = pInternal->length;
     if ( pInternal->length )
     {
-        palCopyMemory( pMac->hHdd, ( tANI_U8* )pDot11f->ssid, ( tANI_U8* )&pInternal->ssId,
+        vos_mem_copy( ( tANI_U8* )pDot11f->ssid, ( tANI_U8* )&pInternal->ssId,
                        pInternal->length );
     }
 } // End PopulateDot11fSSID.
@@ -1445,7 +1492,7 @@
         if(psessionEntry != NULL)
         {
             nRates = psessionEntry->rateSet.numRates;
-            palCopyMemory(pMac->hHdd, rates, psessionEntry->rateSet.rate, 
+            vos_mem_copy( rates, psessionEntry->rateSet.rate,
                           nRates);
         }
         else
@@ -1468,7 +1515,7 @@
     if ( 0 != nRates )
     {
         pDot11f->num_rates = ( tANI_U8 )nRates;
-        palCopyMemory( pMac->hHdd, pDot11f->rates, rates, nRates );
+        vos_mem_copy( pDot11f->rates, rates, nRates );
         pDot11f->present   = 1;
     }
 
@@ -1752,7 +1799,7 @@
         {
         pDot11f->present  = 1;
         pDot11f->num_data = pRsnIe->rsnIEdata[ idx + 1 ] - 4;
-        palCopyMemory( pMac->hHdd, pDot11f->data,
+        vos_mem_copy(  pDot11f->data,
                        pRsnIe->rsnIEdata + idx + 2 + 4,    // EID, len, OUI
                        pRsnIe->rsnIEdata[ idx + 1 ] - 4 ); // OUI
     }
@@ -1798,7 +1845,7 @@
     tDot11fProbeRequest pr;
 
     // Ok, zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, (tANI_U8*)pProbeReq, sizeof(tSirProbeReq));
+    vos_mem_set( (tANI_U8*)pProbeReq, sizeof(tSirProbeReq), 0);
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackProbeRequest(pMac, pFrame, nFrame, &pr);
@@ -1846,7 +1893,7 @@
 
     if ( pr.HTCaps.present )
     {
-        palCopyMemory( pMac, &pProbeReq->HTCaps, &pr.HTCaps, sizeof( tDot11fIEHTCaps ) );
+        vos_mem_copy( &pProbeReq->HTCaps, &pr.HTCaps, sizeof( tDot11fIEHTCaps ) );
     }
 
     if ( pr.WscProbeReq.present )
@@ -1857,7 +1904,7 @@
 #ifdef WLAN_FEATURE_11AC
     if ( pr.VHTCaps.present )
     {
-        palCopyMemory( pMac, &pProbeReq->VHTCaps, &pr.VHTCaps, sizeof( tDot11fIEVHTCaps ) );
+        vos_mem_copy( &pProbeReq->VHTCaps, &pr.VHTCaps, sizeof( tDot11fIEVHTCaps ) );
     }
 #endif
 
@@ -1880,16 +1927,20 @@
     tDot11fProbeResponse *pr;
 
     // Ok, zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pProbeResp, sizeof(tSirProbeRespBeacon) );
+    vos_mem_set( ( tANI_U8* )pProbeResp, sizeof(tSirProbeRespBeacon), 0 );
 
-    status = palAllocateMemory(pMac->hHdd, (void **)&pr, sizeof(tDot11fProbeResponse));
-    if(!HAL_STATUS_SUCCESS(status))
+    pr = vos_mem_malloc(sizeof(tDot11fProbeResponse));
+    if ( NULL == pr )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
+    if (!HAL_STATUS_SUCCESS(status))
     {
         limLog(pMac, LOGE, FL("Failed to allocate memory\n") );
         return eSIR_FAILURE;
     }
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pr, sizeof(tDot11fProbeResponse) );
+    vos_mem_set( ( tANI_U8* )pr, sizeof(tDot11fProbeResponse), 0 );
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackProbeResponse( pMac, pFrame, nFrame, pr );
@@ -1898,7 +1949,7 @@
         limLog(pMac, LOGE, FL("Failed to parse a Probe Response (0x%08x, %d bytes):\n"),
                   status, nFrame);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pFrame, nFrame);)
-        palFreeMemory(pMac->hHdd, pr);
+        vos_mem_free(pr);
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
@@ -1911,7 +1962,8 @@
     // & "transliterate" from a 'tDot11fProbeResponse' to a 'tSirProbeRespBeacon'...
 
     // Timestamp
-    palCopyMemory( pMac->hHdd, ( tANI_U8* )pProbeResp->timeStamp, ( tANI_U8* )&pr->TimeStamp, sizeof(tSirMacTimeStamp) );
+    vos_mem_copy( ( tANI_U8* )pProbeResp->timeStamp, ( tANI_U8* )&pr->TimeStamp,
+                  sizeof(tSirMacTimeStamp) );
 
     // Beacon Interval
     pProbeResp->beaconInterval = pr->BeaconInterval.interval;
@@ -1982,43 +2034,44 @@
     if ( pr->ChanSwitchAnn.present )
     {
         pProbeResp->channelSwitchPresent = 1;
-        palCopyMemory( pMac, &pProbeResp->channelSwitchIE, &pr->ChanSwitchAnn,
+        vos_mem_copy( &pProbeResp->channelSwitchIE, &pr->ChanSwitchAnn,
                        sizeof(tDot11fIEExtChanSwitchAnn) );
     }
 
        if ( pr->ExtChanSwitchAnn.present )
     {
         pProbeResp->extChannelSwitchPresent = 1;
-        palCopyMemory( pMac, &pProbeResp->extChannelSwitchIE, &pr->ExtChanSwitchAnn,
+        vos_mem_copy ( &pProbeResp->extChannelSwitchIE, &pr->ExtChanSwitchAnn,
                        sizeof(tDot11fIEExtChanSwitchAnn) );
     }
 
     if( pr->TPCReport.present)
     {
         pProbeResp->tpcReportPresent = 1;
-        palCopyMemory(pMac->hHdd, &pProbeResp->tpcReport, &pr->TPCReport, sizeof(tDot11fIETPCReport));
+        vos_mem_copy( &pProbeResp->tpcReport, &pr->TPCReport, sizeof(tDot11fIETPCReport));
     }
 
     if( pr->PowerConstraints.present)
     {
         pProbeResp->powerConstraintPresent = 1;
-        palCopyMemory(pMac->hHdd, &pProbeResp->localPowerConstraint, &pr->PowerConstraints, sizeof(tDot11fIEPowerConstraints));
+        vos_mem_copy( &pProbeResp->localPowerConstraint, &pr->PowerConstraints,
+                      sizeof(tDot11fIEPowerConstraints));
     }
 
     if ( pr->Quiet.present )
     {
         pProbeResp->quietIEPresent = 1;
-        palCopyMemory( pMac, &pProbeResp->quietIE, &pr->Quiet, sizeof(tDot11fIEQuiet) );
+        vos_mem_copy( &pProbeResp->quietIE, &pr->Quiet, sizeof(tDot11fIEQuiet) );
     }
 
     if ( pr->HTCaps.present )
     {
-        palCopyMemory( pMac, &pProbeResp->HTCaps, &pr->HTCaps, sizeof( tDot11fIEHTCaps ) );
+        vos_mem_copy( &pProbeResp->HTCaps, &pr->HTCaps, sizeof( tDot11fIEHTCaps ) );
     }
 
     if ( pr->HTInfo.present )
     {
-        palCopyMemory( pMac, &pProbeResp->HTInfo, &pr->HTInfo, sizeof( tDot11fIEHTInfo ) );
+        vos_mem_copy( &pProbeResp->HTInfo, &pr->HTInfo, sizeof( tDot11fIEHTInfo ) );
     }
 
     if ( pr->DSParams.present )
@@ -2031,10 +2084,10 @@
         pProbeResp->channelNumber = pr->HTInfo.primaryChannel;
     }
 
-    if ( pr->RSN.present )
+    if ( pr->RSNOpaque.present )
     {
         pProbeResp->rsnPresent = 1;
-        ConvertRSN( pMac, &pProbeResp->rsn, &pr->RSN );
+        ConvertRSNOpaque( pMac, &pProbeResp->rsn, &pr->RSNOpaque );
     }
 
     if ( pr->WPA.present )
@@ -2074,7 +2127,8 @@
     {
         // MobilityDomain
         pProbeResp->mdiePresent = 1;
-        palCopyMemory( pMac->hHdd, (tANI_U8 *)&(pProbeResp->mdie[0]), (tANI_U8 *)&(pr->MobilityDomain.MDID), sizeof(tANI_U16) );
+        vos_mem_copy( (tANI_U8 *)&(pProbeResp->mdie[0]), (tANI_U8 *)&(pr->MobilityDomain.MDID),
+                       sizeof(tANI_U16) );
         pProbeResp->mdie[2] = ((pr->MobilityDomain.overDSCap << 0) | (pr->MobilityDomain.resourceReqCap << 1));
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
         limLog(pMac, LOG2, FL("mdie=%02x%02x%02x\n"), (unsigned int)pProbeResp->mdie[0],
@@ -2086,29 +2140,29 @@
 #if defined FEATURE_WLAN_CCX
     if (pr->QBSSLoad.present)
     {
-        palCopyMemory(pMac->hHdd, &pProbeResp->QBSSLoad, &pr->QBSSLoad, sizeof(tDot11fIEQBSSLoad));
+        vos_mem_copy(&pProbeResp->QBSSLoad, &pr->QBSSLoad, sizeof(tDot11fIEQBSSLoad));
     }
 #endif
     if (pr->P2PProbeRes.present)
     {
-       palCopyMemory( pMac, &pProbeResp->P2PProbeRes, &pr->P2PProbeRes,
+       vos_mem_copy( &pProbeResp->P2PProbeRes, &pr->P2PProbeRes,
                                                 sizeof(tDot11fIEP2PProbeRes) );
     }
 #ifdef WLAN_FEATURE_11AC
     if ( pr->VHTCaps.present )
     {
-       palCopyMemory( pMac, &pProbeResp->VHTCaps, &pr->VHTCaps, sizeof( tDot11fIEVHTCaps ) );
+       vos_mem_copy( &pProbeResp->VHTCaps, &pr->VHTCaps, sizeof( tDot11fIEVHTCaps ) );
     }
     if ( pr->VHTOperation.present )
     {
-        palCopyMemory( pMac, &pProbeResp->VHTOperation, &pr->VHTOperation, sizeof( tDot11fIEVHTOperation) );
+        vos_mem_copy( &pProbeResp->VHTOperation, &pr->VHTOperation, sizeof( tDot11fIEVHTOperation) );
     }
     if ( pr->VHTExtBssLoad.present )
     {
-        palCopyMemory( pMac, &pProbeResp->VHTExtBssLoad, &pr->VHTExtBssLoad, sizeof( tDot11fIEVHTExtBssLoad) );
+        vos_mem_copy( &pProbeResp->VHTExtBssLoad, &pr->VHTExtBssLoad, sizeof( tDot11fIEVHTExtBssLoad) );
     }
 #endif
-    palFreeMemory(pMac->hHdd, pr);
+    vos_mem_free(pr);
     return eSIR_SUCCESS;
 
 } // End sirConvertProbeFrame2Struct.
@@ -2122,15 +2176,19 @@
     tDot11fAssocRequest *ar;
     tANI_U32                 status;
 
-    status = palAllocateMemory(pMac->hHdd, (void **)&ar, sizeof(tDot11fAssocRequest));
-    if(!HAL_STATUS_SUCCESS(status))
+    ar = vos_mem_malloc(sizeof(tDot11fAssocRequest));
+    if ( NULL == ar )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
+    if (!HAL_STATUS_SUCCESS(status))
     {
         limLog(pMac, LOGE, FL("Failed to allocate memory\n") );
         return eSIR_FAILURE;
     }
         // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pAssocReq, sizeof(tSirAssocReq) );
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )ar, sizeof( tDot11fAssocRequest ) );
+    vos_mem_set( ( tANI_U8* )pAssocReq, sizeof(tSirAssocReq), 0 );
+    vos_mem_set( ( tANI_U8* )ar, sizeof( tDot11fAssocRequest ), 0 );
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackAssocRequest( pMac, pFrame, nFrame, ar );
@@ -2139,7 +2197,7 @@
         limLog(pMac, LOGE, FL("Failed to parse an Association Request (0x%08x, %d bytes):\n"),
                   status, nFrame);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pFrame, nFrame);)
-        palFreeMemory(pMac->hHdd, ar);
+        vos_mem_free(ar);
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
@@ -2254,13 +2312,14 @@
 
     if ( ar->HTCaps.present )
     {
-        palCopyMemory( pMac, &pAssocReq->HTCaps, &ar->HTCaps, sizeof( tDot11fIEHTCaps ) );
+        vos_mem_copy( &pAssocReq->HTCaps, &ar->HTCaps, sizeof( tDot11fIEHTCaps ) );
     }
 
     if ( ar->WMMInfoStation.present )
     {
         pAssocReq->wmeInfoPresent = 1;
-        palCopyMemory( pMac, &pAssocReq->WMMInfoStation, &ar->WMMInfoStation, sizeof( tDot11fIEWMMInfoStation ) );
+        vos_mem_copy( &pAssocReq->WMMInfoStation, &ar->WMMInfoStation,
+                      sizeof( tDot11fIEWMMInfoStation ) );
 
     }
 
@@ -2270,32 +2329,32 @@
     if ( ! pAssocReq->ssidPresent )
     {
         PELOG2(limLog(pMac, LOG2, FL("Received Assoc without SSID IE.\n"));)
-        palFreeMemory(pMac->hHdd, ar);
+        vos_mem_free(ar);
         return eSIR_FAILURE;
     }
 
     if ( !pAssocReq->suppRatesPresent && !pAssocReq->extendedRatesPresent )
     {
         PELOG2(limLog(pMac, LOG2, FL("Received Assoc without supp rate IE.\n"));)
-        palFreeMemory(pMac->hHdd, ar);
+        vos_mem_free(ar);
         return eSIR_FAILURE;
     }
 
 #ifdef WLAN_FEATURE_11AC
     if ( ar->VHTCaps.present )
     {
-        palCopyMemory( pMac, &pAssocReq->VHTCaps, &ar->VHTCaps, sizeof( tDot11fIEVHTCaps ) );
+        vos_mem_copy( &pAssocReq->VHTCaps, &ar->VHTCaps, sizeof( tDot11fIEVHTCaps ) );
         limLog( pMac, LOGW, FL("Received Assoc Req with VHT Cap\n"));
         limLogVHTCap( pMac, &pAssocReq->VHTCaps);
     }
     if ( ar->OperatingMode.present )
     {
-        palCopyMemory( pMac, &pAssocReq->operMode, &ar->OperatingMode, sizeof (tDot11fIEOperatingMode));
+        vos_mem_copy( &pAssocReq->operMode, &ar->OperatingMode, sizeof (tDot11fIEOperatingMode));
         limLog( pMac, LOGW, FL("Received Assoc Req with Operating Mode IE\n"));
         limLogOperatingMode( pMac, &pAssocReq->operMode);
     }
 #endif
-    palFreeMemory(pMac->hHdd, ar);
+    vos_mem_free(ar);
     return eSIR_SUCCESS;
 
 } // End sirConvertAssocReqFrame2Struct.
@@ -2311,7 +2370,7 @@
     tANI_U8  cnt =0;
 
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pAssocRsp, sizeof(tSirAssocRsp) );
+    vos_mem_set( ( tANI_U8* )pAssocRsp, sizeof(tSirAssocRsp), 0 );
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackAssocResponse( pMac, pFrame, nFrame, &ar);
@@ -2386,12 +2445,12 @@
 
     if ( ar.HTCaps.present )
     {
-        palCopyMemory( pMac, &pAssocRsp->HTCaps, &ar.HTCaps, sizeof( tDot11fIEHTCaps ) );
+        vos_mem_copy( &pAssocRsp->HTCaps, &ar.HTCaps, sizeof( tDot11fIEHTCaps ) );
     }
 
     if ( ar.HTInfo.present )
     {
-        palCopyMemory( pMac, &pAssocRsp->HTInfo, &ar.HTInfo, sizeof( tDot11fIEHTInfo ) );
+        vos_mem_copy( &pAssocRsp->HTInfo, &ar.HTInfo, sizeof( tDot11fIEHTInfo ) );
     }
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -2399,7 +2458,8 @@
     {
         // MobilityDomain
         pAssocRsp->mdiePresent = 1;
-        palCopyMemory( pMac->hHdd, (tANI_U8 *)&(pAssocRsp->mdie[0]), (tANI_U8 *)&(ar.MobilityDomain.MDID), sizeof(tANI_U16) );
+        vos_mem_copy( (tANI_U8 *)&(pAssocRsp->mdie[0]), (tANI_U8 *)&(ar.MobilityDomain.MDID),
+                       sizeof(tANI_U16) );
         pAssocRsp->mdie[2] = ((ar.MobilityDomain.overDSCap << 0) | (ar.MobilityDomain.resourceReqCap << 1));
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
         limLog(pMac, LOG1, FL("new mdie=%02x%02x%02x"), (unsigned int)pAssocRsp->mdie[0],
@@ -2415,7 +2475,7 @@
                 ar.FTInfo.R1KH_ID.present);
 #endif
         pAssocRsp->ftinfoPresent = 1;
-        palCopyMemory( pMac, &pAssocRsp->FTInfo, &ar.FTInfo, sizeof(tDot11fIEFTInfo) );
+        vos_mem_copy( &pAssocRsp->FTInfo, &ar.FTInfo, sizeof(tDot11fIEFTInfo) );
     }
 #endif
 
@@ -2423,7 +2483,8 @@
     if (ar.num_RICDataDesc) {
         for (cnt=0; cnt < ar.num_RICDataDesc; cnt++) {
             if (ar.RICDataDesc[cnt].present) {
-                palCopyMemory(pMac, &pAssocRsp->RICData[cnt], &ar.RICDataDesc[cnt], sizeof(tDot11fIERICDataDesc));
+                vos_mem_copy( &pAssocRsp->RICData[cnt], &ar.RICDataDesc[cnt],
+                              sizeof(tDot11fIERICDataDesc));
             }
         }
         pAssocRsp->num_RICData = ar.num_RICDataDesc;
@@ -2435,7 +2496,8 @@
     if (ar.num_WMMTSPEC) {
         pAssocRsp->num_tspecs = ar.num_WMMTSPEC;
         for (cnt=0; cnt < ar.num_WMMTSPEC; cnt++) {
-            palCopyMemory(pMac, &pAssocRsp->TSPECInfo[cnt], &ar.WMMTSPEC[cnt], (sizeof(tDot11fIEWMMTSPEC)*ar.num_WMMTSPEC));
+            vos_mem_copy( &pAssocRsp->TSPECInfo[cnt], &ar.WMMTSPEC[cnt],
+                          (sizeof(tDot11fIEWMMTSPEC)*ar.num_WMMTSPEC));
         }
         pAssocRsp->tspecPresent = TRUE;
     }
@@ -2443,7 +2505,7 @@
     if(ar.CCXTrafStrmMet.present)
     {
         pAssocRsp->tsmPresent = 1;
-        palCopyMemory(pMac->hHdd,&pAssocRsp->tsmIE.tsid,
+        vos_mem_copy(&pAssocRsp->tsmIE.tsid,
                 &ar.CCXTrafStrmMet.tsid,sizeof(tSirMacCCXTSMIE));
     }    
 #endif
@@ -2451,13 +2513,13 @@
 #ifdef WLAN_FEATURE_11AC
     if ( ar.VHTCaps.present )
     {
-        palCopyMemory( pMac, &pAssocRsp->VHTCaps, &ar.VHTCaps, sizeof( tDot11fIEVHTCaps ) );
+        vos_mem_copy( &pAssocRsp->VHTCaps, &ar.VHTCaps, sizeof( tDot11fIEVHTCaps ) );
         limLog( pMac, LOG1, FL("Received Assoc Response with VHT Cap"));
         limLogVHTCap(pMac, &pAssocRsp->VHTCaps);
     }
     if ( ar.VHTOperation.present )
     {
-        palCopyMemory( pMac, &pAssocRsp->VHTOperation, &ar.VHTOperation, sizeof( tDot11fIEVHTOperation) );
+        vos_mem_copy( &pAssocRsp->VHTOperation, &ar.VHTOperation, sizeof( tDot11fIEVHTOperation) );
         limLog( pMac, LOG1, FL("Received Assoc Response with VHT Operation"));
         limLogVHTOperation(pMac, &pAssocRsp->VHTOperation);
     }
@@ -2477,7 +2539,7 @@
     tANI_U32                   status;
 
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pAssocReq, sizeof(tSirAssocReq) );
+    vos_mem_set( ( tANI_U8* )pAssocReq, sizeof(tSirAssocReq), 0 );
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackReAssocRequest( pMac, pFrame, nFrame, &ar );
@@ -2581,13 +2643,14 @@
 
     if ( ar.HTCaps.present )
     {
-        palCopyMemory( pMac, &pAssocReq->HTCaps, &ar.HTCaps, sizeof( tDot11fIEHTCaps ) );
+        vos_mem_copy( &pAssocReq->HTCaps, &ar.HTCaps, sizeof( tDot11fIEHTCaps ) );
     }
 
     if ( ar.WMMInfoStation.present )
     {
         pAssocReq->wmeInfoPresent = 1;
-        palCopyMemory( pMac, &pAssocReq->WMMInfoStation, &ar.WMMInfoStation, sizeof( tDot11fIEWMMInfoStation ) );
+        vos_mem_copy( &pAssocReq->WMMInfoStation, &ar.WMMInfoStation,
+                      sizeof( tDot11fIEWMMInfoStation ) );
 
     }
 
@@ -2632,11 +2695,11 @@
 #ifdef WLAN_FEATURE_11AC
     if ( ar.VHTCaps.present )
     {
-        palCopyMemory( pMac, &pAssocReq->VHTCaps, &ar.VHTCaps, sizeof( tDot11fIEVHTCaps ) );
+        vos_mem_copy( &pAssocReq->VHTCaps, &ar.VHTCaps, sizeof( tDot11fIEVHTCaps ) );
     }
     if ( ar.OperatingMode.present )
     {
-        palCopyMemory( pMac, &pAssocReq->operMode, &ar.OperatingMode, sizeof( tDot11fIEOperatingMode  ) );
+        vos_mem_copy( &pAssocReq->operMode, &ar.OperatingMode, sizeof( tDot11fIEOperatingMode  ) );
         limLog( pMac, LOGW, FL("Received Assoc Req with Operating Mode IE\n"));
         limLogOperatingMode( pMac, &pAssocReq->operMode);
     }
@@ -2645,6 +2708,202 @@
 
 } // End sirConvertReassocReqFrame2Struct.
 
+
+#if defined(FEATURE_WLAN_CCX_UPLOAD)
+tSirRetStatus
+sirFillBeaconMandatoryIEforCcxBcnReport(tpAniSirGlobal   pMac,
+                                        tANI_U8         *pPayload,
+                                        const tANI_U32   nPayload,
+                                        tANI_U8        **outIeBuf,
+                                        tANI_U32        *pOutIeLen)
+{
+    tDot11fBeaconIEs            *pBies = NULL;
+    tANI_U32                    status = eHAL_STATUS_SUCCESS;
+    tSirCcxBcnReportMandatoryIe ccxBcnReportMandatoryIe;
+
+    /* To store how many bytes are required to be allocated
+           for Bcn report mandatory Ies */
+    tANI_U16 numBytes = 0;
+    tANI_U8  *pos = NULL;
+
+    // Zero-init our [out] parameter,
+    vos_mem_set( (tANI_U8*)&ccxBcnReportMandatoryIe, sizeof(ccxBcnReportMandatoryIe), 0 );
+    pBies = vos_mem_malloc(sizeof(tDot11fBeaconIEs));
+    if ( NULL == pBies )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
+    if (!HAL_STATUS_SUCCESS(status))
+    {
+        limLog(pMac, LOGE, FL("Failed to allocate memory\n") );
+        return eSIR_FAILURE;
+    }
+    // delegate to the framesc-generated code,
+    status = dot11fUnpackBeaconIEs( pMac, pPayload, nPayload, pBies );
+
+    if ( DOT11F_FAILED( status ) )
+    {
+        limLog(pMac, LOGE, FL("Failed to parse Beacon IEs (0x%08x, %d bytes):\n"),
+                  status, nPayload);
+        vos_mem_free(pBies);
+        return eSIR_FAILURE;
+    }
+    else if ( DOT11F_WARNED( status ) )
+    {
+      limLog( pMac, LOGW, FL("There were warnings while unpacking Beacon IEs (0x%08x, %d bytes):\n"),
+                 status, nPayload );
+        PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pPayload, nPayload);)
+    }
+
+    // & "transliterate" from a 'tDot11fBeaconIEs' to a 'ccxBcnReportMandatoryIe'...
+    if ( !pBies->SSID.present )
+    {
+        PELOGW(limLog(pMac, LOGW, FL("Mandatory IE SSID not present!\n"));)
+    }
+    else
+    {
+        ccxBcnReportMandatoryIe.ssidPresent = 1;
+        ConvertSSID( pMac, &ccxBcnReportMandatoryIe.ssId, &pBies->SSID );
+        /* 1 for EID, 1 for length and length bytes */
+        numBytes += 1 + 1 + ccxBcnReportMandatoryIe.ssId.length;
+    }
+
+    if ( !pBies->SuppRates.present )
+    {
+        PELOGW(limLog(pMac, LOGW, FL("Mandatory IE Supported Rates not present!\n"));)
+    }
+    else
+    {
+        ccxBcnReportMandatoryIe.suppRatesPresent = 1;
+        ConvertSuppRates( pMac, &ccxBcnReportMandatoryIe.supportedRates, &pBies->SuppRates );
+        numBytes += 1 + 1 + ccxBcnReportMandatoryIe.supportedRates.numRates;
+    }
+
+    if ( pBies->FHParamSet.present)
+    {
+        ccxBcnReportMandatoryIe.fhParamPresent = 1;
+        ConvertFHParams( pMac, &ccxBcnReportMandatoryIe.fhParamSet, &pBies->FHParamSet );
+        numBytes += 1 + 1 + SIR_MAC_FH_PARAM_SET_EID_MAX;
+    }
+
+    if ( pBies->DSParams.present )
+    {
+        ccxBcnReportMandatoryIe.dsParamsPresent = 1;
+        ccxBcnReportMandatoryIe.dsParamSet.channelNumber = pBies->DSParams.curr_channel;
+        numBytes += 1 + 1 + SIR_MAC_DS_PARAM_SET_EID_MAX;
+    }
+
+    if ( pBies->CFParams.present )
+    {
+        ccxBcnReportMandatoryIe.cfPresent = 1;
+        ConvertCFParams( pMac, &ccxBcnReportMandatoryIe.cfParamSet, &pBies->CFParams );
+        numBytes += 1 + 1 + SIR_MAC_CF_PARAM_SET_EID_MAX;
+    }
+
+    if ( pBies->IBSSParams.present )
+    {
+        ccxBcnReportMandatoryIe.ibssParamPresent = 1;
+        ccxBcnReportMandatoryIe.ibssParamSet.atim = pBies->IBSSParams.atim;
+        numBytes += 1 + 1 + SIR_MAC_IBSS_PARAM_SET_EID_MAX;
+    }
+
+    if ( pBies->TIM.present )
+    {
+        ccxBcnReportMandatoryIe.timPresent = 1;
+        ccxBcnReportMandatoryIe.tim.dtimCount     = pBies->TIM.dtim_count;
+        ccxBcnReportMandatoryIe.tim.dtimPeriod    = pBies->TIM.dtim_period;
+        ccxBcnReportMandatoryIe.tim.bitmapControl = pBies->TIM.bmpctl;
+        /* As per the CCX spec, May truncate and report first 4 octets only */
+        numBytes += 1 + 1 + SIR_MAC_TIM_EID_MIN;
+    }
+
+    if ( pBies->RRMEnabledCap.present )
+    {
+        vos_mem_copy( &ccxBcnReportMandatoryIe.rmEnabledCapabilities, &pBies->RRMEnabledCap, sizeof( tDot11fIERRMEnabledCap ) );
+        numBytes += 1 + 1 + SIR_MAC_RM_ENABLED_CAPABILITY_EID_MAX;
+    }
+
+    *outIeBuf = vos_mem_malloc(numBytes);
+    if (NULL == *outIeBuf)
+    {
+        limLog(pMac, LOGP, FL("Memory Allocation failure"));
+        vos_mem_free(pBies);
+        return eSIR_FAILURE;
+    }
+    pos = *outIeBuf;
+    *pOutIeLen = numBytes;
+
+    /* Start filling the output Ie with Mandatory IE information */
+    /* Fill SSID IE */
+    *pos = SIR_MAC_SSID_EID;
+    pos++;
+    *pos = ccxBcnReportMandatoryIe.ssId.length;
+    pos++;
+    vos_mem_copy(pos, (tANI_U8*)ccxBcnReportMandatoryIe.ssId.ssId, ccxBcnReportMandatoryIe.ssId.length);
+    pos += ccxBcnReportMandatoryIe.ssId.length;
+
+    /* Fill Supported Rates IE */
+    *pos = SIR_MAC_RATESET_EID;
+    pos++;
+    *pos = ccxBcnReportMandatoryIe.supportedRates.numRates;
+    pos++;
+    vos_mem_copy(pos, (tANI_U8*)ccxBcnReportMandatoryIe.supportedRates.rate,
+                      ccxBcnReportMandatoryIe.supportedRates.numRates);
+    pos += ccxBcnReportMandatoryIe.supportedRates.numRates;
+
+    /* Fill FH Parameter set IE */
+    *pos = SIR_MAC_FH_PARAM_SET_EID;
+    pos++;
+    *pos = SIR_MAC_FH_PARAM_SET_EID_MAX;
+    pos++;
+    vos_mem_copy(pos, (tANI_U8*)&ccxBcnReportMandatoryIe.fhParamSet, SIR_MAC_FH_PARAM_SET_EID_MAX);
+    pos += SIR_MAC_FH_PARAM_SET_EID_MAX;
+
+    /* Fill DS Parameter set IE */
+    *pos = SIR_MAC_DS_PARAM_SET_EID;
+    pos++;
+    *pos = SIR_MAC_DS_PARAM_SET_EID_MAX;
+    pos++;
+    *pos = ccxBcnReportMandatoryIe.dsParamSet.channelNumber;
+    pos += SIR_MAC_DS_PARAM_SET_EID_MAX;
+
+    /* Fill CF Parameter set */
+    *pos = SIR_MAC_CF_PARAM_SET_EID;
+    pos++;
+    *pos = SIR_MAC_CF_PARAM_SET_EID_MAX;
+    pos++;
+    vos_mem_copy(pos, (tANI_U8*)&ccxBcnReportMandatoryIe.cfParamSet, SIR_MAC_CF_PARAM_SET_EID_MAX);
+    pos += SIR_MAC_CF_PARAM_SET_EID_MAX;
+
+    /* Fill IBSS Parameter set IE */
+    *pos = SIR_MAC_IBSS_PARAM_SET_EID;
+    pos++;
+    *pos = SIR_MAC_IBSS_PARAM_SET_EID_MAX;
+    pos++;
+    vos_mem_copy(pos, (tANI_U8*)&ccxBcnReportMandatoryIe.ibssParamSet.atim, SIR_MAC_IBSS_PARAM_SET_EID_MAX);
+    pos += SIR_MAC_IBSS_PARAM_SET_EID_MAX;
+
+    /* Fill TIM IE */
+    *pos = SIR_MAC_TIM_EID;
+    pos++;
+    *pos = SIR_MAC_TIM_EID_MIN;
+    pos++;
+    vos_mem_copy(pos, (tANI_U8*)&ccxBcnReportMandatoryIe.tim, SIR_MAC_TIM_EID_MIN);
+    pos += SIR_MAC_TIM_EID_MIN;
+
+    /* Fill RM Capability IE */
+    *pos = SIR_MAC_RM_ENABLED_CAPABILITY_EID;
+    pos++;
+    *pos = SIR_MAC_RM_ENABLED_CAPABILITY_EID_MAX;
+    pos++;
+    vos_mem_copy(pos, (tANI_U8*)&ccxBcnReportMandatoryIe.rmEnabledCapabilities, SIR_MAC_RM_ENABLED_CAPABILITY_EID_MAX);
+
+    vos_mem_free(pBies);
+    return eSIR_SUCCESS;
+}
+
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
+
 tSirRetStatus
 sirParseBeaconIE(tpAniSirGlobal        pMac,
                  tpSirProbeRespBeacon  pBeaconStruct,
@@ -2655,10 +2914,14 @@
     tANI_U32              status;
 
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pBeaconStruct, sizeof(tSirProbeRespBeacon) );
+    vos_mem_set( ( tANI_U8* )pBeaconStruct, sizeof(tSirProbeRespBeacon), 0 );
 
-    status = palAllocateMemory(pMac->hHdd, (void **)&pBies, sizeof(tDot11fBeaconIEs));
-    if(!HAL_STATUS_SUCCESS(status))
+    pBies = vos_mem_malloc(sizeof(tDot11fBeaconIEs));
+    if ( NULL == pBies )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
+    if (!HAL_STATUS_SUCCESS(status))
     {
         limLog(pMac, LOGE, FL("Failed to allocate memory\n") );
         return eSIR_FAILURE;
@@ -2671,7 +2934,7 @@
         limLog(pMac, LOGE, FL("Failed to parse Beacon IEs (0x%08x, %d bytes):\n"),
                   status, nPayload);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pPayload, nPayload);)
-        palFreeMemory(pMac->hHdd, pBies);
+        vos_mem_free(pBies);
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
@@ -2730,8 +2993,7 @@
     if(pBies->TPCReport.present)
     {
         pBeaconStruct->tpcReportPresent = 1;
-        palCopyMemory(pMac,
-                      &pBeaconStruct->tpcReport,
+        vos_mem_copy( &pBeaconStruct->tpcReport,
                       &pBies->TPCReport,
                       sizeof( tDot11fIETPCReport));
     }
@@ -2739,8 +3001,7 @@
     if(pBies->PowerConstraints.present)
     {
         pBeaconStruct->powerConstraintPresent = 1;
-        palCopyMemory(pMac,
-                      &pBeaconStruct->localPowerConstraint,
+        vos_mem_copy( &pBeaconStruct->localPowerConstraint,
                       &pBies->PowerConstraints,
                       sizeof(tDot11fIEPowerConstraints));
     }
@@ -2752,7 +3013,7 @@
     }
     if (pBies->QBSSLoad.present)
     {
-        palCopyMemory(pMac->hHdd, &pBeaconStruct->QBSSLoad, &pBies->QBSSLoad, sizeof(tDot11fIEQBSSLoad));
+        vos_mem_copy( &pBeaconStruct->QBSSLoad, &pBies->QBSSLoad, sizeof(tDot11fIEQBSSLoad));
     }
 #endif
 
@@ -2774,31 +3035,31 @@
     if ( pBies->ChanSwitchAnn.present )
     {
         pBeaconStruct->channelSwitchPresent = 1;
-        palCopyMemory(pMac->hHdd, &pBeaconStruct->channelSwitchIE, &pBies->ChanSwitchAnn,
+        vos_mem_copy( &pBeaconStruct->channelSwitchIE, &pBies->ChanSwitchAnn,
                       sizeof(tDot11fIEChanSwitchAnn));
     }
 
     if ( pBies->ExtChanSwitchAnn.present)
     {
         pBeaconStruct->extChannelSwitchPresent= 1;
-        palCopyMemory(pMac->hHdd, &pBeaconStruct->extChannelSwitchIE, &pBies->ExtChanSwitchAnn,
+        vos_mem_copy( &pBeaconStruct->extChannelSwitchIE, &pBies->ExtChanSwitchAnn,
                       sizeof(tDot11fIEExtChanSwitchAnn));
     }
 
     if ( pBies->Quiet.present )
     {
         pBeaconStruct->quietIEPresent = 1;
-        palCopyMemory( pMac, &pBeaconStruct->quietIE, &pBies->Quiet, sizeof(tDot11fIEQuiet) );
+        vos_mem_copy( &pBeaconStruct->quietIE, &pBies->Quiet, sizeof(tDot11fIEQuiet) );
     }
 
     if ( pBies->HTCaps.present )
     {
-        palCopyMemory( pMac, &pBeaconStruct->HTCaps, &pBies->HTCaps, sizeof( tDot11fIEHTCaps ) );
+        vos_mem_copy( &pBeaconStruct->HTCaps, &pBies->HTCaps, sizeof( tDot11fIEHTCaps ) );
     }
 
     if ( pBies->HTInfo.present )
     {
-        palCopyMemory( pMac, &pBeaconStruct->HTInfo, &pBies->HTInfo, sizeof( tDot11fIEHTInfo ) );
+        vos_mem_copy( &pBeaconStruct->HTInfo, &pBies->HTInfo, sizeof( tDot11fIEHTInfo ) );
     }
 
     if ( pBies->DSParams.present )
@@ -2849,27 +3110,30 @@
 #ifdef WLAN_FEATURE_11AC
     if ( pBies->VHTCaps.present )
     {
-        pBeaconStruct->VHTCaps.present = 1;
-        palCopyMemory( pMac, &pBeaconStruct->VHTCaps, &pBies->VHTCaps, sizeof( tDot11fIEVHTCaps ) );
+         pBeaconStruct->VHTCaps.present = 1;
+         vos_mem_copy( &pBeaconStruct->VHTCaps, &pBies->VHTCaps, sizeof( tDot11fIEVHTCaps ) );
     }
     if ( pBies->VHTOperation.present )
     {
          pBeaconStruct->VHTOperation.present = 1;
-         palCopyMemory( pMac, &pBeaconStruct->VHTOperation, &pBies->VHTOperation, sizeof( tDot11fIEVHTOperation) );
+         vos_mem_copy( &pBeaconStruct->VHTOperation, &pBies->VHTOperation,
+                       sizeof( tDot11fIEVHTOperation) );
     }
     if ( pBies->VHTExtBssLoad.present )
     {
          pBeaconStruct->VHTExtBssLoad.present = 1;
-         palCopyMemory( pMac, &pBeaconStruct->VHTExtBssLoad, &pBies->VHTExtBssLoad, sizeof( tDot11fIEVHTExtBssLoad) );
+         vos_mem_copy( &pBeaconStruct->VHTExtBssLoad, &pBies->VHTExtBssLoad,
+                       sizeof( tDot11fIEVHTExtBssLoad) );
     }
     if( pBies->OperatingMode.present)
     {
         pBeaconStruct->OperatingMode.present = 1;
-        palCopyMemory( pMac, &pBeaconStruct->OperatingMode, &pBies->OperatingMode, sizeof( tDot11fIEOperatingMode) );
+        vos_mem_copy( &pBeaconStruct->OperatingMode, &pBies->OperatingMode,
+                      sizeof( tDot11fIEOperatingMode) );
     }
 
 #endif
-    palFreeMemory(pMac->hHdd, pBies);
+    vos_mem_free(pBies);
 
 
     return eSIR_SUCCESS;
@@ -2886,26 +3150,32 @@
     tANI_U8        *pPayload;
     tpSirMacMgmtHdr pHdr;
     tANI_U8         mappedRXCh;
+    tANI_U8         rfBand;
 
     pPayload = WDA_GET_RX_MPDU_DATA( pFrame );
     nPayload = WDA_GET_RX_PAYLOAD_LEN( pFrame );
     pHdr     = WDA_GET_RX_MAC_HEADER( pFrame );
     mappedRXCh = WDA_GET_RX_CH( pFrame );
+    rfBand = WDA_GET_RX_RFBAND( pFrame );
     
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pBeaconStruct, sizeof(tSirProbeRespBeacon) );
-    
-    status = palAllocateMemory(pMac->hHdd, (void **)&pBeacon, sizeof(tDot11fBeacon));
-    if(!HAL_STATUS_SUCCESS(status))
+    vos_mem_set( ( tANI_U8* )pBeaconStruct, sizeof(tSirProbeRespBeacon), 0 );
+
+    pBeacon = vos_mem_malloc(sizeof(tDot11fBeacon));
+    if ( NULL == pBeacon )
+        status = eHAL_STATUS_FAILURE;
+    else
+        status = eHAL_STATUS_SUCCESS;
+    if (!HAL_STATUS_SUCCESS(status))
     {
         limLog(pMac, LOGE, FL("Failed to allocate memory\n") );
         return eSIR_FAILURE;
     }
 
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pBeacon, sizeof(tDot11fBeacon) );
+    vos_mem_set( ( tANI_U8* )pBeacon, sizeof(tDot11fBeacon), 0 );
 
     // get the MAC address out of the BD,
-    palCopyMemory( pMac->hHdd, pBeaconStruct->bssid, pHdr->sa, 6 );
+    vos_mem_copy( pBeaconStruct->bssid, pHdr->sa, 6 );
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackBeacon( pMac, pPayload, nPayload, pBeacon );
@@ -2914,7 +3184,7 @@
         limLog(pMac, LOGE, FL("Failed to parse Beacon IEs (0x%08x, %d bytes):\n"),
                   status, nPayload);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pPayload, nPayload);)
-        palFreeMemory(pMac->hHdd, pBeacon);
+        vos_mem_free(pBeacon);
         return eSIR_FAILURE;
     }
     else if ( DOT11F_WARNED( status ) )
@@ -2926,7 +3196,8 @@
 
     // & "transliterate" from a 'tDot11fBeacon' to a 'tSirProbeRespBeacon'...
     // Timestamp
-    palCopyMemory( pMac->hHdd, ( tANI_U8* )pBeaconStruct->timeStamp, ( tANI_U8* )&pBeacon->TimeStamp, sizeof(tSirMacTimeStamp) );
+    vos_mem_copy( ( tANI_U8* )pBeaconStruct->timeStamp, ( tANI_U8* )&pBeacon->TimeStamp,
+                   sizeof(tSirMacTimeStamp) );
 
     // Beacon Interval
     pBeaconStruct->beaconInterval = pBeacon->BeaconInterval.interval;
@@ -3010,45 +3281,45 @@
     if ( pBeacon->ChanSwitchAnn.present )
     {
         pBeaconStruct->channelSwitchPresent = 1;
-        palCopyMemory( pMac, &pBeaconStruct->channelSwitchIE, &pBeacon->ChanSwitchAnn,
+        vos_mem_copy( &pBeaconStruct->channelSwitchIE, &pBeacon->ChanSwitchAnn,
                                                        sizeof(tDot11fIEChanSwitchAnn) );
     }
 
     if ( pBeacon->ExtChanSwitchAnn.present )
     {
         pBeaconStruct->extChannelSwitchPresent = 1;
-        palCopyMemory( pMac, &pBeaconStruct->extChannelSwitchIE, &pBeacon->ExtChanSwitchAnn,
+        vos_mem_copy( &pBeaconStruct->extChannelSwitchIE, &pBeacon->ExtChanSwitchAnn,
                                                        sizeof(tDot11fIEExtChanSwitchAnn) );
     }
 
     if( pBeacon->TPCReport.present)
     {
         pBeaconStruct->tpcReportPresent = 1;
-        palCopyMemory(pMac->hHdd, &pBeaconStruct->tpcReport, &pBeacon->TPCReport,
+        vos_mem_copy( &pBeaconStruct->tpcReport, &pBeacon->TPCReport,
                                                      sizeof(tDot11fIETPCReport));
     }
 
     if( pBeacon->PowerConstraints.present)
     {
         pBeaconStruct->powerConstraintPresent = 1;
-        palCopyMemory(pMac->hHdd, &pBeaconStruct->localPowerConstraint, &pBeacon->PowerConstraints,
+        vos_mem_copy( &pBeaconStruct->localPowerConstraint, &pBeacon->PowerConstraints,
                                                                sizeof(tDot11fIEPowerConstraints));
     }
 
     if ( pBeacon->Quiet.present )
     {
         pBeaconStruct->quietIEPresent = 1;
-        palCopyMemory( pMac, &pBeaconStruct->quietIE, &pBeacon->Quiet, sizeof(tDot11fIEQuiet));
+        vos_mem_copy( &pBeaconStruct->quietIE, &pBeacon->Quiet, sizeof(tDot11fIEQuiet));
     }
 
     if ( pBeacon->HTCaps.present )
     {
-        palCopyMemory( pMac, &pBeaconStruct->HTCaps, &pBeacon->HTCaps, sizeof( tDot11fIEHTCaps ) );
+        vos_mem_copy( &pBeaconStruct->HTCaps, &pBeacon->HTCaps, sizeof( tDot11fIEHTCaps ) );
     }
 
     if ( pBeacon->HTInfo.present )
     {
-        palCopyMemory( pMac, &pBeaconStruct->HTInfo, &pBeacon->HTInfo, sizeof( tDot11fIEHTInfo) );
+        vos_mem_copy( &pBeaconStruct->HTInfo, &pBeacon->HTInfo, sizeof( tDot11fIEHTInfo) );
 
     }
 
@@ -3063,7 +3334,21 @@
     }
     else
     {
-        pBeaconStruct->channelNumber = limUnmapChannel(mappedRXCh);
+       if ((!rfBand) || IS_5G_BAND(rfBand))
+           pBeaconStruct->channelNumber = limUnmapChannel(mappedRXCh);
+       else if (IS_24G_BAND(rfBand))
+           pBeaconStruct->channelNumber = mappedRXCh;
+       else
+       {
+           /*Only 0, 1, 2 are expected values for RF band from FW
+            * if FW fixes are not present then rf band value will
+            * be 0, else either 1 or 2 are expected from FW, 3 is
+            * not expected from FW */
+           PELOGE(limLog(pMac, LOGE,
+           FL("Channel info is not present in Beacon and"
+                   " mapping is not done correctly"));)
+           pBeaconStruct->channelNumber = mappedRXCh;
+       }
     }
 
     if ( pBeacon->RSN.present )
@@ -3108,50 +3393,59 @@
     {
         // MobilityDomain
         pBeaconStruct->mdiePresent = 1;
-        palCopyMemory( pMac->hHdd, (tANI_U8 *)&(pBeaconStruct->mdie[0]), (tANI_U8 *)&(pBeacon->MobilityDomain.MDID), sizeof(tANI_U16) );
+        vos_mem_copy( (tANI_U8 *)&(pBeaconStruct->mdie[0]),
+                      (tANI_U8 *)&(pBeacon->MobilityDomain.MDID), sizeof(tANI_U16) );
         pBeaconStruct->mdie[2] = ((pBeacon->MobilityDomain.overDSCap << 0) | (pBeacon->MobilityDomain.resourceReqCap << 1));
 
     }
 #endif
 
+#ifdef FEATURE_WLAN_CCX
+    if (pBeacon->CCXTxmitPower.present)
+    {
+        /* copy CCX TPC info element */
+        pBeaconStruct->ccxTxPwr.present = 1;
+        vos_mem_copy( &pBeaconStruct->ccxTxPwr,
+                      &pBeacon->CCXTxmitPower,
+                      sizeof(tDot11fIECCXTxmitPower));
+    }
+    if (pBeacon->QBSSLoad.present)
+    {
+        vos_mem_copy(&pBeaconStruct->QBSSLoad,
+                     &pBeacon->QBSSLoad,
+                     sizeof(tDot11fIEQBSSLoad));
+    }
+#endif
+
 #ifdef WLAN_FEATURE_11AC
     if ( pBeacon->VHTCaps.present )
     {
-        palCopyMemory( pMac, &pBeaconStruct->VHTCaps, &pBeacon->VHTCaps, sizeof( tDot11fIEVHTCaps ) );
+        vos_mem_copy( &pBeaconStruct->VHTCaps, &pBeacon->VHTCaps, sizeof( tDot11fIEVHTCaps ) );
     }
     if ( pBeacon->VHTOperation.present )
     {
-        palCopyMemory( pMac, &pBeaconStruct->VHTOperation, &pBeacon->VHTOperation, sizeof( tDot11fIEVHTOperation) );
+        vos_mem_copy( &pBeaconStruct->VHTOperation, &pBeacon->VHTOperation,
+                      sizeof( tDot11fIEVHTOperation) );
     }
     if ( pBeacon->VHTExtBssLoad.present )
     {
-        palCopyMemory( pMac, &pBeaconStruct->VHTExtBssLoad, &pBeacon->VHTExtBssLoad, sizeof( tDot11fIEVHTExtBssLoad) );
+        vos_mem_copy( &pBeaconStruct->VHTExtBssLoad, &pBeacon->VHTExtBssLoad,
+                      sizeof( tDot11fIEVHTExtBssLoad) );
     }
     if(pBeacon->OperatingMode.present)
     {
-        palCopyMemory( pMac, &pBeaconStruct->OperatingMode, &pBeacon->OperatingMode, sizeof( tDot11fIEOperatingMode) );
+        vos_mem_copy( &pBeaconStruct->OperatingMode, &pBeacon->OperatingMode,
+                      sizeof( tDot11fIEOperatingMode) );
     }
     if(pBeacon->WiderBWChanSwitchAnn.present)
     {
         pBeaconStruct->WiderBWChanSwitchAnnPresent = 1;
-        palCopyMemory( pMac, &pBeaconStruct->WiderBWChanSwitchAnn, &pBeacon->WiderBWChanSwitchAnn, sizeof( tDot11fIEWiderBWChanSwitchAnn));
+        vos_mem_copy( &pBeaconStruct->WiderBWChanSwitchAnn, &pBeacon->WiderBWChanSwitchAnn,
+                      sizeof( tDot11fIEWiderBWChanSwitchAnn));
     }      
 #endif
 
-#ifdef FEATURE_WLAN_CCX
-    /* copy CCX TPC info element */
-    if (pBeacon->CCXTxmitPower.present) {
-        pBeaconStruct->ccxTxPwr.present = 1;
-        pBeaconStruct->ccxTxPwr.power_limit =
-          pBeacon->CCXTxmitPower.power_limit;
-    }
-    if (pBeacon->QBSSLoad.present) {
-        palCopyMemory(pMac, &pBeaconStruct->QBSSLoad, &pBeacon->QBSSLoad,
-          sizeof(tDot11fIEQBSSLoad));
-    }
-#endif
-
-    palFreeMemory(pMac->hHdd, pBeacon);
+    vos_mem_free(pBeacon);
     return eSIR_SUCCESS;
 
 } // End sirConvertBeaconFrame2Struct.
@@ -3166,7 +3460,7 @@
     tANI_U32                   status;
 
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pAuth, sizeof(tSirMacAuthFrameBody) );
+    vos_mem_set( ( tANI_U8* )pAuth, sizeof(tSirMacAuthFrameBody), 0 );
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackAuthentication( pMac, pFrame, nFrame, &auth );
@@ -3193,7 +3487,7 @@
     {
         pAuth->type   = SIR_MAC_CHALLENGE_TEXT_EID;
         pAuth->length = auth.ChallengeText.num_text;
-        palCopyMemory( pMac->hHdd, pAuth->challengeText, auth.ChallengeText.text, auth.ChallengeText.num_text );
+        vos_mem_copy( pAuth->challengeText, auth.ChallengeText.text, auth.ChallengeText.num_text );
     }
 
     return eSIR_SUCCESS;
@@ -3222,7 +3516,7 @@
     }
 
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pAddTs, sizeof(tSirAddtsReqInfo) );
+    vos_mem_set( ( tANI_U8* )pAddTs, sizeof(tSirAddtsReqInfo), 0 );
 
     // delegate to the framesc-generated code,
     switch ( *pFrame )
@@ -3370,9 +3664,9 @@
     }
 
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pAddTs, sizeof(tSirAddtsRspInfo) );
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&addts, sizeof(tDot11fAddTSResponse) );
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )&wmmaddts, sizeof(tDot11fWMMAddTSResponse) );
+    vos_mem_set( ( tANI_U8* )pAddTs, sizeof(tSirAddtsRspInfo), 0 );
+    vos_mem_set( ( tANI_U8* )&addts, sizeof(tDot11fAddTSResponse), 0 );
+    vos_mem_set( ( tANI_U8* )&wmmaddts, sizeof(tDot11fWMMAddTSResponse), 0 );
 
 
     // delegate to the framesc-generated code,
@@ -3460,7 +3754,7 @@
         if(addts.CCXTrafStrmMet.present)
         {
             pAddTs->tsmPresent = 1;
-            palCopyMemory(pMac->hHdd,&pAddTs->tsmIE.tsid,
+            vos_mem_copy(&pAddTs->tsmIE.tsid,
                       &addts.CCXTrafStrmMet.tsid,sizeof(tSirMacCCXTSMIE));
         }
 #endif
@@ -3530,7 +3824,7 @@
         if(wmmaddts.CCXTrafStrmMet.present)
         {
             pAddTs->tsmPresent = 1;
-            palCopyMemory(pMac->hHdd,&pAddTs->tsmIE.tsid,
+            vos_mem_copy(&pAddTs->tsmIE.tsid,
                          &wmmaddts.CCXTrafStrmMet.tsid,sizeof(tSirMacCCXTSMIE));
         }
 #endif
@@ -3561,7 +3855,7 @@
     }
 
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pDelTs, sizeof(tSirDeltsReqInfo) );
+    vos_mem_set( ( tANI_U8* )pDelTs, sizeof(tSirDeltsReqInfo), 0 );
 
     // delegate to the framesc-generated code,
     switch ( *pFrame )
@@ -3642,7 +3936,7 @@
     tANI_U32                   status;
 
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pTpcReqFrame, sizeof(tSirMacTpcReqActionFrame) );
+    vos_mem_set( ( tANI_U8* )pTpcReqFrame, sizeof(tSirMacTpcReqActionFrame), 0 );
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackTPCRequest( pMac, pFrame, nFrame, &req );
@@ -3691,7 +3985,7 @@
     tANI_U32                       status;
 
     // Zero-init our [out] parameter,
-    palZeroMemory( pMac->hHdd, ( tANI_U8* )pMeasReqFrame, sizeof(tpSirMacMeasReqActionFrame) );
+    vos_mem_set( ( tANI_U8* )pMeasReqFrame, sizeof(tpSirMacMeasReqActionFrame), 0 );
 
     // delegate to the framesc-generated code,
     status = dot11fUnpackMeasurementRequest( pMac, pFrame, nFrame, &mr );
@@ -3736,7 +4030,7 @@
 
     pMeasReqFrame->measReqIE.measReqField.channelNumber = mr.MeasurementRequest[0].channel_no;
 
-    palCopyMemory( pMac->hHdd, pMeasReqFrame->measReqIE.measReqField.measStartTime,
+    vos_mem_copy(  pMeasReqFrame->measReqIE.measReqField.measStartTime,
                    mr.MeasurementRequest[0].meas_start_time, 8 );
 
     pMeasReqFrame->measReqIE.measReqField.measDuration = mr.MeasurementRequest[0].meas_duration;
@@ -3822,14 +4116,51 @@
 
 } // End PopulateDot11fWMMTSPEC.
 
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX)
+// Fill the CCX version currently supported
+void PopulateDot11fCCXVersion(tDot11fIECCXVersion *pCCXVersion)
+{
+    pCCXVersion->present = 1;
+    pCCXVersion->version = CCX_VERSION_SUPPORTED;
+}
+// Fill the CCX ie for the station.
+// The State is Normal (1)
+// The MBSSID for station is set to 0.
+void PopulateDot11fCCXRadMgmtCap(tDot11fIECCXRadMgmtCap *pCCXRadMgmtCap)
+{
+    pCCXRadMgmtCap->present = 1;
+    pCCXRadMgmtCap->mgmt_state = RM_STATE_NORMAL;
+    pCCXRadMgmtCap->mbssid_mask = 0;
+    pCCXRadMgmtCap->reserved = 0;
+}
+tSirRetStatus PopulateDot11fCCXCckmOpaque( tpAniSirGlobal pMac,
+                                           tpSirCCKMie    pCCKMie,
+                                           tDot11fIECCXCckmOpaque *pDot11f )
+{
+    int idx;
+    if ( pCCKMie->length )
+    {
+        if( 0 <= ( idx = FindIELocation( pMac, (tpSirRSNie)pCCKMie,
+                                         DOT11F_EID_CCXCCKMOPAQUE ) ) )
+        {
+            pDot11f->present  = 1;
+            // Dont include OUI
+            pDot11f->num_data = pCCKMie->cckmIEdata[ idx + 1 ] - 4;
+            palCopyMemory( pMac->hHdd, pDot11f->data,
+                           pCCKMie->cckmIEdata + idx + 2 + 4, //EID,len,OUI
+                           pCCKMie->cckmIEdata[ idx + 1 ] - 4 ); // Skip OUI
+        }
+    }
+    return eSIR_SUCCESS;
+} // End PopulateDot11fCCXCckmOpaque.
+
 void PopulateDot11TSRSIE(tpAniSirGlobal  pMac,
                                tSirMacCCXTSRSIE     *pOld,
                                tDot11fIECCXTrafStrmRateSet  *pDot11f,
                                tANI_U8 rate_length)
 {
     pDot11f->tsid = pOld->tsid;
-    palCopyMemory(pMac->hHdd,pDot11f->tsrates, pOld->rates,rate_length);
+    vos_mem_copy(pDot11f->tsrates, pOld->rates,rate_length);
     pDot11f->num_tsrates = rate_length;
     pDot11f->present = 1;
 }
@@ -3848,22 +4179,22 @@
     switch ( pDot11f->classifier_type )
     {
     case SIR_MAC_TCLASTYPE_ETHERNET:
-        palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.EthParams.source,
-                       ( tANI_U8* )&pOld->tclasParams.eth.srcAddr, 6 );
-        palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.EthParams.dest,
-                       ( tANI_U8* )&pOld->tclasParams.eth.dstAddr, 6 );
+        vos_mem_copy( ( tANI_U8* )&pDot11f->info.EthParams.source,
+                      ( tANI_U8* )&pOld->tclasParams.eth.srcAddr, 6 );
+        vos_mem_copy( ( tANI_U8* )&pDot11f->info.EthParams.dest,
+                      ( tANI_U8* )&pOld->tclasParams.eth.dstAddr, 6 );
         pDot11f->info.EthParams.type = pOld->tclasParams.eth.type;
         break;
     case SIR_MAC_TCLASTYPE_TCPUDPIP:
         pDot11f->info.IpParams.version = pOld->version;
         if ( SIR_MAC_TCLAS_IPV4 == pDot11f->info.IpParams.version )
         {
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
-                           IpV4Params.source,
-                           ( tANI_U8* )pOld->tclasParams.ipv4.srcIpAddr, 4 );
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
-                           IpV4Params.dest,
-                           ( tANI_U8* )pOld->tclasParams.ipv4.dstIpAddr, 4 );
+            vos_mem_copy( ( tANI_U8* )&pDot11f->info.IpParams.params.
+                          IpV4Params.source,
+                          ( tANI_U8* )pOld->tclasParams.ipv4.srcIpAddr, 4 );
+            vos_mem_copy( ( tANI_U8* )&pDot11f->info.IpParams.params.
+                          IpV4Params.dest,
+                          ( tANI_U8* )pOld->tclasParams.ipv4.dstIpAddr, 4 );
             pDot11f->info.IpParams.params.IpV4Params.src_port  =
               pOld->tclasParams.ipv4.srcPort;
             pDot11f->info.IpParams.params.IpV4Params.dest_port =
@@ -3877,17 +4208,17 @@
         }
         else
         {
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
+            vos_mem_copy(  ( tANI_U8* )&pDot11f->info.IpParams.params.
                            IpV6Params.source,
                            ( tANI_U8* )pOld->tclasParams.ipv6.srcIpAddr, 16 );
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
+            vos_mem_copy(  ( tANI_U8* )&pDot11f->info.IpParams.params.
                            IpV6Params.dest,
                            ( tANI_U8* )pOld->tclasParams.ipv6.dstIpAddr, 16 );
             pDot11f->info.IpParams.params.IpV6Params.src_port  =
               pOld->tclasParams.ipv6.srcPort;
             pDot11f->info.IpParams.params.IpV6Params.dest_port =
               pOld->tclasParams.ipv6.dstPort;
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
+            vos_mem_copy(  ( tANI_U8* )&pDot11f->info.IpParams.params.
                            IpV6Params.flow_label,
                            ( tANI_U8* )pOld->tclasParams.ipv6.flowLabel, 3 );
         }
@@ -3920,9 +4251,9 @@
     switch ( pDot11f->classifier_type )
     {
     case SIR_MAC_TCLASTYPE_ETHERNET:
-        palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.EthParams.source,
+        vos_mem_copy(  ( tANI_U8* )&pDot11f->info.EthParams.source,
                        ( tANI_U8* )&pOld->tclasParams.eth.srcAddr, 6 );
-        palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.EthParams.dest,
+        vos_mem_copy(  ( tANI_U8* )&pDot11f->info.EthParams.dest,
                        ( tANI_U8* )&pOld->tclasParams.eth.dstAddr, 6 );
         pDot11f->info.EthParams.type = pOld->tclasParams.eth.type;
         break;
@@ -3930,10 +4261,10 @@
         pDot11f->info.IpParams.version = pOld->version;
         if ( SIR_MAC_TCLAS_IPV4 == pDot11f->info.IpParams.version )
         {
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
+            vos_mem_copy(  ( tANI_U8* )&pDot11f->info.IpParams.params.
                            IpV4Params.source,
                            ( tANI_U8* )pOld->tclasParams.ipv4.srcIpAddr, 4 );
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
+            vos_mem_copy(  ( tANI_U8* )&pDot11f->info.IpParams.params.
                            IpV4Params.dest,
                            ( tANI_U8* )pOld->tclasParams.ipv4.dstIpAddr, 4 );
             pDot11f->info.IpParams.params.IpV4Params.src_port  =
@@ -3949,17 +4280,17 @@
         }
         else
         {
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
+            vos_mem_copy( ( tANI_U8* )&pDot11f->info.IpParams.params.
                            IpV6Params.source,
                            ( tANI_U8* )pOld->tclasParams.ipv6.srcIpAddr, 16 );
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
+            vos_mem_copy(  ( tANI_U8* )&pDot11f->info.IpParams.params.
                            IpV6Params.dest,
                            ( tANI_U8* )pOld->tclasParams.ipv6.dstIpAddr, 16 );
             pDot11f->info.IpParams.params.IpV6Params.src_port  =
               pOld->tclasParams.ipv6.srcPort;
             pDot11f->info.IpParams.params.IpV6Params.dest_port =
               pOld->tclasParams.ipv6.dstPort;
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pDot11f->info.IpParams.params.
+            vos_mem_copy(  ( tANI_U8* )&pDot11f->info.IpParams.params.
                            IpV6Params.flow_label,
                            ( tANI_U8* )pOld->tclasParams.ipv6.flowLabel, 3 );
         }
@@ -4122,7 +4453,7 @@
     if(pSirWPSProbeRspIE->FieldPresent & SIR_WPS_PROBRSP_UUIDE_PRESENT)
     {
         pDot11f->UUID_E.present = 1;
-        palCopyMemory(pMac->hHdd, pDot11f->UUID_E.uuid, pSirWPSProbeRspIE->UUID_E, WNI_CFG_WPS_UUID_LEN);
+        vos_mem_copy(pDot11f->UUID_E.uuid, pSirWPSProbeRspIE->UUID_E, WNI_CFG_WPS_UUID_LEN);
     }
     else
         pDot11f->UUID_E.present = 0;
@@ -4131,7 +4462,8 @@
     {
         pDot11f->Manufacturer.present = 1;
         pDot11f->Manufacturer.num_name = pSirWPSProbeRspIE->Manufacture.num_name;
-        palCopyMemory(pMac->hHdd, pDot11f->Manufacturer.name, pSirWPSProbeRspIE->Manufacture.name, pSirWPSProbeRspIE->Manufacture.num_name);
+        vos_mem_copy(pDot11f->Manufacturer.name, pSirWPSProbeRspIE->Manufacture.name,
+                     pSirWPSProbeRspIE->Manufacture.num_name);
     } 
     else
         pDot11f->Manufacturer.present = 0;
@@ -4140,7 +4472,8 @@
     {
         pDot11f->ModelName.present = 1;
         pDot11f->ModelName.num_text = pSirWPSProbeRspIE->ModelName.num_text;
-        palCopyMemory(pMac->hHdd, pDot11f->ModelName.text, pSirWPSProbeRspIE->ModelName.text, pDot11f->ModelName.num_text);
+        vos_mem_copy(pDot11f->ModelName.text, pSirWPSProbeRspIE->ModelName.text,
+                     pDot11f->ModelName.num_text);
     }
     else
       pDot11f->ModelName.present = 0;
@@ -4149,7 +4482,8 @@
     {
         pDot11f->ModelNumber.present = 1;
         pDot11f->ModelNumber.num_text = pSirWPSProbeRspIE->ModelNumber.num_text;
-        palCopyMemory(pMac->hHdd, pDot11f->ModelNumber.text, pSirWPSProbeRspIE->ModelNumber.text, pDot11f->ModelNumber.num_text);
+        vos_mem_copy(pDot11f->ModelNumber.text, pSirWPSProbeRspIE->ModelNumber.text,
+                     pDot11f->ModelNumber.num_text);
     }
     else
         pDot11f->ModelNumber.present = 0;
@@ -4158,7 +4492,8 @@
     {
         pDot11f->SerialNumber.present = 1;
         pDot11f->SerialNumber.num_text = pSirWPSProbeRspIE->SerialNumber.num_text;
-        palCopyMemory(pMac->hHdd, pDot11f->SerialNumber.text, pSirWPSProbeRspIE->SerialNumber.text, pDot11f->SerialNumber.num_text);
+        vos_mem_copy(pDot11f->SerialNumber.text, pSirWPSProbeRspIE->SerialNumber.text,
+                     pDot11f->SerialNumber.num_text);
     }
     else
         pDot11f->SerialNumber.present = 0;
@@ -4166,7 +4501,8 @@
     if(pSirWPSProbeRspIE->FieldPresent & SIR_WPS_PROBRSP_PRIMARYDEVICETYPE_PRESENT)
     {
         pDot11f->PrimaryDeviceType.present = 1;
-        palCopyMemory(pMac->hHdd, pDot11f->PrimaryDeviceType.oui, pSirWPSProbeRspIE->PrimaryDeviceOUI, sizeof(pSirWPSProbeRspIE->PrimaryDeviceOUI)); 
+        vos_mem_copy(pDot11f->PrimaryDeviceType.oui, pSirWPSProbeRspIE->PrimaryDeviceOUI,
+                     sizeof(pSirWPSProbeRspIE->PrimaryDeviceOUI));
         pDot11f->PrimaryDeviceType.primary_category = (tANI_U16)pSirWPSProbeRspIE->PrimaryDeviceCategory;
         pDot11f->PrimaryDeviceType.sub_category = (tANI_U16)pSirWPSProbeRspIE->DeviceSubCategory;
     }
@@ -4177,7 +4513,8 @@
     {
         pDot11f->DeviceName.present = 1;
         pDot11f->DeviceName.num_text = pSirWPSProbeRspIE->DeviceName.num_text;
-        palCopyMemory(pMac->hHdd, pDot11f->DeviceName.text, pSirWPSProbeRspIE->DeviceName.text, pDot11f->DeviceName.num_text);
+        vos_mem_copy(pDot11f->DeviceName.text, pSirWPSProbeRspIE->DeviceName.text,
+                     pDot11f->DeviceName.num_text);
     }
     else
         pDot11f->DeviceName.present = 0;
@@ -4296,7 +4633,7 @@
     if(pSirWPSBeaconIE->FieldPresent & SIR_WPS_BEACON_UUIDE_PRESENT)
     {
         pDot11f->UUID_E.present = 1;
-        palCopyMemory(pMac->hHdd, pDot11f->UUID_E.uuid, pSirWPSBeaconIE->UUID_E, WNI_CFG_WPS_UUID_LEN);
+        vos_mem_copy(pDot11f->UUID_E.uuid, pSirWPSBeaconIE->UUID_E, WNI_CFG_WPS_UUID_LEN);
     }
     else
         pDot11f->UUID_E.present = 0;
@@ -4610,20 +4947,22 @@
 
      pDot11f->report.Beacon.regClass = pBeaconReport->regClass;
      pDot11f->report.Beacon.channel = pBeaconReport->channel;
-     palCopyMemory( pMac->hHdd, pDot11f->report.Beacon.meas_start_time, pBeaconReport->measStartTime, sizeof(pDot11f->report.Beacon.meas_start_time) );
+     vos_mem_copy( pDot11f->report.Beacon.meas_start_time, pBeaconReport->measStartTime,
+                   sizeof(pDot11f->report.Beacon.meas_start_time) );
      pDot11f->report.Beacon.meas_duration = pBeaconReport->measDuration;
      pDot11f->report.Beacon.condensed_PHY = pBeaconReport->phyType;
      pDot11f->report.Beacon.reported_frame_type = !pBeaconReport->bcnProbeRsp;
      pDot11f->report.Beacon.RCPI = pBeaconReport->rcpi;
      pDot11f->report.Beacon.RSNI = pBeaconReport->rsni;
-     palCopyMemory( pMac->hHdd, pDot11f->report.Beacon.BSSID, pBeaconReport->bssid, sizeof(tSirMacAddr));
+     vos_mem_copy( pDot11f->report.Beacon.BSSID, pBeaconReport->bssid, sizeof(tSirMacAddr));
      pDot11f->report.Beacon.antenna_id = pBeaconReport->antennaId;
      pDot11f->report.Beacon.parent_TSF = pBeaconReport->parentTSF;
 
      if( pBeaconReport->numIes )
      {
           pDot11f->report.Beacon.BeaconReportFrmBody.present = 1;
-          palCopyMemory( pMac->hHdd, pDot11f->report.Beacon.BeaconReportFrmBody.reportedFields, pBeaconReport->Ies, pBeaconReport->numIes );
+          vos_mem_copy( pDot11f->report.Beacon.BeaconReportFrmBody.reportedFields,
+                        pBeaconReport->Ies, pBeaconReport->numIes );
           pDot11f->report.Beacon.BeaconReportFrmBody.num_reportedFields = pBeaconReport->numIes;
      }
 
diff --git a/CORE/SYS/legacy/src/utils/src/utilsParser.c b/CORE/SYS/legacy/src/utils/src/utilsParser.c
index 2451cef..ad50322 100644
--- a/CORE/SYS/legacy/src/utils/src/utilsParser.c
+++ b/CORE/SYS/legacy/src/utils/src/utilsParser.c
@@ -26,7 +26,6 @@
  */
 
 /*
- *
  * Airgo Networks, Inc proprietary. All rights reserved.
  * This file utilsParser.cc contains the code for parsing
  * 802.11 messages.
@@ -47,7 +46,7 @@
                        tDot11fIESSID    *pNew)
 {
     pOld->length = pNew->num_ssid;
-    palCopyMemory( pMac->hHdd, pOld->ssId, pNew->ssid, pNew->num_ssid );
+    vos_mem_copy( pOld->ssId, pNew->ssid, pNew->num_ssid );
 }
 
 void ConvertSuppRates(tpAniSirGlobal   pMac,
@@ -55,7 +54,7 @@
                             tDot11fIESuppRates *pNew)
 {
     pOld->numRates = pNew->num_rates;
-    palCopyMemory( pMac->hHdd, pOld->rate, pNew->rates, pNew->num_rates );
+    vos_mem_copy( pOld->rate, pNew->rates, pNew->num_rates );
 }
 
 void ConvertExtSuppRates(tpAniSirGlobal      pMac,
@@ -63,7 +62,7 @@
                                tDot11fIEExtSuppRates *pNew)
 {
     pOld->numRates = pNew->num_rates;
-    palCopyMemory( pMac->hHdd, pOld->rate, pNew->rates, pNew->num_rates );
+    vos_mem_copy(  pOld->rate, pNew->rates, pNew->num_rates );
 }
 
 
@@ -111,7 +110,7 @@
     }
 
     pOld->length = (tANI_U8)written - 2;
-    palCopyMemory( pMac->hHdd, pOld->info, buffer + 2, pOld->length );
+    vos_mem_copy( pOld->info, buffer + 2, pOld->length );
 
     return eSIR_SUCCESS;
 }
@@ -127,7 +126,7 @@
     pOld->info[ 1 ] = 0x50;
     pOld->info[ 2 ] = 0xf2;
     pOld->info[ 3 ] = 0x01;
-    palCopyMemory( pMac->hHdd, pOld->info + 4, pNew->data, pNew->num_data );
+    vos_mem_copy( pOld->info + 4, pNew->data, pNew->num_data );
 
     return eSIR_SUCCESS;
 }
@@ -147,7 +146,7 @@
     pOld->addIEdata[ curAddIELen++ ] = 0x50;
     pOld->addIEdata[ curAddIELen++ ] = 0xf2;
     pOld->addIEdata[ curAddIELen++ ] = 0x04;
-    palCopyMemory( pMac->hHdd, pOld->addIEdata + curAddIELen, pNew->data, pNew->num_data );
+    vos_mem_copy( pOld->addIEdata + curAddIELen, pNew->data, pNew->num_data );
 
     return eSIR_SUCCESS;
 }
@@ -167,7 +166,7 @@
     pOld->addIEdata[ curAddIELen++ ] = 0x6f;
     pOld->addIEdata[ curAddIELen++ ] = 0x9A;
     pOld->addIEdata[ curAddIELen++ ] = 0x09;
-    palCopyMemory( pMac->hHdd, pOld->addIEdata + curAddIELen, pNew->data, pNew->num_data );
+    vos_mem_copy( pOld->addIEdata + curAddIELen, pNew->data, pNew->num_data );
 
     return eSIR_SUCCESS;
 }
@@ -188,7 +187,7 @@
     pOld->addIEdata[ curAddIELen++ ] = 0x6f;
     pOld->addIEdata[ curAddIELen++ ] = 0x9A;
     pOld->addIEdata[ curAddIELen++ ] = 0x0a;
-    palCopyMemory( pMac->hHdd, pOld->addIEdata + curAddIELen, pNew->data, pNew->num_data );
+    vos_mem_copy( pOld->addIEdata + curAddIELen, pNew->data, pNew->num_data );
 
     return eSIR_SUCCESS;
 }
@@ -209,7 +208,7 @@
     }
 
     pOld->length = (tANI_U8)written - 2;
-    palCopyMemory( pMac->hHdd, pOld->info, buffer + 2, pOld->length );
+    vos_mem_copy( pOld->info, buffer + 2, pOld->length );
 
     return eSIR_SUCCESS;
 }
@@ -221,7 +220,7 @@
     // This is awful, I know, but the old code just rammed the IE into
     // an opaque array.
     pOld->length = pNew->num_data;
-    palCopyMemory( pMac->hHdd, pOld->info, pNew->data, pOld->length );
+    vos_mem_copy( pOld->info, pNew->data, pOld->length );
 
     return eSIR_SUCCESS;
 }
@@ -242,7 +241,7 @@
 {
     pOld->type   = 36;
     pOld->length = ( pNew->num_bands * 2 );
-    palCopyMemory( pMac->hHdd, ( tANI_U8* )pOld->supportedChannels, ( tANI_U8* )pNew->bands, pOld->length );
+    vos_mem_copy( ( tANI_U8* )pOld->supportedChannels, ( tANI_U8* )pNew->bands, pOld->length );
 }
 
 void ConvertCFParams(tpAniSirGlobal     pMac,
@@ -255,6 +254,16 @@
     pOld->cfpDurRemaining = pNew->cfp_durremaining;
 }
 
+void ConvertFHParams (tpAniSirGlobal        pMac,
+                      tSirMacFHParamSet    *pOld,
+                      tDot11fIEFHParamSet  *pNew)
+{
+    pOld->dwellTime   = pNew->dwell_time;
+    pOld->hopSet      = pNew->hop_set;
+    pOld->hopPattern  = pNew->hop_pattern;
+    pOld->hopIndex    = pNew->hop_index;
+}
+
 void ConvertTIM(tpAniSirGlobal pMac,
                       tSirMacTim    *pOld,
                       tDot11fIETIM     *pNew)
@@ -264,7 +273,7 @@
     pOld->bitmapControl = pNew->bmpctl;
     pOld->bitmapLength  = pNew->num_vbmp;
 
-    palCopyMemory( pMac->hHdd, pOld->bitmap, pNew->vbmp, pNew->num_vbmp );
+    vos_mem_copy( pOld->bitmap, pNew->vbmp, pNew->num_vbmp );
 }
 
 void ConvertCountry(tpAniSirGlobal          pMac,
@@ -273,7 +282,7 @@
 {
     int i;
 
-    palCopyMemory( pMac->hHdd, pOld->countryString, pNew->country, COUNTRY_STRING_LENGTH );
+    vos_mem_copy( pOld->countryString, pNew->country, COUNTRY_STRING_LENGTH );
 
     pOld->numIntervals = pNew->num_triplets;
 
@@ -292,7 +301,7 @@
     pOld->type = 221;
     pOld->length = 24;
 
-    palCopyMemory( pMac->hHdd, ( tANI_U8* )&pOld->qosInfo, ( tANI_U8* )&pNew->qosInfo, 1 );
+    vos_mem_copy( ( tANI_U8* )&pOld->qosInfo, ( tANI_U8* )&pNew->qosInfo, 1 );
 
     pOld->acbe.aci.aifsn  = pNew->acbe_aifsn;
     pOld->acbe.aci.acm    = pNew->acbe_acm;
@@ -339,7 +348,7 @@
     pOld->type   = 12;
     pOld->length = 20;
 
-    palCopyMemory( pMac->hHdd, ( tANI_U8* )&pOld->qosInfo, ( tANI_U8* )&pNew->qos, 1 );
+    vos_mem_copy( ( tANI_U8* )&pOld->qosInfo, ( tANI_U8* )&pNew->qos, 1 );
 
     pOld->acbe.aci.aifsn  = pNew->acbe_aifsn;
     pOld->acbe.aci.acm    = pNew->acbe_acm;
@@ -423,8 +432,8 @@
     switch ( pNew->classifier_type )
     {
     case 0:
-        palCopyMemory( pMac->hHdd, pOld->tclasParams.eth.srcAddr, pNew->info.EthParams.source, 6 );
-        palCopyMemory( pMac->hHdd, pOld->tclasParams.eth.dstAddr, pNew->info.EthParams.dest, 6 );
+        vos_mem_copy( pOld->tclasParams.eth.srcAddr, pNew->info.EthParams.source, 6 );
+        vos_mem_copy( pOld->tclasParams.eth.dstAddr, pNew->info.EthParams.dest, 6 );
         pOld->tclasParams.eth.type = pNew->info.EthParams.type;
         break;
     case 1:
@@ -432,8 +441,10 @@
         if ( 4 == pNew->info.IpParams.version )
         {
             pOld->tclasParams.ipv4.version = 4;
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pOld->tclasParams.ipv4.srcIpAddr, ( tANI_U8* )pNew->info.IpParams.params.IpV4Params.source, 4 );
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pOld->tclasParams.ipv4.dstIpAddr, ( tANI_U8* )pNew->info.IpParams.params.IpV4Params.dest, 4 );
+            vos_mem_copy( ( tANI_U8* )&pOld->tclasParams.ipv4.srcIpAddr,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV4Params.source, 4 );
+            vos_mem_copy( ( tANI_U8* )&pOld->tclasParams.ipv4.dstIpAddr,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV4Params.dest, 4 );
             pOld->tclasParams.ipv4.srcPort  = pNew->info.IpParams.params.IpV4Params.src_port;
             pOld->tclasParams.ipv4.dstPort  = pNew->info.IpParams.params.IpV4Params.dest_port;
             pOld->tclasParams.ipv4.dscp     = pNew->info.IpParams.params.IpV4Params.DSCP;
@@ -443,11 +454,14 @@
         else if ( 6 == pNew->info.IpParams.version )
         {
             pOld->tclasParams.ipv6.version = 6;
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )pOld->tclasParams.ipv6.srcIpAddr, ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.source, 16 );
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )pOld->tclasParams.ipv6.dstIpAddr, ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.dest, 16 );
+            vos_mem_copy( ( tANI_U8* )pOld->tclasParams.ipv6.srcIpAddr,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.source, 16 );
+            vos_mem_copy( ( tANI_U8* )pOld->tclasParams.ipv6.dstIpAddr,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.dest, 16 );
             pOld->tclasParams.ipv6.srcPort  = pNew->info.IpParams.params.IpV6Params.src_port;
             pOld->tclasParams.ipv6.dstPort  = pNew->info.IpParams.params.IpV6Params.dest_port;
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )pOld->tclasParams.ipv6.flowLabel, ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.flow_label, 3 );
+            vos_mem_copy( ( tANI_U8* )pOld->tclasParams.ipv6.flowLabel,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.flow_label, 3 );
         }
         else
         {
@@ -476,7 +490,7 @@
     pOld->tsinfo.traffic.psb          = (tANI_U16)pNew->psb;
     pOld->tsinfo.traffic.userPrio     = (tANI_U16)pNew->user_priority;
     pOld->tsinfo.traffic.ackPolicy    = (tANI_U16)pNew->tsinfo_ack_pol;
-    pOld->nomMsduSz                   = pNew->size;
+    pOld->nomMsduSz                   = (pNew->fixed << 15) | pNew->size;
     pOld->maxMsduSz                   = pNew->max_msdu_size;
     pOld->minSvcInterval              = pNew->min_service_int;
     pOld->maxSvcInterval              = pNew->max_service_int;
@@ -513,8 +527,8 @@
     switch ( pNew->classifier_type )
     {
     case 0:
-        palCopyMemory( pMac->hHdd, pOld->tclasParams.eth.srcAddr, pNew->info.EthParams.source, 6 );
-        palCopyMemory( pMac->hHdd, pOld->tclasParams.eth.dstAddr, pNew->info.EthParams.dest, 6 );
+        vos_mem_copy(  pOld->tclasParams.eth.srcAddr, pNew->info.EthParams.source, 6 );
+        vos_mem_copy( pOld->tclasParams.eth.dstAddr, pNew->info.EthParams.dest, 6 );
         pOld->tclasParams.eth.type = pNew->info.EthParams.type;
         break;
     case 1:
@@ -522,8 +536,10 @@
         if ( 4 == pNew->info.IpParams.version )
         {
             pOld->tclasParams.ipv4.version = 4;
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pOld->tclasParams.ipv4.srcIpAddr, ( tANI_U8* )pNew->info.IpParams.params.IpV4Params.source, 4 );
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )&pOld->tclasParams.ipv4.dstIpAddr, ( tANI_U8* )pNew->info.IpParams.params.IpV4Params.dest, 4 );
+            vos_mem_copy( ( tANI_U8* )&pOld->tclasParams.ipv4.srcIpAddr,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV4Params.source, 4 );
+            vos_mem_copy( ( tANI_U8* )&pOld->tclasParams.ipv4.dstIpAddr,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV4Params.dest, 4 );
             pOld->tclasParams.ipv4.srcPort  = pNew->info.IpParams.params.IpV4Params.src_port;
             pOld->tclasParams.ipv4.dstPort  = pNew->info.IpParams.params.IpV4Params.dest_port;
             pOld->tclasParams.ipv4.dscp     = pNew->info.IpParams.params.IpV4Params.DSCP;
@@ -533,11 +549,14 @@
         else if ( 6 == pNew->info.IpParams.version )
         {
             pOld->tclasParams.ipv6.version = 6;
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )pOld->tclasParams.ipv6.srcIpAddr, ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.source, 16 );
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )pOld->tclasParams.ipv6.dstIpAddr, ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.dest, 16 );
+            vos_mem_copy( ( tANI_U8* )pOld->tclasParams.ipv6.srcIpAddr,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.source, 16 );
+            vos_mem_copy( ( tANI_U8* )pOld->tclasParams.ipv6.dstIpAddr,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.dest, 16 );
             pOld->tclasParams.ipv6.srcPort  = pNew->info.IpParams.params.IpV6Params.src_port;
             pOld->tclasParams.ipv6.dstPort  = pNew->info.IpParams.params.IpV6Params.dest_port;
-            palCopyMemory( pMac->hHdd, ( tANI_U8* )pOld->tclasParams.ipv6.flowLabel, ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.flow_label, 3 );
+            vos_mem_copy( ( tANI_U8* )pOld->tclasParams.ipv6.flowLabel,
+                          ( tANI_U8* )pNew->info.IpParams.params.IpV6Params.flow_label, 3 );
         }
         else
         {
@@ -638,11 +657,11 @@
     macMgmtHdr->seqControl.fragNum = 0;
     macMgmtHdr->seqControl.seqNumLo = 0;
     macMgmtHdr->seqControl.seqNumHi = 2;
-    palCopyMemory(pMac->hHdd, (void *)&macMgmtHdr->da,
+    vos_mem_copy( (void *)&macMgmtHdr->da,
                               (void *)bssid, sizeof(tSirMacAddr));
-    palCopyMemory(pMac->hHdd, (void *)&macMgmtHdr->sa,
+    vos_mem_copy( (void *)&macMgmtHdr->sa,
                               (void *)selfMacAddr, sizeof(tSirMacAddr));
-    palCopyMemory(pMac->hHdd, (void *)&macMgmtHdr->bssId,
+    vos_mem_copy( (void *)&macMgmtHdr->bssId,
                               (void *)bssid, sizeof(tSirMacAddr));
     
     return;
@@ -663,7 +682,7 @@
     macMgmtHdr->fc.toDS = 0;
     macMgmtHdr->durationLo = (tANI_U8) (SIR_MAC_MAX_DURATION_MICRO_SECONDS & 0xff);
     macMgmtHdr->durationHi = (tANI_U8) ((SIR_MAC_MAX_DURATION_MICRO_SECONDS & 0xff00) >> 8);
-    palCopyMemory(pMac->hHdd, (void *)macMgmtHdr->da, (void *)selfMac, sizeof(tSirMacAddr));
+    vos_mem_copy( (void *)macMgmtHdr->da, (void *)selfMac, sizeof(tSirMacAddr));
             
     return;
 }
@@ -703,9 +722,9 @@
         macMgmtHdr->seqControl.fragNum = 0;
         macMgmtHdr->seqControl.seqNumLo = 0;
         macMgmtHdr->seqControl.seqNumHi = 2;
-        palCopyMemory(pMac->hHdd, (void *)&macMgmtHdr->da, (void *)pSta[0].bssId, 6);
-        palCopyMemory(pMac->hHdd, &macMgmtHdr->sa, pSta[0].staAddr, 6);
-        palCopyMemory(pMac->hHdd, (void *)&macMgmtHdr->bssId, (void *)pSta[0].bssId, 6);
+        vos_mem_copy( (void *)&macMgmtHdr->da, (void *)pSta[0].bssId, 6);
+        vos_mem_copy( &macMgmtHdr->sa, pSta[0].staAddr, 6);
+        vos_mem_copy( (void *)&macMgmtHdr->bssId, (void *)pSta[0].bssId, 6);
     }
     else if (role == eSYSTEM_AP_ROLE || role == eSYSTEM_STA_IN_IBSS_ROLE)
     {
@@ -721,7 +740,7 @@
         macMgmtHdr->fc.toDS = 0;
         macMgmtHdr->durationLo = (tANI_U8) (SIR_MAC_MAX_DURATION_MICRO_SECONDS & 0xff);
         macMgmtHdr->durationHi = (tANI_U8) ((SIR_MAC_MAX_DURATION_MICRO_SECONDS & 0xff00) >> 8);
-        palCopyMemory(pMac->hHdd, (void *)macMgmtHdr->da, (void *)pSta[0].staAddr, 6);
+        vos_mem_copy( (void *)macMgmtHdr->da, (void *)pSta[0].staAddr, 6);
     }
     return;
 #endif
@@ -757,9 +776,9 @@
         macMgmtHdr->seqControl.fragNum = 0;
         macMgmtHdr->seqControl.seqNumLo = 0;
         macMgmtHdr->seqControl.seqNumHi = 2;
-        palCopyMemory(pMac->hHdd, (void *)macMgmtHdr->da, (void *)pSta[0].bssId, 6);
-        palCopyMemory(pMac->hHdd, macMgmtHdr->sa, pSta[0].staAddr, 6);
-        palCopyMemory(pMac->hHdd, (void *)macMgmtHdr->bssId, (void *)pSta[0].bssId, 6);
+        vos_mem_copy( (void *)macMgmtHdr->da, (void *)pSta[0].bssId, 6);
+        vos_mem_copy( macMgmtHdr->sa, pSta[0].staAddr, 6);
+        vos_mem_copy( (void *)macMgmtHdr->bssId, (void *)pSta[0].bssId, 6);
 
     }
     
diff --git a/CORE/TL/inc/wlan_qct_tl.h b/CORE/TL/inc/wlan_qct_tl.h
index cce365d..a25daf8 100644
--- a/CORE/TL/inc/wlan_qct_tl.h
+++ b/CORE/TL/inc/wlan_qct_tl.h
@@ -25,7 +25,6 @@
  * to the Linux Foundation.
  */
 
-
 #ifndef WLAN_QCT_WLANTL_H
 #define WLAN_QCT_WLANTL_H
 
@@ -90,7 +89,6 @@
 #ifdef QCA_WIFI_2_0
 #include "adf_nbuf.h"
 #endif
-
 /*----------------------------------------------------------------------------
  * Preprocessor Definitions and Constants
  * -------------------------------------------------------------------------*/
@@ -140,6 +138,9 @@
 #define WLANTL_HO_DEFAULT_ALPHA               5
 #define WLANTL_HO_TDLS_ALPHA                  7
 
+// Choose the largest possible value that can be accomodates in 8 bit signed
+// variable.
+#define SNR_HACK_BMPS                         (127)
 /*--------------------------------------------------------------------------
   Access category enum used by TL
   - order must be kept as these values are used to setup the AC mask
@@ -424,6 +425,10 @@
   v_U16_t   ucDesSTAId;
  /*Rssi based on the received packet */
   v_S7_t    rssiAvg;
+ #ifdef FEATURE_WLAN_TDLS
+ /* Packet received on direct link/AP link */
+  v_U8_t    isStaTdls;
+ #endif
 }WLANTL_RxMetaInfoType;
 
 
@@ -1193,6 +1198,7 @@
   SIDE EFFECTS
 
 ============================================================================*/
+#ifndef QCA_WIFI_2_0
 VOS_STATUS
 WLANTL_GetSTAState
 (
@@ -1200,6 +1206,18 @@
   v_U8_t                ucSTAId,
   WLANTL_STAStateType   *ptlSTAState
 );
+#else
+static inline VOS_STATUS
+WLANTL_GetSTAState
+(
+  v_PVOID_t             pvosGCtx,
+  v_U8_t                ucSTAId,
+  WLANTL_STAStateType   *ptlSTAState
+)
+{
+     return VOS_STATUS_SUCCESS;
+}
+#endif /* QCA_WIFI_2_0 */
 
 /*===========================================================================
 
@@ -1466,12 +1484,58 @@
   SIDE EFFECTS 
   
 ============================================================================*/
+
 VOS_STATUS  
 WLANTL_GetRssi 
 ( 
   v_PVOID_t             pvosGCtx,
   v_U8_t                ucSTAId,
-  v_S7_t*               puRssi
+  v_S7_t*               puRssi,
+  v_PVOID_t             pGetRssiReq
+);
+/*==========================================================================
+
+  FUNCTION    WLANTL_GetSnr
+
+  DESCRIPTION
+    TL will extract the SNR information from every data packet from the
+    ongoing traffic and will store it. It will provide the result to SME
+    upon request.
+
+  DEPENDENCIES
+
+    WARNING: the read and write of this value will not be protected
+             by locks, therefore the information obtained after a read
+             might not always be consistent.
+
+  PARAMETERS
+
+    IN
+    pvosGCtx:       pointer to the global vos context; a handle to TL's
+                    or SME's control block can be extracted from its context
+    ucSTAId:        station identifier for the requested value
+
+    OUT
+    puSnr:         the average value of the SNR
+
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_INVAL:  Input parameters are invalid
+    VOS_STATUS_E_FAULT:  Station ID is outside array boundaries or pointer
+                         to TL cb is NULL ; access would cause a page fault
+    VOS_STATUS_E_EXISTS: STA was not yet registered
+    VOS_STATUS_SUCCESS:  Everything is good :)
+
+  SIDE EFFECTS
+
+============================================================================*/
+VOS_STATUS
+WLANTL_GetSnr
+(
+  tANI_U8           ucSTAId,
+  tANI_S8*          pSnr
 );
 
 /*==========================================================================
@@ -2103,8 +2167,12 @@
   v_U8_t             ucUP,
   v_U32_t            uServiceInt,
   v_U32_t            uSuspendInt,
+#ifdef QCA_WIFI_2_0
   WLANTL_TSDirType   wTSDir,
   v_U32_t            sessionId
+#else
+  WLANTL_TSDirType   wTSDir
+#endif
 );
 
 
@@ -2140,8 +2208,12 @@
 (
   v_PVOID_t          pvosGCtx,
   v_U8_t             ucSTAId,
+#ifdef QCA_WIFI_2_0
   WLANTL_ACEnumType  ucACId,
   v_U32_t            sessionId
+#else
+  WLANTL_ACEnumType  ucACId
+#endif
 );
 
 #if defined WLAN_FEATURE_NEIGHBOR_ROAMING
@@ -2583,6 +2655,26 @@
 
 void WLANTL_UpdateRssiBmps(v_PVOID_t pvosGCtx, v_U8_t staId, v_S7_t rssi);
 
+/*===============================================================================
+  FUNCTION       WLANTL_UpdateSnrBmps
+
+  DESCRIPTION    This function updates the TL's SNR (in BMPS mode)
+
+  DEPENDENCIES   None
+
+  PARAMETERS
+
+    pvosGCtx         VOS context          VOS Global context
+    staId            Station ID           Station ID
+    snr             SNR (BMPS mode)     SNR in BMPS mode
+
+  RETURN         None
+
+  SIDE EFFECTS   none
+ ===============================================================================*/
+
+void WLANTL_UpdateSnrBmps(v_PVOID_t pvosGCtx, v_U8_t staId, v_S7_t snr);
+
 /*==========================================================================
   FUNCTION   WLANTL_SetTxXmitPending
 
@@ -2699,7 +2791,7 @@
       VOS_STATUS_E_EXISTS: Station was not registered
       VOS_STATUS_SUCCESS:  Everything is good :)
 
-    SIDE EFFECTS
+  SIDE EFFECTS
 ============================================================================*/
 
 VOS_STATUS
@@ -2712,4 +2804,298 @@
 
 
 
+/*===============================================================================
+  FUNCTION       WLANTL_UpdateLinkCapacity
+
+  DESCRIPTION    This function updates the STA's Link Capacity in TL
+
+  DEPENDENCIES   None
+
+  PARAMETERS
+
+    pvosGCtx         VOS context          VOS Global context
+    staId            Station ID           Station ID
+    linkCapacity     linkCapacity         Link Capacity
+
+  RETURN         None
+
+  SIDE EFFECTS   none
+ ===============================================================================*/
+
+void
+WLANTL_UpdateLinkCapacity
+(
+  v_PVOID_t pvosGCtx,
+  v_U8_t staId,
+  v_U32_t linkCapacity);
+
+/*===========================================================================
+
+  FUNCTION    WLANTL_GetSTALinkCapacity
+
+  DESCRIPTION
+
+    Returns Link Capacity of a particular STA.
+
+  DEPENDENCIES
+
+    A station must have been registered before its state can be retrieved.
+
+  PARAMETERS
+
+    IN
+    pvosGCtx:       pointer to the global vos context; a handle to TL's
+                    control block can be extracted from its context
+    ucSTAId:        identifier of the station
+
+    OUT
+    plinkCapacity:  the current link capacity the connection to
+                    the given station
+
+
+  RETURN VALUE
+
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_INVAL:  Input parameters are invalid
+    VOS_STATUS_E_FAULT:  Station ID is outside array boundaries or pointer to
+                         TL cb is NULL ; access would cause a page fault
+    VOS_STATUS_E_EXISTS: Station was not registered
+    VOS_STATUS_SUCCESS:  Everything is good :)
+
+  SIDE EFFECTS
+
+============================================================================*/
+
+#ifndef QCA_WIFI_2_0
+VOS_STATUS
+WLANTL_GetSTALinkCapacity
+(
+  v_PVOID_t             pvosGCtx,
+  v_U8_t                ucSTAId,
+  v_U32_t               *plinkCapacity
+);
+#else
+static inline VOS_STATUS
+WLANTL_GetSTALinkCapacity
+(
+  v_PVOID_t             pvosGCtx,
+  v_U8_t                ucSTAId,
+  v_U32_t               *plinkCapacity
+)
+{
+    return VOS_STATUS_SUCCESS;
+}
+#endif /* QCA_WIFI_2_0 */
+/*===========================================================================
+  FUNCTION   WLANTL_TxThreadDebugHandler
+
+  DESCRIPTION
+    Printing TL Snapshot dump, processed under TxThread context, currently
+    information regarding the global TlCb struture. Dumps information related
+    to per active STA connection currently in use by TL.
+
+  DEPENDENCIES
+    The TL must be initialized before this gets called.
+
+  PARAMETERS
+
+    IN
+    pvosGCtx:    Pointer to the global vos context; a handle to TL's
+                    or WDA's control block can be extracted from its context
+
+  RETURN VALUE   None
+
+  SIDE EFFECTS
+============================================================================*/
+
+v_VOID_t
+WLANTL_TxThreadDebugHandler
+(
+  v_PVOID_t       *pvosGCtx
+);
+
+/*==========================================================================
+  FUNCTION   WLANTL_TLDebugMessage
+
+  DESCRIPTION
+    Post a TL Snapshot request, posts message in TxThread.
+
+  DEPENDENCIES
+    The TL must be initialized before this gets called.
+
+  PARAMETERS
+
+    IN
+    displaySnapshot Boolean showing whether to dump the snapshot or not.
+
+  RETURN VALUE      None
+
+  SIDE EFFECTS
+
+============================================================================*/
+
+#ifndef QCA_WIFI_2_0
+v_VOID_t
+WLANTL_TLDebugMessage
+(
+  v_BOOL_t displaySnapshot
+);
+#else
+static inline v_VOID_t
+WLANTL_TLDebugMessage
+(
+  v_BOOL_t displaySnapshot
+)
+{
+
+}
+#endif /* QCA_WIFI_2_0 */
+
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+/*=============================================================================
+  FUNCTION    WLANTL_EnableReliableMcast
+
+  DESCRIPTION
+    This function enables data path of reliable multicast transmitter in TL
+
+  DEPENDENCIES
+    Reliable multicast receive leader must be selected by FW before
+    UMAC calling this API
+
+  PARAMETERS
+
+   IN
+
+   pvosGCtx   : Pointer to VOS global context
+   pMcastAddr : Pointer to MAC ADDR of reliable multicast transmitter
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAULT:   Sanity  check on input failed
+
+    VOS_STATUS_SUCCESS:   Everything is good :)
+
+   Other return values are possible coming from the called functions.
+   Please check API for additional info.
+
+  SIDE EFFECTS
+
+==============================================================================*/
+#ifndef QCA_WIFI_2_0
+VOS_STATUS
+WLANTL_EnableReliableMcast
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastAddr
+);
+#else
+static inline VOS_STATUS
+WLANTL_EnableReliableMcast
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastAddr
+)
+{
+     return VOS_STATUS_SUCCESS;
+}
+#endif /* QCA_WIFI_2_0 */
+
+/*=============================================================================
+  FUNCTION    WLANTL_DisableReliableMcast
+
+  DESCRIPTION
+    This function disables data path of reliable multicast transmitter in TL
+
+  DEPENDENCIES
+    HDD should have recived IOCTL to disable reliable RMC
+
+  PARAMETERS
+
+   IN
+
+   pvosGCtx   : Pointer to VOS global context
+   pMcastAddr : Pointer to MAC ADDR of reliable multicast transmitter
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAULT:   Sanity  check on input failed
+
+    VOS_STATUS_SUCCESS:   Everything is good :)
+
+   Other return values are possible coming from the called functions.
+   Please check API for additional info.
+
+  SIDE EFFECTS
+
+==============================================================================*/
+#ifndef QCA_WIFI_2_0
+VOS_STATUS
+WLANTL_DisableReliableMcast
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastAddr
+);
+#else
+static inline VOS_STATUS
+WLANTL_DisableReliableMcast
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastAddr
+)
+{
+     return VOS_STATUS_SUCCESS;
+}
+#endif /* QCA_WIFI_2_0 */
+/*=============================================================================
+  FUNCTION    WLANTL_SetMcastDuplicateDetection
+
+  DESCRIPTION
+    This function sets multicate duplicate detection operation.
+    If enable is 1, the detection is enabled, else it is disabled.
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pvosGCtx   : Pointer to VOS global context
+   enable : Boolean to enable or disable
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAULT:   Sanity check on input failed
+
+    VOS_STATUS_SUCCESS:   Everything is good :)
+
+   Other return values are possible coming from the called functions.
+   Please check API for additional info.
+
+  SIDE EFFECTS
+
+==============================================================================*/
+#ifndef QCA_WIFI_2_0
+VOS_STATUS
+WLANTL_SetMcastDuplicateDetection
+(
+    v_PVOID_t     pvosGCtx,
+    v_U8_t        enable
+);
+#else
+static inline VOS_STATUS
+WLANTL_SetMcastDuplicateDetection
+(
+    v_PVOID_t     pvosGCtx,
+    v_U8_t        enable
+)
+{
+     return VOS_STATUS_SUCCESS;
+}
+#endif /* QCA_WIFI_2_0 */
+#endif /*End of WLAN_FEATURE_RELIABLE_MCAST*/
+
 #endif /* #ifndef WLAN_QCT_WLANTL_H */
diff --git a/CORE/TL/src/wlan_qct_tl.c b/CORE/TL/src/wlan_qct_tl.c
index 14dc7ef..9733635 100644
--- a/CORE/TL/src/wlan_qct_tl.c
+++ b/CORE/TL/src/wlan_qct_tl.c
@@ -61,6 +61,7 @@
 
   when        who     what, where, why
 ----------    ---    --------------------------------------------------------
+2013-08-19    rajekuma Added reliable multicast support
 2010-07-13    c_shinde Fixed an issue where WAPI rekeying was failing because 
                       WAI frame sent out during rekeying had the protected bit
                       set to 1.
@@ -144,13 +145,13 @@
 /*Enables debugging FC control frame in TL*/
 //#define TL_DEBUG_FC
 //#define WLAN_SOFTAP_FLOWCTRL_EN
-
 //#define BTAMP_TEST
 #ifdef TL_DEBUG_FC
 #include <wlan_qct_pal_status.h>
 #include <wlan_qct_pal_device.h> // wpalReadRegister
 #endif
 
+extern tVOS_CON_MODE hdd_get_conparam ( void );
 /*----------------------------------------------------------------------------
  * Preprocessor Definitions and Constants
  * -------------------------------------------------------------------------*/
@@ -165,6 +166,7 @@
 /*BT-AMP packet LLC OUI value*/
 const v_U8_t WLANTL_BT_AMP_OUI[] =  {0x00, 0x19, 0x58 };
 
+#define WLANTL_MAX_SNR_DATA_SAMPLES 20
 
 #ifdef VOLANS_PERF
 #define WLANTL_BD_PDU_INTERRUPT_ENABLE_THRESHOLD  120
@@ -218,7 +220,8 @@
 #define SWAP_ENDIAN_UINT32(a)          ((a) = ((a) >> 0x18 ) |(((a) & 0xFF0000) >> 0x08) | \
                                             (((a) & 0xFF00) << 0x08)  | (((a) & 0xFF) << 0x18))
 
-
+/* Maximum value of SNR that can be calculated by the HW */
+#define WLANTL_MAX_HW_SNR 35
 
 /*--------------------------------------------------------------------------
    TID to AC mapping in TL
@@ -328,7 +331,6 @@
 #define WLAN_TL_INVALID_B_SIG 255
 #define ENTER() VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO, "Enter:%s", __func__)
 
-
 #define WLAN_TL_AC_ARRAY_2_MASK( _pSTA, _ucACMask, i ) \
   do\
   {\
@@ -592,6 +594,17 @@
   }
 #endif
 
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+   /*Initialize RMC suppport in TL*/
+   status = WLANTL_RmcInit(pvosGCtx);
+   if (!VOS_IS_STATUS_SUCCESS(status))
+   {
+    TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "Reliable multicast module init fail"));
+    return status;
+  }
+#endif
+
   pTLCb->isBMPS = VOS_FALSE;
   pmcRegisterDeviceStateUpdateInd( smeContext,
                                    WLANTL_PowerStateChangedCB, pvosGCtx );
@@ -680,7 +693,6 @@
   vos_atomic_set_U8( &pTLCb->ucTxSuspended, 0);
 
   pTLCb->uResCount = uResCount;
-
   return VOS_STATUS_SUCCESS;
 }/* WLANTL_Start */
 
@@ -849,6 +861,14 @@
   }
 #endif
 
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+  if(VOS_STATUS_SUCCESS != WLANTL_RmcDeInit(pvosGCtx))
+  {
+    TLLOGW(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_WARN,
+               "Reliable multicast module DeInit fail"));
+  }
+#endif
+
   /*------------------------------------------------------------------------
     Cleanup TL control block.
    ------------------------------------------------------------------------*/
@@ -996,7 +1016,7 @@
   vos_mem_zero( &sMessage, sizeof(vos_msg_t) );
 
   uData = ucSTAId | (ucUcastSig << 8 ) | (ucBcastSig << 16); 
-  sMessage.bodyptr = (v_PVOID_t)uData;
+  sMessage.bodyval = uData;
   sMessage.type    = WLANTL_TX_FWD_CACHED;
 
   return vos_tx_mq_serialize(VOS_MQ_ID_TL, &sMessage);
@@ -1401,6 +1421,10 @@
         pTLCb->ucTdlsPeerCount++;
 #endif
   }
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+  vos_lock_init(&pClientSTA->mcLock);
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
   return VOS_STATUS_SUCCESS;
 }/* WLANTL_RegisterSTAClient */
 
@@ -1502,6 +1526,15 @@
              "WLAN TL:Clearing STA Client ID: %d", ucSTAId ));
   WLANTL_CleanSTA(pTLCb->atlSTAClients[ucSTAId], 1 /*empty packets*/);
 
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+  /*--------------------------------------------------------------------
+    Delete multicast entries for duplicate detection
+    --------------------------------------------------------------------*/
+  WLANTL_McastDeleteAllEntries(pTLCb->atlSTAClients[ucSTAId]);
+
+  vos_lock_destroy(&pTLCb->atlSTAClients[ucSTAId]->mcLock);
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
   TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
              "WLAN TL:Clearing STA Reset History RSSI and Region number"));
   pTLCb->hoSupport.currentHOState.historyRSSI = 0;
@@ -2376,7 +2409,8 @@
   {
     vosStatus =  WLANTL_Translate8023To80211Header( vosDataBuff, &vosStatus,
                                                     pTLCb, &ucStaId,
-                                                    pMetaInfo->ucUP, &ucWDSEnabled, &extraHeadSpace);
+                                                    pMetaInfo, &ucWDSEnabled,
+                                                    &extraHeadSpace);
 
     if ( VOS_STATUS_SUCCESS != vosStatus )
     {
@@ -2498,11 +2532,13 @@
 (
   v_PVOID_t        pvosGCtx,
   v_U8_t           ucSTAId,
-  v_S7_t*          pRssi
+  v_S7_t*          pRssi,
+ v_PVOID_t        pGetRssiReq
 )
 {
   WLANTL_CbType*  pTLCb = NULL;
   WLANTL_STAClientType* pClientSTA = NULL;
+  tpAniSirGlobal pMac = vos_get_context(VOS_MODULE_ID_WDA, pvosGCtx);
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
 
   /*------------------------------------------------------------------------
@@ -2552,7 +2588,7 @@
   /*------------------------------------------------------------------------
     Copy will not be locked; please read restriction
    ------------------------------------------------------------------------*/
-  if(pTLCb->isBMPS)
+  if(pTLCb->isBMPS || IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE)
   {
     *pRssi = pClientSTA->rssiAvgBmps;
     /* Check If RSSI is zero because we are reading rssAvgBmps updated by HAL in 
@@ -2569,6 +2605,14 @@
     *pRssi = pClientSTA->rssiAvg;
   }
 
+  if (VOS_STA_MODE == hdd_get_conparam() && pMac) {
+     if (ccmCfgSetInt(pMac, WNI_CFG_CURRENT_RSSI, ((*pRssi) * (-1)), NULL,
+                      eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE) {
+        TLLOGW(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                         FL("Could not pass WNI_CFG_CURRENT_RSSI")));
+     }
+  }
+
   TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
                     "WLAN TL:WLANTL_GetRssi for STA: %d RSSI: %d%s",
                     ucSTAId, *pRssi,
@@ -2579,6 +2623,142 @@
 
 /*==========================================================================
 
+  FUNCTION    WLANTL_GetSnr
+
+  DESCRIPTION
+    TL will extract the SNR information from every data packet from the
+    ongoing traffic and will store it. It will provide the result to SME
+    upon request.
+
+  DEPENDENCIES
+
+    WARNING: the read and write of this value will not be protected
+             by locks, therefore the information obtained after a read
+             might not always be consistent.
+
+  PARAMETERS
+
+    IN
+    pvosGCtx:       pointer to the global vos context; a handle to TL's
+                    or SME's control block can be extracted from its context
+    ucSTAId:        station identifier for the requested value
+
+    OUT
+    pSnr:         the average value of the SNR
+
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_INVAL:  Input parameters are invalid
+    VOS_STATUS_E_FAULT:  Station ID is outside array boundaries or pointer
+                         to TL cb is NULL ; access would cause a page fault
+    VOS_STATUS_E_EXISTS: STA was not yet registered
+    VOS_STATUS_SUCCESS:  Everything is good :)
+
+  SIDE EFFECTS
+
+============================================================================*/
+VOS_STATUS
+WLANTL_GetSnr
+(
+  tANI_U8           ucSTAId,
+  tANI_S8*          pSnr
+)
+{
+  WLANTL_CbType*  pTLCb = NULL;
+  WLANTL_STAClientType* pClientSTA = NULL;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
+
+  /*------------------------------------------------------------------------
+    Sanity check
+   ------------------------------------------------------------------------*/
+  if (NULL == pSnr)
+  {
+    TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+               "WLAN TL:Invalid parameter sent on %s", __func__));
+    return VOS_STATUS_E_INVAL;
+  }
+
+  if (WLANTL_STA_ID_INVALID(ucSTAId))
+  {
+    TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+               "WLAN TL:Invalid station id requested on %s", __func__));
+    return VOS_STATUS_E_FAULT;
+  }
+
+  /*------------------------------------------------------------------------
+    Extract TL control block and check existance
+   ------------------------------------------------------------------------*/
+  pTLCb = VOS_GET_TL_CB(vos_get_global_context(VOS_MODULE_ID_TL, NULL));
+  if (NULL == pTLCb)
+  {
+    TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "WLAN TL:Invalid TL pointer from pvosGCtx on %s", __func__));
+    return VOS_STATUS_E_FAULT;
+  }
+
+  pClientSTA = pTLCb->atlSTAClients[ucSTAId];
+
+  if (NULL == pClientSTA)
+  {
+    TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "WLAN TL:Client Memory was not allocated on %s", __func__));
+    return VOS_STATUS_E_FAILURE;
+  }
+
+  if (0 == pClientSTA->ucExists)
+  {
+    TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+         "WLAN TL:Station was not previously registered on %s", __func__));
+    return VOS_STATUS_E_EXISTS;
+  }
+
+  /*------------------------------------------------------------------------
+    Copy will not be locked; please read restriction
+   ------------------------------------------------------------------------*/
+  if (pTLCb->isBMPS)
+  {
+    *pSnr = pClientSTA->snrAvgBmps;
+  }
+  else
+  {
+    /* SNR is averaged over WLANTL_MAX_SNR_DATA_SAMPLES, if there are not enough
+     * data samples (snridx) to calculate the average then return the
+     * average for the window of prevoius 20 packets. And if there aren't
+     * enough samples and the average for previous window of 20 packets is
+     * not available then return a predefined value
+     *
+     * NOTE: the SNR_HACK_BMPS value is defined to 127, documents from HW
+     * team reveal that the SNR value has a ceiling well below 127 dBm,
+     * so if SNR has value of 127 the userspace applications can know that
+     * the SNR has not been computed yet because enough data was not
+     * available for SNR calculation
+     */
+    if (pClientSTA->snrIdx > (WLANTL_MAX_SNR_DATA_SAMPLES/2)
+        || !(pClientSTA->prevSnrAvg))
+    {
+       *pSnr = pClientSTA->snrSum / pClientSTA->snrIdx;
+    }
+    else if (pClientSTA->prevSnrAvg)
+    {
+       *pSnr = pClientSTA->prevSnrAvg;
+    }
+    else
+    {
+       *pSnr = SNR_HACK_BMPS;
+    }
+  }
+
+  VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
+            "WLAN TL:WLANTL_GetSnr for STA: %d SNR: %d%s",
+            ucSTAId, *pSnr,
+            pTLCb->isBMPS ? " in BMPS" : "");
+
+  return VOS_STATUS_SUCCESS;
+}/* WLANTL_GetSnr */
+/*==========================================================================
+
   FUNCTION    WLANTL_GetLinkQuality
 
   DESCRIPTION
@@ -3337,7 +3517,15 @@
       return VOS_STATUS_E_FAULT;
     }
 
-    if ( pTLCb->atlSTAClients[*pucSTAId] && (0 == pTLCb->atlSTAClients[*pucSTAId]->ucExists ))
+    if ( NULL == pTLCb->atlSTAClients[*pucSTAId] )
+    {
+      TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL:Invalid pTLCb->atlSTAClients pointer for STA Id :%d on "
+            "WLANTL_SuspendDataTx", *pucSTAId));
+      return VOS_STATUS_E_FAULT;
+    }
+
+    if ( 0 == pTLCb->atlSTAClients[*pucSTAId]->ucExists )
     {
       TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
              "WLAN TL:Station %d was not previously registered on WLANTL_SuspendDataTx", *pucSTAId));
@@ -3437,7 +3625,15 @@
       return VOS_STATUS_E_FAULT;
     }
 
-    if ( pTLCb->atlSTAClients[*pucSTAId] && (0 == pTLCb->atlSTAClients[*pucSTAId]->ucExists ))
+    if ( NULL == pTLCb->atlSTAClients[*pucSTAId] )
+    {
+      TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL:Invalid pTLCb->atlSTAClients pointer for STA Id :%d on "
+            "WLANTL_ResumeDataTx", *pucSTAId));
+      return VOS_STATUS_E_FAULT;
+    }
+
+    if ( 0 == pTLCb->atlSTAClients[*pucSTAId]->ucExists )
     {
       TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
              "WLAN TL:Station %d was not previously registered on WLANTL_ResumeDataTx", *pucSTAId));
@@ -4043,7 +4239,7 @@
         if ( NULL != pfnSTAFsm )
         {
           pClientSTA->ucNoMoreData = 0;
-          vosStatus  = pfnSTAFsm( pvosGCtx, ucSTAId, &vosTempBuf);
+          vosStatus  = pfnSTAFsm( pvosGCtx, ucSTAId, &vosTempBuf, VOS_FALSE);
 
           if (( VOS_STATUS_SUCCESS != vosStatus ) &&
               ( NULL != vosTempBuf ))
@@ -4179,7 +4375,7 @@
           if ( NULL != pfnSTAFsm )
           {
             pClientSTA->ucNoMoreData = 0;
-            vosStatus  = pfnSTAFsm( pvosGCtx, ucSTAId, &vosTempBuf);
+            vosStatus  = pfnSTAFsm( pvosGCtx, ucSTAId, &vosTempBuf, VOS_FALSE);
 
             if (( VOS_STATUS_SUCCESS != vosStatus ) &&
                 ( NULL != vosTempBuf ))
@@ -4758,8 +4954,7 @@
 
 }/*WLANTL_ForwardSTAFrames*/
 
-
-#ifdef FEATURE_WLAN_CCX
+#if defined(FEATURE_WLAN_CCX) || defined(FEATURE_WLAN_CCX_UPLOAD)
 /*==========================================================================
 
   FUNCTION    WLANTL_IsIAPPFrame
@@ -5005,7 +5200,7 @@
 
       /* software frame translation for BTAMP WDS.*/
       WLANTL_Translate80211To8023Header( vosTempBuff, &vosStatus, usActualHLen,
-                                         ucMPDUHLen, pTLCb,ucSTAId );
+                                         ucMPDUHLen, pTLCb,ucSTAId, VOS_FALSE);
       
     }
     if (pTLCb->tlBAPClient.pfnTlBAPRx)
@@ -5304,6 +5499,7 @@
   v_U8_t              ucMPDUHLen = 0 ;
   v_U16_t             usEtherType = 0;
 #endif
+  v_BOOL_t            bForwardIAPPwithLLC = VOS_FALSE;
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
 
   TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
@@ -5443,19 +5639,27 @@
 #else
         vosStatus = WLANTL_ReadRSSI(pvosGCtx, pvBDHeader, ucSTAId);
 #endif
+        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+        {
+          TLLOGW(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_WARN,
+                           "Handle RX Management Frame fail within Handoff "
+                           "support module"));
+          /* Do Not Drop packet at here
+           * Revisit why HO module return fail
+           *   vos_pkt_return_packet(vosTempBuff);
+           *   vosTempBuff = vosDataBuff;
+           *   continue;
+           */
+        }
+        vosStatus = WLANTL_ReadSNR(pvosGCtx, pvBDHeader, ucSTAId);
+
+        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+        {
+          TLLOGW(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_WARN,
+                            FL("Failed to Read SNR")));
+        }
       }
 
-      if(!VOS_IS_STATUS_SUCCESS(vosStatus))
-      {
-        TLLOGW(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_WARN,
-          "Handle RX Management Frame fail within Handoff support module"));
-        /* Do Not Drop packet at here 
-         * Revisit why HO module return fail
-        vos_pkt_return_packet(vosTempBuff);
-        vosTempBuff = vosDataBuff;
-        continue;
-         */
-      }
       pTLCb->tlMgmtFrmClient.pfnTlMgmtFrmRx( pvosGCtx, vosTempBuff); 
     }
     else /* Data Frame */
@@ -5588,7 +5792,22 @@
         continue;
       }
 
-#ifdef FEATURE_WLAN_CCX
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+      if ((pClientSTA->wSTADesc.ucIsCcxSta)|| broadcast)
+      {
+        /*--------------------------------------------------------------------
+          Filter the IAPP frames for CCX connection;
+          if data it will return false and it
+          will be routed through the regular data path
+        --------------------------------------------------------------------*/
+        if ( WLANTL_IsIAPPFrame(pvBDHeader,
+                                vosTempBuff))
+        {
+            bForwardIAPPwithLLC = VOS_TRUE;
+        }
+      }
+#endif
+#if defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD)
       if ((pClientSTA->wSTADesc.ucIsCcxSta)|| broadcast)
       {
         /*--------------------------------------------------------------------
@@ -5616,7 +5835,7 @@
             continue;
         }
       }
-#endif
+#endif /* defined(FEATURE_WLAN_CCX) && !defined(FEATURE_WLAN_CCX_UPLOAD) */
 
       if ( WLAN_STA_BT_AMP == pClientSTA->wSTADesc.wSTAType )
       {
@@ -5664,18 +5883,49 @@
 #else
         vosStatus = WLANTL_ReadRSSI(pvosGCtx, pvBDHeader, ucSTAId);
 #endif /*FEATURE_WLAN_GEN6_ROAMING*/
-        if(!VOS_IS_STATUS_SUCCESS(vosStatus))
+        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
         {
           TLLOGW(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_WARN,
             "Handle RX Data Frame fail within Handoff support module"));
           /* Do Not Drop packet at here 
            * Revisit why HO module return fail
-          vos_pkt_return_packet(vosTempBuff);
-          vosTempBuff = vosDataBuff;
-          continue;
+           * vos_pkt_return_packet(vosTempBuff);
+           * vosTempBuff = vosDataBuff;
+           * continue;
            */
         }
-        pfnSTAFsm( pvosGCtx, ucSTAId, &vosTempBuff);
+        else {
+           v_S7_t currentRSSI = 0, currentRSSI0, currentRSSI1;
+           tpAniSirGlobal pMac = vos_get_context(VOS_MODULE_ID_WDA, pvosGCtx);
+
+           if (VOS_STA_MODE == hdd_get_conparam()) {
+              /* update the RSSI value in cfg when acting as STA
+               * and connected to AP. TODO: check if frames are
+               * from associated AP only
+              */
+              if (NULL != pMac) {
+                 currentRSSI0 = WLANTL_GETRSSI0(pvBDHeader);
+                 currentRSSI1 = WLANTL_GETRSSI1(pvBDHeader);
+                 currentRSSI  = (currentRSSI0 > currentRSSI1) ? currentRSSI0 :
+                                                             currentRSSI1;
+                 currentRSSI = currentRSSI * (-1);
+                 if (ccmCfgSetInt(pMac, WNI_CFG_CURRENT_RSSI, currentRSSI, NULL,
+                                  eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE) {
+                    TLLOGW(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                                    FL("Could not pass WNI_CFG_CURRENT_RSSI")));
+                 }
+              }
+           }
+        }
+        vosStatus = WLANTL_ReadSNR(pvosGCtx, pvBDHeader, ucSTAId);
+
+        if (!VOS_IS_STATUS_SUCCESS(vosStatus))
+        {
+          TLLOGW(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_WARN,
+                           FL("Failed to Read SNR")));
+        }
+
+        pfnSTAFsm( pvosGCtx, ucSTAId, &vosTempBuff, bForwardIAPPwithLLC);
       }
       else
         {
@@ -5868,12 +6118,12 @@
     -------------------------------------------------------------------------*/
     if ( !bSigMatch )
     {
-            TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_MED,
         "WLAN TL: Cached packet does not match DPU Sig of the new STA - drop "
         " DPU Sig %d  UC %d BC %d B %d",
         uDPUSig,
         pClientSTA->wSTADesc.ucUcastSig,
-        pClientSTA->wSTADesc.ucUcastSig,
+        pClientSTA->wSTADesc.ucBcastSig,
         broadcast));
 
       /* Drop packet */ 
@@ -5947,7 +6197,7 @@
            */
         }
         pfnSTAFsm( vos_get_global_context(VOS_MODULE_ID_TL,pTLCb), ucSTAId, 
-                 &vosTempBuff);
+                 &vosTempBuff, VOS_FALSE);
       }
       else
       {
@@ -6179,6 +6429,218 @@
   return;
 }/*WLANTL_ClearTxXmitPending */
 
+/*==========================================================================
+  FUNCTION   WLANTL_TxThreadDebugHandler
+
+  DESCRIPTION
+    Printing TL Snapshot dump, processed under TxThread context, currently
+    information regarding the global TlCb struture. Dumps information related
+    to per active STA connection currently in use by TL.
+
+  DEPENDENCIES
+    The TL must be initialized before this gets called.
+
+  PARAMETERS
+
+    IN
+    pvosGCtx:       pointer to the global vos context; a handle to TL's
+                    or WDA's control block can be extracted from its context
+
+  RETURN VALUE      None
+
+  SIDE EFFECTS
+
+============================================================================*/
+
+v_VOID_t
+WLANTL_TxThreadDebugHandler
+(
+ v_PVOID_t *pVosContext
+)
+{
+   WLANTL_CbType* pTLCb = NULL;
+   WLANTL_STAClientType* pClientSTA = NULL;
+   int i = 0;
+   tWDA_CbContext *pWDA = NULL;
+
+   TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_FATAL,
+        "WLAN TL: %s Enter ", __func__));
+
+   pTLCb = VOS_GET_TL_CB(pVosContext);
+   pWDA = (tWDA_CbContext *)vos_get_global_context(VOS_MODULE_ID_WDA, pVosContext);
+
+   if ( NULL == pVosContext || NULL == pTLCb )
+   {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                        "Global VoS Context or TL Context are NULL"));
+        return;
+   }
+
+   if (NULL != pWDA)
+   {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "WDA uTxFlowMask: %d", pWDA->uTxFlowMask));
+   }
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "************************TL DUMP INFORMATION**************"));
+
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "uDelayedTriggerFrmInt:%d\tuMinFramesProcThres:%d",
+          pTLCb->tlConfigInfo.uDelayedTriggerFrmInt,
+          pTLCb->tlConfigInfo.uMinFramesProcThres));
+
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "Management Frame Client exists: %d",
+          pTLCb->tlMgmtFrmClient.ucExists));
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "usPendingTxCompleteCount: %d\tucTxSuspended: %d",
+          pTLCb->usPendingTxCompleteCount,
+          pTLCb->ucTxSuspended));
+
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "uResCount: %d", pTLCb->uResCount));
+
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "ucRegisteredStaId: %d\tucCurrentSTA: %d",
+          pTLCb->ucRegisteredStaId, pTLCb->ucCurrentSTA));
+
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "UrgentFrameProcessing: %s\tuFramesProcThres: %d",
+          (pTLCb->bUrgent?"True":"False"), pTLCb->uFramesProcThres));
+
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "isTxTranmitMsgPending: %d\t isBMPS: %s",
+          pTLCb->isTxTranmitMsgPending, pTLCb->isBMPS?"True":"False"));
+
+#ifdef FEATURE_WLAN_TDLS
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "TDLS Peer Count: %d", pTLCb->ucTdlsPeerCount));
+#endif
+
+   TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+          "++++++++++++++++++++Registerd Client Information++++++++++"));
+
+   for ( i =0; i<WLAN_MAX_STA_COUNT; i++ )
+   {
+        pClientSTA = pTLCb->atlSTAClients[i];
+        if( NULL == pClientSTA || 0 == pClientSTA->ucExists)
+        {
+                continue;
+        }
+
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "######################STA Index: %d ############################",i));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR, "WLAN_STADescType:"));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "STAId: %d\t STA MAC Address: %pM", pClientSTA->wSTADesc.ucSTAId,
+              pClientSTA->wSTADesc.vSTAMACAddress.bytes));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "STA Type: %d\tProtectedFrame: %d",
+              pClientSTA->wSTADesc.wSTAType, pClientSTA->wSTADesc.ucProtectedFrame));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+               "QoS: %d\tRxFrameTrans: %d\tTxFrameTrans: %d",
+               pClientSTA->wSTADesc.ucQosEnabled, pClientSTA->wSTADesc.ucSwFrameRXXlation,
+               pClientSTA->wSTADesc.ucSwFrameTXXlation));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "ucUcastSig: %d\tucBcastSig: %d", pClientSTA->wSTADesc.ucUcastSig,
+              pClientSTA->wSTADesc.ucBcastSig));
+
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "ClientIndex: %d\t Exists: %d", i, pClientSTA->ucExists));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "TL State: %d\t TL Priority: %d", pClientSTA->tlState,
+              pClientSTA->tlPri));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "ucTxSuspended: %d\tucPktPending: %d", pClientSTA->ucTxSuspended,
+              pClientSTA->ucPktPending));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "ucEAPOLPktPending: %d\tucNoMoreData: %d",
+              pClientSTA->ucEapolPktPending, pClientSTA->ucNoMoreData));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+               "ucRxBlocked: %d\t fcStaTxDisabled: %d", pClientSTA->ucRxBlocked,
+               pClientSTA->fcStaTxDisabled));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+               "ucCurrentAC: %d\tucServicedAC: %d", pClientSTA->ucCurrentAC,
+               pClientSTA->ucServicedAC));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "TID: %d\tautTxCount[0]: %d\tauRxCount[0]: %d",0, pClientSTA->auTxCount[0],
+              pClientSTA->auRxCount[0]));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+              "aucAcMask[0]: %d\taucAcMask[1]: %d\taucAcMask[2]: %d\taucAcMask[3]: %d\t",
+              pClientSTA->aucACMask[0], pClientSTA->aucACMask[1],
+              pClientSTA->aucACMask[2], pClientSTA->aucACMask[3]));
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+               "ucCurrentWeight: %d", pClientSTA->ucCurrentWeight));
+
+        if( WLAN_STA_SOFTAP == pClientSTA->wSTADesc.wSTAType)
+        {
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                  "TrafficStatistics for SOFTAP Station:"));
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                  "RUF=%d\tRMF=%d\tRBF=%d", pClientSTA->trafficStatistics.rxUCFcnt,
+                                            pClientSTA->trafficStatistics.rxMCFcnt,
+                                            pClientSTA->trafficStatistics.rxBCFcnt));
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                  "RUB=%d\tRMB=%d\tRBB=%d", pClientSTA->trafficStatistics.rxUCBcnt,
+                                            pClientSTA->trafficStatistics.rxMCBcnt,
+                                            pClientSTA->trafficStatistics.rxBCBcnt));
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                  "TUF=%d\tTMF=%d\tTBF=%d", pClientSTA->trafficStatistics.txUCFcnt,
+                                            pClientSTA->trafficStatistics.txMCFcnt,
+                                            pClientSTA->trafficStatistics.txBCFcnt));
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                  "TUB=%d\tTMB=%d\tTBB=%d", pClientSTA->trafficStatistics.txUCBcnt,
+                                            pClientSTA->trafficStatistics.txMCBcnt,
+                                            pClientSTA->trafficStatistics.txBCBcnt));
+        }
+    }
+   return;
+}
+
+/*==========================================================================
+  FUNCTION   WLANTL_TLDebugMessage
+
+  DESCRIPTION
+    Post a TL Snapshot request, posts message in TxThread.
+
+  DEPENDENCIES
+    The TL must be initialized before this gets called.
+
+  PARAMETERS
+
+    IN
+    displaySnapshot Boolean showing whether to dump the snapshot or not.
+
+  RETURN VALUE      None
+
+  SIDE EFFECTS
+
+============================================================================*/
+
+v_VOID_t
+WLANTL_TLDebugMessage
+(
+ v_BOOL_t   displaySnapshot
+)
+{
+   vos_msg_t vosMsg;
+   VOS_STATUS status;
+
+   if(displaySnapshot)
+   {
+        vosMsg.reserved = 0;
+        vosMsg.bodyptr  = NULL;
+        vosMsg.type     = WLANTL_TX_SNAPSHOT;
+
+        status = vos_tx_mq_serialize( VOS_MODULE_ID_TL, &vosMsg);
+        if(status != VOS_STATUS_SUCCESS)
+        {
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR, "TX Msg Posting Failed with status: %d",status));
+            return;
+        }
+   }
+   return;
+}
 
 /*============================================================================
                            TL STATE MACHINE
@@ -6219,7 +6681,8 @@
 (
   v_PVOID_t     pvosGCtx,
   v_U8_t        ucSTAId,
-  vos_pkt_t**   pvosDataBuff
+  vos_pkt_t**   pvosDataBuff,
+  v_BOOL_t      bForwardIAPPwithLLC
 )
 {
    v_U16_t              usPktLen;
@@ -6444,7 +6907,7 @@
   /*Make sure TID is valid*/
   if ( WLANTL_TID_INVALID(ucTid)) 
   {
-     TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+     TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
             "WLAN TL:Invalid TID sent in meta info %d - defaulting to 0 (BE)", 
              ucTid));
      ucTid = 0; 
@@ -6470,7 +6933,8 @@
   {
     vosStatus =  WLANTL_Translate8023To80211Header( vosDataBuff, &vosStatus,
                                                     pTLCb, &ucSTAId,
-                                                    tlMetaInfo.ucUP, &ucWDSEnabled, &extraHeadSpace);
+                                                    &tlMetaInfo, &ucWDSEnabled,
+                                                    &extraHeadSpace);
     if ( VOS_STATUS_SUCCESS != vosStatus )
     {
       TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
@@ -6591,7 +7055,8 @@
 (
   v_PVOID_t     pvosGCtx,
   v_U8_t        ucSTAId,
-  vos_pkt_t**   pvosDataBuff
+  vos_pkt_t**   pvosDataBuff,
+  v_BOOL_t      bForwardIAPPwithLLC
 )
 {
    v_U16_t               usPktLen;
@@ -6752,7 +7217,7 @@
   /*Make sure TID is valid*/
   if ( WLANTL_TID_INVALID(ucTid)) 
   {
-     TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+     TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
             "WLAN TL:Invalid TID sent in meta info %d - defaulting to 0 (BE)", 
              ucTid));
      ucTid = 0; 
@@ -6872,7 +7337,8 @@
 
        vosStatus =  WLANTL_Translate8023To80211Header( vosDataBuff, &vosStatus,
                                                     pTLCb, &ucSTAId,
-                                                    tlMetaInfo.ucUP, &ucWDSEnabled, &extraHeadSpace);
+                                                    &tlMetaInfo, &ucWDSEnabled,
+                                                    &extraHeadSpace);
        if ( VOS_STATUS_SUCCESS != vosStatus )
        {
           TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
@@ -6886,7 +7352,18 @@
        tlMetaInfo.ucDisableFrmXtl = 1;
     }
   }
+#ifdef FEATURE_WLAN_TDLS
+    /*In case of TDLS, if the packet is destined to TDLS STA ucSTAId may
+      change. so update the pStaClient accordingly */
+    pStaClient = pTLCb->atlSTAClients[ucSTAId];
 
+    if ( NULL == pStaClient )
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+        "pStaClient is NULL %s", __func__));
+        return VOS_STATUS_E_FAILURE;
+    }
+#endif
   /*-------------------------------------------------------------------------
     Call HAL to fill BD header
    -------------------------------------------------------------------------*/
@@ -7029,7 +7506,8 @@
 (
   v_PVOID_t     pvosGCtx,
   v_U8_t        ucSTAId,
-  vos_pkt_t**   pvosDataBuff
+  vos_pkt_t**   pvosDataBuff,
+  v_BOOL_t      bForwardIAPPwithLLC
 )
 {
    WLANTL_CbType*        pTLCb       = NULL;
@@ -7107,7 +7585,8 @@
 (
   v_PVOID_t     pvosGCtx,
   v_U8_t        ucSTAId,
-  vos_pkt_t**   pvosDataBuff
+  vos_pkt_t**   pvosDataBuff,
+  v_BOOL_t      bForwardIAPPwithLLC
 )
 {
    WLANTL_CbType*           pTLCb = NULL;
@@ -7230,7 +7709,7 @@
       }
 
       vosStatus = WLANTL_Translate80211To8023Header( vosDataBuff, &vosStatus, usActualHLen, 
-                      ucMPDUHLen, pTLCb, ucSTAId);
+                      ucMPDUHLen, pTLCb, ucSTAId, bForwardIAPPwithLLC);
 
         if ( VOS_STATUS_SUCCESS != vosStatus ) 
         {
@@ -7423,15 +7902,16 @@
       wRxMetaInfo.ucUP = (v_U8_t)(STAMetaInfo & WLANTL_AC_MASK);
       wRxMetaInfo.ucDesSTAId = ucDesSTAId;
      
-   vosStatus = pClientSTA->pfnSTARx( pvosGCtx, vosDataBuff, ucDesSTAId,
+      vosStatus = pClientSTA->pfnSTARx( pvosGCtx, vosDataBuff, ucDesSTAId,
                                             &wRxMetaInfo );
-  if ( VOS_STATUS_SUCCESS != vosStatus )
-  {
-     TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+      if ( VOS_STATUS_SUCCESS != vosStatus )
+      {
+          TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
                 "WLAN TL: failed to send pkt to HDD \n"));
-     vos_pkt_return_packet(vosDataBuff);
-     return vosStatus;
-   }
+          vos_pkt_return_packet(vosDataBuff);
+
+          return vosStatus;
+      }
       vosDataBuff = vosNextDataBuff;
    }
    return VOS_STATUS_SUCCESS;
@@ -7470,7 +7950,8 @@
 (
   v_PVOID_t     pvosGCtx,
   v_U8_t        ucSTAId,
-  vos_pkt_t**   pvosDataBuff
+  vos_pkt_t**   pvosDataBuff,
+  v_BOOL_t      bForwardIAPPwithLLC
 )
 {
    WLANTL_CbType*           pTLCb = NULL;
@@ -7596,6 +8077,25 @@
   }
   }
 
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+  if (pTLCb->multicastDuplicateDetectionEnabled &&
+      (WLAN_STA_IBSS == pClientSTA->wSTADesc.wSTAType) &&
+       WLANTL_IS_DATA_FRAME(WDA_GET_RX_TYPE_SUBTYPE(aucBDHeader)))
+  {
+    /*
+     * Multicast duplicate detection is only for frames received in
+     * IBSS mode.
+     */
+    if (VOS_TRUE == WLANTL_IsDuplicateMcastFrm(pClientSTA, vosDataBuff))
+    {
+         pTLCb->mcastDupCnt++;
+         /* Duplicate multicast data packet, drop the packet */
+         vos_pkt_return_packet(vosDataBuff);
+         return VOS_STATUS_SUCCESS;
+    }
+  }
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
 #ifdef FEATURE_WLAN_WAPI
   if ( pClientSTA->wSTADesc.ucIsWapiSta )
   {
@@ -7689,7 +8189,7 @@
       usActualHLen = usMPDUDOffset - ucMPDUHOffset;
     }
     vosStatus = WLANTL_Translate80211To8023Header( vosDataBuff, &vosStatus, usActualHLen, 
-                        ucMPDUHLen, pTLCb, ucSTAId);
+                        ucMPDUHLen, pTLCb, ucSTAId, bForwardIAPPwithLLC);
 
       if ( VOS_STATUS_SUCCESS != vosStatus )
       {
@@ -7832,6 +8332,16 @@
     {
       wRxMetaInfo.ucUP = ucTid;
       wRxMetaInfo.rssiAvg = pClientSTA->rssiAvg;
+#ifdef FEATURE_WLAN_TDLS
+      if (WLAN_STA_TDLS == pClientSTA->wSTADesc.wSTAType)
+      {
+          wRxMetaInfo.isStaTdls = TRUE;
+      }
+      else
+      {
+          wRxMetaInfo.isStaTdls = FALSE;
+      }
+#endif
       pClientSTA->pfnSTARx( pvosGCtx, vosDataBuff, ucSTAId,
                                             &wRxMetaInfo );
     }
@@ -7871,7 +8381,8 @@
 (
   v_PVOID_t     pvosGCtx,
   v_U8_t        ucSTAId,
-  vos_pkt_t**   pvosDataBuff
+  vos_pkt_t**   pvosDataBuff,
+  v_BOOL_t      bForwardIAPPwithLLC
 )
 {
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
@@ -8232,7 +8743,7 @@
        | 00 | ucBcastSignature | ucUcastSignature | ucSTAID |
        each field above is one byte
     ---------------------------------------------------------------------*/
-    uData       = (v_U32_t)message->bodyptr; 
+    uData       = message->bodyval;
     ucSTAId     = ( uData & 0x000000FF); 
     ucUcastSig  = ( uData & 0x0000FF00)>>8; 
     ucBcastSig  = (v_U8_t)(( uData & 0x00FF0000)>>16); 
@@ -8266,10 +8777,8 @@
       break;
 
   case WDA_DS_TX_START_XMIT:
-
-    WLANTL_ClearTxXmitPending(pvosGCtx);
-    vosStatus = WDA_DS_TxFrames( pvosGCtx );
-
+      WLANTL_ClearTxXmitPending(pvosGCtx);
+      vosStatus = WDA_DS_TxFrames( pvosGCtx );
       break;
 
   case WDA_DS_FINISH_ULA:
@@ -8278,6 +8787,13 @@
     callbackRoutine(callbackContext);
     break;
 
+  case WLANTL_TX_SNAPSHOT:
+    /*Dumping TL State and then continuing to print
+      the DXE Dump*/
+    WLANTL_TxThreadDebugHandler(pvosGCtx);
+    WDA_TransportChannelDebug(NULL, VOS_TRUE, VOS_FALSE);
+    break;
+
   default:
     /*no processing for now*/
     break;
@@ -8643,7 +9159,7 @@
   VOS_STATUS*     pvosStatus,
   WLANTL_CbType*  pTLCb,
   v_U8_t          *pucStaId,
-  v_U8_t          ucUP,
+  WLANTL_MetaInfoType *tlMetaInfo,
   v_U8_t          *ucWDSEnabled,
   v_U8_t          *extraHeadSpace
 )
@@ -8657,6 +9173,11 @@
   WLANTL_STAClientType*  pClientSTA = NULL;
   v_U8_t                 ucQoSOffset = WLAN80211_MANDATORY_HEADER_SIZE;
   v_U8_t                 ucStaId;
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+  v_BOOL_t               bIAPPTxwithLLC = VOS_FALSE;
+  v_SIZE_t               wIAPPSnapSize = WLANTL_LLC_HEADER_LEN;
+  v_U8_t                 wIAPPSnap[WLANTL_LLC_HEADER_LEN] = {0};
+#endif
 
   *ucWDSEnabled = 0; // default WDS off.
   vosStatus = vos_pkt_pop_head( vosDataBuff, &w8023Header,
@@ -8694,7 +9215,8 @@
     for ( ucIndex = 0; ucIndex < WLAN_MAX_STA_COUNT ; ucIndex++)
     {
       if ( ucIndex != ucStaId && pTLCb->atlSTAClients[ucIndex] && pTLCb->atlSTAClients[ucIndex]->ucExists &&
-          !pTLCb->atlSTAClients[ucIndex]->ucTxSuspended &&
+          (pTLCb->atlSTAClients[ucIndex]->tlState == WLANTL_STA_AUTHENTICATED) &&
+          (!pTLCb->atlSTAClients[ucIndex]->ucTxSuspended) &&
           vos_mem_compare( (void*)pTLCb->atlSTAClients[ucIndex]->wSTADesc.vSTAMACAddress.bytes,
             (void*)w8023Header.vDA, 6) )
       {
@@ -8715,8 +9237,33 @@
   }
 #endif
 
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+  if ((0 == w8023Header.usLenType) && (pClientSTA->wSTADesc.ucIsCcxSta))
+  {
+      vos_pkt_extract_data(vosDataBuff,0,&wIAPPSnap[0],&wIAPPSnapSize);
+      if (vos_mem_compare(wIAPPSnap,
+                          WLANTL_AIRONET_SNAP_HEADER,
+                          WLANTL_LLC_HEADER_LEN))
+      {
+          /*
+           * The SNAP and the protocol type are already in the data buffer.
+           * They are filled by the application (wpa_supplicant). So,
+           * Skip Adding LLC below.
+           */
+           bIAPPTxwithLLC = VOS_TRUE;
+      }
+      else
+      {
+          bIAPPTxwithLLC = VOS_FALSE;
+      }
+  }
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
 
-  if ( 0 != pClientSTA->wSTADesc.ucAddRmvLLC )
+  if ((0 != pClientSTA->wSTADesc.ucAddRmvLLC)
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+      && (!bIAPPTxwithLLC)
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
+     )
   {
     /* Push the length */
     vosStatus = vos_pkt_push_head(vosDataBuff,
@@ -8761,6 +9308,12 @@
   }/*If add LLC is enabled*/
   else
   {
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+       bIAPPTxwithLLC = VOS_FALSE; /*
+                                    * Reset the Flag here to start afresh
+                                    * with the next TX pkt
+                                    */
+#endif /* FEATURE_WLAN_CCX_UPLOAD */
        TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
                  "WLAN TL: STA Client registered to not remove LLC"
                   " WLANTL_Translate8023To80211Header"));
@@ -8827,7 +9380,7 @@
   {
       pw80211Header->wFrmCtrl.subType  = WLANTL_80211_DATA_QOS_SUBTYPE;
 
-      *((v_U16_t *)((v_U8_t *)ppvBDHeader + ucQoSOffset)) = ucUP;
+      *((v_U16_t *)((v_U8_t *)ppvBDHeader + ucQoSOffset)) = tlMetaInfo->ucUP;
 
   }
   else
@@ -8842,36 +9395,49 @@
 
   switch( pClientSTA->wSTADesc.wSTAType )
   {
-      case WLAN_STA_IBSS:
+     case WLAN_STA_IBSS:
         pw80211Header->wFrmCtrl.toDS          = 0;
         pw80211Header->wFrmCtrl.fromDS        = 0;
-        /*Fix me*/
-        vos_copy_macaddr( (v_MACADDR_t*)&pw80211Header->vA1,
-              &pClientSTA->wSTADesc.vSTAMACAddress);
+
+        /*
+         * If the frame is a multicast frame, then, the Address1
+         * should be the destination address filled in the packet. Which is
+         * the multicast address. Otherwise, set it to BSSID
+         */
+        if (0 == tlMetaInfo->ucBcast && 1 == tlMetaInfo->ucMcast)
+        {
+           vos_copy_macaddr( (v_MACADDR_t*)&pw80211Header->vA1,
+                             (v_MACADDR_t*)&w8023Header.vDA);
+        }
+        else
+        {
+           vos_copy_macaddr( (v_MACADDR_t*)&pw80211Header->vA1,
+                 &pClientSTA->wSTADesc.vSTAMACAddress);
+        }
         vos_mem_copy( pw80211Header->vA3,
               &pClientSTA->wSTADesc.vBSSIDforIBSS ,
               VOS_MAC_ADDR_SIZE);
         break;
 
-      case WLAN_STA_BT_AMP:
+     case WLAN_STA_BT_AMP:
         *ucWDSEnabled = 1; // WDS on.
         pw80211Header->wFrmCtrl.toDS          = 1;
         pw80211Header->wFrmCtrl.fromDS        = 1;
         vos_copy_macaddr( (v_MACADDR_t*)&pw80211Header->vA1,
               &pClientSTA->wSTADesc.vSTAMACAddress);
         vos_mem_copy( pw80211Header->vA2,
-                w8023Header.vSA, VOS_MAC_ADDR_SIZE);
+              w8023Header.vSA, VOS_MAC_ADDR_SIZE);
         vos_copy_macaddr( (v_MACADDR_t*)&pw80211Header->vA3,
               &pClientSTA->wSTADesc.vSTAMACAddress);
         /* fill the optional A4 header */
         vos_mem_copy( pw80211Header->optvA4,
-                w8023Header.vSA, VOS_MAC_ADDR_SIZE);
+              w8023Header.vSA, VOS_MAC_ADDR_SIZE);
         TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
-            "BTAMP CASE NOW ---------staid=%d\n",
-            ucStaId));
+                 "BTAMP CASE NOW ---------staid=%d\n",
+                 ucStaId));
         break;
 
-      case WLAN_STA_SOFTAP:
+     case WLAN_STA_SOFTAP:
         *ucWDSEnabled = 0; // WDS off.
         pw80211Header->wFrmCtrl.toDS          = 0;
         pw80211Header->wFrmCtrl.fromDS        = 1;
@@ -8880,13 +9446,13 @@
         vos_copy_macaddr( (v_MACADDR_t*)&pw80211Header->vA2,
               &pClientSTA->wSTADesc.vSelfMACAddress);
         vos_mem_copy( pw80211Header->vA3,
-                w8023Header.vSA, VOS_MAC_ADDR_SIZE);
+              w8023Header.vSA, VOS_MAC_ADDR_SIZE);
         TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
-            "sw 802 to 80211 softap case  ---------staid=%d\n",
-            ucStaId));
+                 "sw 802 to 80211 softap case  ---------staid=%d\n",
+                 ucStaId));
         break;
 #ifdef FEATURE_WLAN_TDLS
-      case WLAN_STA_TDLS:
+     case WLAN_STA_TDLS:
         pw80211Header->wFrmCtrl.toDS          = 0;
         pw80211Header->wFrmCtrl.fromDS        = 0;
         /*Fix me*/
@@ -8896,19 +9462,19 @@
               &pClientSTA->wSTADesc.vBSSIDforIBSS ,
               VOS_MAC_ADDR_SIZE);
         VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
-            ("TL:TDLS CASE NOW ---------staid=%d\n"), ucStaId);
+              ("TL:TDLS CASE NOW ---------staid=%d\n"), ucStaId);
         break;
 #endif
-      case WLAN_STA_INFRA:
-      default:
+     case WLAN_STA_INFRA:
+     default:
         pw80211Header->wFrmCtrl.toDS          = 1;
         pw80211Header->wFrmCtrl.fromDS        = 0;
         vos_copy_macaddr( (v_MACADDR_t*)&pw80211Header->vA1,
               &pClientSTA->wSTADesc.vSTAMACAddress);
         vos_mem_copy( pw80211Header->vA3, w8023Header.vDA , VOS_MAC_ADDR_SIZE);
         TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
-            "REGULAR INFRA LINK CASE---------staid=%d\n",
-            ucStaId));
+                 "REGULAR INFRA LINK CASE---------staid=%d\n",
+                 ucStaId));
         break;
   }
   // OK now we have the space. Fill the 80211 header
@@ -9015,7 +9581,8 @@
   v_U16_t         usActualHLen,
   v_U8_t          ucHeaderLen,
   WLANTL_CbType*  pTLCb,
-  v_U8_t          ucSTAId
+  v_U8_t          ucSTAId,
+  v_BOOL_t        bForwardIAPPwithLLC
 )
 {
   WLANTL_8023HeaderType  w8023Header;
@@ -9105,7 +9672,11 @@
       return VOS_STATUS_E_FAILURE;
   }
 
-  if ( 0 != pTLCb->atlSTAClients[ucSTAId]->wSTADesc.ucAddRmvLLC )
+  if ( 0 != pTLCb->atlSTAClients[ucSTAId]->wSTADesc.ucAddRmvLLC
+#ifdef FEATURE_WLAN_CCX_UPLOAD
+    && (!bForwardIAPPwithLLC)
+#endif /*  FEATURE_WLAN_CCX_UPLOAD */
+     )
   {
     // Extract the LLC header
     vosStatus = vos_pkt_pop_head( vosDataBuff, aucLLCHeader,
@@ -10006,7 +10577,7 @@
 
 /*==========================================================================
 
-  FUNCTION    WLANTL_STARxDefaultCb
+  FUNCTION   WLANTL_BAPRxDefaultCb
 
   DESCRIPTION
     Default BAP rx callback: asserts all the time. If this function gets
@@ -10070,7 +10641,7 @@
        "WLAN TL: No registered STA client rx cb for STAID: %d dropping pkt",
                ucSTAId));
   vos_pkt_return_packet(vosDataBuff);
-  return VOS_STATUS_E_FAILURE;
+  return VOS_STATUS_SUCCESS;
 }/*WLANTL_MgmtFrmRxDefaultCb*/
 
 
@@ -10477,12 +11048,12 @@
    ------------------------------------------------------------------------*/
   pTLCb = VOS_GET_TL_CB(pvosGCtx);
   if (( NULL == pTLCb ) || WLANTL_STA_ID_INVALID( ucSTAId )
-      ||   WLANTL_AC_INVALID(ucAC) || ( 0 == uServiceInt ) )
+      ||   WLANTL_AC_INVALID(ucAC))
   {
     TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
                "WLAN TL:Invalid input params on WLANTL_EnableUAPSDForAC"
-               " TL: %p  STA: %d  AC: %d SI: %d",
-               pTLCb, ucSTAId, ucAC, uServiceInt ));
+               " TL: %p  STA: %d  AC: %d",
+               pTLCb, ucSTAId, ucAC));
     return VOS_STATUS_E_FAULT;
   }
 
@@ -10495,24 +11066,35 @@
 
   /*Set this flag in order to remember that this is a trigger enabled AC*/
   pTLCb->atlSTAClients[ucSTAId]->wUAPSDInfo[ucAC].ucSet = 1;
-  
-  TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
-             "WLAN TL:Enabling U-APSD in FW for STA: %d AC: %d SI: %d SPI: %d "
-             "DI: %d",
-             ucSTAId, ucAC, uServiceInt, uSuspendInt,
-             pTLCb->tlConfigInfo.uDelayedTriggerFrmInt));
 
-  /*Save all info for HAL*/
-  halUAPSDInfo.staidx         = ucSTAId; 
-  halUAPSDInfo.ac             = ucAC;   
-  halUAPSDInfo.up             = ucUP;   
-  halUAPSDInfo.srvInterval    = uServiceInt;  
-  halUAPSDInfo.susInterval    = uSuspendInt;
-  halUAPSDInfo.delayInterval  = pTLCb->tlConfigInfo.uDelayedTriggerFrmInt; 
+#ifdef FEATURE_WLAN_TDLS
+  if(pTLCb->atlSTAClients[ucSTAId]->wSTADesc.wSTAType != WLAN_STA_TDLS)
+#endif
+  {
+    if( 0 == uServiceInt )
+    {
+      TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+               "WLAN TL:Input params on WLANTL_EnableUAPSDForAC"
+               " SI: %d", uServiceInt ));
+    }
 
-  /*Notify HAL*/
-  vosStatus = WDA_EnableUapsdAcParams(pvosGCtx, ucSTAId, &halUAPSDInfo);
+    TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
+               "WLAN TL:Enabling U-APSD in FW for STA: %d AC: %d SI: %d SPI: %d "
+               "DI: %d",
+               ucSTAId, ucAC, uServiceInt, uSuspendInt,
+               pTLCb->tlConfigInfo.uDelayedTriggerFrmInt));
 
+    /*Save all info for HAL*/
+    halUAPSDInfo.staidx         = ucSTAId;
+    halUAPSDInfo.ac             = ucAC;
+    halUAPSDInfo.up             = ucUP;
+    halUAPSDInfo.srvInterval    = uServiceInt;
+    halUAPSDInfo.susInterval    = uSuspendInt;
+    halUAPSDInfo.delayInterval  = pTLCb->tlConfigInfo.uDelayedTriggerFrmInt;
+
+    /*Notify HAL*/
+    vosStatus = WDA_EnableUapsdAcParams(pvosGCtx, ucSTAId, &halUAPSDInfo);
+  }
   return vosStatus;
 
 }/*WLANTL_EnableUAPSDForAC*/
@@ -11209,6 +11791,83 @@
    return VOS_STATUS_SUCCESS;
 }
 
+/*==========================================================================
+
+   FUNCTION
+
+   DESCRIPTION   Read SNR value out of a RX BD
+
+   PARAMETERS:  Caller must validate all parameters
+
+   RETURN VALUE
+
+============================================================================*/
+VOS_STATUS WLANTL_ReadSNR
+(
+   v_PVOID_t        pAdapter,
+   v_PVOID_t        pBDHeader,
+   v_U8_t           STAid
+)
+{
+   WLANTL_CbType   *tlCtxt = VOS_GET_TL_CB(pAdapter);
+   v_S7_t           currentSNR;
+
+
+   if (NULL == tlCtxt)
+   {
+      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                       "%s Invalid TL handle", __func__));
+      return VOS_STATUS_E_INVAL;
+   }
+
+   if (NULL == tlCtxt->atlSTAClients[STAid])
+   {
+       TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+           "WLAN TL:Client Memory was not allocated on %s", __func__));
+       return VOS_STATUS_E_FAILURE;
+   }
+
+   currentSNR = WLANTL_GETSNR(pBDHeader);
+
+   /* SNR reported in the Buffer Descriptor is scaled up by 2(SNR*2),
+    * Get the correct SNR value
+    */
+   currentSNR = currentSNR >> 1;
+
+   /* SNR reported by HW cannot be more than 35dB due to HW limitations */
+   currentSNR = (WLANTL_MAX_HW_SNR > currentSNR ? currentSNR :
+                                                  WLANTL_MAX_HW_SNR);
+
+   TLLOG2(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
+          "%s: snrsum: %d snridx: %d prevsnravg: %d",
+           __func__,
+           tlCtxt->atlSTAClients[STAid]->snrSum,
+           tlCtxt->atlSTAClients[STAid]->snrIdx,
+           tlCtxt->atlSTAClients[STAid]->prevSnrAvg));
+
+   /* The SNR returned for all purposes is the average SNR over
+    * WLANTL_MAX_SNR_DATA_SMAPLES.When data samples
+    * > WLANTL_MAX_SNR_DATA_SAMPLES are obtained,
+    * store the average of the samples in prevSnrAvg
+    * and start a new averaging window. The prevSnrAvg is used when
+    * enough data samples are not available when applications
+    * actually query for SNR.
+    *
+    * SEE: WLANTL_GetSnr()
+    */
+   if (tlCtxt->atlSTAClients[STAid]->snrIdx >= WLANTL_MAX_SNR_DATA_SAMPLES)
+   {
+       tlCtxt->atlSTAClients[STAid]->prevSnrAvg =
+               tlCtxt->atlSTAClients[STAid]->snrSum /
+               tlCtxt->atlSTAClients[STAid]->snrIdx;
+       tlCtxt->atlSTAClients[STAid]->snrSum = 0;
+       tlCtxt->atlSTAClients[STAid]->snrIdx = 0;
+   }
+   tlCtxt->atlSTAClients[STAid]->snrSum += currentSNR;
+   tlCtxt->atlSTAClients[STAid]->snrIdx += 1;
+
+   return VOS_STATUS_SUCCESS;
+}
 
 /*
  DESCRIPTION 
@@ -11752,3 +12411,953 @@
     pTLCb->atlSTAClients[staId]->rssiAvgBmps = rssi;
   }
 }
+
+/*===============================================================================
+  FUNCTION       WLANTL_UpdateSnrBmps
+
+  DESCRIPTION    This function updates the TL's SNR (in BMPS mode)
+
+  DEPENDENCIES   None
+
+  PARAMETERS
+
+    pvosGCtx         VOS context          VOS Global context
+    staId            Station ID           Station ID
+    snr             SNR (BMPS mode)     SNR in BMPS mode
+
+  RETURN         None
+
+  SIDE EFFECTS   none
+ ===============================================================================*/
+
+void WLANTL_UpdateSnrBmps(v_PVOID_t pvosGCtx, v_U8_t staId, v_S7_t snr)
+{
+  WLANTL_CbType* pTLCb = VOS_GET_TL_CB(pvosGCtx);
+
+  if (NULL != pTLCb && NULL != pTLCb->atlSTAClients[staId])
+  {
+    pTLCb->atlSTAClients[staId]->snrAvgBmps = snr;
+  }
+}
+
+/*===============================================================================
+  FUNCTION       WLANTL_UpdateLinkCapacity
+
+  DESCRIPTION    This function updates the STA's Link Capacity in TL
+
+  DEPENDENCIES   None
+
+  PARAMETERS
+
+    pvosGCtx         VOS context          VOS Global context
+    staId            Station ID           Station ID
+    linkCapacity     linkCapacity         Link Capacity
+
+  RETURN         None
+
+  SIDE EFFECTS   none
+ ===============================================================================*/
+
+void WLANTL_UpdateLinkCapacity(v_PVOID_t pvosGCtx, v_U8_t staId, v_U32_t linkCapacity)
+{
+    WLANTL_CbType* pTLCb = VOS_GET_TL_CB(pvosGCtx);
+
+    if (NULL != pTLCb && NULL != pTLCb->atlSTAClients[staId])
+    {
+        pTLCb->atlSTAClients[staId]->linkCapacity = linkCapacity;
+    }
+}
+
+
+/*===========================================================================
+
+  FUNCTION    WLANTL_GetSTALinkCapacity
+
+  DESCRIPTION
+
+    Returns Link Capacity of a particular STA.
+
+  DEPENDENCIES
+
+    A station must have been registered before its state can be retrieved.
+
+
+  PARAMETERS
+
+    IN
+    pvosGCtx:       pointer to the global vos context; a handle to TL's
+                    control block can be extracted from its context
+    ucSTAId:        identifier of the station
+
+    OUT
+    plinkCapacity:  the current link capacity the connection to
+                    the given station
+
+
+  RETURN VALUE
+
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_INVAL:  Input parameters are invalid
+    VOS_STATUS_E_FAULT:  Station ID is outside array boundaries or pointer to
+                         TL cb is NULL ; access would cause a page fault
+    VOS_STATUS_E_EXISTS: Station was not registered
+    VOS_STATUS_SUCCESS:  Everything is good :)
+
+  SIDE EFFECTS
+
+============================================================================*/
+VOS_STATUS
+WLANTL_GetSTALinkCapacity
+(
+    v_PVOID_t             pvosGCtx,
+    v_U8_t                ucSTAId,
+    v_U32_t               *plinkCapacity
+)
+{
+    WLANTL_CbType*  pTLCb = NULL;
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
+
+    /*------------------------------------------------------------------------
+      Sanity check
+     ------------------------------------------------------------------------*/
+    if ( NULL == plinkCapacity )
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                         FL("WLAN TL:Invalid parameter")));
+        return VOS_STATUS_E_INVAL;
+    }
+
+    if ( WLANTL_STA_ID_INVALID( ucSTAId ) )
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                         FL("WLAN TL:Invalid station id")));
+        return VOS_STATUS_E_FAULT;
+    }
+
+    /*------------------------------------------------------------------------
+      Extract TL control block and check existance
+     ------------------------------------------------------------------------*/
+    pTLCb = VOS_GET_TL_CB(pvosGCtx);
+    if ( NULL == pTLCb )
+    {
+         TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                          FL("WLAN TL:Invalid TL pointer from pvosGCtx")));
+         return VOS_STATUS_E_FAULT;
+    }
+
+    if ( NULL == pTLCb->atlSTAClients[ucSTAId] )
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                         FL("WLAN TL:Client Memory was not allocated")));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    if ( 0 == pTLCb->atlSTAClients[ucSTAId]->ucExists )
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_WARN,
+                         FL("WLAN TL:Station was not previously registered")));
+        return VOS_STATUS_E_EXISTS;
+    }
+
+    /*------------------------------------------------------------------------
+      Get STA state
+     ------------------------------------------------------------------------*/
+    *plinkCapacity = pTLCb->atlSTAClients[ucSTAId]->linkCapacity;
+
+    return VOS_STATUS_SUCCESS;
+}/* WLANTL_GetSTALinkCapacity */
+
+
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+
+/*==========================================================================
+   FUNCTION WLANTL_RmcInit
+
+   DESCRIPTION This function initilizes RMC module in TL
+
+   PARAMETERS
+   pADapter : pointer to VOS global context
+
+   RETURN VALUE
+   VOS_STATUS_SUCCESS : for success
+   VOS_STATUS_FAILURE : for failure
+   VOS_STATUS_E_INVAL : for invalid input parameter
+
+============================================================================*/
+VOS_STATUS WLANTL_RmcInit
+(
+    v_PVOID_t   pAdapter
+)
+{
+    WLANTL_CbType   *pTLCb = VOS_GET_TL_CB(pAdapter);
+    VOS_STATUS       status = VOS_STATUS_SUCCESS;
+    tANI_U8          count;
+
+    /*sanity check*/
+    if (NULL == pTLCb)
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "Invalid TL handle"));
+        return VOS_STATUS_E_INVAL;
+    }
+
+    /*init active rmcast sessions list*/
+    for ( count = 0; count < WLANTL_RMCAST_HASH_TABLE_SIZE; count++ )
+    {
+        pTLCb->reliableMcastSession[count] = NULL;
+    }
+
+    vos_lock_init(&pTLCb->rmcLock);
+
+    pTLCb->multicastDuplicateDetectionEnabled = 1;
+    pTLCb->rmcDataPathEnabled = 0;
+
+    return status;
+}
+
+
+/*==========================================================================
+   FUNCTION WLANTL_RmcDeInit
+
+   DESCRIPTION This function de-initilizes RMC module in TL
+
+   PARAMETERS
+   pADapter : pointer to VOS global context
+
+   RETURN VALUE
+   VOS_STATUS_SUCCESS : for success
+   VOS_STATUS_FAILURE : for failure
+   VOS_STATUS_E_INVAL : for invalid input parameter
+
+============================================================================*/
+VOS_STATUS WLANTL_RmcDeInit
+(
+    v_PVOID_t   pAdapter
+)
+{
+    WLANTL_CbType   *pTLCb = VOS_GET_TL_CB(pAdapter);
+    VOS_STATUS       status = VOS_STATUS_SUCCESS;
+    tANI_U8          count;
+    WLANTL_RMCAST_SESSION *pNode;
+    WLANTL_RMCAST_SESSION *pPrev;
+
+    /*sanity check*/
+    if (NULL == pTLCb)
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "Invalid TL handle"));
+        return VOS_STATUS_E_INVAL;
+    }
+
+    /*free active rmcast sessions list*/
+    for ( count = 0; count < WLANTL_RMCAST_HASH_TABLE_SIZE; count++ )
+    {
+        pNode = pTLCb->reliableMcastSession[count];
+        while (pNode)
+        {
+            pPrev = pNode;
+            pNode = pNode->next;
+            vos_mem_free((v_VOID_t * )pPrev);
+        }
+    }
+
+    vos_lock_destroy(&pTLCb->rmcLock);
+
+    return status;
+}
+
+
+/*==========================================================================
+   FUNCTION WLANTL_RmcHashRmcastSession
+
+   DESCRIPTION This function creates hash on input RMCAST MAC address
+
+   PARAMETERS
+   pMcastAddr : pointer to input RMCAST MAC address
+
+   RETURN VALUE
+   tANI_U8 : A hash value between 0 to WLANTL_RMCAST_HASH_TABLE_SIZE - 1
+============================================================================*/
+tANI_U8 WLANTL_RmcHashRmcastSession ( v_MACADDR_t   *pMcastAddr )
+{
+    tANI_U32 sum;
+    tANI_U8  hash;
+
+    sum = (pMcastAddr->bytes[0] + pMcastAddr->bytes[1] + pMcastAddr->bytes[2] +
+           pMcastAddr->bytes[3] + pMcastAddr->bytes[4] + pMcastAddr->bytes[5]);
+
+    hash = (tANI_U8)(sum & ((WLANTL_RMCAST_HASH_TABLE_SIZE - 1)));
+
+    return hash;
+}
+
+
+/*===========================================================================
+   FUNCTION WLANTL_RmcLookUpRmcastSession
+
+   DESCRIPTION This function tries to find out RMCAST address in TL's active
+    list of reliable multicast sessions
+
+   PARAMETERS
+   pTLCb      : pointer to TL Cb
+   pMcastAddr : pointer to input RMCAST MAC address
+
+   RETURN VALUE
+   WLANTL_RMCAST_SESSION * :
+     NULL if input RMCAST MAC address does exist in active RMCAST sessions list
+     else pointer to RMCAST session found in active RMCAST sessions list
+=============================================================================*/
+WLANTL_RMCAST_SESSION* WLANTL_RmcLookUpRmcastSession
+(
+    WLANTL_RMCAST_SESSION *reliableMcastSession[],
+    v_MACADDR_t     *pMcastAddr
+)
+{
+    WLANTL_RMCAST_SESSION *pNode;
+    tANI_U8               index;
+
+    /*sanity check*/
+    if (NULL == pMcastAddr)
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "Sanity check failed pMcastAddr %p", pMcastAddr));
+        return NULL;
+    }
+
+    index = WLANTL_RmcHashRmcastSession(pMcastAddr);
+    pNode = reliableMcastSession[index];
+    while ( pNode )
+    {
+        if (vos_is_macaddr_equal( &(pNode->reliableMcastAddr), pMcastAddr))
+        {
+            return pNode;
+        }
+        pNode = pNode->next;
+    }
+
+    return NULL;
+}
+
+/*===========================================================================
+   FUNCTION WLANTL_RmcAddRmcastSession
+
+   DESCRIPTION This function adds requested RMCAST address in TL's active
+    list of reliable multicast sessions
+
+   PARAMETERS
+   pTLCb      : pointer to TL Cb
+   pMcastAddr : pointer to input RMCAST MAC address
+
+   RETURN VALUE
+   WLANTL_RMCAST_SESSION * :
+     NULL if input RMCAST MAC address already exists in active RMCAST sessions
+     list else pointer to RMCAST session which is now added in active RMCAST
+     sessions list
+=============================================================================*/
+WLANTL_RMCAST_SESSION *WLANTL_RmcAddRmcastSession
+(
+  WLANTL_RMCAST_SESSION *reliableMcastSession[],
+  v_MACADDR_t   *pMcastAddr
+)
+{
+    WLANTL_RMCAST_SESSION *pNode;
+    tANI_U8               index;
+
+    index = WLANTL_RmcHashRmcastSession(pMcastAddr);
+    pNode = WLANTL_RmcLookUpRmcastSession(reliableMcastSession, pMcastAddr);
+    if ( NULL != pNode )
+    {
+        /*already exists*/
+        return NULL;
+    }
+    else
+    {
+        pNode = (WLANTL_RMCAST_SESSION *)vos_mem_malloc(sizeof(*pNode));
+        if (pNode)
+        {
+            vos_mem_copy( &(pNode->reliableMcastAddr), pMcastAddr,
+                sizeof(pNode->reliableMcastAddr) );
+            pNode->next = reliableMcastSession[index];
+            reliableMcastSession[index] = pNode;
+            return pNode;
+        }
+        else
+        {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: vos_mem_malloc failed can't enable RMCAST session",
+                __func__);
+            return NULL;
+        }
+    }
+}
+
+/*===========================================================================
+   FUNCTION WLANTL_RmcDeleteRmcastSession
+
+   DESCRIPTION This function deleted requested RMCAST address from TL's active
+    list of reliable multicast sessions
+
+   PARAMETERS
+   pTLCb      : pointer to TL Cb
+   pMcastAddr : pointer to input RMCAST MAC address
+
+   RETURN VALUE
+   WLANTL_RMCAST_SESSION * :
+     0 if input RMCAST session does not exist in active RMCAST
+      sessions list
+     1 if input RMCAST session is successfully deleted from
+       TL's active list of reliable multicast sessions
+=============================================================================*/
+tANI_U8
+WLANTL_RmcDeleteRmcastSession
+(
+  WLANTL_RMCAST_SESSION *reliableMcastSession[],
+  v_MACADDR_t   *pMcastAddr
+)
+{
+    WLANTL_RMCAST_SESSION *pHead;
+    WLANTL_RMCAST_SESSION *pNode;
+    WLANTL_RMCAST_SESSION *pPrev;
+    tANI_U8               index;
+
+    index = WLANTL_RmcHashRmcastSession(pMcastAddr);
+    pHead = pNode = reliableMcastSession[index];
+    while (pNode)
+    {
+        if (vos_is_macaddr_equal( &(pNode->reliableMcastAddr), pMcastAddr))
+        {
+            if (pHead == pNode)
+            {
+                reliableMcastSession[index] = pNode->next;
+            }
+            else
+            {
+                pPrev->next = pNode->next;
+            }
+            vos_mem_free((v_VOID_t * )pNode);
+            return 1;
+        }
+        pPrev = pNode;
+        pNode = pNode->next;
+    }
+
+    return 0;
+}
+
+/*=============================================================================
+  FUNCTION    WLANTL_ProcessRmcCommand
+
+  DESCRIPTION
+    This function adds/deletes input RMCAST session to/from TL's active hash
+    table of RMCAST sessions
+
+  DEPENDENCIES
+    Reliable multicast receive leader must be selected by FW before
+    UMAC calling this API
+
+  PARAMETERS
+
+   IN
+
+   pTLCb      : Pointer to TL context
+   pMcastAddr : Pointer to MAC ADDR of RMCAST session which needs to to added
+                or deleted
+   command    : If command is 1 then add requested RMCAST session in active
+                session hash table else delete it from active session hash
+                table
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAILURE:   When add or delete command failed
+
+    VOS_STATUS_SUCCESS:     Everything is good :)
+
+  SIDE EFFECTS
+==============================================================================*/
+VOS_STATUS
+WLANTL_ProcessRmcCommand
+(
+    WLANTL_CbType*  pTLCb,
+    v_MACADDR_t    *pMcastAddr,
+    tANI_U32        command
+)
+{
+    VOS_STATUS status;
+    tANI_U32 count;
+    tANI_U32 rmcActive;
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire( &(pTLCb->rmcLock))))
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "%s Get Lock Fail", __func__));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    /*add or delete node from active rmcast hash table*/
+    if (command)
+    {
+        /*add requested rmcast session in active rmcast session list*/
+        if (WLANTL_RmcAddRmcastSession(pTLCb->reliableMcastSession, pMcastAddr))
+        {
+            TLLOGE( VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "RMCAST session " MAC_ADDRESS_STR " added in TL hash table",
+                MAC_ADDR_ARRAY(pMcastAddr->bytes) ) );
+            pTLCb->rmcDataPathEnabled = TRUE;
+            status = VOS_STATUS_SUCCESS;
+        }
+        else
+        {
+            TLLOGE( VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "RMCAST session " MAC_ADDRESS_STR " already exists in TL hash"
+                " table", MAC_ADDR_ARRAY(pMcastAddr->bytes) ) );
+            status = VOS_STATUS_E_FAILURE;
+        }
+    }
+    else
+    {
+        /*delete requested rmcast session from active rmcast session list*/
+        if (WLANTL_RmcDeleteRmcastSession(pTLCb->reliableMcastSession, pMcastAddr))
+        {
+            TLLOGE( VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                "RMCAST session " MAC_ADDRESS_STR " deleted from TL hash table",
+                MAC_ADDR_ARRAY(pMcastAddr->bytes)) );
+            status = VOS_STATUS_SUCCESS;
+            rmcActive = FALSE;
+            for ( count = 0; count < WLANTL_RMCAST_HASH_TABLE_SIZE; count++ )
+            {
+                if (pTLCb->reliableMcastSession[count])
+                {
+                    rmcActive = TRUE;
+                    break;
+                }
+            }
+            if (TRUE == rmcActive)
+            {
+                pTLCb->rmcDataPathEnabled = TRUE;
+            }
+            else
+            {
+                pTLCb->rmcDataPathEnabled = FALSE;
+            }
+        }
+        else
+        {
+            TLLOGE( VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "RMCAST session " MAC_ADDRESS_STR " doesn't exist in TL hash"
+                " table", MAC_ADDR_ARRAY(pMcastAddr->bytes) ) );
+            status = VOS_STATUS_E_FAILURE;
+        }
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_release(&(pTLCb->rmcLock))))
+    {
+         TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+             "%s Release Lock Fail", __func__));
+         return VOS_STATUS_E_FAILURE;
+    }
+
+    return status;
+}/* End of WLANTL_ProcessRmcCommand */
+
+/*=============================================================================
+  FUNCTION    WLANTL_EnableReliableMcast
+
+  DESCRIPTION
+    This function enables data path of reliable multicast in TL
+
+  DEPENDENCIES
+    Reliable multicast receive leader must be selected by FW before
+    UMAC calling this API
+
+  PARAMETERS
+
+   IN
+
+   pvosGCtx   : Pointer to VOS global context
+   pMcastTransmitterAddr : Pointer to MAC ADDR of reliable multicast transmitter
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAULT:   Sanity  check on input failed
+
+    VOS_STATUS_SUCCESS:   Everything is good :)
+
+   Other return values are possible coming from the called functions.
+   Please check API for additional info.
+
+  SIDE EFFECTS
+
+==============================================================================*/
+VOS_STATUS
+WLANTL_EnableReliableMcast
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastTransmitterAddr
+)
+{
+    WLANTL_CbType*  pTLCb;
+    VOS_STATUS status;
+
+    /*sanity check*/
+    if ( (NULL == pvosGCtx) || (NULL == pMcastTransmitterAddr) )
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: Sanity check failed pvosGCtx %p aMcastAddr %p",
+            __func__, pvosGCtx, pMcastTransmitterAddr));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    /*sanity check*/
+    pTLCb = VOS_GET_TL_CB(pvosGCtx);
+    if ( NULL == pTLCb )
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: pTLCb is NULL", __func__));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    status = WLANTL_ProcessRmcCommand(pTLCb, pMcastTransmitterAddr , 1);
+
+    return status;
+} /* End of WLANTL_EnableReliableMcast */
+
+
+/*=============================================================================
+  FUNCTION    WLANTL_DisableReliableMcast
+
+  DESCRIPTION
+    This function disables data path of reliable multicast in TL
+
+  DEPENDENCIES
+    HDD should have recived IOCTL to disable reliable RMC
+
+  PARAMETERS
+
+   IN
+
+   pvosGCtx   : Pointer to VOS global context
+   pMcastAddr : Pointer to MAC ADDR of reliable multicast transmitter
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAULT:   Sanity  check on input failed
+
+    VOS_STATUS_SUCCESS:   Everything is good :)
+
+   Other return values are possible coming from the called functions.
+   Please check API for additional info.
+
+  SIDE EFFECTS
+
+==============================================================================*/
+VOS_STATUS
+WLANTL_DisableReliableMcast
+(
+    v_PVOID_t     pvosGCtx,
+    v_MACADDR_t   *pMcastTransmitterAddr
+)
+{
+    WLANTL_CbType* pTLCb;
+    VOS_STATUS status;
+
+    /*Sanity check*/
+    if ((NULL == pvosGCtx) || (NULL == pMcastTransmitterAddr))
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: Sanity check failed pvosGCtx %p aMcastAddr %p",
+             __func__, pvosGCtx, pMcastTransmitterAddr));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    /*Sanity check*/
+    pTLCb = VOS_GET_TL_CB(pvosGCtx);
+    if (NULL == pTLCb)
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: pTLCb is NULL", __func__));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    status = WLANTL_ProcessRmcCommand(pTLCb, pMcastTransmitterAddr, 0);
+
+    return status;
+} /* End of WLANTL_DisableReliableMcast */
+
+/*=============================================================================
+        Duplicate Multicast Detection Functions
+==============================================================================*/
+
+/*=============================================================================
+  FUNCTION    WLANTL_IsDuplicateMcastFrm
+
+  DESCRIPTION
+    This function checks for duplicast multicast frames and drops them.
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pClientSTA  : Pointer to WLANTL_STAClientType
+   aucBDHeader : Pointer to BD header
+
+  RETURN VALUE
+
+    VOS_FALSE:  This frame is not a duplicate
+
+    VOS_TRUE:   This frame is a duplicate
+
+==============================================================================*/
+v_U8_t
+WLANTL_IsDuplicateMcastFrm
+(
+    WLANTL_STAClientType *pClientSTA,
+    vos_pkt_t *vosDataBuff
+)
+{
+    v_U8_t duplicate = VOS_FALSE;
+    WLANTL_RMCAST_SESSION *pNode;
+    v_U16_t     usSeqCtrl;
+    v_MACADDR_t mcastAddr;
+    VOS_STATUS  vosStatus;
+    v_PVOID_t   pvPeekData;
+
+    /* Get address 1 of Data Frame */
+    vosStatus = vos_pkt_peek_data(vosDataBuff, WLANTL_MAC_ADDR_ALIGN(1),
+                                  (v_PVOID_t)&pvPeekData, VOS_MAC_ADDR_SIZE);
+
+    if ( VOS_STATUS_SUCCESS != vosStatus )
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "WLAN TL: Failed to get Addr 1 of 80211 header from packet %d",
+                vosStatus));
+        return VOS_FALSE;
+    }
+
+    /* Copy address 1 of Data Frame */
+    vos_mem_copy(&mcastAddr.bytes, pvPeekData, VOS_MAC_ADDR_SIZE);
+
+    /*
+     * We perform duplicate detection for only multicast data frames
+     */
+    if (vos_is_macaddr_group(&mcastAddr) &&
+         !vos_is_macaddr_broadcast(&mcastAddr))
+    {
+        /* Get sequence control of Data Frame */
+        vosStatus = vos_pkt_peek_data(vosDataBuff,
+                    (WLANTL_MAC_ADDR_ALIGN(1) + (3 * VOS_MAC_ADDR_SIZE)),
+                      (v_PVOID_t)&pvPeekData, sizeof(v_U16_t));
+
+        if ( VOS_STATUS_SUCCESS != vosStatus )
+        {
+            TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                    "WLAN TL: Failed to get Sequence Control from packet %d",
+                    vosStatus));
+            return VOS_FALSE;
+        }
+
+        /* Copy sequence control from the Data Frame */
+        usSeqCtrl = *(v_U16_t *)pvPeekData;
+
+        if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&(pClientSTA->mcLock))))
+        {
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                    "%s Get Lock Fail", __func__));
+            return VOS_FALSE;
+        }
+
+        pNode = WLANTL_RmcLookUpRmcastSession(pClientSTA->mcastSession,
+                                                      &mcastAddr);
+        if (NULL == pNode)
+        {
+            /* If the session does not exist, add it. */
+            pNode = WLANTL_RmcAddRmcastSession(pClientSTA->mcastSession,
+                                              &mcastAddr);
+            /* If we could not add a entry, skip duplicate detection */
+            if (NULL == pNode)
+            {
+                TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                    "%s Failed to add multicast session", __func__));
+                if (!VOS_IS_STATUS_SUCCESS
+                     (vos_lock_release(&(pClientSTA->mcLock))))
+                {
+                    TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                        "%s Release Lock Fail", __func__));
+                }
+                return VOS_FALSE;
+            }
+            /* Initialize the sequence control value. */
+            pNode->mcSeqCtl = usSeqCtrl;
+        }
+        else
+        {
+            /*
+             * Check if the sequence number of this frame matches the last
+             * we have seen.
+             */
+            if (pNode->mcSeqCtl == usSeqCtrl)
+            {
+                pNode->rxMCDupcnt++;
+                TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                     "%s Rx Multicast Duplicate %d " MAC_ADDRESS_STR
+                     " (Seq %x)", __func__,
+                     pNode->rxMCDupcnt, MAC_ADDR_ARRAY(mcastAddr.bytes),
+                     usSeqCtrl));
+                duplicate = VOS_TRUE;
+            }
+            else
+            {
+                /* Update the last seen sequence number */
+                pNode->mcSeqCtl = usSeqCtrl;
+            }
+        }
+
+        if (!VOS_IS_STATUS_SUCCESS (vos_lock_release(&(pClientSTA->mcLock))))
+        {
+            TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                    "%s Release Lock Fail", __func__));
+        }
+    }
+
+    return duplicate;
+}
+
+/*=============================================================================
+  FUNCTION    WLANTL_McastDeleteAllEntries
+
+  DESCRIPTION
+    This function removes all multicast entries used for duplicate detection
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pClientSTA  : Pointer to WLANTL_STAClientType
+
+  RETURN VALUE
+
+    None
+
+==============================================================================*/
+void
+WLANTL_McastDeleteAllEntries(WLANTL_STAClientType * pClientSTA)
+{
+    WLANTL_RMCAST_SESSION *pNode, **head;
+    int index;
+
+    TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                        "%s Deleting all multicast entries", __func__));
+
+    if (!VOS_IS_STATUS_SUCCESS(vos_lock_acquire(&(pClientSTA->mcLock))))
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "%s Get Lock Fail", __func__));
+        return;
+    }
+
+    for (index = 0; index < WLANTL_RMCAST_HASH_TABLE_SIZE; index++)
+    {
+        head = &pClientSTA->mcastSession[index];
+
+        pNode = *head;
+
+        while (pNode)
+        {
+            *head = pNode->next;
+            /* free the group entry */
+            vos_mem_free(pNode);
+            pNode = *head;
+        }
+    }
+
+    if (!VOS_IS_STATUS_SUCCESS (vos_lock_release(&(pClientSTA->mcLock))))
+    {
+        TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                "%s Release Lock Fail", __func__));
+    }
+}
+
+/*=============================================================================
+  FUNCTION    WLANTL_SetMcastDuplicateDetection
+
+  DESCRIPTION
+    This function sets multicate duplicate detection operation.
+    If enable is 1, the detection is enabled, else it is disabled.
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pvosGCtx   : Pointer to VOS global context
+   enable : Boolean to enable or disable
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAULT:   Sanity check on input failed
+
+    VOS_STATUS_SUCCESS:   Everything is good :)
+
+   Other return values are possible coming from the called functions.
+   Please check API for additional info.
+
+  SIDE EFFECTS
+
+==============================================================================*/
+VOS_STATUS
+WLANTL_SetMcastDuplicateDetection
+(
+    v_PVOID_t     pvosGCtx,
+    v_U8_t        enable
+)
+{
+    WLANTL_CbType* pTLCb;
+
+    /*Sanity check*/
+    if (NULL == pvosGCtx)
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: Sanity check failed pvosGCtx %p",
+             __func__, pvosGCtx));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    /*Sanity check*/
+    pTLCb = VOS_GET_TL_CB(pvosGCtx);
+    if (NULL == pTLCb)
+    {
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: pTLCb is NULL", __func__));
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    switch (enable)
+    {
+    default:
+        /*
+         * Any value other than 0 or 1 is used to dump the
+         * duplicate count.
+         */
+        TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+            "WLAN TL %s: Multicast Duplicate Count %d",
+             __func__, pTLCb->mcastDupCnt));
+        break;
+    case 0:
+    case 1:
+        pTLCb->multicastDuplicateDetectionEnabled = enable;
+        break;
+    }
+
+    return VOS_STATUS_SUCCESS;
+}
+
+#endif /* End of WLAN_FEATURE_RELIABLE_MCAST */
diff --git a/CORE/TL/src/wlan_qct_tl_ba.c b/CORE/TL/src/wlan_qct_tl_ba.c
index 953eb37..7590442 100644
--- a/CORE/TL/src/wlan_qct_tl_ba.c
+++ b/CORE/TL/src/wlan_qct_tl_ba.c
@@ -85,6 +85,8 @@
 //#define WLANTL_REORDER_DEBUG_MSG_ENABLE
 #define WLANTL_BA_REORDERING_AGING_TIMER   30   /* 30 millisec */
 #define WLANTL_BA_MIN_FREE_RX_VOS_BUFFER   0    /* RX VOS buffer low threshold */
+#define CSN_WRAP_AROUND_THRESHOLD          3000 /* CSN wrap around threshold */
+
 
 
 /*==========================================================================
@@ -121,6 +123,10 @@
    v_U8_t                       opCode;
    WLANTL_RxMetaInfoType        wRxMetaInfo;
    v_U32_t                      fwIdx = 0;
+   WDI_DS_RxMetaInfoType       *pRxMetadata;
+   vos_pkt_t                   *pCurrent;
+   vos_pkt_t                   *pNext;
+   v_S15_t                      seq;
    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
 
    if(NULL == timerUdata)
@@ -296,6 +302,24 @@
       return;
    }
 
+   pCurrent = vosDataBuff;
+
+   while (pCurrent != NULL)
+   {
+       vos_pkt_walk_packet_chain(pCurrent, &pNext, VOS_FALSE);
+
+       if (NULL == pNext)
+       {
+           /* This is the last packet, retrieve its sequence number */
+           pRxMetadata = WDI_DS_ExtractRxMetaData(VOS_TO_WPAL_PKT(pCurrent));
+           seq = WDA_GET_RX_REORDER_CUR_PKT_SEQ_NO(pRxMetadata);
+       }
+       pCurrent = pNext;
+   }
+   TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+          "%s: Sending out Frame no: %d to HDD", __func__, seq));
+   ReorderInfo->LastSN = seq;
+
    if( WLAN_STA_SOFTAP == pClientSTA->wSTADesc.wSTAType)
    {
       WLANTL_FwdPktToHDD( expireHandle->pAdapter, vosDataBuff, ucSTAID);
@@ -541,6 +565,7 @@
   pClientSTA->atlBAReorderInfo[ucTid].SSN       = SSN;
   pClientSTA->atlBAReorderInfo[ucTid].sessionID = sessionID;
   pClientSTA->atlBAReorderInfo[ucTid].pendingFramesCount = 0;
+  pClientSTA->atlBAReorderInfo[ucTid].LastSN = SSN;
   TLLOG2(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_HIGH,
              "WLAN TL:New BA session added for STA: %d TID: %d",
              ucSTAId, ucTid));
@@ -763,6 +788,7 @@
   reOrderInfo->winSize   = 0;
   reOrderInfo->SSN       = 0;
   reOrderInfo->sessionID = 0;
+  reOrderInfo->LastSN = 0;
 
   while (vos_lock_destroy(&reOrderInfo->reorderLock) == VOS_STATUS_E_BUSY)
   {
@@ -1113,13 +1139,39 @@
    // remember our current CI so that later we can tell if it advanced
    ucCIndexOrig = currentReorderInfo->ucCIndex;
 
-   switch(ucOpCode) 
+   switch(ucOpCode)
    {
       case WLANTL_OPCODE_INVALID:
          /* Do nothing just pass through current frame */
          break;
 
       case WLANTL_OPCODE_QCUR_FWDBUF:
+         if (currentReorderInfo->LastSN > CSN)
+         {
+             if ((currentReorderInfo->LastSN - CSN) < CSN_WRAP_AROUND_THRESHOLD)
+             {
+                 //this frame is received after BA timer is expired, discard it
+                 TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                          "(QCUR_FWDBUF) dropping old frame, SN=%d LastSN=%d",
+                          CSN, currentReorderInfo->LastSN));
+                 status = vos_pkt_return_packet(*vosDataBuff);
+                 if (!VOS_IS_STATUS_SUCCESS(status))
+                 {
+                      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                             "(QCUR_FWDBUF) drop old frame fail %d", status));
+                 }
+                 *vosDataBuff = NULL;
+                 lockStatus = vos_lock_release(&currentReorderInfo->reorderLock);
+                 if (!VOS_IS_STATUS_SUCCESS(lockStatus))
+                 {
+                     TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                            "WLANTL_MSDUReorder, Release LOCK Fail"));
+                     return lockStatus;
+                 }
+                 return status;
+             }
+         }
+         currentReorderInfo->LastSN = CSN;
          if(0 == currentReorderInfo->pendingFramesCount)
          {
             //This frame will be fwd'ed to the OS. The next slot is the one we expect next
@@ -1233,6 +1285,32 @@
          break;
 
       case WLANTL_OPCODE_QCUR:
+        if (currentReorderInfo->LastSN > CSN)
+        {
+            if ((currentReorderInfo->LastSN - CSN) < CSN_WRAP_AROUND_THRESHOLD)
+            {
+                // this frame is received after BA timer is expired, so disard it
+                TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                                "(QCUR) dropping old frame, SN=%d LastSN=%d",
+                                CSN, currentReorderInfo->LastSN));
+                status = vos_pkt_return_packet(*vosDataBuff);
+                if (!VOS_IS_STATUS_SUCCESS(status))
+                {
+                    TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                               "*** (QCUR) drop old frame fail %d", status));
+                }
+                *vosDataBuff = NULL;
+                lockStatus = vos_lock_release(&currentReorderInfo->reorderLock);
+                if (!VOS_IS_STATUS_SUCCESS(lockStatus))
+                {
+                    TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                                   "WLANTL_MSDUReorder, Release LOCK Fail"));
+                    return lockStatus;
+                }
+                return status;
+            }
+        }
+
          status = WLANTL_QueueCurrent(currentReorderInfo,
                                       vosDataBuff,
                                       ucSlotIdx);
@@ -1473,8 +1551,8 @@
    vos_pkt_get_available_buffer_pool(VOS_PKT_TYPE_RX_RAW, &rxFree);
    if(WLANTL_BA_MIN_FREE_RX_VOS_BUFFER >= rxFree)
    {
-      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,"RX Free: %d", rxFree));
-      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,"RX free buffer count is too low, Pending frame count is %d",
+      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO, "RX Free: %d", rxFree));
+      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO, "RX free buffer count is too low, Pending frame count is %d",
                   currentReorderInfo->pendingFramesCount));
       vosPktIdx = NULL;
       status = WLANTL_ChainFrontPkts(ucFwdIdx,
diff --git a/CORE/TL/src/wlan_qct_tl_hosupport.c b/CORE/TL/src/wlan_qct_tl_hosupport.c
index 0815e2b..23bdd76 100644
--- a/CORE/TL/src/wlan_qct_tl_hosupport.c
+++ b/CORE/TL/src/wlan_qct_tl_hosupport.c
@@ -927,6 +927,8 @@
       return VOS_STATUS_E_INVAL;
    }
 
+   THSGETLOCK("WLANTL_HSBMPSRSSIRegionChangedNotification",
+                                                   &tlCtxt->hoSupport.hosLock);
    currentHO = &(tlCtxt->hoSupport.currentHOState);
    hoSupport = &(tlCtxt->hoSupport);
    preFWNotification = currentHO->fwNotification;
@@ -954,6 +956,8 @@
    }
    else if(preFWNotification == curFWNotification)
    {
+      THSRELEASELOCK("WLANTL_HSBMPSRSSIRegionChangedNotification",
+                                                   &tlCtxt->hoSupport.hosLock);
       return status;
    }
 
@@ -989,12 +993,13 @@
       nRegionNumber = 1;
    }
 
-
    newRegionNumber = (nRegionNumber > pRegionNumber) ? nRegionNumber : pRegionNumber;
    if((currentHO->regionNumber) && (newRegionNumber == currentHO->regionNumber))
    {
       TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,"No Region Change with BMPS mode"));
       preFWNotification = curFWNotification;
+      THSRELEASELOCK("WLANTL_HSBMPSRSSIRegionChangedNotification",
+                                                   &tlCtxt->hoSupport.hosLock);
       return status;
    }
    else if(newRegionNumber > currentHO->regionNumber)
@@ -1052,6 +1057,8 @@
    TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,"BMPS State, MSG from FW, Trigger Event %d, region index %d",
                  evtType, currentHO->regionNumber));
 
+   THSRELEASELOCK("WLANTL_HSBMPSRSSIRegionChangedNotification",
+                                                   &tlCtxt->hoSupport.hosLock);
    return VOS_STATUS_SUCCESS;
 }
 
@@ -1215,6 +1222,7 @@
       return VOS_STATUS_E_INVAL;
    }
 
+   THSGETLOCK("WLANTL_HSHandleRXFrame", &tlCtxt->hoSupport.hosLock);
    WLANTL_StatHandleRXFrame(pAdapter, pBDHeader, STAid, isBroadcast, dataBuffer);
 
    /* If this frame is not management frame increase frame count */
@@ -1244,12 +1252,14 @@
    {
       WLANTL_HSGetRSSI(pAdapter, pBDHeader, STAid, &currentAvgRSSI);
       currentHO->historyRSSI = currentAvgRSSI;
+      THSRELEASELOCK("WLANTL_HSHandleRXFrame", &tlCtxt->hoSupport.hosLock);
       return status;
    }
 
    currentTimestamp = WDA_GET_RX_TIMESTAMP(pBDHeader);
    if((currentTimestamp - currentHO->sampleTime) < WLANTL_HO_SAMPLING_PERIOD)
    {
+      THSRELEASELOCK("WLANTL_HSHandleRXFrame", &tlCtxt->hoSupport.hosLock);
       return status;
    }
    currentHO->sampleTime = currentTimestamp;
@@ -1259,6 +1269,7 @@
    if(!VOS_IS_STATUS_SUCCESS(status))
    {
       TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,"Get RSSI Fail"));
+      THSRELEASELOCK("WLANTL_HSHandleRXFrame", &tlCtxt->hoSupport.hosLock);
       return status;
    }
 #ifdef WLAN_ACTIVEMODE_OFFLOAD_FEATURE
@@ -1277,11 +1288,14 @@
          if(!VOS_IS_STATUS_SUCCESS(status))
          {
             TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,"Handle new RSSI fail"));
+            THSRELEASELOCK("WLANTL_HSHandleRXFrame",
+                                                  &tlCtxt->hoSupport.hosLock);
             return status;
          }
       }
    }
 
+   THSRELEASELOCK("WLANTL_HSHandleRXFrame", &tlCtxt->hoSupport.hosLock);
    return status;
 }
 
@@ -1679,23 +1693,26 @@
       tlCtxt->hoSupport.registeredInd[currentHO->numThreshold - 1].numClient            = 0;
    }
 
-   if((VOS_FALSE == tlCtxt->isBMPS) && (rssiValue >= currentHO->historyRSSI))
+   if( ((VOS_FALSE == tlCtxt->isBMPS) && (rssiValue >= currentHO->historyRSSI))
+    || ((VOS_TRUE == tlCtxt->isBMPS) && (VOS_TRUE == bmpsAbove)) )
    {
-      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,"Removed Threshold above current RSSI level, old RN %d", currentHO->regionNumber));
+      TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                       "Removed Threshold above current RSSI level, old RN %d",
+                                                      currentHO->regionNumber));
       if(0 < currentHO->regionNumber)
       {
          currentHO->regionNumber--;
       }
       else
       {
-         TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,"Current Region number is 0, cannot decrease anymore"));
+          TLLOGE(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                        "Current Region number is 0, cannot decrease anymore"));
       }
-      TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,"Decrease region number without notification %d", currentHO->regionNumber));
+      TLLOG1(VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                       "Decrease region number without notification %d",
+                                                      currentHO->regionNumber));
    }
-   else if((VOS_TRUE == tlCtxt->isBMPS) && (VOS_TRUE == bmpsAbove))
-   {
-      currentHO->regionNumber--;
-   }
+
    /* Decrease number of thresholds */
    tlCtxt->hoSupport.currentHOState.numThreshold--;
    /*Reset the FW notification*/
diff --git a/CORE/TL/src/wlan_qct_tli.h b/CORE/TL/src/wlan_qct_tli.h
index 7c3c443..0e642f9 100644
--- a/CORE/TL/src/wlan_qct_tli.h
+++ b/CORE/TL/src/wlan_qct_tli.h
@@ -57,6 +57,7 @@
 
 when        who    what, where, why
 --------    ---    ----------------------------------------------------------
+08/19/13    rajekuma Added reliable multicast support in TL
 02/19/10    bad     Fixed 802.11 to 802.3 ft issues with WAPI
 01/14/10    rnair   Fixed the byte order for the WAI packet type.
 01/08/10    lti     Added TL Data Caching
@@ -97,7 +98,6 @@
 
 
 #define STATIC  static
-
 /*----------------------------------------------------------------------------
  * Preprocessor Definitions and Constants
  * -------------------------------------------------------------------------*/
@@ -178,6 +178,11 @@
 #define WLANTL_FRAME_TYPE_MCAST 0x01
 #define WLANTL_FRAME_TYPE_UCAST 0x00
 
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+/*Size of TL's active list of reliable multicast hash table.
+  Always keep this value 2 ^ n for efficient hashing*/
+#define WLANTL_RMCAST_HASH_TABLE_SIZE (32)
+#endif
 
 /*-------------------------------------------------------------------------
   BT-AMP related definition - !!! should probably be moved to BT-AMP header
@@ -235,6 +240,8 @@
 /*get RSSI1 from a RX BD*/
 #define WLANTL_GETRSSI1(pBD)    (WDA_GETRSSI1(pBD) - WLAN_TL_RSSI_CORRECTION)
 
+#define WLANTL_GETSNR(pBD)      WDA_GET_RX_SNR(pBD)
+
 /* Check whether Rx frame is LS or EAPOL packet (other than data) */
 #define WLANTL_BAP_IS_NON_DATA_PKT_TYPE(usType) \
   ((WLANTL_BT_AMP_TYPE_AR == usType) || (WLANTL_BT_AMP_TYPE_SEC == usType) || \
@@ -264,6 +271,9 @@
   /* Serialzie Finish UL Authentication request */
   WLANTL_FINISH_ULA   = 5,
 
+  /* Serialized Snapshot request indication */
+  WLANTL_TX_SNAPSHOT = 6,
+
   WLANTL_TX_MAX
 }WLANTL_TxSignalsType;
 
@@ -301,7 +311,8 @@
 ---------------------------------------------------------------------------*/
 typedef VOS_STATUS (*WLANTL_STAFuncType)( v_PVOID_t     pAdapter,
                                           v_U8_t        ucSTAId,
-                                          vos_pkt_t**   pvosDataBuff);
+                                          vos_pkt_t**   pvosDataBuff,
+                                          v_BOOL_t      bForwardIAPPwithLLC);
 
 /*---------------------------------------------------------------------------
   STA FSM Entry type
@@ -314,32 +325,38 @@
 /* Receive in connected state - only EAPOL or WAI*/
 VOS_STATUS WLANTL_STARxConn( v_PVOID_t     pAdapter,
                              v_U8_t        ucSTAId,
-                             vos_pkt_t**   pvosDataBuff );
+                             vos_pkt_t**   pvosDataBuff,
+                             v_BOOL_t      bForwardIAPPwithLLC);
 
 /* Transmit in connected state - only EAPOL or WAI*/
 VOS_STATUS WLANTL_STATxConn( v_PVOID_t     pAdapter,
                              v_U8_t        ucSTAId,
-                             vos_pkt_t**   pvosDataBuff );
+                             vos_pkt_t**   pvosDataBuff,
+                             v_BOOL_t      bForwardIAPPwithLLC);
 
 /* Receive in authenticated state - all data allowed*/
 VOS_STATUS WLANTL_STARxAuth( v_PVOID_t     pAdapter,
                              v_U8_t        ucSTAId,
-                             vos_pkt_t**   pvosDataBuff );
+                             vos_pkt_t**   pvosDataBuff,
+                             v_BOOL_t      bForwardIAPPwithLLC);
 
 /* Transmit in authenticated state - all data allowed*/
 VOS_STATUS WLANTL_STATxAuth( v_PVOID_t     pAdapter,
                              v_U8_t        ucSTAId,
-                             vos_pkt_t**   pvosDataBuff );
+                             vos_pkt_t**   pvosDataBuff,
+                             v_BOOL_t      bForwardIAPPwithLLC);
 
 /* Receive in disconnected state - no data allowed*/
 VOS_STATUS WLANTL_STARxDisc( v_PVOID_t     pAdapter,
                              v_U8_t        ucSTAId,
-                             vos_pkt_t**   pvosDataBuff );
+                             vos_pkt_t**   pvosDataBuff,
+                             v_BOOL_t      bForwardIAPPwithLLC);
 
 /* Transmit in disconnected state - no data allowed*/
 VOS_STATUS WLANTL_STATxDisc( v_PVOID_t     pAdapter,
                              v_U8_t        ucSTAId,
-                             vos_pkt_t**   pvosDataBuff );
+                             vos_pkt_t**   pvosDataBuff,
+                             v_BOOL_t      bForwardIAPPwithLLC);
 
 /* TL State Machine */
 STATIC const WLANTL_STAFsmEntryType tlSTAFsm[WLANTL_STA_MAX_STATE] =
@@ -438,6 +455,8 @@
   WLANTL_TIMER_EXPIER_UDATA_T timerUdata;
 
   WLANTL_REORDER_BUFFER_T     *reorderBuffer;
+
+  v_U16_t            LastSN;
 }WLANTL_BAReorderType;
 
 
@@ -450,6 +469,23 @@
   v_U8_t              ucSet;
 }WLANTL_UAPSDInfoType;
 
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+/*---------------------------------------------------------------------------
+  Reliable Multicast Session information
+---------------------------------------------------------------------------*/
+struct tTL_ReliableMcastList
+{
+  /* Reliable multicast session in TL */
+  struct tTL_ReliableMcastList *next;
+  v_MACADDR_t           reliableMcastAddr;
+  v_U16_t               mcSeqCtl;
+  v_U32_t               rxMCDupcnt;
+};
+
+typedef struct tTL_ReliableMcastList WLANTL_RMCAST_SESSION;
+
+#endif
+
 /*---------------------------------------------------------------------------
   STA Client type
 ---------------------------------------------------------------------------*/
@@ -500,6 +536,18 @@
   /* Value of the averaged RSSI for this station */
   v_U32_t                       uLinkQualityAvg;
 
+  /* Sum of SNR for snrIdx number of consecutive frames */
+  v_U32_t                       snrSum;
+
+  /* Number of consecutive frames over which snrSum is calculated */
+  v_S7_t                        snrIdx;
+
+  /* Average SNR of previous 20 frames */
+  v_S7_t                        prevSnrAvg;
+
+  /* Average SNR returned by fw */
+  v_S7_t                        snrAvgBmps;
+
   /* Tx packet count per station per TID */
   v_U32_t                       auTxCount[WLAN_MAX_TID];
 
@@ -622,6 +670,15 @@
     1 then we have to encrypt the data irrespective of TL
     state (CONNECTED/AUTHENTICATED) */
   v_U8_t ptkInstalled;
+
+  v_U32_t       linkCapacity;
+
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+  /*Active reliable multicast sessions list in TL*/
+  WLANTL_RMCAST_SESSION *mcastSession[WLANTL_RMCAST_HASH_TABLE_SIZE];
+  /*Reliable multicast lock*/
+  vos_lock_t mcLock;
+#endif
 }WLANTL_STAClientType;
 
 /*---------------------------------------------------------------------------
@@ -815,6 +872,17 @@
   v_BOOL_t                  isBMPS;
   /* Whether WDA_DS_TX_START_XMIT msg is pending or not */
   v_BOOL_t   isTxTranmitMsgPending;
+
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+  /*Active reliable multicast sessions list in TL*/
+  WLANTL_RMCAST_SESSION *reliableMcastSession[WLANTL_RMCAST_HASH_TABLE_SIZE];
+  /*Reliable multicast lock*/
+  vos_lock_t rmcLock;
+  v_U8_t multicastDuplicateDetectionEnabled;
+  v_U8_t rmcDataPathEnabled;
+  v_U32_t mcastDupCnt;
+#endif
+
 }WLANTL_CbType;
 
 /*==========================================================================
@@ -1269,7 +1337,7 @@
   VOS_STATUS*     pvosStatus,
   WLANTL_CbType*  pTLCb,
   v_U8_t          *pucStaId,
-  v_U8_t          ucUP,
+  WLANTL_MetaInfoType* pTlMetaInfo,
   v_U8_t          *ucWDSEnabled,
   v_U8_t          *extraHeadSpace
 );
@@ -1310,7 +1378,8 @@
   v_U16_t         usActualHLen,
   v_U8_t          ucHeaderLen,
   WLANTL_CbType*  pTLCb,
-  v_U8_t          ucSTAId
+  v_U8_t          ucSTAId,
+  v_BOOL_t        bForwardIAPPwithLLC
 );
 
 /*==========================================================================
@@ -1602,6 +1671,23 @@
    v_U8_t           STAid
 );
 
+/*==========================================================================
+
+   FUNCTION
+
+   DESCRIPTION   Read SNR value out of a RX BD
+
+   PARAMETERS: Caller must validate all parameters
+
+   RETURN VALUE
+
+============================================================================*/
+VOS_STATUS WLANTL_ReadSNR
+(
+   v_PVOID_t        pAdapter,
+   v_PVOID_t        pBDHeader,
+   v_U8_t           STAid
+);
 
 
 void WLANTL_PowerStateChangedCB
@@ -1646,4 +1732,218 @@
   v_U8_t          ucSTAId
 );
 
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+
+/*==========================================================================
+   FUNCTION WLANTL_RmcInit
+
+   DESCRIPTION This function initilizes RMC module in TL
+
+   PARAMETERS
+   pADapter : pointer to VOS global context
+
+   RETURN VALUE
+   VOS_STATUS_SUCCESS : for success
+   VOS_STATUS_FAILURE : for failure
+   VOS_STATUS_E_INVAL : for invalid input parameter
+
+============================================================================*/
+VOS_STATUS WLANTL_RmcInit
+(
+     v_PVOID_t   pAdapter
+);
+
+/*==========================================================================
+   FUNCTION WLANTL_RmcDeInit
+
+   DESCRIPTION This function de-initilizes RMC module in TL
+
+   PARAMETERS
+   pADapter : pointer to VOS global context
+
+   RETURN VALUE
+   VOS_STATUS_SUCCESS : for success
+   VOS_STATUS_FAILURE : for failure
+   VOS_STATUS_E_INVAL : for invalid input parameter
+
+============================================================================*/
+VOS_STATUS WLANTL_RmcDeInit
+(
+    v_PVOID_t   pAdapter
+);
+
+
+/*==========================================================================
+   FUNCTION WLANTL_RmcHashRmcastSession
+
+   DESCRIPTION This function hashes input RMCAST MAC address
+
+   PARAMETERS
+   pMcastAddr : pointer to input RMCAST MAC address
+
+   RETURN VALUE
+   tANI_U8 : A hash value between 0 to WLANTL_MAX_RMCAST_SESSIONS - 1
+============================================================================*/
+tANI_U8 WLANTL_RmcHashRmcastSession ( v_MACADDR_t   *pMcastAddr );
+
+
+/*===========================================================================
+   FUNCTION WLANTL_RmcLookUpRmcastSession
+
+   DESCRIPTION This function tries to find out RMCAST address in TL's active
+    list of reliable multicast sessions
+
+   PARAMETERS
+   pTLCb      : pointer to TL Cb
+   pMcastAddr : pointer to input RMCAST MAC address
+
+   RETURN VALUE
+   WLANTL_RMCAST_SESSION * :
+     NULL if input RMCAST MAC address does exist in active RMCAST sessions list
+     Pointer to RMCAST session found in active RMCAST sessions list
+=============================================================================*/
+WLANTL_RMCAST_SESSION *WLANTL_RmcLookUpRmcastSession
+(
+    WLANTL_RMCAST_SESSION *reliableMcastSession[],
+    v_MACADDR_t     *pMcastAddr
+);
+
+/*===========================================================================
+   FUNCTION WLANTL_RmcAddRmcastSession
+
+   DESCRIPTION This function adds requested RMCAST address in TL's active
+    list of reliable multicast sessions
+
+   PARAMETERS
+   pTLCb      : pointer to TL Cb
+   pMcastAddr : pointer to input RMCAST MAC address
+
+   RETURN VALUE
+   WLANTL_RMCAST_SESSION * :
+     NULL if input RMCAST MAC address already exists in active RMCAST sessions
+     list else pointer to RMCAST session which is added in active RMCAST
+     sessions list
+=============================================================================*/
+WLANTL_RMCAST_SESSION *WLANTL_RmcAddRmcastSession
+(
+    WLANTL_RMCAST_SESSION *reliableMcastSession[],
+    v_MACADDR_t   *pMcastAddr
+);
+
+/*===========================================================================
+   FUNCTION WLANTL_RmcDeleteRmcastSession
+
+   DESCRIPTION This function deleted requested RMCAST address from TL's active
+    list of reliable multicast sessions
+
+   PARAMETERS
+   pTLCb      : pointer to TL Cb
+   pMcastAddr : pointer to input RMCAST MAC address
+
+   RETURN VALUE
+   WLANTL_RMCAST_SESSION * :
+     0   if input RMCAST session does not exist in active RMCAST
+         sessions list
+     1   if input RMCAST session is successfully deleted from TL's active list
+         of reliable multicast sessions
+=============================================================================*/
+tANI_U8
+WLANTL_RmcDeleteRmcastSession
+(
+    WLANTL_RMCAST_SESSION *reliableMcastSession[],
+    v_MACADDR_t   *pMcastAddr
+);
+
+/*=============================================================================
+  FUNCTION    WLANTL_ProcessRmcCommand
+
+  DESCRIPTION
+    This function adds/deletes input RMCAST session to/from TL's active hash
+    table of RMCAST sessions
+
+  DEPENDENCIES
+    Reliable multicast receive leader must be selected by FW before
+    UMAC calling this API
+
+  PARAMETERS
+
+   IN
+
+   pTLCb      : Pointer to TL context
+   pMcastAddr : Pointer to MAC ADDR of RMCAST session which needs to to added
+                or deleted
+   command    : If command is 1 then add requested RMCAST session in active
+                session hash table else delete it from active session hash
+                table
+
+  RETURN VALUE
+    The result code associated with performing the operation
+
+    VOS_STATUS_E_FAILURE:   When add or delete command failed
+
+    VOS_STATUS_SUCCESS:     Everything is good :)
+
+  SIDE EFFECTS
+==============================================================================*/
+VOS_STATUS
+WLANTL_ProcessRmcCommand
+(
+    WLANTL_CbType*  pTLCb,
+    v_MACADDR_t    *pMcastAddr,
+    tANI_U32        command
+);
+
+/*=============================================================================
+  FUNCTION    WLANTL_IsDuplicateMcastFrm
+
+  DESCRIPTION
+    This function checks for duplicast multicast frames and drops them.
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pClientSTA  : Pointer to WLANTL_STAClientType
+   aucBDHeader : Pointer to BD header
+
+  RETURN VALUE
+
+    VOS_FALSE:  This frame is not a duplicate
+
+    VOS_TRUE:   This frame is a duplicate
+
+==============================================================================*/
+v_U8_t
+WLANTL_IsDuplicateMcastFrm
+(
+    WLANTL_STAClientType *pClientSTA,
+    vos_pkt_t* vosDataBuff
+);
+
+/*=============================================================================
+  FUNCTION    WLANTL_McastDeleteAllEntries
+
+  DESCRIPTION
+    This function removes all multicast entries used for duplicate detection
+
+  DEPENDENCIES
+
+  PARAMETERS
+
+   IN
+
+   pClientSTA  : Pointer to WLANTL_STAClientType
+
+  RETURN VALUE
+
+    None
+
+==============================================================================*/
+void
+WLANTL_McastDeleteAllEntries(WLANTL_STAClientType * pClientSTA);
+
+#endif /*End of WLAN_FEATURE_RELIABLE_MCAST*/
+
 #endif /* #ifndef WLAN_QCT_TLI_H */
diff --git a/CORE/VOSS/inc/i_vos_packet.h b/CORE/VOSS/inc/i_vos_packet.h
index 6ec546f..ef7a8ec 100644
--- a/CORE/VOSS/inc/i_vos_packet.h
+++ b/CORE/VOSS/inc/i_vos_packet.h
@@ -221,6 +221,10 @@
    //Add the field for a faster rx path
    v_SIZE_t rxRawFreeListCount;
 
+   // Number of RX Raw packets that will be reserved; this is a configurable
+   // value to the driver to save the memory usage.
+   v_SIZE_t numOfRxRawPackets;
+
    // These are the structs to keep low-resource callback information.
    // There are separate low-resource callback information blocks for
    // RX_RAW, TX_DATA, and TX_MGMT.
@@ -228,7 +232,11 @@
    vos_pkt_low_resource_info txDataLowResourceInfo;
    vos_pkt_low_resource_info txMgmtLowResourceInfo;
 
-   struct mutex mlock;
+   struct mutex rxReplenishListLock;
+   struct mutex rxRawFreeListLock;
+   struct mutex txDataFreeListLock;
+   struct mutex txMgmtFreeListLock;
+
    /*Meta Information to be transported with the packet*/
    WDI_DS_TxMetaInfoType txMgmtMetaInfo[VPKT_NUM_TX_MGMT_PACKETS];
    WDI_DS_TxMetaInfoType txDataMetaInfo[VPKT_NUM_TX_DATA_PACKETS];
diff --git a/CORE/VOSS/inc/i_vos_trace.h b/CORE/VOSS/inc/i_vos_trace.h
index 73cb1b2..edd92a6 100644
--- a/CORE/VOSS/inc/i_vos_trace.h
+++ b/CORE/VOSS/inc/i_vos_trace.h
@@ -25,7 +25,6 @@
  * to the Linux Foundation.
  */
 
-
 #if !defined( __I_VOS_TRACE_H )
 #define __I_VOS_TRACE_H
 
@@ -72,6 +71,9 @@
   --------------------------------------------------------------------------*/
 void vos_trace_msg( VOS_MODULE_ID module, VOS_TRACE_LEVEL level, char *strFormat, ... );
 
+void vos_trace_hex_dump( VOS_MODULE_ID module, VOS_TRACE_LEVEL level,
+                                void *data, int buf_len );
+
 void vos_trace_display(void);
 
 void vos_trace_setValue( VOS_MODULE_ID module, VOS_TRACE_LEVEL level, v_U8_t on );
@@ -88,8 +90,10 @@
 // without being bogged down by all the tracing in the code.
 #if defined( WLAN_DEBUG )
 #define VOS_TRACE vos_trace_msg
+#define VOS_TRACE_HEX_DUMP vos_trace_hex_dump
 #else
-#define VOS_TRACE(arg...) 
+#define VOS_TRACE(arg...)
+#define VOS_TRACE_HEX_DUMP(arg...)
 #endif
 
 
diff --git a/CORE/VOSS/inc/i_vos_types.h b/CORE/VOSS/inc/i_vos_types.h
index 5c93f46..d6d80a5 100644
--- a/CORE/VOSS/inc/i_vos_types.h
+++ b/CORE/VOSS/inc/i_vos_types.h
@@ -165,35 +165,35 @@
   ------------------------------------------------------------------------*/
 
 /// unsigned 8-bit types
-typedef unsigned char v_U8_t;
-typedef unsigned char v_UCHAR_t;
-typedef unsigned char v_BYTE_t;
+typedef u8 v_U8_t;
+typedef u8 v_UCHAR_t;
+typedef u8 v_BYTE_t;
 
 /// unsigned 16-bit types
-typedef unsigned short v_U16_t;
+typedef u16 v_U16_t;
 typedef unsigned short v_USHORT_t;
 
 /// unsigned 32-bit types
-typedef unsigned long  v_U32_t;
+typedef u32 v_U32_t;
 // typedef atomic_t v_U32AT_t;
 typedef unsigned long  v_ULONG_t;
 
 /// unsigned 64-bit types
-typedef long long v_U64_t;
+typedef u64 v_U64_t;
 
 /// unsigned integer types
 typedef unsigned int  v_UINT_t;
 
 /// signed 8-bit types
-typedef signed char  v_S7_t;
+typedef s8  v_S7_t;
 typedef signed char  v_SCHAR_t;
 
 /// signed 16-bit types
-typedef signed short v_S15_t;
+typedef s16 v_S15_t;
 typedef signed short v_SSHORT_t;
 
 /// signed 32-bit types
-typedef signed long v_S31_t;
+typedef s32 v_S31_t;
 typedef signed long v_SLONG_t;
 
 /// signed integer types
diff --git a/CORE/VOSS/inc/log_codes.h b/CORE/VOSS/inc/log_codes.h
index d09c243..4068429 100644
--- a/CORE/VOSS/inc/log_codes.h
+++ b/CORE/VOSS/inc/log_codes.h
@@ -2008,8 +2008,10 @@
 
 #define LOG_GNSS_PDSM_PPM_SESSION_END_C                             ((0x4E9) + LOG_1X_BASE_C)
 
+#define LOG_TRSP_DATA_STALL_C                                       ((0x801) + LOG_1X_BASE_C)
+
 /* The last defined DMSS log code */
-#define LOG_1X_LAST_C                                   ((0x4E9) + LOG_1X_BASE_C)
+#define LOG_1X_LAST_C                                   ((0x801) + LOG_1X_BASE_C)
 
 
 /* This is only here for old (pre equipment ID update) logging code */
diff --git a/CORE/VOSS/inc/vos_api.h b/CORE/VOSS/inc/vos_api.h
index 5ff1cb0..25f391b 100644
--- a/CORE/VOSS/inc/vos_api.h
+++ b/CORE/VOSS/inc/vos_api.h
@@ -71,8 +71,8 @@
 #include <vos_trace.h>
 #include <vos_event.h>
 #include <vos_lock.h>
-#include <vos_mq.h>
 #include <vos_nvitem.h>
+#include <vos_mq.h>
 #include <vos_packet.h>
 #include <vos_threads.h>
 #include <vos_timer.h>
@@ -172,9 +172,13 @@
 
 v_U8_t vos_is_logp_in_progress(VOS_MODULE_ID moduleId, v_VOID_t *moduleContext);
 void vos_set_logp_in_progress(VOS_MODULE_ID moduleId, v_U8_t value);
+
 v_U8_t vos_is_load_unload_in_progress(VOS_MODULE_ID moduleId, v_VOID_t *moduleContext);
 void vos_set_load_unload_in_progress(VOS_MODULE_ID moduleId, v_U8_t value);
 
+v_U8_t vos_is_reinit_in_progress(VOS_MODULE_ID moduleId, v_VOID_t *moduleContext);
+void vos_set_reinit_in_progress(VOS_MODULE_ID moduleId, v_U8_t value);
+
 /**---------------------------------------------------------------------------
   
   \brief vos_alloc_context() - allocate a context within the VOSS global Context
@@ -290,6 +294,9 @@
 */
 VOS_STATUS vos_wlanReInit(void);
 
+VOS_STATUS vos_get_vdev_types(tVOS_CON_MODE mode, tANI_U32 *type,
+                                  tANI_U32 *subType);
+
 /**
   @brief vos_wlanRestart() - This API will reload WLAN driver.
 
@@ -305,6 +312,21 @@
 
 */
 VOS_STATUS vos_wlanRestart(void);
-VOS_STATUS vos_get_vdev_types(tVOS_CON_MODE mode, tANI_U32 *type,
-                                  tANI_U32 *subType);
+
+/**
+  @brief vos_fwDumpReq()
+
+  This function is called to issue dump commands to Firmware
+
+  @param
+       cmd - Command No. to execute
+       arg1 - argument 1 to cmd
+       arg2 - argument 2 to cmd
+       arg3 - argument 3 to cmd
+       arg4 - argument 4 to cmd
+  @return
+       NONE
+*/
+v_VOID_t vos_fwDumpReq(tANI_U32 cmd, tANI_U32 arg1, tANI_U32 arg2,
+                        tANI_U32 arg3, tANI_U32 arg4);
 #endif // if !defined __VOS_NVITEM_H
diff --git a/CORE/VOSS/inc/vos_diag_core_log.h b/CORE/VOSS/inc/vos_diag_core_log.h
index 7307f26..2d70df3 100644
--- a/CORE/VOSS/inc/vos_diag_core_log.h
+++ b/CORE/VOSS/inc/vos_diag_core_log.h
@@ -333,6 +333,43 @@
   v_U16_t         medium_time;
 } vos_log_qos_tspec_pkt_type;
 
+/*---------------------------------------------------------------------------
+   This packet contains data information when stall detected
+   LOG_TRSP_DATA_STALL_C                           0x1801
+---------------------------------------------------------------------------*/
+
+typedef struct
+{
+   char         channelName[4];
+   v_U32_t      numDesc;
+   v_U32_t      numFreeDesc;
+   v_U32_t      numRsvdDesc;
+   v_U32_t      headDescOrder;
+   v_U32_t      tailDescOrder;
+   v_U32_t      ctrlRegVal;
+   v_U32_t      statRegVal;
+   v_U32_t      numValDesc;
+   v_U32_t      numInvalDesc;
+} vos_log_data_stall_channel_type;
+
+typedef struct
+{
+   log_hdr_type                     hdr;
+   v_U32_t                          PowerState;
+   v_U32_t                          numFreeBd;
+   vos_log_data_stall_channel_type  dxeChannelInfo[4];
+} vos_log_data_stall_type;
+
+/*---------------------------------------------------------------------------
+   This packet contains the rssi value from BSS descriptor
+   LOG_WLAN_RSSI_UPDATE_C                          0x1354
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  log_hdr_type       hdr;
+  v_S7_t            rssi;
+} vos_log_rssi_pkt_type;
+
 /*------------------------------------------------------------------------- 
   Function declarations and documenation
   ------------------------------------------------------------------------*/
diff --git a/CORE/VOSS/inc/vos_getBin.h b/CORE/VOSS/inc/vos_getBin.h
index 9674a7a..06a215d 100644
--- a/CORE/VOSS/inc/vos_getBin.h
+++ b/CORE/VOSS/inc/vos_getBin.h
@@ -73,8 +73,10 @@
   VOS_BINARY_ID_COUNTRY_INFO,
 
   /// Binary ID for Handoff Configuration data
-  VOS_BINARY_ID_HO_CONFIG
+  VOS_BINARY_ID_HO_CONFIG,
 
+  /// Binary ID for Dictionary Configuration data
+  VOS_BINARY_ID_DICT_CONFIG
   
 } VOS_BINARY_ID;
 
diff --git a/CORE/VOSS/inc/vos_nvitem.h b/CORE/VOSS/inc/vos_nvitem.h
index e9b1f24..b8d2be7 100644
--- a/CORE/VOSS/inc/vos_nvitem.h
+++ b/CORE/VOSS/inc/vos_nvitem.h
@@ -170,6 +170,18 @@
 }
 v_REGDOMAIN_t;
 
+typedef enum
+{
+   COUNTRY_NV,
+   COUNTRY_IE,
+   COUNTRY_USER,
+   COUNTRY_CELL_BASE,
+   //add new sources here
+   COUNTRY_QUERY,
+   COUNTRY_MAX = COUNTRY_QUERY
+}
+v_CountryInfoSource_t;
+
 // enum of supported NV items in VOSS
 typedef enum
 {
@@ -216,6 +228,8 @@
 
   \param countryCode - country code
 
+  \param source      - source of country code
+
   \return VOS_STATUS_SUCCESS - regulatory domain is found for the given country
           VOS_STATUS_E_FAULT - invalid pointer error
           VOS_STATUS_E_EMPTY - country code table is empty
@@ -225,7 +239,7 @@
 
   -------------------------------------------------------------------------*/
 VOS_STATUS vos_nv_getRegDomainFromCountryCode( v_REGDOMAIN_t *pRegDomain,
-      const v_COUNTRYCODE_t countryCode );
+      const v_COUNTRYCODE_t countryCode, v_CountryInfoSource_t source);
 
 /**------------------------------------------------------------------------
 
@@ -620,16 +634,64 @@
   \return status of the NV read operation
   \sa
   -------------------------------------------------------------------------*/
-VOS_STATUS vos_nv_getNVBuffer(v_VOID_t **pNvBuffer ,v_SIZE_t *pSize);
+VOS_STATUS vos_nv_getNVBuffer(v_VOID_t **pNvBuffer, v_SIZE_t *pSize);
+
+/**------------------------------------------------------------------------
+  \brief vos_nv_getNVEncodedBuffer -
+  \param pBuffer  - to return the buffer address
+         pSize    - buffer size.
+  \return status of the NV read operation
+  \sa
+  -------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_getNVEncodedBuffer(v_VOID_t **pNvBuffer, v_SIZE_t *pSize);
+
+
+/**------------------------------------------------------------------------
+  \brief vos_nv_getNVDictionary -
+  \param pBuffer  - to return the buffer address
+         pSize    - buffer size.
+  \return status of the NV read operation
+  \sa
+  -------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_getNVDictionary(v_VOID_t **pNvBuffer, v_SIZE_t *pSize);
+
+/**------------------------------------------------------------------------
+  \brief vos_nv_isEmbeddedNV() - NV.bin is embedded or not
+
+  \return VOS_STATUS_SUCCESS - if NV is embedded
+          otherwise  - NOT embedded
+  \sa
+  -------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_isEmbeddedNV(void);
+
+/**------------------------------------------------------------------------
+  \brief vos_nv_setNVEncodedBuffer() - set Encode Buffer
+
+  \return VOS_STATUS_SUCCESS - if able to set encoded buffer successfully
+          otherwise  - NOT able to set encoded data
+  \sa
+  -------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_setNVEncodedBuffer(v_U8_t *pNvBuffer, v_SIZE_t size);
+
+/**------------------------------------------------------------------------
+  \brief vos_nv_get_dictionary_data() - read dictionary data
+
+  \return VOS_STATUS_SUCCESS - if dictionary data is read successfully
+          otherwise  - NOT able to read dictionary data
+  \sa
+  -------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_get_dictionary_data(void);
 
 /**------------------------------------------------------------------------
   \brief vos_nv_setRegDomain -
   \param clientCtxt  - Client Context, Not used for PRIMA
               regId  - Regulatory Domain ID
+              sendRegHint - send hint to cfg80211
   \return status set REG domain operation
   \sa
   -------------------------------------------------------------------------*/
-VOS_STATUS vos_nv_setRegDomain(void * clientCtxt, v_REGDOMAIN_t regId);
+VOS_STATUS vos_nv_setRegDomain(void * clientCtxt, v_REGDOMAIN_t regId,
+                                                  v_BOOL_t sendRegHint);
 
 /**------------------------------------------------------------------------
   \brief vos_nv_getChannelEnabledState -
@@ -646,4 +708,5 @@
    v_U32_t    rfChannel
 );
 
+VOS_STATUS vos_init_wiphy_from_nv_bin(void);
 #endif // __VOS_NVITEM_H
diff --git a/CORE/VOSS/inc/vos_packet.h b/CORE/VOSS/inc/vos_packet.h
index e38f97f..6029944 100644
--- a/CORE/VOSS/inc/vos_packet.h
+++ b/CORE/VOSS/inc/vos_packet.h
@@ -1212,5 +1212,22 @@
    VOS_PKT_TYPE  pktType,
    v_SIZE_t     *vosFreeBuffer
 );
+
+/**
+  @brief vos_pkt_get_num_of_rx_raw_pkts() - Get the number of RX packets
+                                       that should be allocated.
+
+  This function is called by VOS packet module to know how many RX raw
+  packets it should allocate/reserve. This value can be configured thru
+  Kernel device tree to save memory usage.
+
+  @param
+       NONE
+  @return
+       v_SIZE_t the number of packets to allocate
+
+*/
+v_SIZE_t vos_pkt_get_num_of_rx_raw_pkts(void);
+
 #endif
 #endif  // !defined( __VOS_PKT_H )
diff --git a/CORE/VOSS/inc/vos_trace.h b/CORE/VOSS/inc/vos_trace.h
index 5fa3c1f..0a38818 100644
--- a/CORE/VOSS/inc/vos_trace.h
+++ b/CORE/VOSS/inc/vos_trace.h
@@ -91,6 +91,7 @@
 // below definition is obsolete and is no longer being used in BMP and WM
 // TODO: remove this once this is not used on Android
 #define VOS_ENABLE_TRACING 
+#define WCONN_TRACE_KMSG_LOG_BUFF
 
 #include  <i_vos_trace.h>   
 
@@ -139,4 +140,22 @@
   --------------------------------------------------------------------------*/
 v_BOOL_t vos_trace_getLevel( VOS_MODULE_ID module, VOS_TRACE_LEVEL level );
 
+#ifdef WCONN_TRACE_KMSG_LOG_BUFF
+/*--------------------------------------------------------------------------
+ \brief vos_wconn_trace_init(); - Initializing the spinlock,
+  Initialization would be called at the time of hdd_driver_init()
+
+ \return - returns None
+ --------------------------------------------------------------------------*/
+void vos_wconn_trace_init(void);
+
+/*--------------------------------------------------------------------------
+ \brief vos_wconn_trace_exit(); - De-Initializing the spinlock,
+  De-Initialization would be called at the time of hdd_driver_exit()
+
+ \return - returns None
+ --------------------------------------------------------------------------*/
+void vos_wconn_trace_exit(void);
+#endif
+
 #endif
diff --git a/CORE/VOSS/inc/vos_types.h b/CORE/VOSS/inc/vos_types.h
index 0d41079..1872f7b 100644
--- a/CORE/VOSS/inc/vos_types.h
+++ b/CORE/VOSS/inc/vos_types.h
@@ -1,3 +1,5 @@
+#if !defined( __VOS_TYPES_H )
+#define __VOS_TYPES_H
 /*
  * Copyright (c) 2013, The Linux Foundation. All rights reserved.
  *
@@ -25,8 +27,6 @@
  * to the Linux Foundation.
  */
 
-#if !defined( __VOS_TYPES_H )
-#define __VOS_TYPES_H
 
 /**=========================================================================
   \file  vos_Types.h
@@ -118,13 +118,14 @@
    VOS_MODULE_ID_VOSS       = 10,
    VOS_MODULE_ID_SAP        = 11,
    VOS_MODULE_ID_HDD_SOFTAP = 12,
+   VOS_MODULE_ID_PMC        = 13,
 
 #ifdef QCA_WIFI_2_0
-   VOS_MODULE_ID_HIF       = 13,
-   VOS_MODULE_ID_HTC       = 14,
-   VOS_MODULE_ID_TXRX	   = 15,
-   VOS_MODULE_ID_ADF	   = 16,
-   VOS_MODULE_ID_CFG	   = 17,
+   VOS_MODULE_ID_HIF        = 14,
+   VOS_MODULE_ID_HTC        = 15,
+   VOS_MODULE_ID_TXRX       = 16,
+   VOS_MODULE_ID_ADF        = 17,
+   VOS_MODULE_ID_CFG        = 18,
 #endif
 
    // not a real module ID.  This is used to identify the maxiumum
@@ -149,7 +150,6 @@
     VOS_IBSS_MODE,
     VOS_P2P_DEVICE_MODE,
     VOS_MAX_NO_OF_MODE
-
 } tVOS_CON_MODE;
 
 //This is a bit pattern to be set for each mode
@@ -217,7 +217,7 @@
 /// v_MACADDR_t macAddress = VOS_MAC_ADDR_ZERO_INITIALIZER;
 #define VOS_MAC_ADDR_ZERO_INITIALIZER { { 0, 0, 0, 0, 0, 0 } }
 
-
+#define VOS_IPV4_ADDR_SIZE ( 4 )
 
 /*----------------------------------------------------------------------------
   
diff --git a/CORE/VOSS/inc/wcnss_api.h b/CORE/VOSS/inc/wcnss_api.h
index d132b90..0baa2a4 100644
--- a/CORE/VOSS/inc/wcnss_api.h
+++ b/CORE/VOSS/inc/wcnss_api.h
@@ -34,7 +34,7 @@
 #include <linux/wcnss_wlan.h>
 #else
 #include <wcnss_wlan.h>
-#endif	/* #ifdef ANI_BUS_TYPE_PLATFORM */
+#endif  /* #ifdef ANI_BUS_TYPE_PLATFORM */
 #include <linux/crypto.h>
 #include <crypto/hash.h>
 
@@ -44,14 +44,15 @@
 
 extern int wcnss_wlan_crypto_ahash_digest(struct ahash_request *req);
 extern void wcnss_wlan_crypto_free_ahash(struct crypto_ahash *tfm);
-extern int wcnss_wlan_crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key,
-                                          unsigned int keylen);
-extern struct crypto_ablkcipher *wcnss_wlan_crypto_alloc_ablkcipher(const char *alg_name,
-                                                                    u32 type, u32 mask);
+extern int wcnss_wlan_crypto_ahash_setkey(struct crypto_ahash *tfm,
+                                          const u8 *key, unsigned int keylen);
+extern struct crypto_ablkcipher *wcnss_wlan_crypto_alloc_ablkcipher(
+                                          const char *alg_name,
+                                          u32 type, u32 mask);
 extern void wcnss_wlan_ablkcipher_request_free(struct ablkcipher_request *req);
 extern void wcnss_wlan_crypto_free_ablkcipher(struct crypto_ablkcipher *tfm);
 
-#else	/* #ifdef QCA_WIFI_ISOC */
+#else   /* #ifdef QCA_WIFI_ISOC */
 
 /*
  * Do nothing for non ISOC
@@ -84,12 +85,12 @@
 
 static inline unsigned int wcnss_get_serial_number(void)
 {
-	return 0;
+        return 0;
 }
 
 static inline void *wcnss_wlan_crypto_alloc_ahash(const char *alg_name,
-						  unsigned int type,
-						  unsigned int mask)
+                                                  unsigned int type,
+                                                  unsigned int mask)
 {
         return NULL;
 }
@@ -104,14 +105,14 @@
 }
 
 static inline int wcnss_wlan_crypto_ahash_setkey(void *tfm,
-						 const u8 *key,
-						 unsigned int keylen)
+                                                 const u8 *key,
+                                                 unsigned int keylen)
 {
         return 0;
 }
 
 static inline void *wcnss_wlan_crypto_alloc_ablkcipher(const char *alg_name,
-						       u32 type, u32 mask)
+                                                       u32 type, u32 mask)
 {
         return NULL;
 }
@@ -126,22 +127,22 @@
 
 static inline int req_riva_power_on_lock(char *driver_name)
 {
-	return 0;
+        return 0;
 }
 
 static inline int free_riva_power_on_lock(char *driver_name)
 {
-	return 0;
+        return 0;
 }
 
 #ifdef CONFIG_WCNSS_MEM_PRE_ALLOC
 static inline void *wcnss_prealloc_get(size_t size)
 {
-	return NULL;
+        return NULL;
 }
 static inline int wcnss_prealloc_put(void *ptr)
 {
-	return 0;
+        return 0;
 }
 #endif
 
diff --git a/CORE/VOSS/inc/wlan_hdd_misc.h b/CORE/VOSS/inc/wlan_hdd_misc.h
index 55dee38..b418ff5 100644
--- a/CORE/VOSS/inc/wlan_hdd_misc.h
+++ b/CORE/VOSS/inc/wlan_hdd_misc.h
@@ -25,22 +25,35 @@
  * to the Linux Foundation.
  */
 
+
 #ifndef WLAN_HDD_MISC_H
 #define WLAN_HDD_MISC_H
 
 #ifdef MSM_PLATFORM
 #ifdef QC_WLAN_CHIPSET_QCA_CLD
+#ifdef QCA_WIFI_2_0
 #define WLAN_INI_FILE              "wlan/qca_cld/WCNSS_qcom_cfg.ini"
 #define WLAN_CFG_FILE              "wlan/qca_cld/WCNSS_cfg.dat"
 #define WLAN_FW_FILE               ""
 #define WLAN_NV_FILE               "wlan/qca_cld/WCNSS_qcom_wlan_nv.bin"
+#define WLAN_DICT_FILE             "wlan/qca_cld/WCNSS_qcom_wlan_dictionary.dat"
 #define WLAN_COUNTRY_INFO_FILE     "wlan/qca_cld/WCNSS_wlan_country_info.dat"
 #define WLAN_HO_CFG_FILE           "wlan/qca_cld/WCNSS_wlan_ho_config"
 #else
+#define WLAN_INI_FILE              "wlan/prima/WCNSS_qcom_cfg.ini"
+#define WLAN_CFG_FILE              "wlan/prima/WCNSS_cfg.dat"
+#define WLAN_FW_FILE               ""
+#define WLAN_NV_FILE               "wlan/prima/WCNSS_qcom_wlan_nv.bin"
+#define WLAN_DICT_FILE             "wlan/prima/WCNSS_qcom_wlan_dictionary.dat"
+#define WLAN_COUNTRY_INFO_FILE     "wlan/prima/WCNSS_wlan_country_info.dat"
+#define WLAN_HO_CFG_FILE           "wlan/prima/WCNSS_wlan_ho_config"
+#endif // QCA_WIFI_2_0
+#else
 #define WLAN_INI_FILE              "wlan/volans/WCN1314_qcom_cfg.ini"
 #define WLAN_CFG_FILE              "wlan/volans/WCN1314_cfg.dat"
 #define WLAN_FW_FILE               "wlan/volans/WCN1314_qcom_fw.bin"
 #define WLAN_NV_FILE               "wlan/volans/WCN1314_qcom_wlan_nv.bin"
+#define WLAN_DICT_FILE             ""
 #define WLAN_COUNTRY_INFO_FILE     "wlan/volans/WCN1314_wlan_country_info.dat"
 #define WLAN_HO_CFG_FILE           "wlan/volans/WCN1314_wlan_ho_config"
 #endif // ANI_CHIPSET
@@ -49,6 +62,7 @@
 #define WLAN_CFG_FILE              "wlan/cfg.dat"
 #define WLAN_FW_FILE               "wlan/qcom_fw.bin"
 #define WLAN_NV_FILE               "wlan/qcom_wlan_nv.bin"
+#define WLAN_DICT_FILE             ""
 #define WLAN_COUNTRY_INFO_FILE     "wlan/wlan_country_info.dat"
 #define WLAN_HO_CFG_FILE           "wlan/wlan_ho_config"
 #endif // MSM_PLATFORM
diff --git a/CORE/VOSS/src/vos_api.c b/CORE/VOSS/src/vos_api.c
index 032614e..1d14be1 100644
--- a/CORE/VOSS/src/vos_api.c
+++ b/CORE/VOSS/src/vos_api.c
@@ -107,6 +107,9 @@
 /* Approximate amount of time to wait for WDA to stop WDI */
 #define VOS_WDA_STOP_TIMEOUT WDA_STOP_TIMEOUT 
 
+/* Approximate amount of time to wait for WDA to issue a DUMP req */
+#define VOS_WDA_RESP_TIMEOUT WDA_STOP_TIMEOUT
+
 /*---------------------------------------------------------------------------
  * Data definitions
  * ------------------------------------------------------------------------*/
@@ -344,9 +347,9 @@
 
    /* Initialize BMI and Download firmware */
    if (bmi_download_firmware(scn)) {
-	VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
-		  "%s: BMI failed to download target", __func__);
-	goto err_bmi_close;
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                  "%s: BMI failed to download target", __func__);
+        goto err_bmi_close;
    }
    htcInfo.pContext = gpVosContext->pHIFContext;
    htcInfo.TargetFailure = ol_target_failure;
@@ -357,8 +360,8 @@
    /* Create HTC */
    gpVosContext->htc_ctx = HTCCreate(htcInfo.pContext, &htcInfo, adf_ctx);
    if (!gpVosContext->htc_ctx) {
-	VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
-		  "%s: Failed to Create HTC", __func__);
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                  "%s: Failed to Create HTC", __func__);
 #ifndef QCA_WIFI_ISOC
            goto err_bmi_close;
 #endif
@@ -367,9 +370,9 @@
 
 #ifndef QCA_WIFI_ISOC
    if (bmi_done(vos_get_context(VOS_MODULE_ID_HIF, gpVosContext))) {
-	VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
-		  "%s: Failed to complete BMI phase", __func__);
-	goto err_htc_close;
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                  "%s: Failed to complete BMI phase", __func__);
+        goto err_htc_close;
    }
 #endif
 #endif /* #ifdef QCA_WIFI_2_0 */
@@ -388,10 +391,11 @@
    macOpenParms.driverType         = eDRIVER_TYPE_PRODUCTION;
    macOpenParms.powersaveOffloadEnabled =
       pHddCtx->cfg_ini->enablePowersaveOffload;
-   macOpenParms.wowEnable = pHddCtx->cfg_ini->wowEnable;
+   macOpenParms.wowEnable          = pHddCtx->cfg_ini->wowEnable;
    macOpenParms.maxWoWFilters      = pHddCtx->cfg_ini->maxWoWFilters;
    vStatus = WDA_open( gpVosContext, gpVosContext->pHDDContext,
-#ifndef QCA_WIFI_ISOC
+#if defined (QCA_WIFI_2_0) && \
+   !defined (QCA_WIFI_ISOC)
                        hdd_update_tgt_cfg,
 #else
                        NULL,
@@ -447,7 +451,7 @@
       goto err_packet_close;
    }
 
-
+#ifndef CONFIG_ENABLE_LINUX_REG
    /* initialize the NV module */
    vStatus = vos_nv_open();
    if (!VOS_IS_STATUS_SUCCESS(vStatus))
@@ -457,6 +461,7 @@
                 "%s: Failed to initialize the NV module", __func__);
      goto err_sys_close;
    }
+#endif
 
    /* If we arrive here, both threads dispacthing messages correctly */
    
@@ -477,10 +482,6 @@
      VOS_ASSERT(0);
      goto err_nv_close;
    }
-/* call crda before sme_Open which will read NV and store the default country code */
-   wlan_hdd_get_crda_regd_entry(
-      ((hdd_context_t*)(gpVosContext->pHDDContext))->wiphy,
-      ((hdd_context_t*)(gpVosContext->pHDDContext))->cfg_ini);
 
    /* Now proceed to open the SME */
    vStatus = sme_Open(gpVosContext->pMACContext);
@@ -522,9 +523,13 @@
    macClose(gpVosContext->pMACContext);
 
 err_nv_close:
+
+#ifndef CONFIG_ENABLE_LINUX_REG
    vos_nv_close();
-   
-err_sys_close:   
+
+err_sys_close:
+#endif
+
    sysClose(gpVosContext);
 
 err_packet_close:
@@ -551,7 +556,7 @@
 #endif /* #ifndef QCA_WIFI_ISOC */
 #endif /* #ifdef QCA_WIFI_2_0 */
 
-err_sched_close:   
+err_sched_close:
    vos_sched_close(gpVosContext);
 
 
@@ -651,6 +656,10 @@
          VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
            "%s: WDA_preStart reporting other error", __func__);
       }
+      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+           "%s: Test MC thread by posting a probe message to SYS", __func__);
+      wlan_sys_probe();
+
       macStop(gpVosContext->pMACContext, HAL_STOP_TYPE_SYS_DEEP_SLEEP);
       ccmStop(gpVosContext->pMACContext);
       VOS_ASSERT( 0 );
@@ -790,6 +799,10 @@
      }
      VOS_ASSERT(0);
      vos_event_reset( &(gpVosContext->wdaCompleteEvent) );
+     if (vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL))
+     {
+         VOS_BUG(0);
+     }
      WDA_setNeedShutdown(vosContext);
      return VOS_STATUS_E_FAILURE;
   }
@@ -856,7 +869,7 @@
 
 
 err_sme_stop:
-  sme_Stop(pVosContext->pMACContext, TRUE);
+  sme_Stop(pVosContext->pMACContext, HAL_STOP_TYPE_SYS_RESET);
     
 err_mac_stop:
   macStop( pVosContext->pMACContext, HAL_STOP_TYPE_SYS_RESET );
@@ -934,6 +947,9 @@
           VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
            "%s: WDA_stop reporting other error", __func__ );
        }
+       VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+           "%s: Test MC thread by posting a probe message to SYS", __func__);
+       wlan_sys_probe();
        WDA_setNeedShutdown(vosContext);
     }
   }
@@ -1006,6 +1022,7 @@
 
   ((pVosContextType)vosContext)->pMACContext = NULL;
 
+#ifndef CONFIG_ENABLE_LINUX_REG
   vosStatus = vos_nv_close();
   if (!VOS_IS_STATUS_SUCCESS(vosStatus))
   {
@@ -1013,7 +1030,7 @@
          "%s: Failed to close NV", __func__);
      VOS_ASSERT( VOS_IS_STATUS_SUCCESS( vosStatus ) );
   }
-
+#endif
 
   vosStatus = sysClose( vosContext );
   if (!VOS_IS_STATUS_SUCCESS(vosStatus))
@@ -1164,6 +1181,7 @@
 
     case VOS_MODULE_ID_SME:
     case VOS_MODULE_ID_PE:
+    case VOS_MODULE_ID_PMC:
     {
       /* 
       ** In all these cases, we just return the MAC Context
@@ -1191,15 +1209,15 @@
 #ifndef QCA_WIFI_ISOC
     case VOS_MODULE_ID_HIF:
     {
-	pModContext = gpVosContext->pHIFContext;
-	break;
+        pModContext = gpVosContext->pHIFContext;
+        break;
     }
 #endif
 
     case VOS_MODULE_ID_HTC:
     {
-	pModContext = gpVosContext->htc_ctx;
-	break;
+        pModContext = gpVosContext->htc_ctx;
+        break;
     }
 
     case VOS_MODULE_ID_ADF:
@@ -1210,16 +1228,16 @@
 
     case VOS_MODULE_ID_TXRX:
     {
-	pModContext = gpVosContext->pdev_txrx_ctx;
-	break;
+        pModContext = gpVosContext->pdev_txrx_ctx;
+        break;
     }
 
     case VOS_MODULE_ID_CFG:
     {
-	pModContext = gpVosContext->cfg_ctx;
+       pModContext = gpVosContext->cfg_ctx;
         break;
     }
-#endif	/* #ifdef QCA_WIFI_2_0 */
+#endif /* #ifdef QCA_WIFI_2_0 */
 
     default:
     {
@@ -1320,6 +1338,31 @@
    gpVosContext->isLoadUnloadInProgress = value;
 }
 
+v_U8_t vos_is_reinit_in_progress(VOS_MODULE_ID moduleId, v_VOID_t *moduleContext)
+{
+  if (gpVosContext == NULL)
+  {
+    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+        "%s: global voss context is NULL", __func__);
+    return 1;
+  }
+
+   return gpVosContext->isReInitInProgress;
+}
+
+void vos_set_reinit_in_progress(VOS_MODULE_ID moduleId, v_U8_t value)
+{
+  if (gpVosContext == NULL)
+  {
+    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+        "%s: global voss context is NULL", __func__);
+    return;
+  }
+
+   gpVosContext->isReInitInProgress = value;
+}
+
+
 /**---------------------------------------------------------------------------
   
   \brief vos_alloc_context() - allocate a context within the VOSS global Context
@@ -1404,6 +1447,7 @@
     }
     case VOS_MODULE_ID_SME:
     case VOS_MODULE_ID_PE:
+    case VOS_MODULE_ID_PMC:
     case VOS_MODULE_ID_HDD:
     case VOS_MODULE_ID_HDD_SOFTAP:
     default:
@@ -1529,6 +1573,7 @@
     case VOS_MODULE_ID_HDD:
     case VOS_MODULE_ID_SME:
     case VOS_MODULE_ID_PE:
+    case VOS_MODULE_ID_PMC:
     case VOS_MODULE_ID_HDD_SOFTAP:
     default:
     {     
@@ -2342,6 +2387,53 @@
    return vstatus;
 }
 
+
+/**
+  @brief vos_fwDumpReq()
+
+  This function is called to issue dump commands to Firmware
+
+  @param
+       cmd - Command No. to execute
+       arg1 - argument 1 to cmd
+       arg2 - argument 2 to cmd
+       arg3 - argument 3 to cmd
+       arg4 - argument 4 to cmd
+  @return
+       NONE
+*/
+v_VOID_t vos_fwDumpReq(tANI_U32 cmd, tANI_U32 arg1, tANI_U32 arg2,
+                        tANI_U32 arg3, tANI_U32 arg4)
+{
+   VOS_STATUS vStatus          = VOS_STATUS_SUCCESS;
+
+   /* Reset wda wait event */
+   vos_event_reset(&gpVosContext->wdaCompleteEvent);
+
+   WDA_HALDumpCmdReq(NULL, cmd, arg1, arg2, arg3, arg4, NULL);
+
+   /* Need to update time out of complete */
+   vStatus = vos_wait_single_event(&gpVosContext->wdaCompleteEvent,
+                                   VOS_WDA_RESP_TIMEOUT );
+
+   if (vStatus != VOS_STATUS_SUCCESS)
+   {
+      if (vStatus == VOS_STATUS_E_TIMEOUT)
+      {
+         VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+          "%s: Timeout occurred before WDA HAL DUMP complete\n", __func__);
+      }
+      else
+      {
+         VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+           "%s: reporting other error", __func__);
+      }
+   }
+
+   return;
+
+}
+
 VOS_STATUS vos_get_vdev_types(tVOS_CON_MODE mode, tANI_U32 *type,
         tANI_U32 *sub_type)
 {
diff --git a/CORE/VOSS/src/vos_diag.c b/CORE/VOSS/src/vos_diag.c
index 1108f5b..153974c 100644
--- a/CORE/VOSS/src/vos_diag.c
+++ b/CORE/VOSS/src/vos_diag.c
@@ -127,7 +127,7 @@
 
     tAniHdr *wmsg = NULL;
     v_U8_t *pBuf;
-    hdd_context_t *pHddCtx;
+    struct hdd_context_s *pHddCtx;
     v_CONTEXT_t pVosContext= NULL;
     v_U16_t data_len;
     v_U16_t total_len;
@@ -139,6 +139,14 @@
      /*Get the Hdd Context */
     pHddCtx = ((VosContextType*)(pVosContext))->pHDDContext;
 
+#ifdef WLAN_KD_READY_NOTIFIER
+    /* NL is not ready yet, WLAN KO started first */
+    if ((pHddCtx->kd_nl_init) && (!pHddCtx->ptt_pid))
+    {
+        nl_srv_nl_ready_indication();
+    }
+#endif /* WLAN_KD_READY_NOTIFIER */
+
    /* Send the log data to the ptt app only if it is registered with the wlan driver*/
     if(pHddCtx->ptt_pid)
     {
@@ -173,8 +181,9 @@
         if(pHddCtx->ptt_pid)
         {
             if( ptt_sock_send_msg_to_app(wmsg, 0, ANI_NL_MSG_PUMAC, pHddCtx->ptt_pid) < 0) {
-        
-                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ("Ptt Socket error sending message to the app!!\n"));
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                          ("Ptt Socket error sending message to the app!!\n"));
+                vos_mem_free((v_VOID_t *)wmsg);
                 return;
             }
        
@@ -202,7 +211,7 @@
 
     tAniHdr *wmsg = NULL;
     v_U8_t *pBuf;
-    hdd_context_t *pHddCtx;
+    struct hdd_context_s *pHddCtx;
     v_CONTEXT_t pVosContext= NULL;
     event_report_t *pEvent_report;
     v_U16_t total_len;
@@ -213,6 +222,13 @@
      /*Get the Hdd Context */
     pHddCtx = ((VosContextType*)(pVosContext))->pHDDContext;
 
+#ifdef WLAN_KD_READY_NOTIFIER
+    /* NL is not ready yet, WLAN KO started first */
+    if ((pHddCtx->kd_nl_init) && (!pHddCtx->ptt_pid))
+    {
+        nl_srv_nl_ready_indication();
+    }
+#endif /* WLAN_KD_READY_NOTIFIER */
     
     /* Send the log data to the ptt app only if it is registered with the wlan driver*/
     if(pHddCtx->ptt_pid)
@@ -242,8 +258,9 @@
         memcpy(pBuf, pPayload,length);
       
         if( ptt_sock_send_msg_to_app(wmsg, 0, ANI_NL_MSG_PUMAC, pHddCtx->ptt_pid) < 0) {
-    
-            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ("Ptt Socket error sending message to the app!!\n"));
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                       ("Ptt Socket error sending message to the app!!\n"));
+            vos_mem_free((v_VOID_t*)wmsg);
             return;
         }
     
diff --git a/CORE/VOSS/src/vos_getBin.c b/CORE/VOSS/src/vos_getBin.c
index 1740121..7e73cea 100644
--- a/CORE/VOSS/src/vos_getBin.c
+++ b/CORE/VOSS/src/vos_getBin.c
@@ -92,6 +92,9 @@
         case VOS_BINARY_ID_HO_CONFIG:
            pFileName = WLAN_HO_CFG_FILE;
            break;
+        case VOS_BINARY_ID_DICT_CONFIG:
+           pFileName = WLAN_DICT_FILE;
+           break;
         default:
            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "Invalid binaryID");
            return VosSts;
diff --git a/CORE/VOSS/src/vos_memory.c b/CORE/VOSS/src/vos_memory.c
index 098e414..48cf07f 100644
--- a/CORE/VOSS/src/vos_memory.c
+++ b/CORE/VOSS/src/vos_memory.c
@@ -25,32 +25,32 @@
  * to the Linux Foundation.
  */
 
+
 /*===========================================================================
   @file vos_memory.c
 
   @brief Virtual Operating System Services Memory API
 
-  
   Copyright (c) 2008 Qualcomm Technologies, Inc.
   All Rights Reserved.
   Qualcomm Technologies Confidential and Proprietary
 ===========================================================================*/
 
-/*=========================================================================== 
-    
-                       EDIT HISTORY FOR FILE 
-   
-                         
-  This section contains comments describing changes made to the module. 
-  Notice that changes are listed in reverse chronological order. 
-   
-   
-  $Header:$ $DateTime: $ $Author: $ 
-   
-   
-  when        who    what, where, why 
+/*===========================================================================
+
+                       EDIT HISTORY FOR FILE
+
+
+  This section contains comments describing changes made to the module.
+  Notice that changes are listed in reverse chronological order.
+
+
+  $Header:$ $DateTime: $ $Author: $
+
+
+  when        who    what, where, why
   --------    ---    --------------------------------------------------------
-     
+
 ===========================================================================*/ 
 
 /*---------------------------------------------------------------------------
@@ -116,6 +116,10 @@
        VOS_STATUS vosStatus;
 
        struct s_vos_mem_struct* memStruct;
+       char* prev_mleak_file = "";
+       unsigned int prev_mleak_lineNum = 0;
+       unsigned int prev_mleak_sz = 0;
+       unsigned int mleak_cnt = 0;
  
        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
              "%s: List is not Empty. listSize %d ", __func__, (int)listSize);
@@ -128,13 +132,41 @@
           if(VOS_STATUS_SUCCESS == vosStatus)
           {
              memStruct = (struct s_vos_mem_struct*)pNode;
-             VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
-                   "Memory Leak@ File %s, @Line %d, size %d", 
-                   memStruct->fileName, (int)memStruct->lineNum, memStruct->size);
+
+             /* Take care to log only once multiple memory leaks from
+              * the same place */
+             if(strcmp(prev_mleak_file, memStruct->fileName) ||
+                (prev_mleak_lineNum != memStruct->lineNum) ||
+                (prev_mleak_sz !=  memStruct->size))
+             {
+                if(mleak_cnt != 0)
+                {
+                   VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                      "%d Time Memory Leak@ File %s, @Line %d, size %d",
+                      mleak_cnt, prev_mleak_file, prev_mleak_lineNum,
+                      prev_mleak_sz);
+                }
+                prev_mleak_file = memStruct->fileName;
+                prev_mleak_lineNum = memStruct->lineNum;
+                prev_mleak_sz =  memStruct->size;
+                mleak_cnt = 0;
+             }
+             mleak_cnt++;
+
              kfree((v_VOID_t*)memStruct);
           }
        }while(vosStatus == VOS_STATUS_SUCCESS);
 
+       /* Print last memory leak from the module */
+       if(mleak_cnt)
+       {
+          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                      "%d Time memory Leak@ File %s, @Line %d, size %d",
+                      mleak_cnt, prev_mleak_file, prev_mleak_lineNum,
+                      prev_mleak_sz);
+       }
+
+
 #ifdef CONFIG_HALT_KMEMLEAK
        BUG_ON(0);
 #endif
@@ -159,10 +191,11 @@
                "%s: called with arg > 1024K; passed in %d !!!", __func__,size); 
        return NULL;
    }
+
    if (in_interrupt())
    {
-       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-               "%s is being called in interrupt context, using GPF_ATOMIC.", __func__);
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s is being"
+                 "called from interrupt context, using GPF_ATOMIC.", __func__);
        return kmalloc(size, GFP_ATOMIC);
    }
 
diff --git a/CORE/VOSS/src/vos_nvitem.c b/CORE/VOSS/src/vos_nvitem.c
index 2b80ab3..8453189 100644
--- a/CORE/VOSS/src/vos_nvitem.c
+++ b/CORE/VOSS/src/vos_nvitem.c
@@ -49,13 +49,34 @@
 #include "vos_api.h"
 #include "wlan_hdd_misc.h"
 #include "vos_sched.h"
+#include "sme_Api.h"
+#include "wlan_nv_parser.h"
 #include "wlan_hdd_main.h"
 #include <net/cfg80211.h>
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,9,0))
+#define IEEE80211_CHAN_NO_80MHZ		1<<7
+#endif
+
+#ifdef CONFIG_ENABLE_LINUX_REG
+
+static v_REGDOMAIN_t cur_reg_domain = REGDOMAIN_COUNT;
+static char linux_reg_cc[2] = {0, 0};
+static v_REGDOMAIN_t temp_reg_domain = REGDOMAIN_COUNT;
+
+#else
+
+/* Cant access pAdapter in this file so defining a new variable to wait when changing country*/
+static struct completion change_country_code;
+
+#endif
+
 static char crda_alpha2[2] = {0, 0}; /* country code from initial crda req */
 static char run_time_alpha2[2] = {0, 0}; /* country code from none-default country req */
 static v_BOOL_t crda_regulatory_entry_valid = VOS_FALSE;
 static v_BOOL_t crda_regulatory_run_time_entry_valid = VOS_FALSE;
 
+
 /*----------------------------------------------------------------------------
  * Preprocessor Definitions and Constants
  * -------------------------------------------------------------------------*/
@@ -66,6 +87,7 @@
 #define VOS_HARD_CODED_MAC    {0, 0x0a, 0xf5, 4, 5, 6}
 
 #define DEFAULT_NV_VALIDITY_BITMAP 0xFFFFFFFF
+#define MAGIC_NUMBER            0xCAFEBABE
 
 /*----------------------------------------------------------------------------
  * Type Declarations
@@ -95,17 +117,176 @@
 // cache of country info table;
 // this is re-initialized from data on binary file
 // loaded on driver initialization if available
+
+#ifdef CONFIG_ENABLE_LINUX_REG
+
+static CountryInfoTable_t countryInfoTable =
+{
+    /* the first entry in the table is always the world domain */
+    138,
+    {
+      {REGDOMAIN_WORLD, {'0', '0'}}, // WORLD DOMAIN
+      {REGDOMAIN_FCC, {'A', 'D'}}, // ANDORRA
+      {REGDOMAIN_ETSI, {'A', 'E'}}, //UAE
+      {REGDOMAIN_ETSI, {'A', 'L'}}, //ALBANIA
+      {REGDOMAIN_ETSI, {'A', 'M'}}, //ARMENIA
+      {REGDOMAIN_ETSI, {'A', 'N'}}, //NETHERLANDS ANTILLES
+      {REGDOMAIN_FCC, {'A', 'R'}}, //ARGENTINA
+      {REGDOMAIN_FCC, {'A', 'S'}}, //AMERICAN SOMOA
+      {REGDOMAIN_ETSI, {'A', 'T'}}, //AUSTRIA
+      {REGDOMAIN_FCC, {'A', 'U'}}, //AUSTRALIA
+      {REGDOMAIN_ETSI , {'A', 'W'}}, //ARUBA
+      {REGDOMAIN_ETSI,  {'A', 'Z'}}, //AZERBAIJAN
+      {REGDOMAIN_ETSI, {'B', 'A'}}, //BOSNIA AND HERZEGOVINA
+      {REGDOMAIN_FCC, {'B', 'B'}}, //BARBADOS
+      {REGDOMAIN_ETSI, {'B', 'D'}}, //BANGLADESH
+      {REGDOMAIN_ETSI, { 'B', 'E'}}, //BELGIUM
+      {REGDOMAIN_ETSI, {'B', 'G'}}, //BULGARIA
+      {REGDOMAIN_ETSI, {'B', 'H'}}, //BAHRAIN
+      {REGDOMAIN_ETSI, {'B', 'L'}}, //
+      {REGDOMAIN_FCC, {'B', 'M'}}, //BERMUDA
+      {REGDOMAIN_ETSI, {'B', 'N'}}, //BRUNEI DARUSSALAM
+      {REGDOMAIN_ETSI, {'B', 'O'}}, //BOLIVIA
+      {REGDOMAIN_ETSI, {'B', 'R'}}, //BRAZIL
+      {REGDOMAIN_FCC, {'B', 'S'}}, //BAHAMAS
+      {REGDOMAIN_ETSI, {'B', 'Y'}}, //BELARUS
+      {REGDOMAIN_ETSI, {'B', 'Z'}}, //BELIZE
+      {REGDOMAIN_FCC, {'C', 'A'}}, //CANADA
+      {REGDOMAIN_ETSI, {'C', 'H'}}, //SWITZERLAND
+      {REGDOMAIN_ETSI, {'C', 'L'}}, //CHILE
+      {REGDOMAIN_FCC, {'C', 'N'}}, //CHINA
+      {REGDOMAIN_FCC, {'C', 'O'}}, //COLOMBIA
+      {REGDOMAIN_ETSI, {'C', 'R'}}, //COSTA RICA
+      {REGDOMAIN_ETSI, {'C', 'S'}},
+      {REGDOMAIN_ETSI, {'C', 'Y'}}, //CYPRUS
+      {REGDOMAIN_ETSI, {'C', 'Z'}}, //CZECH REPUBLIC
+      {REGDOMAIN_ETSI, {'D', 'E'}}, //GERMANY
+      {REGDOMAIN_ETSI, {'D', 'K'}}, //DENMARK
+      {REGDOMAIN_FCC, {'D', 'O'}}, //DOMINICAN REPUBLIC
+      {REGDOMAIN_ETSI, {'D', 'Z'}}, //ALGERIA
+      {REGDOMAIN_ETSI, {'E', 'C'}}, //ECUADOR
+      {REGDOMAIN_ETSI, {'E', 'E'}}, //ESTONIA
+      {REGDOMAIN_ETSI, {'E', 'G'}}, //EGYPT
+      {REGDOMAIN_ETSI, {'E', 'S'}}, //SPAIN
+      {REGDOMAIN_ETSI, {'F', 'I'}}, //FINLAND
+      {REGDOMAIN_ETSI, {'F', 'R'}}, //FRANCE
+      {REGDOMAIN_ETSI, {'G', 'B'}}, //UNITED KINGDOM
+      {REGDOMAIN_FCC, {'G', 'D'}},  //GRENADA
+      {REGDOMAIN_ETSI, {'G', 'E'}}, //GEORGIA
+      {REGDOMAIN_ETSI, {'G', 'F'}}, //FRENCH GUIANA
+      {REGDOMAIN_ETSI, {'G', 'L'}}, //GREENLAND
+      {REGDOMAIN_ETSI, {'G', 'P'}}, //GUADELOUPE
+      {REGDOMAIN_ETSI, {'G', 'R'}}, //GREECE
+      {REGDOMAIN_FCC, {'G', 'T'}},  //GUATEMALA
+      {REGDOMAIN_FCC, {'G', 'U'}},  //GUAM
+      {REGDOMAIN_ETSI, {'H', 'U'}}, //HUNGARY
+      {REGDOMAIN_FCC, {'I', 'D'}},  //INDONESIA
+      {REGDOMAIN_ETSI, {'I', 'E'}}, //IRELAND
+      {REGDOMAIN_ETSI, {'I', 'L'}}, //ISRAEL
+      {REGDOMAIN_ETSI, {'I', 'N'}}, //INDIA
+      {REGDOMAIN_ETSI, {'I', 'R'}}, //IRAN, ISLAMIC REPUBLIC OF
+      {REGDOMAIN_ETSI, {'I', 'S'}}, //ICELNAD
+      {REGDOMAIN_ETSI, {'I', 'T'}}, //ITALY
+      {REGDOMAIN_FCC, {'J', 'M'}},  //JAMAICA
+      {REGDOMAIN_JAPAN, {'J', 'P'}}, //JAPAN
+      {REGDOMAIN_ETSI, {'J', 'O'}}, //JORDAN
+      {REGDOMAIN_ETSI, {'K', 'E'}}, //KENYA
+      {REGDOMAIN_ETSI, {'K', 'H'}}, //CAMBODIA
+      {REGDOMAIN_ETSI, {'K', 'P'}}, //KOREA, DEMOCRATIC PEOPLE's REPUBLIC OF
+      {REGDOMAIN_ETSI, {'K', 'R'}}, //KOREA, REPUBLIC OF
+      {REGDOMAIN_ETSI, {'K', 'W'}}, //KUWAIT
+      {REGDOMAIN_ETSI, {'K', 'Z'}}, //KAZAKHSTAN
+      {REGDOMAIN_ETSI, {'L', 'B'}}, //LEBANON
+      {REGDOMAIN_ETSI, {'L', 'I'}}, //LIECHTENSTEIN
+      {REGDOMAIN_ETSI, {'L', 'K'}}, //SRI-LANKA
+      {REGDOMAIN_ETSI, {'L', 'T'}}, //LITHUANIA
+      {REGDOMAIN_ETSI, {'L', 'U'}}, //LUXEMBOURG
+      {REGDOMAIN_ETSI, {'L','V'}},  //LATVIA
+      {REGDOMAIN_ETSI, {'M', 'A'}}, //MOROCCO
+      {REGDOMAIN_ETSI, {'M', 'C'}}, //MONACO
+      {REGDOMAIN_ETSI, {'M', 'K'}}, //MACEDONIA, THE FORMER YUGOSLAV REPUBLIC OF
+      {REGDOMAIN_FCC, {'M','N'}}, //MONGOLIA
+      {REGDOMAIN_FCC, {'M', 'O'}}, //MACAO
+      {REGDOMAIN_FCC, {'M', 'P'}}, //NORTHERN MARIANA ISLANDS
+      {REGDOMAIN_ETSI, {'M', 'Q'}}, //MARTINIQUE
+      {REGDOMAIN_FCC, {'M', 'T'}}, //MALTA
+      {REGDOMAIN_ETSI, {'M', 'U'}}, //MAURITIUS
+      {REGDOMAIN_ETSI, {'M', 'W'}}, //MALAWI
+      {REGDOMAIN_FCC, {'M', 'X'}}, //MEXICO
+      {REGDOMAIN_ETSI, {'M', 'Y'}}, //MALAYSIA
+      {REGDOMAIN_ETSI, {'N', 'G'}}, //NIGERIA
+      {REGDOMAIN_FCC, {'N', 'I'}}, //NICARAGUA
+      {REGDOMAIN_ETSI, {'N', 'L'}}, //NETHERLANDS
+      {REGDOMAIN_ETSI, {'N', 'O'}}, //NORWAY
+      {REGDOMAIN_ETSI, {'N', 'P'}}, //NEPAL
+      {REGDOMAIN_FCC, {'N', 'Z'}}, //NEW-ZEALAND
+      {REGDOMAIN_FCC, {'O', 'M'}}, //OMAN
+      {REGDOMAIN_FCC, {'P', 'A'}}, //PANAMA
+      {REGDOMAIN_ETSI, {'P', 'E'}}, //PERU
+      {REGDOMAIN_ETSI, {'P', 'F'}}, //FRENCH POLYNESIA
+      {REGDOMAIN_ETSI, {'P', 'G'}}, //PAPUA NEW GUINEA
+      {REGDOMAIN_FCC, {'P', 'H'}}, //PHILIPPINES
+      {REGDOMAIN_ETSI, {'P', 'K'}}, //PAKISTAN
+      {REGDOMAIN_ETSI, {'P', 'L'}}, //POLAND
+      {REGDOMAIN_FCC, {'P', 'R'}}, //PUERTO RICO
+      {REGDOMAIN_FCC, {'P', 'S'}}, //PALESTINIAN TERRITORY, OCCUPIED
+      {REGDOMAIN_ETSI, {'P', 'T'}}, //PORTUGAL
+      {REGDOMAIN_FCC, {'P', 'Y'}}, //PARAGUAY
+      {REGDOMAIN_ETSI, {'Q', 'A'}}, //QATAR
+      {REGDOMAIN_ETSI, {'R', 'E'}}, //REUNION
+      {REGDOMAIN_ETSI, {'R', 'O'}}, //ROMAINIA
+      {REGDOMAIN_ETSI, {'R', 'S'}}, //SERBIA
+      {REGDOMAIN_ETSI, {'R', 'U'}}, //RUSSIA
+      {REGDOMAIN_FCC, {'R', 'W'}}, //RWANDA
+      {REGDOMAIN_ETSI, {'S', 'A'}}, //SAUDI ARABIA
+      {REGDOMAIN_ETSI, {'S', 'E'}}, //SWEDEN
+      {REGDOMAIN_ETSI, {'S', 'G'}}, //SINGAPORE
+      {REGDOMAIN_ETSI, {'S', 'I'}}, //SLOVENNIA
+      {REGDOMAIN_ETSI, {'S', 'K'}}, //SLOVAKIA
+      {REGDOMAIN_ETSI, {'S', 'V'}}, //EL SALVADOR
+      {REGDOMAIN_ETSI, {'S', 'Y'}}, //SYRIAN ARAB REPUBLIC
+      {REGDOMAIN_ETSI, {'T', 'H'}}, //THAILAND
+      {REGDOMAIN_ETSI, {'T', 'N'}}, //TUNISIA
+      {REGDOMAIN_ETSI, {'T', 'R'}}, //TURKEY
+      {REGDOMAIN_ETSI, {'T', 'T'}}, //TRINIDAD AND TOBAGO
+      {REGDOMAIN_FCC, {'T', 'W'}}, //TAIWAN, PRIVINCE OF CHINA
+      {REGDOMAIN_FCC, {'T', 'Z'}}, //TANZANIA, UNITED REPUBLIC OF
+      {REGDOMAIN_ETSI, {'U', 'A'}}, //UKRAINE
+      {REGDOMAIN_ETSI, {'U', 'G'}}, //UGANDA
+      {REGDOMAIN_FCC, {'U', 'S'}}, //USA
+      {REGDOMAIN_ETSI, {'U', 'Y'}}, //URUGUAY
+      {REGDOMAIN_FCC, {'U', 'Z'}}, //UZBEKISTAN
+      {REGDOMAIN_ETSI, {'V', 'E'}}, //VENEZUELA
+      {REGDOMAIN_FCC, {'V', 'I'}}, //VIRGIN ISLANDS, US
+      {REGDOMAIN_ETSI, {'V', 'N'}}, //VIETNAM
+      {REGDOMAIN_ETSI, {'Y', 'E'}}, //YEMEN
+      {REGDOMAIN_ETSI, {'Y', 'T'}}, //MAYOTTE
+      {REGDOMAIN_ETSI, {'Z', 'A'}}, //SOUTH AFRICA
+      {REGDOMAIN_ETSI, {'Z', 'W'}}, //ZIMBABWE
+    }
+};
+
+#else
+
+// cache of country info table;
+// this is re-initialized from data on binary file
+// loaded on driver initialization if available
 static CountryInfoTable_t countryInfoTable =
 {
     254,
     {
         { REGDOMAIN_FCC,     {'U', 'S'}},  //USA - must be the first country code
         { REGDOMAIN_ETSI,    {'A', 'D'}},  //ANDORRA
+#ifdef FEATURE_CESIUM_PROPRIETARY
+        { REGDOMAIN_WORLD,   {'A', 'E'}}, //UAE
+        { REGDOMAIN_APAC,    {'A', 'F'}},  //AFGHANISTAN
+#else
         { REGDOMAIN_ETSI,    {'A', 'E'}},  //UAE
         { REGDOMAIN_N_AMER_EXC_FCC, {'A', 'F'}},  //AFGHANISTAN
+#endif
         { REGDOMAIN_WORLD,   {'A', 'G'}},  //ANTIGUA AND BARBUDA
         { REGDOMAIN_FCC,     {'A', 'I'}},  //ANGUILLA
-        { REGDOMAIN_NO_5GHZ, {'A', 'L'}},  //ALBANIA
+        { REGDOMAIN_ETSI,    {'A', 'L'}},  //ALBANIA
         { REGDOMAIN_N_AMER_EXC_FCC, {'A', 'M'}},  //ARMENIA
         { REGDOMAIN_ETSI,    {'A', 'N'}},  //NETHERLANDS ANTILLES
         { REGDOMAIN_NO_5GHZ, {'A', 'O'}},  //ANGOLA
@@ -113,13 +294,17 @@
         { REGDOMAIN_WORLD,   {'A', 'R'}},  //ARGENTINA
         { REGDOMAIN_FCC,     {'A', 'S'}},  //AMERICAN SOMOA
         { REGDOMAIN_ETSI,    {'A', 'T'}},  //AUSTRIA
-        { REGDOMAIN_APAC,    {'A', 'U'}},  //AUSTRALIA
+        { REGDOMAIN_WORLD,   {'A', 'U'}},  //AUSTRALIA
         { REGDOMAIN_ETSI,    {'A', 'W'}},  //ARUBA
         { REGDOMAIN_WORLD,   {'A', 'X'}},  //ALAND ISLANDS
+#ifdef FEATURE_CESIUM_PROPRIETARY
+        { REGDOMAIN_WORLD,   {'A', 'Z'}},  //AZERBAIJAN
+#else
         { REGDOMAIN_N_AMER_EXC_FCC, {'A', 'Z'}},  //AZERBAIJAN
+#endif
         { REGDOMAIN_ETSI,    {'B', 'A'}},  //BOSNIA AND HERZEGOVINA
         { REGDOMAIN_APAC,    {'B', 'B'}},  //BARBADOS
-        { REGDOMAIN_NO_5GHZ, {'B', 'D'}},  //BANGLADESH
+        { REGDOMAIN_HI_5GHZ, {'B', 'D'}},  //BANGLADESH
         { REGDOMAIN_ETSI,    {'B', 'E'}},  //BELGIUM
         { REGDOMAIN_HI_5GHZ, {'B', 'F'}},  //BURKINA FASO
         { REGDOMAIN_ETSI,    {'B', 'G'}},  //BULGARIA
@@ -159,10 +344,14 @@
         { REGDOMAIN_ETSI,    {'D', 'K'}},  //DENMARK
         { REGDOMAIN_WORLD,   {'D', 'M'}},  //DOMINICA
         { REGDOMAIN_APAC,    {'D', 'O'}},  //DOMINICAN REPUBLIC
-        { REGDOMAIN_NO_5GHZ, {'D', 'Z'}},  //ALGERIA
+        { REGDOMAIN_ETSI,    {'D', 'Z'}},  //ALGERIA
         { REGDOMAIN_APAC,    {'E', 'C'}},  //ECUADOR
         { REGDOMAIN_ETSI,    {'E', 'E'}},  //ESTONIA
+#ifdef FEATURE_CESIUM_PROPRIETARY
+        { REGDOMAIN_APAC,    {'E', 'G'}},  //EGYPT
+#else
         { REGDOMAIN_N_AMER_EXC_FCC, {'E', 'G'}},  //EGYPT
+#endif
         { REGDOMAIN_WORLD,   {'E', 'H'}},  //WESTERN SAHARA
         { REGDOMAIN_NO_5GHZ, {'E', 'R'}},  //ERITREA
         { REGDOMAIN_ETSI,    {'E', 'S'}},  //SPAIN
@@ -190,7 +379,7 @@
         { REGDOMAIN_ETSI,    {'G', 'R'}},  //GREECE
         { REGDOMAIN_WORLD,   {'G', 'S'}},  //SOUTH GEORGIA AND THE SOUTH SANDWICH ISLANDS
         { REGDOMAIN_APAC,    {'G', 'T'}},  //GUATEMALA
-        { REGDOMAIN_APAC,    {'G', 'U'}},  //GUAM
+        { REGDOMAIN_FCC,     {'G', 'U'}},  //GUAM
         { REGDOMAIN_NO_5GHZ, {'G', 'W'}},  //GUINEA-BISSAU
         { REGDOMAIN_HI_5GHZ, {'G', 'Y'}},  //GUYANA
         { REGDOMAIN_WORLD,   {'H', 'K'}},  //HONGKONG
@@ -201,11 +390,15 @@
         { REGDOMAIN_ETSI,    {'H', 'U'}},  //HUNGARY
         { REGDOMAIN_HI_5GHZ, {'I', 'D'}},  //INDONESIA
         { REGDOMAIN_ETSI,    {'I', 'E'}},  //IRELAND
-        { REGDOMAIN_NO_5GHZ, {'I', 'L'}},  //ISRAEL
+        { REGDOMAIN_N_AMER_EXC_FCC, {'I', 'L'}},  //ISRAEL
         { REGDOMAIN_WORLD,   {'I', 'M'}},  //ISLE OF MAN
         { REGDOMAIN_APAC,    {'I', 'N'}},  //INDIA
         { REGDOMAIN_WORLD,   {'I', 'O'}},  //BRITISH INDIAN OCEAN TERRITORY
+#ifdef FEATURE_CESIUM_PROPRIETARY
+        { REGDOMAIN_ETSI,    {'I', 'Q'}},  //IRAQ
+#else
         { REGDOMAIN_NO_5GHZ, {'I', 'Q'}},  //IRAQ
+#endif
         { REGDOMAIN_HI_5GHZ, {'I', 'R'}},  //IRAN, ISLAMIC REPUBLIC OF
         { REGDOMAIN_ETSI,    {'I', 'S'}},  //ICELAND
         { REGDOMAIN_ETSI,    {'I', 'T'}},  //ITALY
@@ -216,13 +409,13 @@
         { REGDOMAIN_JAPAN,   {'J', '5'}},  //Japan alternate 5
         { REGDOMAIN_WORLD,   {'J', 'E'}},  //JERSEY
         { REGDOMAIN_WORLD,   {'J', 'M'}},  //JAMAICA
-        { REGDOMAIN_WORLD,   {'J', 'O'}},  //JORDAN
+        { REGDOMAIN_APAC,    {'J', 'O'}},  //JORDAN
         { REGDOMAIN_JAPAN,   {'J', 'P'}},  //JAPAN
         { REGDOMAIN_KOREA,   {'K', '1'}},  //Korea alternate 1
         { REGDOMAIN_KOREA,   {'K', '2'}},  //Korea alternate 2
         { REGDOMAIN_KOREA,   {'K', '3'}},  //Korea alternate 3
         { REGDOMAIN_KOREA,   {'K', '4'}},  //Korea alternate 4
-        { REGDOMAIN_HI_5GHZ, {'K', 'E'}},  //KENYA
+        { REGDOMAIN_APAC,    {'K', 'E'}},  //KENYA
         { REGDOMAIN_NO_5GHZ, {'K', 'G'}},  //KYRGYZSTAN
         { REGDOMAIN_ETSI,    {'K', 'H'}},  //CAMBODIA
         { REGDOMAIN_WORLD,   {'K', 'I'}},  //KIRIBATI
@@ -232,9 +425,9 @@
         { REGDOMAIN_KOREA,   {'K', 'R'}},  //KOREA, REPUBLIC OF
         { REGDOMAIN_N_AMER_EXC_FCC, {'K', 'W'}},  //KUWAIT
         { REGDOMAIN_FCC,     {'K', 'Y'}},  //CAYMAN ISLANDS
-        { REGDOMAIN_NO_5GHZ, {'K', 'Z'}},  //KAZAKHSTAN
+        { REGDOMAIN_WORLD,   {'K', 'Z'}},  //KAZAKHSTAN
         { REGDOMAIN_WORLD,   {'L', 'A'}},  //LAO PEOPLE'S DEMOCRATIC REPUBLIC
-        { REGDOMAIN_HI_5GHZ, {'L', 'B'}},  //LEBANON
+        { REGDOMAIN_WORLD,   {'L', 'B'}},  //LEBANON
         { REGDOMAIN_WORLD,   {'L', 'C'}},  //SAINT LUCIA
         { REGDOMAIN_ETSI,    {'L', 'I'}},  //LIECHTENSTEIN
         { REGDOMAIN_WORLD,   {'L', 'K'}},  //SRI LANKA
@@ -244,8 +437,12 @@
         { REGDOMAIN_ETSI,    {'L', 'U'}},  //LUXEMBOURG
         { REGDOMAIN_ETSI,    {'L', 'V'}},  //LATVIA
         { REGDOMAIN_NO_5GHZ, {'L', 'Y'}},  //LIBYAN ARAB JAMAHIRIYA
-        { REGDOMAIN_NO_5GHZ, {'M', 'A'}},  //MOROCCO
-        { REGDOMAIN_N_AMER_EXC_FCC, {'M', 'C'}},  //MONACO
+#ifdef FEATURE_CESIUM_PROPRIETARY
+        { REGDOMAIN_N_AMER_EXC_FCC, {'M', 'A'}},  //MOROCCO
+#else
+        { REGDOMAIN_APAC,    {'M', 'A'}},  //MOROCCO
+#endif
+        { REGDOMAIN_ETSI,    {'M', 'C'}},  //MONACO
         { REGDOMAIN_ETSI,    {'M', 'D'}},  //MOLDOVA, REPUBLIC OF
         { REGDOMAIN_ETSI,    {'M', 'E'}},  //MONTENEGRO
         { REGDOMAIN_NO_5GHZ, {'M', 'G'}},  //MADAGASCAR
@@ -253,7 +450,7 @@
         { REGDOMAIN_ETSI,    {'M', 'K'}},  //MACEDONIA, THE FORMER YUGOSLAV REPUBLIC OF
         { REGDOMAIN_NO_5GHZ, {'M', 'L'}},  //MALI
         { REGDOMAIN_WORLD,   {'M', 'M'}},  //MYANMAR
-        { REGDOMAIN_NO_5GHZ, {'M', 'N'}},  //MONGOLIA
+        { REGDOMAIN_WORLD,   {'M', 'N'}},  //MONGOLIA
         { REGDOMAIN_APAC,    {'M', 'O'}},  //MACAO
         { REGDOMAIN_FCC,     {'M', 'P'}},  //NORTHERN MARIANA ISLANDS
         { REGDOMAIN_ETSI,    {'M', 'Q'}},  //MARTINIQUE
@@ -274,16 +471,16 @@
         { REGDOMAIN_WORLD,   {'N', 'I'}},  //NICARAGUA
         { REGDOMAIN_ETSI,    {'N', 'L'}},  //NETHERLANDS
         { REGDOMAIN_ETSI,    {'N', 'O'}},  //NORWAY
-        { REGDOMAIN_HI_5GHZ, {'N', 'P'}},  //NEPAL
+        { REGDOMAIN_APAC,    {'N', 'P'}},  //NEPAL
         { REGDOMAIN_NO_5GHZ, {'N', 'R'}},  //NAURU
         { REGDOMAIN_WORLD,   {'N', 'U'}},  //NIUE
         { REGDOMAIN_APAC,    {'N', 'Z'}},  //NEW ZEALAND
-        { REGDOMAIN_WORLD,   {'O', 'M'}},  //OMAN
+        { REGDOMAIN_ETSI,    {'O', 'M'}},  //OMAN
         { REGDOMAIN_APAC,    {'P', 'A'}},  //PANAMA
-        { REGDOMAIN_HI_5GHZ, {'P', 'E'}},  //PERU
+        { REGDOMAIN_WORLD,   {'P', 'E'}},  //PERU
         { REGDOMAIN_ETSI,    {'P', 'F'}},  //FRENCH POLYNESIA
-        { REGDOMAIN_APAC,    {'P', 'G'}},  //PAPUA NEW GUINEA
-        { REGDOMAIN_HI_5GHZ, {'P', 'H'}},  //PHILIPPINES
+        { REGDOMAIN_WORLD,   {'P', 'G'}},  //PAPUA NEW GUINEA
+        { REGDOMAIN_WORLD,   {'P', 'H'}},  //PHILIPPINES
         { REGDOMAIN_HI_5GHZ, {'P', 'K'}},  //PAKISTAN
         { REGDOMAIN_ETSI,    {'P', 'L'}},  //POLAND
         { REGDOMAIN_WORLD,   {'P', 'M'}},  //SAINT PIERRE AND MIQUELON
@@ -297,9 +494,9 @@
         { REGDOMAIN_ETSI,    {'R', 'E'}},  //REUNION
         { REGDOMAIN_ETSI,    {'R', 'O'}},  //ROMANIA
         { REGDOMAIN_ETSI,    {'R', 'S'}},  //SERBIA
-        { REGDOMAIN_HI_5GHZ, {'R', 'U'}},  //RUSSIA
-        { REGDOMAIN_HI_5GHZ, {'R', 'W'}},  //RWANDA
-        { REGDOMAIN_APAC,    {'S', 'A'}},  //SAUDI ARABIA
+        { REGDOMAIN_APAC,    {'R', 'U'}},  //RUSSIA
+        { REGDOMAIN_WORLD,   {'R', 'W'}},  //RWANDA
+        { REGDOMAIN_WORLD,   {'S', 'A'}},  //SAUDI ARABIA
         { REGDOMAIN_NO_5GHZ, {'S', 'B'}},  //SOLOMON ISLANDS
         { REGDOMAIN_NO_5GHZ, {'S', 'C'}},  //SEYCHELLES
         { REGDOMAIN_WORLD,   {'S', 'D'}},  //SUDAN
@@ -329,40 +526,54 @@
         { REGDOMAIN_NO_5GHZ, {'T', 'M'}},  //TURKMENISTAN
         { REGDOMAIN_N_AMER_EXC_FCC, {'T', 'N'}},  //TUNISIA
         { REGDOMAIN_NO_5GHZ, {'T', 'O'}},  //TONGA
-        { REGDOMAIN_N_AMER_EXC_FCC, {'T', 'R'}},  //TURKEY
+        { REGDOMAIN_ETSI,    {'T', 'R'}},  //TURKEY
         { REGDOMAIN_WORLD,   {'T', 'T'}},  //TRINIDAD AND TOBAGO
         { REGDOMAIN_NO_5GHZ, {'T', 'V'}},  //TUVALU
-        { REGDOMAIN_WORLD,   {'T', 'W'}},  //TAIWAN, PROVINCE OF CHINA
+        { REGDOMAIN_FCC,     {'T', 'W'}},  //TAIWAN, PROVINCE OF CHINA
         { REGDOMAIN_HI_5GHZ, {'T', 'Z'}},  //TANZANIA, UNITED REPUBLIC OF
-        { REGDOMAIN_NO_5GHZ, {'U', 'A'}},  //UKRAINE
-        { REGDOMAIN_WORLD,   {'U', 'G'}},  //UGANDA
+        { REGDOMAIN_WORLD,   {'U', 'A'}},  //UKRAINE
+        { REGDOMAIN_KOREA,   {'U', 'G'}},  //UGANDA
         { REGDOMAIN_FCC,     {'U', 'M'}},  //UNITED STATES MINOR OUTLYING ISLANDS
         { REGDOMAIN_WORLD,   {'U', 'Y'}},  //URUGUAY
-        { REGDOMAIN_WORLD,   {'U', 'Z'}},  //UZBEKISTAN
+        { REGDOMAIN_FCC,     {'U', 'Z'}},  //UZBEKISTAN
         { REGDOMAIN_ETSI,    {'V', 'A'}},  //HOLY SEE (VATICAN CITY STATE)
         { REGDOMAIN_WORLD,   {'V', 'C'}},  //SAINT VINCENT AND THE GRENADINES
         { REGDOMAIN_HI_5GHZ, {'V', 'E'}},  //VENEZUELA
         { REGDOMAIN_ETSI,    {'V', 'G'}},  //VIRGIN ISLANDS, BRITISH
         { REGDOMAIN_FCC,     {'V', 'I'}},  //VIRGIN ISLANDS, US
-        { REGDOMAIN_N_AMER_EXC_FCC, {'V', 'N'}},  //VIET NAM
+        { REGDOMAIN_FCC,     {'V', 'N'}},  //VIET NAM
         { REGDOMAIN_NO_5GHZ, {'V', 'U'}},  //VANUATU
         { REGDOMAIN_WORLD,   {'W', 'F'}},  //WALLIS AND FUTUNA
         { REGDOMAIN_N_AMER_EXC_FCC, {'W', 'S'}},  //SOMOA
         { REGDOMAIN_NO_5GHZ, {'Y', 'E'}},  //YEMEN
         { REGDOMAIN_ETSI,    {'Y', 'T'}},  //MAYOTTE
+#ifdef FEATURE_CESIUM_PROPRIETARY
+        { REGDOMAIN_ETSI,    {'Z', 'A'}},  //SOUTH AFRICA
+#else
         { REGDOMAIN_WORLD,   {'Z', 'A'}},  //SOUTH AFRICA
+#endif
         { REGDOMAIN_APAC,    {'Z', 'M'}},  //ZAMBIA
-        { REGDOMAIN_NO_5GHZ, {'Z', 'W'}},  //ZIMBABWE
+        { REGDOMAIN_ETSI,    {'Z', 'W'}},  //ZIMBABWE
     }
 };
+
+#endif
+
+
 typedef struct nvEFSTable_s
 {
    v_U32_t    nvValidityBitmap;
    sHalNv     halnv;
 } nvEFSTable_t;
 nvEFSTable_t *gnvEFSTable;
-/* EFS Table  to send the NV structure to HAL*/ 
+/* EFS Table  to send the NV structure to HAL*/
 static nvEFSTable_t *pnvEFSTable;
+static v_U8_t *pnvEncodedBuf;
+static v_U8_t *pDictFile;
+static v_U8_t *pEncodedBuf;
+static v_SIZE_t nvReadEncodeBufSize;
+static v_SIZE_t nDictionarySize;
+static v_U32_t magicNumber;
 
 const tRfChannelProps rfChannels[NUM_RF_CHANNELS] =
 {
@@ -471,6 +682,64 @@
    return VOS_STATUS_SUCCESS;
 }
 
+/**------------------------------------------------------------------------
+  \brief vos_nv_get_dictionary_data() - get the dictionary data required for
+  \ tools
+  \return VOS_STATUS_SUCCESS - dictionary data is read successfully
+          otherwise  - not successful
+  \sa
+-------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_get_dictionary_data(void)
+{
+   VOS_STATUS vosStatus = VOS_STATUS_E_FAILURE;
+
+   if (MAGIC_NUMBER != magicNumber)
+   {
+      return VOS_STATUS_SUCCESS;
+   }
+
+   nDictionarySize = 0;
+
+   vosStatus = vos_get_binary_blob( VOS_BINARY_ID_DICT_CONFIG, NULL,
+                                                &nDictionarySize );
+   if (VOS_STATUS_E_NOMEM != vosStatus)
+   {
+      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                 "Error obtaining binary size" );
+/// NOTE:
+/// We can still work without a dictionary file..
+      return VOS_STATUS_SUCCESS;
+   }
+
+   // malloc a buffer to read in the Configuration binary file.
+   pDictFile = vos_mem_malloc( nDictionarySize );
+   if (NULL == pDictFile)
+   {
+      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+              "Unable to allocate memory for the CFG binary [size= %d bytes]",
+                 nDictionarySize );
+      vosStatus = VOS_STATUS_E_NOMEM;
+      goto fail;
+   }
+
+   /* Get the entire CFG file image... */
+   vosStatus = vos_get_binary_blob( VOS_BINARY_ID_DICT_CONFIG, pDictFile,
+                                                         &nDictionarySize );
+   if (!VOS_IS_STATUS_SUCCESS( vosStatus ))
+   {
+      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+         "Error: Cannot retrieve CFG file image from vOSS. [size= %d bytes]",
+                                                             nDictionarySize );
+      return VOS_STATUS_SUCCESS;
+   }
+
+   VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
+         "Dict file image from vOSS. [size= %d bytes]", nDictionarySize );
+
+fail:
+   return vosStatus;
+}
+
 VOS_STATUS vos_nv_open(void)
 {
     VOS_STATUS status = VOS_STATUS_SUCCESS;
@@ -478,11 +747,13 @@
     v_SIZE_t bufSize;
     v_SIZE_t nvReadBufSize;
     v_BOOL_t itemIsValid = VOS_FALSE;
-    
+    v_U32_t dataOffset;
+    sHalNv *pnvData = NULL;
+
     /*Get the global context */
     pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
-    
-    if(pVosContext == NULL)
+
+    if (NULL == pVosContext)
     {
         return (eHAL_STATUS_FAILURE);
     }
@@ -490,17 +761,94 @@
     bufSize = sizeof(nvEFSTable_t);
     status = hdd_request_firmware(WLAN_NV_FILE,
                                   ((VosContextType*)(pVosContext))->pHDDContext,
-                                  (v_VOID_t**)&gnvEFSTable, &nvReadBufSize);
+                                  (v_VOID_t**)&pnvEncodedBuf, &nvReadBufSize);
 
-    if ( (!VOS_IS_STATUS_SUCCESS( status )) || !gnvEFSTable)
+    if ((!VOS_IS_STATUS_SUCCESS( status )) || (!pnvEncodedBuf))
     {
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
                    "%s: unable to download NV file %s",
                    __func__, WLAN_NV_FILE);
-         return VOS_STATUS_E_RESOURCES;
+       return VOS_STATUS_E_RESOURCES;
     }
 
-     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+    memcpy(&magicNumber, &pnvEncodedBuf[sizeof(v_U32_t)], sizeof(v_U32_t));
+
+    /// Allocate buffer with maximum length..
+    pEncodedBuf = (v_U8_t *)vos_mem_malloc(nvReadBufSize);
+
+    if (NULL == pEncodedBuf)
+    {
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                    "%s : failed to allocate memory for NV", __func__);
+        return VOS_STATUS_E_NOMEM;
+    }
+
+    gnvEFSTable = (nvEFSTable_t*)pnvEncodedBuf;
+
+    if (MAGIC_NUMBER == magicNumber)
+    {
+        pnvData = (sHalNv *)vos_mem_malloc(sizeof(sHalNv));
+
+        if (NULL == pnvData)
+        {
+            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                      "%s : failed to allocate memory for NV", __func__);
+            return VOS_STATUS_E_NOMEM;
+        }
+
+        memset(pnvData, 0, sizeof(sHalNv));
+
+        /// Data starts from offset of validity bit map + magic number..
+        dataOffset = sizeof(v_U32_t) + sizeof(v_U32_t);
+
+        status = nvParser(&pnvEncodedBuf[dataOffset],
+                     (nvReadBufSize-dataOffset), pnvData);
+
+        ///ignore validity bit map
+        nvReadEncodeBufSize = nvReadBufSize - sizeof(v_U32_t);
+
+        vos_mem_copy(pEncodedBuf, &pnvEncodedBuf[sizeof(v_U32_t)],
+            nvReadEncodeBufSize);
+
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   "readEncodeBufSize %d",nvReadEncodeBufSize);
+
+        if (VOS_STATUS_SUCCESS == status) {
+           VOS_TRACE(VOS_MODULE_ID_VOSS,  VOS_TRACE_LEVEL_ERROR,
+                       "Embedded NV parsed success !!productId %d couple Type %d wlan RevId %d",
+                        pnvData->fields.productId,
+                        pnvData->fields.couplerType,
+                        pnvData->fields.wlanNvRevId);
+
+           vos_mem_copy(&gnvEFSTable->halnv, pnvData, sizeof(sHalNv));
+
+           nvReadBufSize = sizeof(sHalNv) + sizeof(v_U32_t);
+        }
+        else
+        {
+           VOS_TRACE(VOS_MODULE_ID_VOSS,  VOS_TRACE_LEVEL_ERROR,
+                       "nvParser failed %d",status);
+
+           nvReadBufSize = 0;
+
+           vos_mem_copy(pEncodedBuf, &nvDefaults, sizeof(sHalNv));
+
+           nvReadEncodeBufSize = sizeof(sHalNv);
+        }
+    }
+    else
+    {
+       dataOffset = sizeof(v_U32_t);
+       nvReadEncodeBufSize = sizeof(sHalNv);
+       memcpy(pEncodedBuf, &pnvEncodedBuf[dataOffset], nvReadEncodeBufSize);
+    }
+
+    if (NULL != pnvData)
+    {
+       vos_mem_free(pnvData);
+    }
+
+    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
            "INFO: NV binary file version=%d Driver default NV version=%d, continue...\n",
            gnvEFSTable->halnv.fields.nvVersion, WLAN_NV_VERSION);
 
@@ -508,7 +856,7 @@
     {
         /* Allocate memory to global NV table */
         pnvEFSTable = (nvEFSTable_t *)vos_mem_malloc(sizeof(nvEFSTable_t));
-        if (NULL == pnvEFSTable)
+        if ( NULL == pnvEFSTable )
         {
             VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
                       "%s : failed to allocate memory for NV", __func__);
@@ -516,7 +864,7 @@
         }
 
         /*Copying the NV defaults */
-        vos_mem_copy(&(pnvEFSTable->halnv),&nvDefaults,sizeof(sHalNv));
+        vos_mem_copy(&(pnvEFSTable->halnv), &nvDefaults, sizeof(sHalNv));
 
         /* Size mismatch */
         if ( nvReadBufSize != bufSize)
@@ -549,8 +897,8 @@
        }
 
        pnvEFSTable->nvValidityBitmap = gnvEFSTable->nvValidityBitmap;
-        /* Copy the valid fields to the NV Global structure */ 
-        if (vos_nv_getValidity(VNV_FIELD_IMAGE, &itemIsValid) == 
+        /* Copy the valid fields to the NV Global structure */
+        if (vos_nv_getValidity(VNV_FIELD_IMAGE, &itemIsValid) ==
            VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE) {
@@ -561,22 +909,22 @@
             }
         }
 
-        if (vos_nv_getValidity(VNV_RATE_TO_POWER_TABLE, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_RATE_TO_POWER_TABLE, &itemIsValid) ==
              VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
             {
-                if(vos_nv_read( VNV_RATE_TO_POWER_TABLE, 
+                if(vos_nv_read( VNV_RATE_TO_POWER_TABLE,
                   (v_VOID_t *)&pnvEFSTable->halnv.tables.pwrOptimum[0],
                   NULL, sizeof(tRateGroupPwr) * NUM_RF_SUBBANDS ) != VOS_STATUS_SUCCESS)
                     goto error;
             }
         }
 
-        if (vos_nv_getValidity(VNV_REGULARTORY_DOMAIN_TABLE, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_REGULARTORY_DOMAIN_TABLE, &itemIsValid) ==
                VOS_STATUS_SUCCESS)
         {
-    
+
             if (itemIsValid == VOS_TRUE)
             {
                 if(vos_nv_read( VNV_REGULARTORY_DOMAIN_TABLE,
@@ -586,7 +934,7 @@
             }
         }
 
-        if (vos_nv_getValidity(VNV_DEFAULT_LOCATION, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_DEFAULT_LOCATION, &itemIsValid) ==
             VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
@@ -597,20 +945,20 @@
                     goto error;
             }
         }
-    
-        if (vos_nv_getValidity(VNV_TPC_POWER_TABLE, &itemIsValid) == 
+
+        if (vos_nv_getValidity(VNV_TPC_POWER_TABLE, &itemIsValid) ==
             VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
             {
-                if(vos_nv_read( VNV_TPC_POWER_TABLE, 
+                if(vos_nv_read( VNV_TPC_POWER_TABLE,
                   (v_VOID_t *)&pnvEFSTable->halnv.tables.plutCharacterized[0],
                   NULL, sizeof(tTpcPowerTable) * NUM_RF_CHANNELS ) != VOS_STATUS_SUCCESS)
                     goto error;
             }
         }
-    
-        if (vos_nv_getValidity(VNV_TPC_PDADC_OFFSETS, &itemIsValid) == 
+
+        if (vos_nv_getValidity(VNV_TPC_PDADC_OFFSETS, &itemIsValid) ==
             VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
@@ -621,7 +969,7 @@
                     goto error;
             }
         }
-        if (vos_nv_getValidity(VNV_RSSI_CHANNEL_OFFSETS, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_RSSI_CHANNEL_OFFSETS, &itemIsValid) ==
            VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
@@ -632,8 +980,8 @@
                     goto error;
             }
         }
-    
-        if (vos_nv_getValidity(VNV_HW_CAL_VALUES, &itemIsValid) == 
+
+        if (vos_nv_getValidity(VNV_HW_CAL_VALUES, &itemIsValid) ==
          VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
@@ -644,7 +992,7 @@
             }
         }
 
-        if (vos_nv_getValidity(VNV_FW_CONFIG, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_FW_CONFIG, &itemIsValid) ==
          VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
@@ -655,59 +1003,59 @@
             }
         }
 
-        if (vos_nv_getValidity(VNV_ANTENNA_PATH_LOSS, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_ANTENNA_PATH_LOSS, &itemIsValid) ==
          VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
             {
                 if(vos_nv_read( VNV_ANTENNA_PATH_LOSS,
-                  (v_VOID_t *)&pnvEFSTable->halnv.tables.antennaPathLoss[0], NULL, 
+                  (v_VOID_t *)&pnvEFSTable->halnv.tables.antennaPathLoss[0], NULL,
                 sizeof(tANI_S16)*NUM_RF_CHANNELS ) != VOS_STATUS_SUCCESS)
                     goto error;
             }
         }
-        if (vos_nv_getValidity(VNV_PACKET_TYPE_POWER_LIMITS, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_PACKET_TYPE_POWER_LIMITS, &itemIsValid) ==
          VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
             {
-                if(vos_nv_read( VNV_PACKET_TYPE_POWER_LIMITS, 
-                  (v_VOID_t *)&pnvEFSTable->halnv.tables.pktTypePwrLimits[0], NULL, 
+                if(vos_nv_read( VNV_PACKET_TYPE_POWER_LIMITS,
+                  (v_VOID_t *)&pnvEFSTable->halnv.tables.pktTypePwrLimits[0], NULL,
                 sizeof(tANI_S16)*NUM_802_11_MODES*NUM_RF_CHANNELS ) != VOS_STATUS_SUCCESS)
                     goto error;
             }
         }
 
-        if (vos_nv_getValidity(VNV_OFDM_CMD_PWR_OFFSET, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_OFDM_CMD_PWR_OFFSET, &itemIsValid) ==
          VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
             {
-                if(vos_nv_read( VNV_OFDM_CMD_PWR_OFFSET, 
-                  (v_VOID_t *)&pnvEFSTable->halnv.tables.ofdmCmdPwrOffset, NULL, 
+                if(vos_nv_read( VNV_OFDM_CMD_PWR_OFFSET,
+                  (v_VOID_t *)&pnvEFSTable->halnv.tables.ofdmCmdPwrOffset, NULL,
                                 sizeof(sOfdmCmdPwrOffset)) != VOS_STATUS_SUCCESS)
                     goto error;
             }
         }
 
-        if (vos_nv_getValidity(VNV_TX_BB_FILTER_MODE, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_TX_BB_FILTER_MODE, &itemIsValid) ==
          VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
             {
-               if(vos_nv_read(VNV_TX_BB_FILTER_MODE, 
-                  (v_VOID_t *)&pnvEFSTable->halnv.tables.txbbFilterMode, NULL, 
+               if(vos_nv_read(VNV_TX_BB_FILTER_MODE,
+                  (v_VOID_t *)&pnvEFSTable->halnv.tables.txbbFilterMode, NULL,
                 sizeof(sTxBbFilterMode)) != VOS_STATUS_SUCCESS)
                    goto error;
             }
         }
-        if (vos_nv_getValidity(VNV_TABLE_VIRTUAL_RATE, &itemIsValid) == 
+        if (vos_nv_getValidity(VNV_TABLE_VIRTUAL_RATE, &itemIsValid) ==
          VOS_STATUS_SUCCESS)
         {
             if (itemIsValid == VOS_TRUE)
             {
-               if(vos_nv_read(VNV_TABLE_VIRTUAL_RATE, 
-                  (v_VOID_t *)&pnvEFSTable->halnv.tables.pwrOptimum_virtualRate, NULL, 
+               if(vos_nv_read(VNV_TABLE_VIRTUAL_RATE,
+                  (v_VOID_t *)&pnvEFSTable->halnv.tables.pwrOptimum_virtualRate, NULL,
                 sizeof(gnvEFSTable->halnv.tables.pwrOptimum_virtualRate)) != VOS_STATUS_SUCCESS)
                    goto error;
             }
@@ -717,6 +1065,7 @@
     return VOS_STATUS_SUCCESS;
 error:
     vos_mem_free(pnvEFSTable);
+    vos_mem_free(pEncodedBuf);
     return eHAL_STATUS_FAILURE ;
 }
 
@@ -734,141 +1083,13 @@
         return VOS_STATUS_E_FAILURE;
     }
     vos_mem_free(pnvEFSTable);
+    vos_mem_free(pEncodedBuf);
+    vos_mem_free(pDictFile);
+
     gnvEFSTable=NULL;
     return VOS_STATUS_SUCCESS;
 }
-/**------------------------------------------------------------------------
-  \brief vos_nv_getRegDomainFromCountryCode() - get the regulatory domain of
-  a country given its country code
-  The \a vos_nv_getRegDomainFromCountryCode() returns the regulatory domain of
-  a country given its country code.  This is done from reading a cached
-  copy of the binary file.
-  \param pRegDomain  - pointer to regulatory domain
-  \param countryCode - country code
-  \return VOS_STATUS_SUCCESS - regulatory domain is found for the given country
-          VOS_STATUS_E_FAULT - invalid pointer error
-          VOS_STATUS_E_EMPTY - country code table is empty
-          VOS_STATUS_E_EXISTS - given country code does not exist in table
-  \sa
-  -------------------------------------------------------------------------*/
-VOS_STATUS vos_nv_getRegDomainFromCountryCode( v_REGDOMAIN_t *pRegDomain,
-      const v_COUNTRYCODE_t countryCode )
-{
-   int i;
-   v_CONTEXT_t pVosContext = NULL;
-   hdd_context_t *pHddCtx = NULL;
-   struct wiphy *wiphy = NULL;
-   int status;
-   // sanity checks
-   if (NULL == pRegDomain)
-   {
-      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-            ("Invalid reg domain pointer\r\n") );
-      return VOS_STATUS_E_FAULT;
-   }
-   *pRegDomain = REGDOMAIN_COUNT;
 
-   if (NULL == countryCode)
-   {
-      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-            ("Country code array is NULL\r\n") );
-      return VOS_STATUS_E_FAULT;
-   }
-   if (0 == countryInfoTable.countryCount)
-   {
-      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-            ("Reg domain table is empty\r\n") );
-      return VOS_STATUS_E_EMPTY;
-   }
-   /* If CRDA regulatory settings is valid, i.e. crda is enabled
-      and reg_notifier is called back.
-      Intercept here and redirect to the Reg domain table's CRDA
-      entry if country code is crda's country.
-      last one NUM_REG_DOMAINS-1 is reserved for crda */
-   VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
-          "vos_nv_getRegDomainFromCountryCode %c%c\n",
-          countryCode[0], countryCode[1]);
-
-   if (crda_regulatory_entry_valid == VOS_TRUE)
-   {
-       if (crda_alpha2[0]==countryCode[0] && crda_alpha2[1]==countryCode[1])
-       {
-          *pRegDomain = NUM_REG_DOMAINS-1;
-              VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
-              "vos_nv_getRegDomainFromCountryCode return crda init entry\n");
-          return VOS_STATUS_SUCCESS;
-       }
-       if (run_time_alpha2[0]==countryCode[0] &&
-           run_time_alpha2[1]==countryCode[1] &&
-           crda_regulatory_run_time_entry_valid == VOS_TRUE)
-       {
-          *pRegDomain = NUM_REG_DOMAINS-2;
-              VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
-              "vos_nv_getRegDomainFromCountryCode return crda none-default country entry\n");
-           return VOS_STATUS_SUCCESS;
-       }
-       else
-       {
-           crda_regulatory_run_time_entry_valid = VOS_FALSE;
-           pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
-           if (NULL != pVosContext)
-               pHddCtx = vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
-           else
-               return VOS_STATUS_E_EXISTS;
-           if (NULL == pHddCtx)
-           {
-              VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                    ("Invalid pHddCtx pointer\r\n") );
-              return VOS_STATUS_E_FAULT;
-           }
-
-           wiphy = pHddCtx->wiphy;
-           INIT_COMPLETION(pHddCtx->driver_crda_req);
-           regulatory_hint(wiphy, countryCode);
-           status = wait_for_completion_interruptible_timeout(
-                   &pHddCtx->driver_crda_req,
-                   msecs_to_jiffies(CRDA_WAIT_TIME));
-           if (!status)
-           {
-               VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                       "%s: Timeout waiting for CRDA REQ", __func__);
-           }
-
-           if (crda_regulatory_run_time_entry_valid == VOS_TRUE)
-           {
-              VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
-                 "vos_nv_getRegDomainFromCountryCode return crda new none-default country entry\n");
-               return VOS_STATUS_SUCCESS;
-           }
-           VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-              "vos_nv_getRegDomainFromCountryCode failed to get crda new none-default country entry\n");
-           return VOS_STATUS_E_EXISTS;
-       }
-   }
-
-   // iterate the country info table until end of table or the country code
-   // is found
-   for (i = 0; i < countryInfoTable.countryCount &&
-         REGDOMAIN_COUNT == *pRegDomain; i++)
-   {
-      if (memcmp(countryCode, countryInfoTable.countryInfo[i].countryCode,
-               VOS_COUNTRY_CODE_LEN) == 0)
-      {
-         // country code is found
-         *pRegDomain = countryInfoTable.countryInfo[i].regDomain;
-      }
-   }
-   if (REGDOMAIN_COUNT != *pRegDomain)
-   {
-      return VOS_STATUS_SUCCESS;
-   }
-   else
-   {
-      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN,
-            ("country code is not found\r\n"));
-      return VOS_STATUS_E_EXISTS;
-   }
-}
 /**------------------------------------------------------------------------
   \brief vos_nv_getSupportedCountryCode() - get the list of supported
   country codes
@@ -896,7 +1117,7 @@
    if ( NULL == pBuffer || providedBufferSize < *pBufferSize )
    {
       VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-            ("Insufficient memory for country code list\r\n"));
+            ("Insufficient memory for country code list\n"));
       return VOS_STATUS_E_NOMEM;
    }
    for (i = 0; i < countryInfoTable.countryCount; i++)
@@ -1261,11 +1482,11 @@
            }
            break;
        case VNV_FW_CONFIG:
-       
+
            itemSize = sizeof(gnvEFSTable->halnv.tables.fwConfig);
-       
+
            if(bufferSize != itemSize) {
-       
+
                VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
                 ("type = %d buffer size=%d is less than data size=%d\r\n"),type, bufferSize,
                  itemSize);
@@ -1488,11 +1709,11 @@
             }
             break;
         case VNV_FW_CONFIG:
-        
+
            itemSize = sizeof(gnvEFSTable->halnv.tables.fwConfig);
-        
+
            if(bufferSize != itemSize) {
-        
+
                VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
                 ("type = %d buffer size=%d is less than data size=%d\r\n"),type, bufferSize,
                  itemSize);
@@ -1553,7 +1774,7 @@
                 memcpy(&gnvEFSTable->halnv.tables.txbbFilterMode,inputVoidBuffer,bufferSize);
             }
             break;
-            
+
 
         case VNV_TABLE_VIRTUAL_RATE:
             itemSize = sizeof(gnvEFSTable->halnv.tables.pwrOptimum_virtualRate);
@@ -1608,7 +1829,7 @@
 {
     VOS_STATUS status = VOS_STATUS_SUCCESS;
     int i, count;
-    
+
     //TODO: Dont want to use pMac here...can we instead store the curRegDomain in NV
     // or pass it as a parameter to NV from SME?
 
@@ -1640,7 +1861,7 @@
         //center channels for 2.4 Ghz 40 MHz channels
         for( i = RF_CHAN_BOND_3; i <= RF_CHAN_BOND_11; i++ )
         {
-            
+
             if( regChannels[i].enabled )
             {
                 channels40MHz[count].chanId = rfChannels[i].channelNum;
@@ -1650,7 +1871,7 @@
         //center channels for 5 Ghz 40 MHz channels
         for( i = RF_CHAN_BOND_38; i <= RF_CHAN_BOND_163; i++ )
         {
-            
+
             if( regChannels[i].enabled )
             {
                 channels40MHz[count].chanId = rfChannels[i].channelNum;
@@ -1718,7 +1939,7 @@
   -------------------------------------------------------------------------*/
 VOS_STATUS vos_nv_readDefaultCountryTable( uNvTables *tableData )
 {
-   
+
    VOS_STATUS status = VOS_STATUS_SUCCESS;
    memcpy(&tableData->defaultCountryTable, &pnvEFSTable->halnv.tables.defaultCountryTable, sizeof(sDefaultCountry));
    pr_info("DefaultCountry is %c%c\n",
@@ -1728,7 +1949,7 @@
 }
 
 /**------------------------------------------------------------------------
-  \brief vos_nv_getBuffer - 
+  \brief vos_nv_getBuffer -
   \param pBuffer  - to return the buffer address
               pSize     - buffer size.
   \return status of the NV read operation
@@ -1736,7 +1957,6 @@
   -------------------------------------------------------------------------*/
 VOS_STATUS vos_nv_getNVBuffer(v_VOID_t **pNvBuffer,v_SIZE_t *pSize)
 {
-
    /* Send the NV structure and size */
    *pNvBuffer = (v_VOID_t *)(&pnvEFSTable->halnv);
    *pSize = sizeof(sHalNv);
@@ -1745,30 +1965,63 @@
 }
 
 /**------------------------------------------------------------------------
-  \brief vos_nv_setRegDomain - 
-  \param clientCtxt  - Client Context, Not used for PRIMA
-              regId  - Regulatory Domain ID
-  \return status set REG domain operation
+  \brief vos_nv_getBuffer -
+  \param pBuffer  - to return the buffer address
+              pSize     - buffer size.
+  \return status of the NV read operation
   \sa
   -------------------------------------------------------------------------*/
-VOS_STATUS vos_nv_setRegDomain(void * clientCtxt, v_REGDOMAIN_t regId)
+VOS_STATUS vos_nv_getNVEncodedBuffer(v_VOID_t **pNvBuffer,v_SIZE_t *pSize)
 {
-   /* Client Context Argumant not used for PRIMA */
-   if(regId >= REGDOMAIN_COUNT)
-   {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                "VOS set reg domain, invalid REG domain ID %d", regId);
-      return VOS_STATUS_E_INVAL;
-   }
+   /* Send the NV structure and size */
+   VOS_STATUS status;
 
-   /* Set correct channel information based on REG Domain */
-   regChannels = pnvEFSTable->halnv.tables.regDomains[regId].channels;
+   status = vos_nv_isEmbeddedNV();
+
+   if (VOS_STATUS_SUCCESS == status)
+   {
+      *pNvBuffer = (v_VOID_t *)(pEncodedBuf);
+      *pSize = nvReadEncodeBufSize;
+   }
+   else
+   {
+      *pNvBuffer = (v_VOID_t *)(&pnvEFSTable->halnv);
+      *pSize = sizeof(sHalNv);
+   }
 
    return VOS_STATUS_SUCCESS;
 }
 
+
+VOS_STATUS vos_nv_getNVDictionary(v_VOID_t **pNvBuffer,v_SIZE_t *pSize)
+{
+    /* Send the NV structure and size */
+   *pNvBuffer = (v_VOID_t *)(pDictFile);
+   *pSize = nDictionarySize;
+
+   return VOS_STATUS_SUCCESS;
+}
+
+VOS_STATUS vos_nv_isEmbeddedNV(v_VOID_t)
+{
+   if (MAGIC_NUMBER == magicNumber)
+   {
+      return VOS_STATUS_SUCCESS;
+   }
+
+   return VOS_STATUS_E_FAILURE;
+}
+
+VOS_STATUS vos_nv_setNVEncodedBuffer(v_U8_t *pNvBuffer, v_SIZE_t size)
+{
+    vos_mem_copy(pEncodedBuf, &pNvBuffer[sizeof(v_U32_t)],
+            (size-sizeof(v_U32_t)));
+
+    return VOS_STATUS_SUCCESS;
+}
+
 /**------------------------------------------------------------------------
-  \brief vos_nv_getChannelEnabledState - 
+  \brief vos_nv_getChannelEnabledState -
   \param rfChannel  - input channel enum to know evabled state
   \return eNVChannelEnabledType enabled state for channel
              * enabled
@@ -1840,7 +2093,7 @@
       if (m > RF_CHAN_BOND_163)
          m = RF_CHAN_BOND_163;
    }
-return m;
+   return m;
 }
 
 void crda_regulatory_entry_default(v_U8_t *countryCode, int domain_id)
@@ -1930,7 +2183,7 @@
        if (wiphy->bands[i] == NULL)
        {
           pr_info("error: wiphy->bands[i] is NULL, i = %d\n", i);
-          continue;
+          return -1;
        }
        // internal channels[] is one continous array for both 2G and 5G bands
        // m is internal starting channel index for each band
@@ -1938,6 +2191,7 @@
            m = 0;
        else
            m = wiphy->bands[i-1]->n_channels + m;
+
        for (j=0;j<wiphy->bands[i]->n_channels;j++)
        {
            // k = (m + j) is internal current channel index for 20MHz channel
@@ -2002,11 +2256,12 @@
    run_time_alpha2[1] = request->alpha2[1];
    crda_regulatory_run_time_entry_valid = VOS_TRUE;
    crda_regulatory_entry_post_processing(wiphy, request, nBandCapability, NUM_REG_DOMAINS-2);
-return 0;
+   return 0;
 }
+
 v_BOOL_t is_crda_regulatory_entry_valid(void)
 {
-return crda_regulatory_entry_valid;
+   return crda_regulatory_entry_valid;
 }
 
 /* Handling routines for the conversion from regd rules (start/end freq) to channel index
@@ -2017,114 +2272,114 @@
 */
 static int bw20_start_freq_to_channel_index(u32 freq_khz)
 {
-int i;
-u32 center_freq = freq_khz + 10000;
-  //Has to compare from low freq to high freq
-  //RF_SUBBAND_2_4_GHZ
-  for (i=RF_CHAN_1;i<=RF_CHAN_14;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_4_9_GHZ, Ch 240, 244, 248, 252, 208, 212, 216
-  for (i=RF_CHAN_240;i<=RF_CHAN_216;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_LOW_GHZ
-  for (i=RF_CHAN_36;i<=RF_CHAN_64;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_MID_GHZ
-  for (i=RF_CHAN_100;i<=RF_CHAN_140;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_HIGH_GHZ
-  for (i=RF_CHAN_149;i<=RF_CHAN_165;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-return -1;
+   int i;
+   u32 center_freq = freq_khz + 10000;
+   //Has to compare from low freq to high freq
+   //RF_SUBBAND_2_4_GHZ
+   for (i=RF_CHAN_1;i<=RF_CHAN_14;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_4_9_GHZ, Ch 240, 244, 248, 252, 208, 212, 216
+   for (i=RF_CHAN_240;i<=RF_CHAN_216;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_LOW_GHZ
+   for (i=RF_CHAN_36;i<=RF_CHAN_64;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_MID_GHZ
+   for (i=RF_CHAN_100;i<=RF_CHAN_140;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_HIGH_GHZ
+   for (i=RF_CHAN_149;i<=RF_CHAN_165;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   return -1;
 }
 
 static int bw20_end_freq_to_channel_index(u32 freq_khz)
 {
-int i;
-u32 center_freq = freq_khz - 10000;
-  //Has to compare from high freq to low freq
-  //RF_SUBBAND_5_HIGH_GHZ
-  for (i=RF_CHAN_165;i>=RF_CHAN_149;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_MID_GHZ
-  for (i=RF_CHAN_140;i>=RF_CHAN_100;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_LOW_GHZ
-  for (i=RF_CHAN_64;i>=RF_CHAN_36;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_4_9_GHZ, Ch 216, 212, 208, 252, 248, 244, 240
-  for (i=RF_CHAN_216;i>=RF_CHAN_240;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_2_4_GHZ
-  for (i=RF_CHAN_14;i>=RF_CHAN_1;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-return -1;
+   int i;
+   u32 center_freq = freq_khz - 10000;
+   //Has to compare from high freq to low freq
+   //RF_SUBBAND_5_HIGH_GHZ
+   for (i=RF_CHAN_165;i>=RF_CHAN_149;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_MID_GHZ
+   for (i=RF_CHAN_140;i>=RF_CHAN_100;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_LOW_GHZ
+   for (i=RF_CHAN_64;i>=RF_CHAN_36;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_4_9_GHZ, Ch 216, 212, 208, 252, 248, 244, 240
+   for (i=RF_CHAN_216;i>=RF_CHAN_240;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_2_4_GHZ
+   for (i=RF_CHAN_14;i>=RF_CHAN_1;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   return -1;
 }
 
 static int bw40_start_freq_to_channel_index(u32 freq_khz)
 {
-int i;
-u32 center_freq = freq_khz + 20000;
-  //Has to compare from low freq to high freq
-  //RF_SUBBAND_2_4_GHZ
-  for (i=RF_CHAN_BOND_3;i<=RF_CHAN_BOND_11;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_4_9_GHZ, Ch 242, 246, 250, 210, 214
-  for (i=RF_CHAN_BOND_242;i<=RF_CHAN_BOND_214;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_LOW_GHZ
-  for (i=RF_CHAN_BOND_38;i<=RF_CHAN_BOND_62;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_MID_GHZ
-  for (i=RF_CHAN_BOND_102;i<=RF_CHAN_BOND_138;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_HIGH_GHZ
-  for (i=RF_CHAN_BOND_151;i<=RF_CHAN_BOND_163;i++)
-    if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-return -1;
+   int i;
+   u32 center_freq = freq_khz + 20000;
+   //Has to compare from low freq to high freq
+   //RF_SUBBAND_2_4_GHZ
+   for (i=RF_CHAN_BOND_3;i<=RF_CHAN_BOND_11;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_4_9_GHZ, Ch 242, 246, 250, 210, 214
+   for (i=RF_CHAN_BOND_242;i<=RF_CHAN_BOND_214;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_LOW_GHZ
+   for (i=RF_CHAN_BOND_38;i<=RF_CHAN_BOND_62;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_MID_GHZ
+   for (i=RF_CHAN_BOND_102;i<=RF_CHAN_BOND_138;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_HIGH_GHZ
+   for (i=RF_CHAN_BOND_151;i<=RF_CHAN_BOND_163;i++)
+      if (center_freq <= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   return -1;
 }
 
 static int bw40_end_freq_to_channel_index(u32 freq_khz)
 {
-int i;
-u32 center_freq = freq_khz - 20000;
-  //Has to compare from high freq to low freq
-  //RF_SUBBAND_5_HIGH_GHZ
-  for (i=RF_CHAN_BOND_163;i>=RF_CHAN_BOND_151;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_MID_GHZ
-  for (i=RF_CHAN_BOND_138;i>=RF_CHAN_BOND_102;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_5_LOW_GHZ
-  for (i=RF_CHAN_BOND_62;i>=RF_CHAN_BOND_38;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_4_9_GHZ, Ch 214, 210, 250, 246, 242
-  for (i=RF_CHAN_BOND_214;i>=RF_CHAN_BOND_242;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-  //RF_SUBBAND_2_4_GHZ
-  for (i=RF_CHAN_BOND_11;i>=RF_CHAN_BOND_3;i--)
-    if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
-      return i;
-return -1;
+   int i;
+   u32 center_freq = freq_khz - 20000;
+   //Has to compare from high freq to low freq
+   //RF_SUBBAND_5_HIGH_GHZ
+   for (i=RF_CHAN_BOND_163;i>=RF_CHAN_BOND_151;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_MID_GHZ
+   for (i=RF_CHAN_BOND_138;i>=RF_CHAN_BOND_102;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_5_LOW_GHZ
+   for (i=RF_CHAN_BOND_62;i>=RF_CHAN_BOND_38;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_4_9_GHZ, Ch 214, 210, 250, 246, 242
+   for (i=RF_CHAN_BOND_214;i>=RF_CHAN_BOND_242;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   //RF_SUBBAND_2_4_GHZ
+   for (i=RF_CHAN_BOND_11;i>=RF_CHAN_BOND_3;i--)
+      if (center_freq >= (u32) (rfChannels[i].targetFreq) * 1000)
+         return i;
+   return -1;
 }
 
 static v_BOOL_t channel_in_capable_band(int j, v_U8_t nBandCapability)
@@ -2273,6 +2528,941 @@
   return 0;
 }
 
+#ifdef CONFIG_ENABLE_LINUX_REG
+
+/**------------------------------------------------------------------------
+  \brief vos_nv_setRegDomain -
+  \param clientCtxt  - Client Context, Not used for PRIMA
+              regId  - Regulatory Domain ID
+              sendRegHint - send hint to nl80211
+  \return status set REG domain operation
+  \sa
+  -------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_setRegDomain(void * clientCtxt, v_REGDOMAIN_t regId,
+                                                v_BOOL_t sendRegHint)
+{
+
+    if (regId >= REGDOMAIN_COUNT)
+    {
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                  "VOS set reg domain, invalid REG domain ID %d", regId);
+        return VOS_STATUS_E_INVAL;
+    }
+
+    /* Set correct channel information based on REG Domain */
+    regChannels = pnvEFSTable->halnv.tables.regDomains[regId].channels;
+
+    return VOS_STATUS_SUCCESS;
+}
+
+/**------------------------------------------------------------------------
+  \brief vos_nv_getRegDomainFromCountryCode() - get the regulatory domain of
+  a country given its country code
+  The \a vos_nv_getRegDomainFromCountryCode() returns the regulatory domain of
+  a country given its country code.  This is done from reading a cached
+  copy of the binary file.
+  \param pRegDomain  - pointer to regulatory domain
+  \param countryCode - country code
+  \param source      - source of the country code
+  \return VOS_STATUS_SUCCESS - regulatory domain is found for the given country
+          VOS_STATUS_E_FAULT - invalid pointer error
+          VOS_STATUS_E_EMPTY - country code table is empty
+          VOS_STATUS_E_EXISTS - given country code does not exist in table
+  \sa
+  -------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_getRegDomainFromCountryCode( v_REGDOMAIN_t *pRegDomain,
+      const v_COUNTRYCODE_t country_code, v_CountryInfoSource_t source)
+{
+
+    v_CONTEXT_t pVosContext = NULL;
+    hdd_context_t *pHddCtx = NULL;
+    struct wiphy *wiphy = NULL;
+    int i;
+    int wait_result;
+
+    /* sanity checks */
+    if (NULL == pRegDomain)
+    {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   ("Invalid reg domain pointer") );
+        return VOS_STATUS_E_FAULT;
+    }
+
+    *pRegDomain = REGDOMAIN_COUNT;
+
+    if (NULL == country_code)
+    {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   ("Country code array is NULL"));
+        return VOS_STATUS_E_FAULT;
+    }
+
+    if (0 == countryInfoTable.countryCount)
+    {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   ("Reg domain table is empty") );
+        return VOS_STATUS_E_EMPTY;
+    }
+
+
+    pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+
+    if (NULL != pVosContext)
+        pHddCtx = vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
+    else
+        return VOS_STATUS_E_EXISTS;
+
+    if (NULL == pHddCtx)
+    {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   ("Invalid pHddCtx pointer") );
+        return VOS_STATUS_E_FAULT;
+    }
+
+    temp_reg_domain = REGDOMAIN_COUNT;
+    /* lookup the country in the local database */
+    for (i = 0; i < countryInfoTable.countryCount &&
+             REGDOMAIN_COUNT == temp_reg_domain; i++)
+    {
+        if (memcmp(country_code, countryInfoTable.countryInfo[i].countryCode,
+                   VOS_COUNTRY_CODE_LEN) == 0)
+        {
+            /* country code is found */
+            /* record the temporary regulatory_domain as well */
+            temp_reg_domain = countryInfoTable.countryInfo[i].regDomain;
+            break;
+        }
+    }
+
+    if (REGDOMAIN_COUNT == temp_reg_domain) {
+
+        /* the country was not found in the driver database */
+        /* so we will return the REGDOMAIN_WORLD to SME/CSR */
+
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   ("Country does not map to any Regulatory domain"));
+
+        temp_reg_domain = REGDOMAIN_WORLD;
+    }
+
+    if (COUNTRY_QUERY == source)
+    {
+        *pRegDomain = temp_reg_domain;
+         return VOS_STATUS_SUCCESS;
+    }
+
+    wiphy = pHddCtx->wiphy;
+
+    if (false == wiphy->registered)
+    {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   ("wiphy is not yet registered with the kernel") );
+        return VOS_STATUS_E_FAULT;
+    }
+
+    /* We need to query the kernel to get the regulatory information
+       for this country */
+
+
+    /* First compare the country code with the existing current country code
+       . If both are same there is no need to query any database */
+
+    VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+                   ("regdomain request"));
+
+    if ((country_code[0] == linux_reg_cc[0]) &&
+        (country_code[1] == linux_reg_cc[1])) {
+
+        /* country code already exists */
+
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+                   (" country code already exists"));
+
+        *pRegDomain = cur_reg_domain;
+
+        return VOS_STATUS_SUCCESS;
+    }
+    else {
+
+        /* get the regulatory information from the kernel
+           database */
+
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN,
+                   (" get country information from kernel db"));
+
+
+        if (COUNTRY_NV == source)
+        {
+            INIT_COMPLETION(pHddCtx->linux_reg_req);
+            regulatory_hint(wiphy, country_code);
+            wait_result = wait_for_completion_interruptible_timeout(
+                                                            &pHddCtx->linux_reg_req,
+                                                            LINUX_REG_WAIT_TIME);
+
+            /* if the country information does not exist with the kernel,
+               then the driver callback would not be called */
+
+            if (wait_result >= 0) {
+
+                /* the driver callback was called. this means the country
+                   regulatory information was found in the kernel database.
+                   The callback would have updated the internal database. Here
+                   update the country and the return value for the regulatory
+                   domain */
+
+                VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+                           ("runtime country code is found in kernel db"));
+
+                *pRegDomain = temp_reg_domain;
+                cur_reg_domain = temp_reg_domain;
+                linux_reg_cc[0] = country_code[0];
+                linux_reg_cc[1] = country_code[1];
+
+                return VOS_STATUS_SUCCESS;
+            }
+            else {
+
+                /* the country information has not been found in the kernel
+                   database, return failure */
+
+                VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN,
+                           ("runtime country code is not found in kernel db"));
+
+                return VOS_STATUS_E_EXISTS;
+            }
+        }
+        else if (COUNTRY_IE == source || COUNTRY_USER == source)
+        {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0))
+            regulatory_hint_user(country_code,NL80211_USER_REG_HINT_USER);
+#else
+            regulatory_hint_user(country_code);
+#endif
+            *pRegDomain = temp_reg_domain;
+        }
+
+   }
+
+   return VOS_STATUS_SUCCESS;
+}
+
+
+/* create_crda_regulatory_entry_from_regd should be called during init time */
+static int create_linux_regulatory_entry_from_regd(struct wiphy *wiphy,
+                struct regulatory_request *request,
+                v_U8_t nBandCapability)
+{
+    int i, j, n, domain_id;
+    int bw20_start_channel_index, bw20_end_channel_index;
+    int bw40_start_channel_index, bw40_end_channel_index;
+    v_CONTEXT_t pVosContext = NULL;
+    hdd_context_t *pHddCtx = NULL;
+
+    if (wiphy->regd == NULL)
+    {
+        wiphy_dbg(wiphy, "error: wiphy->regd is NULL\n");
+        return -1;
+    }
+    pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+
+    if (NULL != pVosContext)
+    {
+        pHddCtx = vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
+        if (NULL == pHddCtx)
+        {
+           VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                       ("Invalid pHddCtx pointer") );
+        }
+        else
+        {
+           pHddCtx->isVHT80Allowed = 0;
+        }
+    }
+    else
+    {
+       VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                  ("Invalid pVosContext pointer") );
+    }
+
+    domain_id = temp_reg_domain;
+
+    for (n = 0; n < NUM_RF_CHANNELS; n++)
+        pnvEFSTable->halnv.tables.regDomains[domain_id].channels[n].enabled = NV_CHANNEL_DISABLE;
+
+    for (i = 0; i < wiphy->regd->n_reg_rules; i++)
+    {
+
+       wiphy_dbg(wiphy, "info: crda rule %d --------------------------------------------\n", i);
+       bw20_start_channel_index =
+           bw20_start_freq_to_channel_index(wiphy->regd->reg_rules[i].freq_range.start_freq_khz);
+       bw20_end_channel_index =
+           bw20_end_freq_to_channel_index(wiphy->regd->reg_rules[i].freq_range.end_freq_khz);
+
+       if (bw20_start_channel_index == -1 || bw20_end_channel_index == -1)
+       {
+           wiphy_dbg(wiphy, "error: crda freq not supported, start freq (KHz) %d end freq %d\n",
+                     wiphy->regd->reg_rules[i].freq_range.start_freq_khz,
+                     wiphy->regd->reg_rules[i].freq_range.end_freq_khz);
+           continue; // skip this rull, but continue to next rule
+       }
+
+       wiphy_dbg(wiphy, "20MHz start freq (KHz) %d end freq %d start ch index %d end ch index %d\n",
+                 wiphy->regd->reg_rules[i].freq_range.start_freq_khz,
+                 wiphy->regd->reg_rules[i].freq_range.end_freq_khz,
+                 bw20_start_channel_index, bw20_end_channel_index);
+
+       for (j=bw20_start_channel_index;j<=bw20_end_channel_index;j++)
+       {
+           if (channel_in_capable_band(j, nBandCapability) == VOS_FALSE)
+           {
+               wiphy_dbg(wiphy, "info: CH %d is not in capable band\n",
+                         rfChannels[j].channelNum);
+               continue; // skip  this channel, continue to next
+           }
+
+           if (wiphy->regd->reg_rules[i].flags & NL80211_RRF_DFS)
+           {
+               pnvEFSTable->halnv.tables.regDomains[domain_id].channels[j].enabled = NV_CHANNEL_DFS;
+               wiphy_dbg(wiphy, "info: CH %d is DFS, max EIRP (mBm) is %d\n", rfChannels[j].channelNum,
+                         wiphy->regd->reg_rules[i].power_rule.max_eirp);
+           }
+           else
+           {
+               pnvEFSTable->halnv.tables.regDomains[domain_id].channels[j].enabled = NV_CHANNEL_ENABLE;
+               wiphy_dbg(wiphy, "info: CH %d is enabled, no DFS, max EIRP (mBm) is %d\n", rfChannels[j].channelNum,
+                         wiphy->regd->reg_rules[i].power_rule.max_eirp);
+           }
+
+           /* max_eirp is in mBm (= 100 * dBm) unit */
+           pnvEFSTable->halnv.tables.regDomains[domain_id].channels[j].pwrLimit =
+               (tANI_S8) ((wiphy->regd->reg_rules[i].power_rule.max_eirp)/100);
+       }
+
+       /* ignore CRDA max_antenna_gain typical is 3dBi, nv.bin antennaGain is
+          real gain which should be provided by the real design */
+       if (wiphy->regd->reg_rules[i].freq_range.max_bandwidth_khz >= 40000)
+       {
+           if (wiphy->regd->reg_rules[i].freq_range.max_bandwidth_khz >= 80000)
+           {
+              wiphy_dbg(wiphy, "info: 80MHz (channel bonding) is allowed\n");
+              if (NULL == pHddCtx)
+              {
+                  VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                             ("Invalid pHddCtx pointer") );
+              }
+              else
+              {
+                 pHddCtx->isVHT80Allowed = 1;
+              }
+
+
+           }
+           else
+           {
+              wiphy_dbg(wiphy, "info: ONLY 40MHz (channel bonding) is allowed\n");
+           }
+           bw40_start_channel_index =
+               bw40_start_freq_to_channel_index(wiphy->regd->reg_rules[i].freq_range.start_freq_khz);
+           bw40_end_channel_index =
+               bw40_end_freq_to_channel_index(wiphy->regd->reg_rules[i].freq_range.end_freq_khz);
+           if (bw40_start_channel_index == -1 || bw40_end_channel_index == -1)
+           {
+               wiphy_dbg(wiphy, "error: crda freq not supported, start_freq_khz %d end_freq_khz %d\n",
+                         wiphy->regd->reg_rules[i].freq_range.start_freq_khz,
+                         wiphy->regd->reg_rules[i].freq_range.end_freq_khz);
+               continue; // skip this rull, but continue to next rule
+           }
+
+           wiphy_dbg(wiphy, "40MHz start freq (KHz) %d end freq %d start ch index %d end ch index %d\n",
+                     wiphy->regd->reg_rules[i].freq_range.start_freq_khz,
+                     wiphy->regd->reg_rules[i].freq_range.end_freq_khz,
+                     bw40_start_channel_index, bw40_end_channel_index);
+           for (j=bw40_start_channel_index;j<=bw40_end_channel_index;j++)
+           {
+               if (channel_in_capable_band(j, nBandCapability) == VOS_FALSE)
+                   continue; // skip  this channel, continue to next
+               if (wiphy->regd->reg_rules[i].flags & NL80211_RRF_DFS)
+               {
+                   pnvEFSTable->halnv.tables.regDomains[domain_id].channels[j].enabled = NV_CHANNEL_DFS;
+                   wiphy_dbg(wiphy, "info: 40MHz centered on CH %d is DFS\n", rfChannels[j].channelNum);
+               }
+               else
+               {
+                   pnvEFSTable->halnv.tables.regDomains[domain_id].channels[j].enabled = NV_CHANNEL_ENABLE;
+                   wiphy_dbg(wiphy, "info: 40MHz centered on CH %d is enabled, no DFS\n", rfChannels[j].channelNum);
+               }
+               /* set 40MHz channel power as half (- 3 dB) of 20MHz */
+               pnvEFSTable->halnv.tables.regDomains[domain_id].channels[j].pwrLimit =
+                   (tANI_S8) (((wiphy->regd->reg_rules[i].power_rule.max_eirp)/100)-3);
+           }
+       }
+    }
+
+    return 0;
+}
+
+/* create_linux_regulatory_entry to populate internal structures from wiphy */
+static int create_linux_regulatory_entry(struct wiphy *wiphy,
+                struct regulatory_request *request,
+                v_U8_t nBandCapability)
+{
+    int i, j, m;
+    int k = 0, n = 0;
+    v_CONTEXT_t pVosContext = NULL;
+    hdd_context_t *pHddCtx = NULL;
+
+    pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+
+    if (NULL != pVosContext)
+    {
+        pHddCtx = vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
+        if (NULL == pHddCtx)
+        {
+           VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                       ("Invalid pHddCtx pointer") );
+        }
+        else
+        {
+           pHddCtx->isVHT80Allowed = 0;
+        }
+    }
+    else
+    {
+       VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                  ("Invalid pVosContext pointer") );
+    }
+
+    /* 20MHz channels */
+    if (nBandCapability == eCSR_BAND_24)
+        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+                  "BandCapability is set to 2G only\n");
+
+    for (i = 0, m = 0; i<IEEE80211_NUM_BANDS; i++)
+    {
+        /* 5G only */
+        if (i == IEEE80211_BAND_2GHZ && nBandCapability == eCSR_BAND_5G)
+            continue;
+
+        /* 2G only */
+        else if (i == IEEE80211_BAND_5GHZ && nBandCapability == eCSR_BAND_24)
+            continue;
+
+        if (wiphy->bands[i] == NULL)
+        {
+
+            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                      "error: wiphy->bands is NULL, i = %d\n", i);
+            return -1;
+        }
+
+        /* internal channels[] is one continous array for both 2G and 5G bands
+           m is internal starting channel index for each band */
+
+        if (i == 0)
+            m = 0;
+        else
+            m = wiphy->bands[i-1]->n_channels + m;
+
+        for (j = 0; j < wiphy->bands[i]->n_channels; j++)
+        {
+            /* k = (m + j) is internal current channel index for 20MHz channel
+              n is internal channel index for corresponding 40MHz channel */
+
+            k = m + j;
+            n = bw20_ch_index_to_bw40_ch_index(k);
+
+            if (n == -1)
+                return -1;
+
+            if (wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_DISABLED)
+            {
+                if (pnvEFSTable == NULL)
+                {
+                    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                              "error: pnvEFSTable is NULL, probably not parsed nv.bin yet\n");
+                    return -1;
+                }
+                pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[k].enabled =
+                    NV_CHANNEL_DISABLE;
+                pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].enabled =
+                    NV_CHANNEL_DISABLE;
+            }
+            else if (wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_RADAR)
+            {
+                pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[k].enabled =
+                    NV_CHANNEL_DFS;
+
+                /* max_power is in mBm = 100 * dBm */
+                pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[k].pwrLimit =
+                    (tANI_S8) ((wiphy->bands[i]->channels[j].max_power)/100);
+                if ((wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_NO_HT40) == 0)
+                {
+                    pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].enabled =
+                        NV_CHANNEL_DFS;
+
+                    /* 40MHz channel power is half of 20MHz (-3dB) ?? */
+                    pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].pwrLimit =
+                        (tANI_S8) (((wiphy->bands[i]->channels[j].max_power)/100)-3);
+                }
+                if ((wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_NO_80MHZ) == 0)
+                {
+                   if (NULL == pHddCtx)
+                   {
+                      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                                  ("Invalid pHddCtx pointer") );
+                   }
+                   else
+                   {
+                      pHddCtx->isVHT80Allowed = 1;
+                   }
+                }
+            }
+            else /* Enable is only last flag we support */
+            {
+                pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[k].enabled =
+                    NV_CHANNEL_ENABLE;
+
+                /* max_power is in dBm */
+                pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[k].pwrLimit =
+                    (tANI_S8) ((wiphy->bands[i]->channels[j].max_power)/100);
+                if ((wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_NO_HT40) == 0)
+                {
+                    pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].enabled =
+                        NV_CHANNEL_ENABLE;
+                    /* 40MHz channel power is half of 20MHz (-3dB) */
+                    pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].pwrLimit =
+                        (tANI_S8) (((wiphy->bands[i]->channels[j].max_power)/100)-3);
+                }
+                if ((wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_NO_80MHZ) == 0)
+                {
+                   if (NULL == pHddCtx)
+                   {
+                      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                                  ("Invalid pHddCtx pointer") );
+                   }
+                   else
+                   {
+                      pHddCtx->isVHT80Allowed = 1;
+                   }
+                }
+
+            }
+
+            /* ignore CRDA max_antenna_gain typical is 3dBi, nv.bin antennaGain
+               is real gain which should be provided by the real design */
+        }
+    }
+
+    if (k == 0)
+       return -1;
+
+    return 0;
+}
+
+
+/*
+ * Function: wlan_hdd_linux_reg_notifier
+ * This function is called from cfg80211 core to provide regulatory settings
+ * after new country is requested or intersected (init, user input or 11d)
+ * This function is used to create a CRDA regulatory settings entry into internal
+ * regulatory setting table.
+ */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0))
+void wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
+                struct regulatory_request *request)
+#else
+int wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
+                struct regulatory_request *request)
+#endif
+{
+    hdd_context_t *pHddCtx = wiphy_priv(wiphy);
+    tANI_U8 nBandCapability;
+    v_COUNTRYCODE_t country_code;
+    int i;
+    v_BOOL_t isVHT80Allowed;
+
+    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+               "cfg80211 reg notifier callback for country for initiator %d", request->initiator);
+
+    if (NULL == pHddCtx)
+    {
+       VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   ("Invalid pHddCtx pointer") );
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0))
+       return;
+#else
+       return 0;
+#endif
+    }
+
+
+    /* first check if this callback is in response to the driver callback */
+
+    if (request->initiator == NL80211_REGDOM_SET_BY_DRIVER)
+    {
+
+        nBandCapability = pHddCtx->cfg_ini->nBandCapability;
+        isVHT80Allowed = pHddCtx->isVHT80Allowed;
+        if (create_linux_regulatory_entry(wiphy, request, pHddCtx->cfg_ini->nBandCapability) == 0)
+        {
+
+            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+                       (" regulatory entry created"));
+        }
+        if (pHddCtx->isVHT80Allowed != isVHT80Allowed)
+        {
+           hdd_checkandupdate_phymode( pHddCtx);
+        }
+
+        complete(&pHddCtx->linux_reg_req);
+    }
+
+    else if (request->initiator == NL80211_REGDOM_SET_BY_USER ||
+             request->initiator ==  NL80211_REGDOM_SET_BY_CORE)
+    {
+
+        /* first lookup the country in the local database */
+
+        country_code[0] = request->alpha2[0];
+        country_code[1] = request->alpha2[1];
+
+        temp_reg_domain = REGDOMAIN_COUNT;
+        for (i = 0; i < countryInfoTable.countryCount &&
+                 REGDOMAIN_COUNT == temp_reg_domain; i++)
+        {
+            if (memcmp(country_code, countryInfoTable.countryInfo[i].countryCode,
+                       VOS_COUNTRY_CODE_LEN) == 0)
+            {
+                /* country code is found */
+                /* record the temporary regulatory_domain as well */
+                temp_reg_domain = countryInfoTable.countryInfo[i].regDomain;
+                break;
+            }
+        }
+
+        if (REGDOMAIN_COUNT == temp_reg_domain)
+            temp_reg_domain = REGDOMAIN_WORLD;
+
+        nBandCapability = pHddCtx->cfg_ini->nBandCapability;
+        isVHT80Allowed = pHddCtx->isVHT80Allowed;
+        if (create_linux_regulatory_entry(wiphy, request,
+                                          pHddCtx->cfg_ini->nBandCapability) == 0)
+        {
+            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+                      (" regulatory entry created"));
+
+        }
+        if (pHddCtx->isVHT80Allowed != isVHT80Allowed)
+        {
+           hdd_checkandupdate_phymode( pHddCtx);
+        }
+
+        cur_reg_domain = temp_reg_domain;
+        linux_reg_cc[0] = country_code[0];
+        linux_reg_cc[1] = country_code[1];
+
+        /* now pass the new country information to sme */
+        if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
+        {
+           sme_GenericChangeCountryCode(pHddCtx->hHal, country_code,
+                                        REGDOMAIN_COUNT);
+        }
+        else
+        {
+           sme_GenericChangeCountryCode(pHddCtx->hHal, country_code,
+                                        temp_reg_domain);
+        }
+
+    }
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0))
+    return;
+#else
+    return 0;
+#endif
+}
+
+
+/* initialize wiphy from NV.bin */
+VOS_STATUS vos_init_wiphy_from_nv_bin(void)
+{
+    int i, j, m;
+    int k = 0;
+    v_REGDOMAIN_t reg_domain;
+    v_CONTEXT_t pVosContext = NULL;
+    hdd_context_t *pHddCtx = NULL;
+    struct wiphy *wiphy = NULL;
+
+    pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+
+    if (NULL != pVosContext)
+        pHddCtx = vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
+    else
+        return VOS_STATUS_E_EXISTS;
+
+    if (NULL == pHddCtx)
+    {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   ("Invalid pHddCtx pointer") );
+        return VOS_STATUS_E_FAULT;
+    }
+
+    wiphy = pHddCtx->wiphy;
+
+    if  (('0' == pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[0])
+         &&
+         ('0' == pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[1]))
+    {
+        /* default country is world roaming */
+
+        reg_domain = REGDOMAIN_WORLD;
+        wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+    }
+    else if (REGDOMAIN_WORLD ==
+	     pnvEFSTable->halnv.tables.defaultCountryTable.regDomain) {
+
+        reg_domain = pnvEFSTable->halnv.tables.defaultCountryTable.regDomain;
+        wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+    }
+    else {
+
+        reg_domain = pnvEFSTable->halnv.tables.defaultCountryTable.regDomain;
+        wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
+    }
+    m = 0;
+    for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+    {
+
+        if (wiphy->bands[i] == NULL)
+        {
+            pr_info("error: wiphy->bands[i] is NULL, i = %d\n", i);
+            continue;
+        }
+
+        /* internal channels[] is one continous array for both 2G and 5G bands
+           m is internal starting channel index for each band */
+
+        for (j = 0; j < wiphy->bands[i]->n_channels; j++)
+        {
+            /* k = (m + j) is internal current channel index */
+            k = m + j;
+
+            if (pnvEFSTable->halnv.tables.regDomains[reg_domain].channels[k].enabled ==
+                NV_CHANNEL_DISABLE)
+                wiphy->bands[i]->channels[j].flags |= IEEE80211_CHAN_DISABLED;
+
+            else if (pnvEFSTable->halnv.tables.regDomains[reg_domain].channels[k].enabled ==
+                     NV_CHANNEL_DFS) {
+
+                wiphy->bands[i]->channels[j].flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+
+                wiphy->bands[i]->channels[j].max_power =
+                    (pnvEFSTable->halnv.tables.regDomains[reg_domain].channels[k].pwrLimit)*100;
+            }
+
+            else if (pnvEFSTable->halnv.tables.regDomains[reg_domain].channels[k].enabled ==
+                     NV_CHANNEL_ENABLE) {
+
+                wiphy->bands[i]->channels[j].max_power =
+                    (pnvEFSTable->halnv.tables.regDomains[reg_domain].channels[k].pwrLimit)*100;
+            }
+        }
+
+        m += wiphy->bands[i]->n_channels;
+    }
+
+    return VOS_STATUS_SUCCESS;
+}
+
+
+#else
+
+/**------------------------------------------------------------------------
+  \brief vos_nv_setRegDomain -
+  \param clientCtxt  - Client Context, Not used for PRIMA
+              regId  - Regulatory Domain ID
+              sendRegHint - send hint to nl80211
+  \return status set REG domain operation
+  \sa
+  -------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_setRegDomain(void * clientCtxt, v_REGDOMAIN_t regId,
+                                                  v_BOOL_t sendRegHint)
+{
+    v_CONTEXT_t pVosContext = NULL;
+    hdd_context_t *pHddCtx = NULL;
+    struct wiphy *wiphy = NULL;
+   /* Client Context Argumant not used for PRIMA */
+   if (regId >= REGDOMAIN_COUNT)
+   {
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                "VOS set reg domain, invalid REG domain ID %d", regId);
+      return VOS_STATUS_E_INVAL;
+   }
+
+   pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+   if (NULL != pVosContext)
+      pHddCtx = vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
+   else
+      return VOS_STATUS_E_EXISTS;
+   /* Set correct channel information based on REG Domain */
+   regChannels = pnvEFSTable->halnv.tables.regDomains[regId].channels;
+
+   /* when CRDA is not running then we are world roaming.
+      In this case if 11d is enabled, then country code should
+      be update on basis of world roaming */
+   if (NULL != pHddCtx && sendRegHint)
+   {
+      wiphy = pHddCtx->wiphy;
+      regulatory_hint(wiphy, "00");
+   }
+   return VOS_STATUS_SUCCESS;
+}
+
+
+/**------------------------------------------------------------------------
+  \brief vos_nv_getRegDomainFromCountryCode() - get the regulatory domain of
+  a country given its country code
+  The \a vos_nv_getRegDomainFromCountryCode() returns the regulatory domain of
+  a country given its country code.  This is done from reading a cached
+  copy of the binary file.
+  \param pRegDomain  - pointer to regulatory domain
+  \param countryCode - country code
+  \param source      - source of the country code
+  \return VOS_STATUS_SUCCESS - regulatory domain is found for the given country
+          VOS_STATUS_E_FAULT - invalid pointer error
+          VOS_STATUS_E_EMPTY - country code table is empty
+          VOS_STATUS_E_EXISTS - given country code does not exist in table
+  \sa
+  -------------------------------------------------------------------------*/
+VOS_STATUS vos_nv_getRegDomainFromCountryCode( v_REGDOMAIN_t *pRegDomain,
+      const v_COUNTRYCODE_t countryCode, v_CountryInfoSource_t source)
+{
+   int i;
+   v_CONTEXT_t pVosContext = NULL;
+   hdd_context_t *pHddCtx = NULL;
+   struct wiphy *wiphy = NULL;
+   int status;
+
+   // sanity checks
+   if (NULL == pRegDomain)
+   {
+      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+            ("Invalid reg domain pointer\n") );
+      return VOS_STATUS_E_FAULT;
+   }
+   *pRegDomain = REGDOMAIN_COUNT;
+
+   if (NULL == countryCode)
+   {
+      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+            ("Country code array is NULL\r\n") );
+      return VOS_STATUS_E_FAULT;
+   }
+   if (0 == countryInfoTable.countryCount)
+   {
+      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+            ("Reg domain table is empty\r\n") );
+      return VOS_STATUS_E_EMPTY;
+   }
+   /* If CRDA regulatory settings is valid, i.e. crda is enabled
+      and reg_notifier is called back.
+      Intercept here and redirect to the Reg domain table's CRDA
+      entry if country code is crda's country.
+      last one NUM_REG_DOMAINS-1 is reserved for crda */
+   VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
+          "vos_nv_getRegDomainFromCountryCode %c%c\n",
+          countryCode[0], countryCode[1]);
+
+   if (crda_regulatory_entry_valid == VOS_TRUE)
+   {
+       if (crda_alpha2[0]==countryCode[0] && crda_alpha2[1]==countryCode[1])
+       {
+          *pRegDomain = NUM_REG_DOMAINS-1;
+              VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
+              "vos_nv_getRegDomainFromCountryCode return crda init entry\n");
+          return VOS_STATUS_SUCCESS;
+       }
+       if (run_time_alpha2[0]==countryCode[0] &&
+           run_time_alpha2[1]==countryCode[1] &&
+           crda_regulatory_run_time_entry_valid == VOS_TRUE)
+       {
+          *pRegDomain = NUM_REG_DOMAINS-2;
+              VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
+              "vos_nv_getRegDomainFromCountryCode return crda none-default country entry\n");
+           return VOS_STATUS_SUCCESS;
+       }
+       else
+       {
+           crda_regulatory_run_time_entry_valid = VOS_FALSE;
+           pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+           if (NULL != pVosContext)
+               pHddCtx = vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
+           else
+               return VOS_STATUS_E_EXISTS;
+           if (NULL == pHddCtx)
+           {
+              VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                    ("Invalid pHddCtx pointer\r\n") );
+              return VOS_STATUS_E_FAULT;
+           }
+
+           wiphy = pHddCtx->wiphy;
+
+           INIT_COMPLETION(pHddCtx->driver_crda_req);
+           regulatory_hint(wiphy, countryCode);
+           status = wait_for_completion_interruptible_timeout(
+                   &pHddCtx->driver_crda_req,
+                   msecs_to_jiffies(CRDA_WAIT_TIME));
+           if (!status)
+           {
+               VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                       "%s: Timeout waiting for CRDA REQ", __func__);
+           }
+
+           if (crda_regulatory_run_time_entry_valid == VOS_TRUE)
+           {
+              VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
+                 "vos_nv_getRegDomainFromCountryCode return crda new none-default country entry\n");
+               return VOS_STATUS_SUCCESS;
+           }
+           VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+              "vos_nv_getRegDomainFromCountryCode failed to get crda new none-default country entry\n");
+           return VOS_STATUS_E_EXISTS;
+       }
+   }
+
+   // iterate the country info table until end of table or the country code
+   // is found
+   for (i = 0; i < countryInfoTable.countryCount &&
+         REGDOMAIN_COUNT == *pRegDomain; i++)
+   {
+      if (memcmp(countryCode, countryInfoTable.countryInfo[i].countryCode,
+               VOS_COUNTRY_CODE_LEN) == 0)
+      {
+         // country code is found
+         *pRegDomain = countryInfoTable.countryInfo[i].regDomain;
+      }
+   }
+   if (REGDOMAIN_COUNT != *pRegDomain)
+   {
+      return VOS_STATUS_SUCCESS;
+   }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN,
+            ("country code is not found\r\n"));
+      return VOS_STATUS_E_EXISTS;
+   }
+}
+/* FUNCTION: vos_nv_change_country_code_cb
+*  to wait for contry code completion
+*/
+void* vos_nv_change_country_code_cb(void *pAdapter)
+{
+   struct completion *change_code_cng = pAdapter;
+   complete(change_code_cng);
+   return NULL;
+}
+
 /*
  * Function: wlan_hdd_crda_reg_notifier
  * This function is called from cfg80211 core to provide regulatory settings
@@ -2289,77 +3479,221 @@
 #endif
 {
     hdd_context_t *pHddCtx = wiphy_priv(wiphy);
+    v_REGDOMAIN_t domainIdCurrent;
+    tANI_U8 ccode[WNI_CFG_COUNTRY_CODE_LEN];
+    tANI_U8 uBufLen = WNI_CFG_COUNTRY_CODE_LEN;
+    tANI_U8 nBandCapability;
+    int i,j,k,m;
+
     wiphy_dbg(wiphy, "info: cfg80211 reg_notifier callback for country"
                      " %c%c\n", request->alpha2[0], request->alpha2[1]);
     if (request->initiator == NL80211_REGDOM_SET_BY_USER)
     {
+       int status;
        wiphy_dbg(wiphy, "info: set by user\n");
-       if (create_crda_regulatory_entry(wiphy, request, pHddCtx->cfg_ini->nBandCapability) != 0) {
+       init_completion(&change_country_code);
+       /* We will process hints by user from nl80211 in driver.
+       * sme_ChangeCountryCode will set the country to driver
+       * and update the regdomain.
+       * when we return back to nl80211 from this callback, the nl80211 will
+       * send NL80211_CMD_REG_CHANGE event to the hostapd waking it up to
+       * query channel list from nl80211. Thus we need to update the channels
+       * according to reg domain set by user before returning to nl80211 so
+       * that hostapd will gets the updated channels.
+       * The argument sendRegHint in sme_ChangeCountryCode is
+       * set to eSIR_FALSE (hint is from nl80211 and thus
+       * no need to notify nl80211 back)*/
+       status = sme_ChangeCountryCode(pHddCtx->hHal,
+                                   (void *)(tSmeChangeCountryCallback)
+                                   vos_nv_change_country_code_cb,
+                                   request->alpha2,
+                                   &change_country_code,
+                                   pHddCtx->pvosContext,
+                                   eSIR_FALSE,
+                                   eSIR_FALSE);
+       if (eHAL_STATUS_SUCCESS == status)
+       {
+          status = wait_for_completion_interruptible_timeout(
+                                       &change_country_code,
+                                       msecs_to_jiffies(WLAN_WAIT_TIME_COUNTRY));
+          if(status <= 0)
+          {
+             wiphy_dbg(wiphy, "info: set country timed out\n");
+          }
+       }
+       else
+       {
+          wiphy_dbg(wiphy, "info: unable to set country by user\n");
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0))
           return;
 #else
           return 0;
 #endif
        }
+       // ToDo
+       /* Don't change default country code to CRDA country code by user req */
        /* Shouldcall sme_ChangeCountryCode to send a message to trigger read
           regd for new country settings */
-       sme_ChangeCountryCode(pHddCtx->hHal, NULL,
-             &request->alpha2[0], NULL, pHddCtx->pvosContext);
+       //sme_ChangeCountryCode(pHddCtx->hHal, NULL,
+       //    &country_code[0], pAdapter, pHddCtx->pvosContext);
     }
-    else if (request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)
+
+    if (request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)
     {
        wiphy_dbg(wiphy, "info: set by country IE\n");
-       if (create_crda_regulatory_entry(wiphy, request, pHddCtx->cfg_ini->nBandCapability) != 0) {
+       if (create_crda_regulatory_entry(wiphy, request, pHddCtx->cfg_ini->nBandCapability) != 0)
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0))
           return;
 #else
           return 0;
 #endif
-       }
-
+       // ToDo
        /* Intersect of 11d and crda settings */
-       /* call sme_ChangeCountryCode to trigger read regd
-          for intersected new country settings */
-       sme_ChangeCountryCode(pHddCtx->hHal, NULL,
-             &request->alpha2[0], NULL, pHddCtx->pvosContext);
-    }
-    else if (request->initiator == NL80211_REGDOM_SET_BY_DRIVER)
-    {
-       wiphy_dbg(wiphy, "info: set by driver\n");
-       /* if set by driver itself, it means driver can accept the crda
-          regulatory settings and wiphy->regd should be populated with crda
-          settings. iwiphy->bands doesn't seem to set ht40 flags in kernel
-          correctly, this may be fixed by later kernel */
-       if (create_crda_regulatory_entry_from_regd(wiphy, request, pHddCtx->cfg_ini->nBandCapability) == 0)
-       {
-          pr_info("crda entry created.\n");
-          if (crda_alpha2[0] == request->alpha2[0] && crda_alpha2[1] == request->alpha2[1])
-          {  /* first CRDA request should be from init time */
-             /* Change default country code to CRDA country code, assume indoor */
-             pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[0] = request->alpha2[0];
-             pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[1] = request->alpha2[1];
-             pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[2] = 'I';
-             pnvEFSTable->halnv.tables.defaultCountryTable.regDomain = NUM_REG_DOMAINS-1;
-             wiphy_dbg(wiphy, "info: init time default country code is %c%c%c\n",
-                pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[0],
-                   pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[1],
-                      pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[2]);
-          }
-          else /* second or later CRDA request after init time */
-          {
-             wiphy_dbg(wiphy, "info: crda none-default country code is %c%c\n",
-                request->alpha2[0], request->alpha2[1]);
-          }
-          // hdd will read regd for this country after complete
-       }
-       complete(&pHddCtx->driver_crda_req);
 
-       /* Haven't seen any condition that will set by driver after init.
-          If we do, then we should also call sme_ChangeCountryCode */
+       /* Don't change default country code to CRDA country code by 11d req */
+       /* for every adapter call sme_ChangeCountryCode to trigger read regd
+          for intersected new country settings */
+       // sme_ChangeCountryCode(pHddCtx->hHal, NULL,
+       //    &country_code[0], pAdapter, pHddCtx->pvosContext);
     }
+    else if (request->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
+             (request->initiator == NL80211_REGDOM_SET_BY_CORE)||
+                (request->initiator == NL80211_REGDOM_SET_BY_USER))
+    {
+         if ( eHAL_STATUS_SUCCESS !=  sme_GetCountryCode(pHddCtx->hHal, ccode, &uBufLen))
+         {
+            wiphy_dbg(wiphy, "info: set by driver CCODE ERROR\n");
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0))
+            return;
+#else
+            return 0;
+#endif
+         }
+         if (eHAL_STATUS_SUCCESS != sme_GetRegulatoryDomainForCountry (pHddCtx->hHal,
+                                             ccode, (v_REGDOMAIN_t *) &domainIdCurrent))
+         {
+            wiphy_dbg(wiphy, "info: set by driver ERROR\n");
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0))
+            return;
+#else
+            return 0;
+#endif
+         }
+
+         wiphy_dbg(wiphy, "country: %c%c set by driver\n",ccode[0],ccode[1]);
+         /* if set by driver itself, it means driver can accept the crda
+            regulatory settings and wiphy->regd should be populated with crda
+            settings. iwiphy->bands doesn't seem to set ht40 flags in kernel
+            correctly, this may be fixed by later kernel */
+
+         nBandCapability = pHddCtx->cfg_ini->nBandCapability;
+         for (i = 0, m = 0; i < IEEE80211_NUM_BANDS; i++)
+         {
+             if (NULL == wiphy->bands[i])
+             {
+                 VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                           "error: wiphy->bands[i] is NULL, i = %d", i);
+                 continue;
+             }
+
+             // internal channels[] is one continous array for both 2G and 5G bands
+             // m is internal starting channel index for each band
+             if (0 == i)
+             {
+                 m = 0;
+             }
+             else
+             {
+                 m = wiphy->bands[i-1]?wiphy->bands[i-1]->n_channels + m:m;
+             }
+
+             for (j=0; j<wiphy->bands[i]->n_channels; j++)
+             {
+                 // k = (m + j) is internal current channel index for 20MHz channel
+                 // n is internal channel index for corresponding 40MHz channel
+                 k = m + j;
+                 if (IEEE80211_BAND_2GHZ == i && eCSR_BAND_5G == nBandCapability) // 5G only
+                 {
+                     // Enable social channels for P2P
+                     if ((2412 == wiphy->bands[i]->channels[j].center_freq ||
+                          2437 == wiphy->bands[i]->channels[j].center_freq ||
+                          2462 == wiphy->bands[i]->channels[j].center_freq ) &&
+                         NV_CHANNEL_ENABLE == regChannels[k].enabled)
+                     {
+                         wiphy->bands[i]->channels[j].flags &= ~IEEE80211_CHAN_DISABLED;
+                     }
+                     else
+                     {
+                         wiphy->bands[i]->channels[j].flags |= IEEE80211_CHAN_DISABLED;
+                     }
+                     continue;
+                 }
+                 else if (IEEE80211_BAND_5GHZ == i && eCSR_BAND_24 == nBandCapability) // 2G only
+                 {
+                     wiphy->bands[i]->channels[j].flags |= IEEE80211_CHAN_DISABLED;
+                     continue;
+                 }
+
+                 if (NV_CHANNEL_DISABLE == regChannels[k].enabled ||
+                     NV_CHANNEL_INVALID == regChannels[k].enabled)
+                 {
+                     wiphy->bands[i]->channels[j].flags |= IEEE80211_CHAN_DISABLED;
+                 }
+                 else if (NV_CHANNEL_DFS == regChannels[k].enabled)
+                 {
+                     wiphy->bands[i]->channels[j].flags &= ~(IEEE80211_CHAN_DISABLED
+                                                             |IEEE80211_CHAN_RADAR);
+                     wiphy->bands[i]->channels[j].flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+                 }
+                 else
+                 {
+                     wiphy->bands[i]->channels[j].flags &= ~(IEEE80211_CHAN_DISABLED
+                                                             |IEEE80211_CHAN_PASSIVE_SCAN
+                                                             |IEEE80211_CHAN_NO_IBSS
+                                                             |IEEE80211_CHAN_RADAR);
+                 }
+             }
+         }
+
+         /* Haven't seen any condition that will set by driver after init.
+            If we do, then we should also call sme_ChangeCountryCode */
+         if (wiphy->bands[IEEE80211_BAND_5GHZ])
+         {
+             for (j=0; j<wiphy->bands[IEEE80211_BAND_5GHZ]->n_channels; j++)
+             {
+                 // UNII-1 band channels are passive when domain is FCC.
+                 if ((wiphy->bands[IEEE80211_BAND_5GHZ ]->channels[j].center_freq == 5180 ||
+                      wiphy->bands[IEEE80211_BAND_5GHZ]->channels[j].center_freq == 5200 ||
+                      wiphy->bands[IEEE80211_BAND_5GHZ]->channels[j].center_freq == 5220 ||
+                      wiphy->bands[IEEE80211_BAND_5GHZ]->channels[j].center_freq == 5240) &&
+                     ((ccode[0]== 'U'&& ccode[1]=='S') && pHddCtx->nEnableStrictRegulatoryForFCC))
+                 {
+                     wiphy->bands[IEEE80211_BAND_5GHZ]->channels[j].flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+                 }
+                 else if ((wiphy->bands[IEEE80211_BAND_5GHZ]->channels[j].center_freq == 5180 ||
+                           wiphy->bands[IEEE80211_BAND_5GHZ]->channels[j].center_freq == 5200 ||
+                           wiphy->bands[IEEE80211_BAND_5GHZ]->channels[j].center_freq == 5220 ||
+                           wiphy->bands[IEEE80211_BAND_5GHZ]->channels[j].center_freq == 5240) &&
+                          ((ccode[0]!= 'U'&& ccode[1]!='S') || !pHddCtx->nEnableStrictRegulatoryForFCC))
+                 {
+                     wiphy->bands[IEEE80211_BAND_5GHZ]->channels[j].flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
+                 }
+             }
+         }
+
+         if (request->initiator == NL80211_REGDOM_SET_BY_CORE)
+         {
+             request->processed = 1;
+         }
+    }
+
+    complete(&pHddCtx->wiphy_channel_update_event);
+
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0))
     return;
 #else
     return 0;
 #endif
 }
+
+#endif
diff --git a/CORE/VOSS/src/vos_packet.c b/CORE/VOSS/src/vos_packet.c
index c010d50..2554959 100644
--- a/CORE/VOSS/src/vos_packet.c
+++ b/CORE/VOSS/src/vos_packet.c
@@ -48,7 +48,7 @@
 #include <i_vos_packet.h>
 #include <vos_timer.h>
 #include <vos_trace.h>
-#include <wlan_hdd_main.h>
+#include <wlan_hdd_main.h>   
 #ifdef QCA_WIFI_2_0
 #include "adf_nbuf.h"
 #include "vos_memory.h"
@@ -214,6 +214,7 @@
 }
 
 #else
+
 /*--------------------------------------------------------------------------
   Preprocessor definitions and constants
   ------------------------------------------------------------------------*/
@@ -334,21 +335,23 @@
    vos_pkt_get_packet_callback callback;
 
    // if there are no packets in the replenish pool then we can't do anything
+   mutex_lock(&gpVosPacketContext->rxReplenishListLock);
    if (likely(0 == gpVosPacketContext->rxReplenishListCount))
    {
+      mutex_unlock(&gpVosPacketContext->rxReplenishListLock);
       return;
    }
 
    // we only replenish if the Rx Raw pool is empty or the Replenish pool
    // reaches a high water mark
-   mutex_lock(&gpVosPacketContext->mlock);
+   mutex_lock(&gpVosPacketContext->rxRawFreeListLock);
 
-
-   if ((gpVosPacketContext->rxReplenishListCount < VPKT_RX_REPLENISH_THRESHOLD)
-       &&
-       (!list_empty(&gpVosPacketContext->rxRawFreeList)))
+   if ((gpVosPacketContext->rxReplenishListCount <
+        gpVosPacketContext->numOfRxRawPackets/4) &&
+         (!list_empty(&gpVosPacketContext->rxRawFreeList)))
    {
-      mutex_unlock(&gpVosPacketContext->mlock);
+      mutex_unlock(&gpVosPacketContext->rxRawFreeListLock);
+      mutex_unlock(&gpVosPacketContext->rxReplenishListLock);
       return;
    }
 
@@ -415,12 +418,14 @@
 
       callback = gpVosPacketContext->rxRawLowResourceInfo.callback;
       gpVosPacketContext->rxRawLowResourceInfo.callback = NULL;
-      mutex_unlock(&gpVosPacketContext->mlock);
+      mutex_unlock(&gpVosPacketContext->rxRawFreeListLock);
+      mutex_unlock(&gpVosPacketContext->rxReplenishListLock);
       callback(pVosPacket, gpVosPacketContext->rxRawLowResourceInfo.userData);
    }
    else
    {
-      mutex_unlock(&gpVosPacketContext->mlock);
+      mutex_unlock(&gpVosPacketContext->rxRawFreeListLock);
+      mutex_unlock(&gpVosPacketContext->rxReplenishListLock);
    }
 }
 
@@ -520,7 +525,7 @@
       if (sizeof(vos_pkt_context_t) != vosPacketContextSize)
       {
          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
-                   "VPKT [%d]: invalid vosPacketContextSize, %d vs %d",
+                   "VPKT [%d]: invalid vosPacketContextSize, %zu vs %d",
                    __LINE__, sizeof(vos_pkt_context_t), vosPacketContextSize);
          vosStatus = VOS_STATUS_E_INVAL;
          break;
@@ -537,6 +542,7 @@
       pVosPacketContext->vosContext = pVosContext;
 
       // initialize the rx Replenish pool (initially empty)
+      mutex_init(&gpVosPacketContext->rxReplenishListLock);
       INIT_LIST_HEAD(&pVosPacketContext->rxReplenishList);
       pVosPacketContext->rxReplenishListCount = 0;
 
@@ -544,12 +550,15 @@
       freePacketIndex = 0;
 
       // initialize the rxRaw free list pool
+      mutex_init(&gpVosPacketContext->rxRawFreeListLock);
       pFreeList = &pVosPacketContext->rxRawFreeList;
       pVosPacketContext->rxRawFreeListCount = 0;
       INIT_LIST_HEAD(pFreeList);
 
+      pVosPacketContext->numOfRxRawPackets = vos_pkt_get_num_of_rx_raw_pkts();
+
       // fill the rxRaw free list
-      for (idx = 0; idx < VPKT_NUM_RX_RAW_PACKETS; idx++)
+      for (idx = 0; idx < pVosPacketContext->numOfRxRawPackets; idx++)
       {
          pPkt = &pVosPacketContext->vosPktBuffers[freePacketIndex++];
          vosStatus = vos_pkti_packet_init(pPkt, VOS_PKT_TYPE_RX_RAW);
@@ -576,6 +585,7 @@
       }
 
       // initialize the txData free list pool
+      mutex_init(&gpVosPacketContext->txDataFreeListLock);
       pFreeList = &pVosPacketContext->txDataFreeList;
       INIT_LIST_HEAD(pFreeList);
 
@@ -605,10 +615,10 @@
       }
 
       // initialize the txMgmt free list pool
+      mutex_init(&gpVosPacketContext->txMgmtFreeListLock);
       pFreeList = &pVosPacketContext->txMgmtFreeList;
       INIT_LIST_HEAD(pFreeList);
 
-      mutex_init(&gpVosPacketContext->mlock);
       // fill the txMgmt free list
       for (idx = 0; idx < VPKT_NUM_TX_MGMT_PACKETS; idx++)
       {
@@ -682,19 +692,27 @@
       return VOS_STATUS_E_INVAL;
    }
 
-   mutex_lock(&gpVosPacketContext->mlock);
+
+   mutex_lock(&gpVosPacketContext->txMgmtFreeListLock);
    (void) vos_pkti_list_destroy(&gpVosPacketContext->txMgmtFreeList);
+   mutex_unlock(&gpVosPacketContext->txMgmtFreeListLock);
+
+   mutex_lock(&gpVosPacketContext->txDataFreeListLock);
    (void) vos_pkti_list_destroy(&gpVosPacketContext->txDataFreeList);
+   gpVosPacketContext->uctxDataFreeListCount = 0;
+   mutex_unlock(&gpVosPacketContext->txDataFreeListLock);
+
+   mutex_lock(&gpVosPacketContext->rxRawFreeListLock);
    (void) vos_pkti_list_destroy(&gpVosPacketContext->rxRawFreeList);
-   (void) vos_pkti_list_destroy(&gpVosPacketContext->rxReplenishList);
-
    gpVosPacketContext->rxRawFreeListCount    = 0;
+   mutex_unlock(&gpVosPacketContext->rxRawFreeListLock);
+
+   mutex_lock(&gpVosPacketContext->rxReplenishListLock);
+   (void) vos_pkti_list_destroy(&gpVosPacketContext->rxReplenishList);
    gpVosPacketContext->rxReplenishListCount  = 0;
-   gpVosPacketContext->uctxDataFreeListCount = 0;
+   mutex_unlock(&gpVosPacketContext->rxReplenishListLock);
 
-   mutex_unlock(&gpVosPacketContext->mlock);
 
-   gpVosPacketContext->uctxDataFreeListCount = 0;
 
    return VOS_STATUS_SUCCESS;
 }
@@ -789,6 +807,8 @@
    vos_pkt_low_resource_info *pLowResourceInfo;
    struct vos_pkt_t *pVosPacket;
    v_SIZE_t *pCount = NULL;
+   struct mutex *mlock;
+
    // Validate the return parameter pointer
    if (unlikely(NULL == ppPacket))
    {
@@ -822,6 +842,7 @@
    case VOS_PKT_TYPE_RX_RAW:
       pPktFreeList = &gpVosPacketContext->rxRawFreeList;
       pLowResourceInfo = &gpVosPacketContext->rxRawLowResourceInfo;
+      mlock = &gpVosPacketContext->rxRawFreeListLock;
 
       // see if we need to replenish the Rx Raw pool
       vos_pkti_replenish_raw_pool();
@@ -832,6 +853,7 @@
    case VOS_PKT_TYPE_TX_802_11_MGMT:
       pPktFreeList = &gpVosPacketContext->txMgmtFreeList;
       pLowResourceInfo = &gpVosPacketContext->txMgmtLowResourceInfo;
+      mlock = &gpVosPacketContext->txMgmtFreeListLock;
       break;
 
    default:
@@ -846,13 +868,13 @@
    // then we know we are already in a low-resource condition
    if (unlikely(pLowResourceInfo->callback))
    {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN,
                 "VPKT [%d]: Low resource handler already registered",
                 __LINE__);
       return VOS_STATUS_E_ALREADY;
    }
 
-   mutex_lock(&gpVosPacketContext->mlock);
+   mutex_lock(mlock);
    // are there vos packets on the associated free pool?
    if (unlikely(list_empty(pPktFreeList)))
    {
@@ -863,7 +885,7 @@
          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
                    "VPKT [%d]: Low resource condition and no callback provided",
                    __LINE__);
-         mutex_unlock(&gpVosPacketContext->mlock);
+         mutex_unlock(mlock);
 
          return VOS_STATUS_E_FAILURE;
       }
@@ -875,7 +897,7 @@
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN,
                 "VPKT [%d]: Low resource condition for packet type %d[%s]",
                 __LINE__, pktType, vos_pkti_packet_type_str(pktType));
-      mutex_unlock(&gpVosPacketContext->mlock);
+      mutex_unlock(mlock);
 
       return VOS_STATUS_E_RESOURCES;
    }
@@ -887,7 +909,7 @@
    {
       (*pCount)--;
    }
-   mutex_unlock(&gpVosPacketContext->mlock);
+   mutex_unlock(mlock);
 
    // clear out the User Data pointers in the voss packet..
    memset(&pVosPacket->pvUserData, 0, sizeof(pVosPacket->pvUserData));
@@ -1008,6 +1030,7 @@
    struct list_head *pPktFreeList;
    vos_pkt_low_resource_info *pLowResourceInfo;
    struct vos_pkt_t *pVosPacket;
+   struct mutex *mlock;
 
    // Validate the return parameter pointer
    if (unlikely(NULL == ppPacket))
@@ -1030,15 +1053,19 @@
    // determine which packet pool and low resource block we should use.
    pPktFreeList = &gpVosPacketContext->txDataFreeList;
    pLowResourceInfo = &gpVosPacketContext->txDataLowResourceInfo;
+   mlock = &gpVosPacketContext->txDataFreeListLock;
+
+   mutex_lock(mlock);
 
    // is there already a low resource callback registered for this pool?
    // we only support one callback per pool, so if one is already registered
    // then we know we are already in a low-resource condition
    if (unlikely(pLowResourceInfo->callback))
    {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN,
                 "VPKT [%d]: Low resource handler already registered",
                 __LINE__);
+      mutex_unlock(mlock);
       return VOS_STATUS_E_ALREADY;
    }
 
@@ -1052,6 +1079,7 @@
          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
                    "VPKT [%d]: Low resource condition and no callback provided",
                    __LINE__);
+         mutex_unlock(mlock);
          return VOS_STATUS_E_FAILURE;
       }
 
@@ -1062,6 +1090,7 @@
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN,
                 "VPKT [%d]: Low resource condition for pool %s",
                 __LINE__, vos_pkti_packet_type_str(pktType));
+      mutex_unlock(mlock);
       return VOS_STATUS_E_RESOURCES;
    }
 
@@ -1069,6 +1098,7 @@
    pVosPacket = list_first_entry(pPktFreeList, struct vos_pkt_t, node);
    list_del(&pVosPacket->node);
    gpVosPacketContext->uctxDataFreeListCount --;
+   mutex_unlock(mlock);
 
    // clear out the User Data pointers in the voss packet..
    memset(&pVosPacket->pvUserData, 0, sizeof(pVosPacket->pvUserData));
@@ -1422,6 +1452,7 @@
    v_SIZE_t *pCount;
    VOS_PKT_TYPE packetType = VOS_PKT_TYPE_TX_802_3_DATA;
    v_BOOL_t lowResource = VOS_FALSE;
+   struct mutex * mlock;
 
    // Validate the input parameter pointer
    if (unlikely(NULL == pPacket))
@@ -1466,12 +1497,14 @@
             pPktFreeList = &gpVosPacketContext->rxRawFreeList;
             pLowResourceInfo = &gpVosPacketContext->rxRawLowResourceInfo;
             pCount = &gpVosPacketContext->rxRawFreeListCount;
+            mlock = &gpVosPacketContext->rxRawFreeListLock;
          }
          else
          {
             pPktFreeList = &gpVosPacketContext->rxReplenishList;
             pLowResourceInfo = NULL;
             pCount = &gpVosPacketContext->rxReplenishListCount;
+            mlock = &gpVosPacketContext->rxReplenishListLock;
          }
          packetType = VOS_PKT_TYPE_RX_RAW;
          break;
@@ -1480,12 +1513,14 @@
                 
          pPktFreeList = &gpVosPacketContext->txMgmtFreeList;
          pLowResourceInfo = &gpVosPacketContext->txMgmtLowResourceInfo;
-         
+         mlock = &gpVosPacketContext->txMgmtFreeListLock;
+
          break;
 
       case VOS_PKT_TYPE_TX_802_3_DATA:
          pPktFreeList = &gpVosPacketContext->txDataFreeList;
          pLowResourceInfo = &gpVosPacketContext->txDataLowResourceInfo;
+         mlock = &gpVosPacketContext->txDataFreeListLock;
          gpVosPacketContext->uctxDataFreeListCount ++;
          break;
 
@@ -1505,10 +1540,10 @@
          // pLowResourceInfo->callback is modified from threads (different CPU's). 
          // So a mutex is enough to protect is against a race condition.
          // mutex is SMP safe
-         mutex_lock(&gpVosPacketContext->mlock);
+         mutex_lock(mlock);
          callback = pLowResourceInfo->callback;
          pLowResourceInfo->callback = NULL;
-         mutex_unlock(&gpVosPacketContext->mlock);
+         mutex_unlock(mlock);
 
          // only one context can get a valid callback
          if(callback)
@@ -1548,14 +1583,14 @@
                    "VPKT [%d]: [%p] Packet returned, type %d[%s]",
                    __LINE__, pPacket, pPacket->packetType,
                    vos_pkti_packet_type_str(pPacket->packetType));
-         mutex_lock(&gpVosPacketContext->mlock);
+         mutex_lock(mlock);
          list_add_tail(&pPacket->node, pPktFreeList);
-         mutex_unlock(&gpVosPacketContext->mlock);
-        
+
          if (pCount)
          {
             (*pCount)++;
          }
+         mutex_unlock(mlock);
       }
 
       // move to next packet in the chain
@@ -3053,6 +3088,8 @@
    struct list_head *pList;
    struct list_head *pNode;
    v_SIZE_t count;
+   struct mutex *mlock;
+
    if (NULL == vosFreeBuffer)
    {
       return VOS_STATUS_E_INVAL;
@@ -3062,6 +3099,7 @@
    {
    case VOS_PKT_TYPE_TX_802_11_MGMT:
       pList = &gpVosPacketContext->txMgmtFreeList;
+      mlock = &gpVosPacketContext->txMgmtFreeListLock;
       break;
 
    case VOS_PKT_TYPE_TX_802_11_DATA:
@@ -3072,7 +3110,10 @@
           return VOS_STATUS_SUCCESS;
       }
       else
-      pList = &gpVosPacketContext->txDataFreeList;
+      {
+         pList = &gpVosPacketContext->txDataFreeList;
+         mlock = &gpVosPacketContext->txDataFreeListLock;
+      }
       break;
 
    case VOS_PKT_TYPE_RX_RAW:
@@ -3090,16 +3131,42 @@
    }
 
    count = 0;
-   mutex_lock(&gpVosPacketContext->mlock);
+   mutex_lock(mlock);
    list_for_each(pNode, pList)
    {
       count++;
    }
-   mutex_unlock(&gpVosPacketContext->mlock);
+   mutex_unlock(mlock);
    *vosFreeBuffer = count;
    return VOS_STATUS_SUCCESS;
 }
 
+/**
+  @brief vos_pkt_get_num_of_rx_raw_pkts() - Get the number of RX packets
+                                       that should be allocated.
+
+  This function is called by VOS packet module to know how many RX raw
+  packets it should allocate/reserve. This value can be configured thru
+  Kernel device tree to save memory usage.
+
+  @param
+       NONE
+  @return
+       v_SIZE_t the number of packets to allocate
+
+*/
+v_SIZE_t vos_pkt_get_num_of_rx_raw_pkts(void)
+{
+#ifdef HAVE_WCNSS_RX_BUFF_COUNT
+    v_SIZE_t buffCount;
+
+    buffCount = wcnss_get_wlan_rx_buff_count();
+    return (buffCount > VPKT_NUM_RX_RAW_PACKETS ?
+               VPKT_NUM_RX_RAW_PACKETS : buffCount);
+#else
+    return VPKT_NUM_RX_RAW_PACKETS;
+#endif
+}
 
 #ifdef VOS_PACKET_UNIT_TEST
 #include "vos_packet_test.c"
diff --git a/CORE/VOSS/src/vos_power.c b/CORE/VOSS/src/vos_power.c
index 77646b3..f1205b2 100644
--- a/CORE/VOSS/src/vos_power.c
+++ b/CORE/VOSS/src/vos_power.c
@@ -84,22 +84,6 @@
 #include <mach/vreg.h>
 #include <linux/err.h>
 #include <linux/delay.h>
-
-#ifdef MSM_PLATFORM_7x30
-#include <mach/irqs-7x30.h>
-#include <linux/mfd/pmic8058.h>
-#include <mach/rpc_pmapp.h>
-#include <mach/pmic.h>
-#endif
-
-#ifdef MSM_PLATFORM_8660
-#include <qcomwlan_pwrif.h>
-#endif
-
-#ifdef MSM_PLATFORM_7x27A
-#include <linux/qcomwlan7x27a_pwrif.h>
-#endif
-
 #endif //MSM_PLATFORM
 
 #include <vos_sched.h>
@@ -124,391 +108,6 @@
 // SDIO Config Cycle Clock Frequency
 #define WLAN_LOW_SD_CONFIG_CLOCK_FREQ 400000
 
-#ifdef MSM_PLATFORM_7x30
-
-#define PM8058_GPIO_PM_TO_SYS(pm_gpio)  (pm_gpio + NR_GPIO_IRQS)
-
-static const char* id = "WLAN";
-
-struct wlan_pm8058_gpio {
-    int gpio_num;
-    struct pm_gpio gpio_cfg;
-};
-
-
-//PMIC8058 GPIO COnfiguration for MSM7x30 //ON
-static struct wlan_pm8058_gpio wlan_gpios_reset[] = {
-    {PM8058_GPIO_PM_TO_SYS(22),{PM_GPIO_DIR_OUT, PM_GPIO_OUT_BUF_CMOS, 0, PM_GPIO_PULL_NO, 2, PM_GPIO_STRENGTH_LOW, PM_GPIO_FUNC_NORMAL, 0}},
-};
-
-//OFF
-static struct wlan_pm8058_gpio wlan_gpios_reset_out[] = {
-    {PM8058_GPIO_PM_TO_SYS(22),{PM_GPIO_DIR_OUT, PM_GPIO_OUT_BUF_CMOS, 1, PM_GPIO_PULL_NO, 2, PM_GPIO_STRENGTH_HIGH, PM_GPIO_FUNC_NORMAL, 0}},
-};
-
-
-/* Routine to power on/off Volans chip */
-int vos_chip_power_qrf8600(int on)
-{
-    struct vreg *vreg_wlan = NULL;
-    struct vreg *vreg_gp16 = NULL;
-    struct vreg *vreg_gp15 = NULL;
-    struct vreg *vreg_s2 = NULL;
-    int rc = 0;
-
-VOS_PWR_SLEEP(100);
-    //2.9v PA from LDO13
-    vreg_wlan = vreg_get(NULL, "wlan");
-    if (IS_ERR(vreg_wlan)) {
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg get failed (%ld)\n",
-                             __func__, PTR_ERR(vreg_wlan));
-        return PTR_ERR(vreg_wlan);
-    }
-
-    //1.2V AON from LDO24
-    vreg_gp16 = vreg_get(NULL, "gp16");
-    if (IS_ERR(vreg_gp16))  {
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp16 vreg get failed (%ld)\n",
-                             __func__, PTR_ERR(vreg_gp16));
-        return PTR_ERR(vreg_gp16);
-    }
-
-    //1.2V sw from LDO22
-    vreg_gp15 = vreg_get(NULL, "gp15");
-    if (IS_ERR(vreg_gp15))  {
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp15 vreg get failed (%ld)\n",
-                             __func__, PTR_ERR(vreg_gp15));
-        return PTR_ERR(vreg_gp15);
-    }
-
-    //1.3V sw from S2
-    vreg_s2 = vreg_get(NULL, "s2");
-    if (IS_ERR(vreg_s2)) {
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: s2 vreg get failed (%ld)\n",
-                             __func__, PTR_ERR(vreg_s2));
-        return PTR_ERR(vreg_s2);
-    }
-
-    if (on) {
-        /* Program GPIO 23 to de-assert (drive 1) external_por_n (default 0x00865a05 */
-        rc = pm8xxx_gpio_config(wlan_gpios_reset[0].gpio_num, &wlan_gpios_reset[0].gpio_cfg);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: pmic gpio %d config failed (%d)\n",
-                            __func__, wlan_gpios_reset[0].gpio_num, rc);
-            return -EIO;
-        }
-        VOS_PWR_SLEEP(300);
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "WLAN put in reset mode \n");
-#if 0
-        rc = pmapp_clock_vote("wlan", PMAPP_CLOCK_ID_A0, PMAPP_CLOCK_VOTE_ON);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: Voting TCXO to ON failed. (%d)\n",__func__, rc);
-            return -EIO;
-        }
-#endif
-        /* Configure TCXO to be slave to WLAN_CLK_PWR_REQ */
-        rc = pmapp_clock_vote(id, PMAPP_CLOCK_ID_A0, PMAPP_CLOCK_VOTE_PIN_CTRL);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: Configuring TCXO to Pin controllable failed. (%d)\n",__func__, rc);
-            return -EIO;
-        }
-
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "TCXO configured to be slave to WLAN_CLK_PWR-REQ \n");
-        printk(KERN_ERR "TCXO is now slave to clk_pwr_req \n");
-
-        //Wait 10msec
-        msleep(10);
-
-        /* Enable L13 to output 2.9V (default 2.9V) */
-        rc = vreg_set_level(vreg_wlan, 3050);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg set level failed (%d)\n", __func__, rc);
-            return -EIO;
-        }
-
-        rc = vreg_enable(vreg_wlan);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg enable failed. (%d)\n",__func__, rc);
-            return -EIO;
-        }
-
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "2.9V Power Supply Enabled \n");
-        printk(KERN_ERR "3.05V Supply Enabled \n");
-
-        /* Enable L24 to output 1.2V AON(default 1.3V) */
-        rc = vreg_set_level(vreg_gp16, 1200);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp16 vreg set level failed (%d)\n", __func__, rc);
-            return -EIO;
-        }
-
-        rc = vreg_enable(vreg_gp16);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp16 vreg enable failed. (%d)\n",__func__, rc);
-            return -EIO;
-        }
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "1.2V AON Power Supply Enabled \n");
-        printk(KERN_ERR "1.2V AON Supply Enabled \n");
-
-        //Wait 300usec
-        msleep(1);
-
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "1.2V AON Power Supply Enabled \n");
-
-        rc = pm8xxx_gpio_config(wlan_gpios_reset_out[0].gpio_num, &wlan_gpios_reset_out[0].gpio_cfg);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: pmic gpio %d config failed (%d)\n",
-                            __func__, wlan_gpios_reset_out[0].gpio_num, rc);
-            return -EIO;
-        }
-
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "WLAN is out of reset now \n");
-        printk(KERN_ERR "WLAN is out of reset \n");
-
-        /* Wait 500usec */
-        msleep(1);
-
-        /* TODO: Replace the code to enable 1.2V sw and 1.3V sw once we have the API to set these power supplies Pin controllable */
-
-        /* Enable 1.2 switcheable power supply */
-        rc = vreg_set_level(vreg_gp15, 1200);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp15 vreg set level failed (%d)\n", __func__, rc);
-            return -EIO;
-        }
-
-#ifdef WLAN_FEATURE_VOS_POWER_VOTED_SUPPLY
-        rc = vreg_enable(vreg_gp15);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp15 vreg enable failed. (%d)\n",__func__, rc);
-            return -EIO;
-        }
-#else        
-        /* 1.2v switchable supply is following the clk_pwr_req signal */
-        rc = pmapp_vreg_pincntrl_vote(id, PMAPP_VREG_LDO22, PMAPP_CLOCK_ID_A0, VOS_TRUE);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp15 vreg enable failed. (%d)\n",__func__, rc);
-            return -EIO;
-        }
-        vos_sleep(5);
-#endif
-
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "1.2V sw Power Supply is enabled \n");
-        printk(KERN_ERR "1.2V sw is enabled \n");
-
-        /* Enable 1.3 switcheable power supply */
-        rc = pmapp_vreg_level_vote(id, PMAPP_VREG_S2, 1300);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: s2 vreg set level failed (%d)\n", __func__, rc);
-            return -EIO;
-        }
-        VOS_PWR_SLEEP(300);
-
-#ifdef WLAN_FEATURE_VOS_POWER_VOTED_SUPPLY
-        rc = vreg_enable(vreg_s2);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: s2 vreg enable failed. .(%d)\n",__func__, rc);
-            return -EIO;
-        }
-        msleep(1);
-#else        
-        /* 1.3v switchable supply is following the clk_pwr_req signal */
-        rc = pmapp_vreg_pincntrl_vote(id, PMAPP_VREG_S2, PMAPP_CLOCK_ID_A0, VOS_TRUE);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: s2 vreg enable failed. (%d)\n",__func__, rc);
-            return -EIO;
-        }
-        vos_sleep(5);
-#endif
-
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "1.3V sw Power Supply is enabled \n");
-        printk(KERN_ERR "1.3V sw is enabled \n");
-
-    } else {
-
-        /**
-        Assert the external POR to keep the chip in reset state. When the chip is turned
-        on the next time, it won't be detected by the bus driver until we deassert it.
-        This is to work-around the issue where it fails sometimes when turning WIFI off and on
-        though GUI. The theory is that, even though we vote off 1.2V AON, it may still on because
-        it is shared by other components. When the next time to turn on WIFI, polling is turned on
-        first and when librasdioif.ko is loaded, the card is detected right away before wlan driver loads. 
-        The bus driver may have finished configuration of the device. When WLAN driver loads, 
-        it resets the device that causes issues when the bus driver tries to assess the chip later.
-        This setting draws more power after the driver is unloaded.
-
-        The load sequence is
-        1. Enable polling
-        2. insmod librasdioif.ko (if card detected, stop polling)
-        3. insmod libra.ko (reset the chip)
-        4. stop polling
-        **/
-        /* Program GPIO 23 to de-assert (drive 1) external_por_n to prevent chip detection
-           until it is asserted.
-        */
-        rc = pm8xxx_gpio_config(wlan_gpios_reset[0].gpio_num, &wlan_gpios_reset[0].gpio_cfg);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: pmic gpio %d config failed (%d)\n",
-                            __func__, wlan_gpios_reset[0].gpio_num, rc);
-            return -EIO;
-        }
-
-#ifdef WLAN_FEATURE_VOS_POWER_VOTED_SUPPLY
-        /* TODO: Remove the code to disable 1.2V sw and 1.3V sw once we have the API to set these power supplies Pin controllable */
-        printk(KERN_ERR "power down switchable\n");
-        rc = pmapp_vreg_level_vote(id, PMAPP_VREG_S2, 0);
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: s2 vreg set level failed (%d)\n", __func__, rc);
-            return -EIO;
-        }
-        
-        /* 1.3V sw */    
-        rc = vreg_disable(vreg_s2); 
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: s2 vreg disable failed (%d)\n", __func__, rc);
-            return -EIO;
-        }
-
-       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "1.3V sw is disabled \n");
-
-        /* 1.2V sw */
-        rc = vreg_disable(vreg_gp15); 
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp15 vreg disable failed (%d)\n", __func__, rc);
-            return -EIO;
-        }
-
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "1.2V sw is disabled \n");
-#endif //#ifdef WLAN_FEATURE_VOS_POWER_VOTED_SUPPLY
-
-        /* 1.2V AON */
-        rc = vreg_disable(vreg_gp16); 
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp16 vreg disable failed (%d)\n", __func__, rc);
-            return -EIO;
-        }
-
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "1.2V AON is disabled \n");
-
-#ifdef VOLANS_2_0
-        /* Cannot turn off 2.9V due to the PAD issue on Volans */
-
-        /* 2.9V */
-        rc = vreg_disable(vreg_wlan); 
-        if (rc) {
-            VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg disable failed (%d)\n", __func__, rc);
-            return -EIO;
-        }
-
-        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO, "2.9V is disabled \n");
-#endif
-    }
-
-    return rc;
-}
-#endif
-
-#ifdef MSM_PLATFORM_7x27_FFA
-
-#define MPP_4_CHIP_PWD_L 3 //MPP4 is hooked to Deep Sleep Signal 
-
-//Helper routine to power up Libra keypad on the 7x27 FFA
-int vos_chip_power_7x27_keypad( int on )
-{
-   struct vreg *vreg_wlan, *vreg_bt = NULL;
-   int rc = 0;
-
-   vreg_wlan = vreg_get(NULL, "wlan");
-   if (IS_ERR(vreg_wlan)) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg get failed (%ld)",
-         __func__, PTR_ERR(vreg_wlan));
-      return PTR_ERR(vreg_wlan);
-   }
-
-   vreg_bt = vreg_get(NULL, "gp6");
-   if (IS_ERR(vreg_bt)) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: gp6 vreg get failed (%ld)",
-                __func__, PTR_ERR(vreg_bt));
-      return PTR_ERR(vreg_bt);
-   }
-
-   if(on) {
-
-      /* units of mV, steps of 50 mV */
-      rc = vreg_set_level(vreg_bt, 2600);
-      if (rc) {
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: vreg set level failed (%d)",__func__, rc);
-         return -EIO;
-      }
-      rc = vreg_enable(vreg_bt);
-      if (rc) {
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: vreg enable failed (%d)",__func__, rc);
-         return -EIO;
-      }
-
-      //Set TCXO to 1.8v.
-      rc = vreg_set_level(vreg_wlan, 1800);
-      if (rc) {
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: vreg set level failed (%d)", __func__, rc);
-         return -EIO;
-      }
-
-      rc = vreg_enable(vreg_wlan);
-      if (rc) {
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg enable failed (%d)",__func__, rc);
-         return -EIO;
-      }
-
-      msleep(100);
-
-      // Pull MPP4 high to turn on various supply voltages.
-      rc = mpp_config_digital_out(MPP_4_CHIP_PWD_L, 
-         MPP_CFG(MPP_DLOGIC_LVL_MSMP, MPP_DLOGIC_OUT_CTRL_HIGH));
-      if (rc) {
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: MPP_4 pull high failed (%d)",__func__, rc);
-         return -EIO;
-      }
-
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: Enabled power supply for WLAN", __func__);
- 
-      msleep(500);
-   }
-   else 
-   {
-
-       // Pull MPP4 low to place the chip in reset.
-       rc = mpp_config_digital_out(MPP_4_CHIP_PWD_L, 
-          MPP_CFG(MPP_DLOGIC_LVL_MSMP, MPP_DLOGIC_OUT_CTRL_LOW));
-       if (rc) {
-          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: MPP_4 pull low failed (%d)",__func__, rc);
-          return -EIO;
-       }
-
-       msleep(100);
-
-      /* Turn off 2.6V */
-      rc = vreg_disable(vreg_bt);
-      if (rc) {
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: vreg disable failed (%d)",__func__, rc);
-         return -EIO;
-      }
-
-      /* Turn off 1.8V */
-      rc = vreg_disable(vreg_wlan);
-      if (rc) {
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg disable failed (%d)",__func__, rc);
-         return -EIO;
-      }
-
-      msleep(100);
-
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: Disabled power supply for WLAN", __func__);
-   }
-
-   return 0;
-}
-#endif
-
 /*===========================================================================
 
                     FUNCTION PROTOTYPES
@@ -549,27 +148,6 @@
   v_PVOID_t             user_data
 )
 {
-
-#ifdef MSM_PLATFORM_8660
-   if(vos_chip_power_qrf8615(CHIP_POWER_ON))
-      return VOS_STATUS_E_FAILURE;
-#endif
-
-#ifdef MSM_PLATFORM_7x30
-   if(vos_chip_power_qrf8600(CHIP_POWER_ON))
-      return VOS_STATUS_E_FAILURE;
-#endif
-
-#ifdef MSM_PLATFORM_7x27_FFA
-   if(vos_chip_power_7x27_keypad(CHIP_POWER_ON))
-      return VOS_STATUS_E_FAILURE;
-#endif
-
-#ifdef MSM_PLATFORM_7x27A
-   if(chip_power_qrf6285(CHIP_POWER_ON))
-      return VOS_STATUS_E_FAILURE;
-#endif
-
    return VOS_STATUS_SUCCESS;
 }
 
@@ -604,29 +182,6 @@
   v_PVOID_t             user_data
 )
 {
-
-#ifdef MSM_PLATFORM_8660
-   if(vos_chip_power_qrf8615(CHIP_POWER_OFF))
-      return VOS_STATUS_E_FAILURE;
-#endif
-
-#ifdef MSM_PLATFORM_7x30
-///#ifndef VOS_PWR_WIFI_ON_OFF_HACK
-   if(vos_chip_power_qrf8600(CHIP_POWER_OFF))
-      return VOS_STATUS_E_FAILURE;
-///#endif
-#endif
-
-#ifdef MSM_PLATFORM_7x27_FFA
-   if(vos_chip_power_7x27_keypad(CHIP_POWER_OFF))
-      return VOS_STATUS_E_FAILURE;
-#endif
-
-#ifdef MSM_PLATFORM_7x27A
-   if(chip_power_qrf6285(CHIP_POWER_OFF))
-      return VOS_STATUS_E_FAILURE;
-#endif
-
    return VOS_STATUS_SUCCESS;
 }
 
@@ -783,29 +338,6 @@
   v_PVOID_t             user_data
 )
 {
-#ifdef FIXME_VOLANS
-#ifdef MSM_PLATFORM_7x27_FFA
-   int rc = mpp_config_digital_out(MPP_4_CHIP_PWD_L, 
-      MPP_CFG(MPP_DLOGIC_LVL_MSMP, MPP_DLOGIC_OUT_CTRL_LOW));
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: Failed to pull high MPP_4_CHIP_PWD_L (%d)",
-                __func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-#endif
-
-#ifdef MSM_PLATFORM_7x30
-   // Configure GPIO 23 for Deep Sleep
-   int rc = pm8xxx_gpio_config(wlan_gpios_reset_out[0].gpio_num, &wlan_gpios_reset_out[0].gpio_cfg);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: pmic GPIO %d config failed (%d)",
-         __func__, wlan_gpios_reset_out[0].gpio_num, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-#endif
-#endif //FIXME_VOLANS
-
    return VOS_STATUS_SUCCESS;
 }
 
@@ -842,29 +374,6 @@
   v_PVOID_t             user_data
 )
 {
-#ifdef FIXME_VOLANS
-#ifdef MSM_PLATFORM_7x27_FFA
-   int rc = mpp_config_digital_out(MPP_4_CHIP_PWD_L, 
-      MPP_CFG(MPP_DLOGIC_LVL_MSMP, MPP_DLOGIC_OUT_CTRL_HIGH));
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: Failed to pull high MPP_4_CHIP_PWD_L (%d)",
-         __func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-
-#endif
-
-#ifdef MSM_PLATFORM_7x30
-   // Configure GPIO 23 for Deep Sleep
-   int rc = pm8xxx_gpio_config(wlan_gpios_reset[2].gpio_num, &wlan_gpios_reset[2].gpio_cfg);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: pmic GPIO %d config failed (%d)",
-                __func__, wlan_gpios_reset[2].gpio_num, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-#endif
-#endif //FIXME_VOLANS
    return VOS_STATUS_SUCCESS;
 }
 
@@ -900,57 +409,6 @@
    v_PVOID_t             user_data
 )
 {
-#ifdef FIXME_VOLANS
-#ifdef MSM_PLATFORM_7x27_FFA
-   struct vreg *vreg_wlan;
-   int rc;
-
-   vreg_wlan = vreg_get(NULL, "wlan");
-   if (IS_ERR(vreg_wlan)) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg get failed (%ld)",
-            __func__, PTR_ERR(vreg_wlan));
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = vreg_set_level(vreg_wlan, 1800);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg set level failed (%d)",
-            __func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = vreg_enable(vreg_wlan);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg enable failed (%d)",
-            __func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   msleep(500);
-
-   rc = vreg_set_level(vreg_wlan, 2600);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: wlan vreg set level failed (%d)",
-            __func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   msleep(500);
-
-   *status = VOS_CALL_SYNC;
-
-#endif
-
-#ifdef MSM_PLATFORM_7x30
-   VOS_STATUS vosStatus;
-   vos_call_status_type callType;
-
-   vosStatus = vos_chipVoteOnBBAnalogSupply(&callType, NULL, NULL);
-   VOS_ASSERT( VOS_IS_STATUS_SUCCESS( vosStatus ) );
-   msleep(500);
-
-#endif
-#endif //FIXME_VOLANS
    return VOS_STATUS_SUCCESS;
 }
 
@@ -985,58 +443,6 @@
   v_PVOID_t             user_data
 )
 {
-#ifdef FIXME_VOLANS
-#ifdef MSM_PLATFORM_7x30
-   int rc;
-   struct vreg *vreg_s2 = NULL;
-   struct vreg *vreg_s4 = NULL;
-
-   //1.3v RF;
-   vreg_s2 = vreg_get(NULL, "s2");
-   if (IS_ERR(vreg_s2)) {
-      printk(KERN_ERR "%s: s2 vreg get failed (%ld)\n",
-         __func__, PTR_ERR(vreg_s2));
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   //2.2v RF
-   vreg_s4 = vreg_get(NULL, "s4");
-   if (IS_ERR(vreg_s4)) {
-      printk(KERN_ERR "%s: s4 vreg get failed (%ld)\n",
-         __func__, PTR_ERR(vreg_s4));
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = pmapp_vreg_level_vote(id, PMAPP_VREG_S2, 1300);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL, "%s: s2 vreg vote "
-          "level failed (%d)",__func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = vreg_enable(vreg_s2);
-   if (rc) {
-      printk(KERN_ERR "%s: s2 vreg enable failed (%d)\n", __func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = pmapp_vreg_level_vote(id, PMAPP_VREG_S4, 2200);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL, "%s: s4 vreg vote "
-          "level failed (%d)",__func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = vreg_enable(vreg_s4);
-   if (rc) {
-      printk(KERN_ERR "%s: s4 vreg enable failed (%d)\n", __func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   return VOS_STATUS_SUCCESS;
-
-#endif //MSM_PLATFORM_7x30
-#endif //FIXME_VOLANS
    return VOS_STATUS_SUCCESS;
 }
 
@@ -1074,55 +480,6 @@
   v_PVOID_t             user_data
 )
 {
-#ifdef FIXME_VOLANS
-#ifdef MSM_PLATFORM_7x30
-
-   int rc;
-   struct vreg *vreg_s2;
-   struct vreg *vreg_s4;
-
-   //1.3v RF
-   vreg_s2 = vreg_get(NULL, "s2");
-   if (IS_ERR(vreg_s2)) {
-      printk(KERN_ERR "%s: s2 vreg get failed (%ld)\n",
-         __func__, PTR_ERR(vreg_s2));
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   //2.2v RF
-   vreg_s4 = vreg_get(NULL, "s4");
-   if (IS_ERR(vreg_s4)) {
-      printk(KERN_ERR "%s: s4 vreg get failed (%ld)\n",
-         __func__, PTR_ERR(vreg_s4));
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = pmapp_vreg_level_vote(id, PMAPP_VREG_S2, 0);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN, "%s: s2 vreg vote "
-          "level failed (%d)",__func__, rc);
-   }
-
-   rc = vreg_disable(vreg_s2);
-   if (rc) {
-      printk(KERN_ERR "%s: s2 vreg disable failed (%d)\n", __func__, rc);
-   }
-
-   rc = pmapp_vreg_level_vote(id, PMAPP_VREG_S4, 0);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN, "%s: s4 vreg vote "
-          "level failed (%d)",__func__, rc);
-   }
-
-   rc = vreg_disable(vreg_s4); 
-   if (rc) {
-      printk(KERN_ERR "%s: s4 vreg disable failed (%d)\n", __func__, rc);
-   }
-
-   return VOS_STATUS_SUCCESS;
-
-#endif //MSM_PLATFORM_7x30
-#endif //FIXME_VOLANS
    return VOS_STATUS_SUCCESS;
 }
 
@@ -1158,34 +515,6 @@
   v_PVOID_t             user_data
 )
 {
-#ifdef FIXME_VOLANS
-#ifdef MSM_PLATFORM_7x30
-   struct vreg *vreg_wlan2 = NULL;
-   int rc;
-
-   //2.5v Analog from LDO19
-   vreg_wlan2 = vreg_get(NULL, "wlan2");
-   if (IS_ERR(vreg_wlan2)) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL, "%s: wlan2 vreg get "
-          "failed (%ld)", __func__, PTR_ERR(vreg_wlan2));
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = vreg_set_level(vreg_wlan2, 2500);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL, "%s: wlan2 vreg set "
-          "level failed (%d)",__func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = vreg_enable(vreg_wlan2);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL, "%s: wlan2 vreg enable "
-          "failed (%d)", __func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-#endif
-#endif //FIXME_VOLANS
    return VOS_STATUS_SUCCESS;
 }
 
@@ -1221,27 +550,6 @@
   v_PVOID_t             user_data
 )
 {
-#ifdef FIXME_VOLANS
-#ifdef MSM_PLATFORM_7x30
-   struct vreg *vreg_wlan2 = NULL;
-   int rc;
-
-   //2.5v Analog from LDO19
-   vreg_wlan2 = vreg_get(NULL, "wlan2");
-   if (IS_ERR(vreg_wlan2)) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL, "%s: wlan2 vreg get "
-          "failed (%ld)", __func__, PTR_ERR(vreg_wlan2));
-      return VOS_STATUS_E_FAILURE;
-   }
-
-   rc = vreg_disable(vreg_wlan2);
-   if (rc) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL, "%s: wlan2 vreg disable "
-          "failed (%d)", __func__, rc);
-      return VOS_STATUS_E_FAILURE;
-   }
-#endif
-#endif //FIXME_VOLANS
    return VOS_STATUS_SUCCESS;
 }
 
@@ -1392,20 +700,5 @@
   v_U32_t               freq
 )
 {
-
-
-#ifdef MSM_PLATFORM_8660
-    if(freq == VOS_NV_FREQUENCY_FOR_1_3V_SUPPLY_3P2MH)
-        {
-            if(qcomwlan_freq_change_1p3v_supply(RPM_VREG_FREQ_3p20))
-                return VOS_STATUS_E_FAILURE;
-        }
-    else
-        {
-            if(qcomwlan_freq_change_1p3v_supply(RPM_VREG_FREQ_1p60))
-                return VOS_STATUS_E_FAILURE;
-        }
-#endif
-
     return VOS_STATUS_SUCCESS;
 }
diff --git a/CORE/VOSS/src/vos_sched.c b/CORE/VOSS/src/vos_sched.c
index 19fe723..2cf9d70 100644
--- a/CORE/VOSS/src/vos_sched.c
+++ b/CORE/VOSS/src/vos_sched.c
@@ -1160,7 +1160,7 @@
         /* Rx Thread Suspended */
         complete(&pHddCtx->rx_sus_event_var);
 
-        init_completion(&pSchedContext->ResumeRxEvent);
+        INIT_COMPLETION(pSchedContext->ResumeRxEvent);
         spin_unlock(&pSchedContext->RxThreadLock);
 
         /* Wait for Resume Indication */
@@ -1825,6 +1825,7 @@
 
     /* Set the flags so that all future CMD53 and Wext commands get blocked right away */
     vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
+    vos_set_reinit_in_progress(VOS_MODULE_ID_VOSS, FALSE);
     pHddCtx->isLogpInProgress = TRUE;
 
     /* Release the lock here */
diff --git a/CORE/VOSS/src/vos_sched.h b/CORE/VOSS/src/vos_sched.h
index 9a29eee..e05f859 100644
--- a/CORE/VOSS/src/vos_sched.h
+++ b/CORE/VOSS/src/vos_sched.h
@@ -25,6 +25,7 @@
  * to the Linux Foundation.
  */
 
+
 #if !defined( __VOS_SCHED_H )
 #define __VOS_SCHED_H
 
@@ -321,7 +322,7 @@
 
    /* SAP Context */
    v_VOID_t           *pSAPContext;
-
+   
    vos_event_t         ProbeEvent;
 
    volatile v_U8_t     isLogpInProgress;
@@ -333,10 +334,10 @@
 
 #ifdef QCA_WIFI_2_0
 #ifndef QCA_WIFI_ISOC
-   v_VOID_t		*pHIFContext;
+   v_VOID_t        *pHIFContext;
 #endif
 
-   v_VOID_t		*htc_ctx;
+   v_VOID_t        *htc_ctx;
 
    /*
     * adf_ctx will be used by adf
@@ -345,17 +346,20 @@
     */
    adf_os_device_t adf_ctx;
 
-   v_VOID_t		*pdev_txrx_ctx;
+   v_VOID_t        *pdev_txrx_ctx;
 
    /* Configuration handle used to get system configuration */
-   v_VOID_t	*cfg_ctx;
+   v_VOID_t    *cfg_ctx;
 #else
    /* VOS Packet Context */
-   vos_pkt_context_t	vosPacket;
+   vos_pkt_context_t    vosPacket;
 #endif	/* QCA_WIFI_2_0 */
 
    volatile v_U8_t    isLoadUnloadInProgress;
 
+   /* SSR re-init in progress */
+   volatile v_U8_t     isReInitInProgress;
+
 } VosContextType, *pVosContextType;
 
 
diff --git a/CORE/VOSS/src/vos_timer.c b/CORE/VOSS/src/vos_timer.c
index ec3814e..d3712ae 100644
--- a/CORE/VOSS/src/vos_timer.c
+++ b/CORE/VOSS/src/vos_timer.c
@@ -94,30 +94,27 @@
 
 
 /*----------------------------------------------------------------------------
-  
-  \brief  vos_linux_timer_callback() - internal vos entry point which is 
-          called when the timer interval expires 
 
-  This function in turn calls the vOS client callback and changes the 
-  state of the timer from running (ACTIVE) to expired (INIT). 
-  
-  
-  \param uTimerID - return value of the timeSetEvent() from the 
-      vos_timer_start() API which 
+  \brief  vos_linux_timer_callback() - internal vos entry point which is
+          called when the timer interval expires
 
-  \param dwUser - this is supplied by the fourth parameter of the timeSetEvent()
-      which is the timer structure being passed as the userData
+  This function in turn calls the vOS client callback and changes the
+  state of the timer from running (ACTIVE) to expired (INIT).
 
-  \param uMsg - Reserved / Not Used
 
-  \param dw1  - Reserved / Not Used
+  \param data - pointer to the timer control block which describes the
+                timer that expired
 
-  \param dw2  - Reserved / Not Used
-  
   \return  nothing
+
+  Note: function signature is defined by the Linux kernel.  The fact
+  that the argument is "unsigned long" instead of "void *" is
+  unfortunately imposed upon us.  But we can safely pass a pointer via
+  this parameter for LP32 and LP64 architectures.
+
   --------------------------------------------------------------------------*/
 
-static void vos_linux_timer_callback ( v_U32_t data ) 
+static void vos_linux_timer_callback (unsigned long data)
 {
    vos_timer_t *timer = ( vos_timer_t *)data; 
    vos_msg_t msg;
@@ -701,9 +698,12 @@
    // Check if timer refers to an uninitialized object
    if ( LINUX_TIMER_COOKIE != timer->platformInfo.cookie )
    {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, 
-                "%s: Cannot start uninitialized timer",__func__);
-      VOS_ASSERT(0);
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+          "%s: Cannot start uninitialized timer",__func__);
+      if ( LINUX_INVALID_TIMER_COOKIE != timer->platformInfo.cookie )
+      {
+         VOS_ASSERT(0);
+      }
       return VOS_STATUS_E_INVAL;
    }
 
@@ -768,10 +768,6 @@
     
   \return VOS_STATUS_SUCCESS - timer was successfully stopped.
   
-          VOS_STATUS_E_EMPTY - The implementation has detected an attempt 
-          to stop a timer that has not been started or has already 
-          expired.
-
           VOS_STATUS_E_INVAL - The value specified by timer is invalid.
           
           VOS_STATUS_E_FAULT  - timer is an invalid pointer.     
@@ -798,8 +794,11 @@
    if ( LINUX_TIMER_COOKIE != timer->platformInfo.cookie )
    {
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, 
-                "%s: Cannot stop uninitialized timer",__func__);
-      VOS_ASSERT(0);
+          "%s: Cannot stop uninitialized timer",__func__);
+      if ( LINUX_INVALID_TIMER_COOKIE != timer->platformInfo.cookie )
+      {
+         VOS_ASSERT(0);
+      }
       return VOS_STATUS_E_INVAL;
    }
       
@@ -812,7 +811,7 @@
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
                 "%s: Cannot stop timer in state = %d",
                 __func__, timer->state);
-      return VOS_STATUS_E_FAULT;
+      return VOS_STATUS_SUCCESS;
    }
    
    timer->state = VOS_TIMER_STATE_STOPPED;
diff --git a/CORE/VOSS/src/vos_trace.c b/CORE/VOSS/src/vos_trace.c
index ea5e30b..2f3481c 100644
--- a/CORE/VOSS/src/vos_trace.c
+++ b/CORE/VOSS/src/vos_trace.c
@@ -108,9 +108,10 @@
    [VOS_MODULE_ID_VOSS]       = { VOS_DEFAULT_TRACE_LEVEL, "VOS" },
    [VOS_MODULE_ID_SAP]        = { VOS_DEFAULT_TRACE_LEVEL, "SAP" },
    [VOS_MODULE_ID_HDD_SOFTAP] = { VOS_DEFAULT_TRACE_LEVEL, "HSP" },
+   [VOS_MODULE_ID_PMC]        = { VOS_DEFAULT_TRACE_LEVEL, "PMC" },
 #if defined (QCA_WIFI_2_0) && \
     defined (QCA_WIFI_ISOC)
-  /// Message Queue ID for messages bound for HTC
+   /* Message Queue ID for messages bound for HTC*/
    [VOS_MODULE_ID_HTC]        = { VOS_DEFAULT_TRACE_LEVEL, "HTC" },
 #endif
 };
@@ -210,6 +211,72 @@
     va_end( val );
 }
 
+#ifdef WCONN_TRACE_KMSG_LOG_BUFF
+
+/* 64k::  size should be power of 2 to
+   get serial 'wconnstrContBuffIdx'  index */
+#define KMSG_WCONN_TRACE_LOG_MAX    65536
+
+static char wconnStrLogBuff[KMSG_WCONN_TRACE_LOG_MAX];
+static unsigned int wconnstrContBuffIdx;
+static void kmsgwconnstrlogchar(char c)
+{
+   wconnStrLogBuff[wconnstrContBuffIdx & (KMSG_WCONN_TRACE_LOG_MAX-1)] = c;
+   wconnstrContBuffIdx++;
+}
+
+/******************************************************************************
+ * function:: kmsgwconnBuffWrite()
+ * wconnlogstrRead -> Recieved the string(log msg) from vos_trace_msg()
+ * 1) Get the timetick, convert into HEX and store in wconnStrLogBuff[]
+ * 2) And 'pwconnlogstr' would be copied into wconnStrLogBuff[] character by
+      character
+ * 3) wconnStrLogBuff[] is been treated as circular buffer.
+ *
+ * Note:: In T32 simulator the content of wconnStrLogBuff[] will appear as
+          continuous string please use logparse.cmm file to extract into
+          readable format
+ *******************************************************************************/
+
+void kmsgwconnBuffWrite(const char *wconnlogstrRead)
+{
+   const char *pwconnlogstr = wconnlogstrRead;
+   static const char num[16] = {'0','1','2','3','4','5','6','7','8','9','A',
+                                'B','C','D','E','F'};
+   unsigned int timetick;
+   int bits; /*timetick for now returns 32 bit number*/
+
+   timetick = ( jiffies_to_msecs(jiffies) / 10 );
+   bits = sizeof(timetick) * 8/*number of bits in a byte*/;
+
+   kmsgwconnstrlogchar('[');
+
+   for ( ; bits > 0; bits -= 4 )
+      kmsgwconnstrlogchar( num[((timetick & (0xF << (bits-4)))>>(bits-4))] );
+
+   kmsgwconnstrlogchar(']');
+
+   for ( ; *pwconnlogstr; pwconnlogstr++)
+   {
+      kmsgwconnstrlogchar(*pwconnlogstr);
+   }
+   kmsgwconnstrlogchar('\n');/*log \n*/
+}
+
+spinlock_t gVosSpinLock;
+
+void vos_wconn_trace_init(void)
+{
+    spin_lock_init(&gVosSpinLock);
+}
+
+void vos_wconn_trace_exit(void)
+{
+    /* does nothing */
+}
+
+#endif
+
 #ifdef VOS_ENABLE_TRACING
 
 /*----------------------------------------------------------------------------
@@ -239,6 +306,7 @@
 {
    char strBuffer[VOS_TRACE_BUFFER_SIZE];
    int n;
+   unsigned long irq_flag;
 
    // Print the trace message when the desired level bit is set in the module
    // tracel level mask.
@@ -263,9 +331,15 @@
       if ((n >= 0) && (n < VOS_TRACE_BUFFER_SIZE))
       {
          vsnprintf(strBuffer + n, VOS_TRACE_BUFFER_SIZE - n, strFormat, val );
+
+#ifdef WCONN_TRACE_KMSG_LOG_BUFF
+         spin_lock_irqsave (&gVosSpinLock, irq_flag);
+         kmsgwconnBuffWrite(strBuffer);
+         spin_unlock_irqrestore (&gVosSpinLock, irq_flag);
+#endif
          pr_err("%s\n", strBuffer);
       }
-      va_end( val);
+     va_end(val);
    }
 }
 
@@ -291,4 +365,55 @@
    }
 }
 
+/*----------------------------------------------------------------------------
+
+  \brief vos_trace_hex_dump() - Externally called hex dump function
+
+  Checks the level of severity and accordingly prints the trace messages
+
+  \param module - module identifier.   A member of the VOS_MODULE_ID
+         enumeration that identifies the module issuing the trace message.
+
+  \param level - trace level.   A member of the VOS_TRACE_LEVEL
+         enumeration indicating the severity of the condition causing the
+         trace message to be issued.   More severe conditions are more
+         likely to be logged.
+
+  \param data - .  The base address of the buffer to be logged.
+
+  \param buf_len - .  The size of the buffer to be logged.
+
+  \return  nothing
+
+  \sa
+  --------------------------------------------------------------------------*/
+void vos_trace_hex_dump( VOS_MODULE_ID module, VOS_TRACE_LEVEL level,
+                                void *data, int buf_len )
+{
+    char *buf = (char *)data;
+    int i;
+    for (i=0; (i+7)<buf_len; i+=8)
+    {
+        vos_trace_msg( module, level,
+                 "%02x %02x %02x %02x %02x %02x %02x %02x \n",
+                 buf[i],
+                 buf[i+1],
+                 buf[i+2],
+                 buf[i+3],
+                 buf[i+4],
+                 buf[i+5],
+                 buf[i+6],
+                 buf[i+7]);
+    }
+
+    // Dump the bytes in the last line
+    for (; i < buf_len; i++)
+    {
+        vos_trace_msg( module, level, "%02x ", buf[i]);
+        if ((i+1) == buf_len)
+            vos_trace_msg( module, level, "\n");
+    }
+
+}
+
 #endif
diff --git a/CORE/WDA/inc/legacy/halMsgApi.h b/CORE/WDA/inc/legacy/halMsgApi.h
index cfd4a5a..385a7f4 100644
--- a/CORE/WDA/inc/legacy/halMsgApi.h
+++ b/CORE/WDA/inc/legacy/halMsgApi.h
@@ -264,8 +264,8 @@
 
     /* The unicast encryption type in the association */
     tANI_U32 encryptType;
-
-    /*The DPU signatures will be sent eventually to TL to help it determine the
+    
+    /*The DPU signatures will be sent eventually to TL to help it determine the 
       association to which a packet belongs to*/
     /*Unicast DPU index*/
     tANI_U8     ucUcastSig;
@@ -273,7 +273,7 @@
     /*Broadcast DPU index*/
     tANI_U8     ucBcastSig;
 
-    tANI_U8     sessionId; //PE session id for PE<->HAL interface
+    tANI_U8     sessionId; //PE session id for PE<->HAL interface 
     // HAL just sends back what it receives.
 
     /*if this is a P2P Capable Sta*/
@@ -337,7 +337,7 @@
     tANI_U16 assocId;
     eHalStatus  status;    // Status of SIR_HAL_DELETE_STA_REQ is reported here
     tANI_U8 respReqd;
-    tANI_U8     sessionId; // PE session id for PE<->HAL interface
+    tANI_U8     sessionId; // PE session id for PE<->HAL interface 
     // PE session id now added to all HAL<->PE transacations
     // HAL sends it back unmodified.
     tANI_U8 smesessionId;
@@ -364,7 +364,7 @@
      * via response message. HAL does not read them.
      */
     eHalStatus  status;    // status of SIR_HAL_SET_STAKEY_REQ is reported here
-    tANI_U8     sessionId; // PE session id for PE<->HAL interface
+    tANI_U8     sessionId; // PE session id for PE<->HAL interface 
 
     // PE session id now added to all HAL<->PE transacations
     // HAL sends back response with no modification
@@ -484,7 +484,7 @@
     //HAL will send the response message to LIM only when this flag is set.
     //LIM will set this flag, whereas DVT will not set this flag.
     tANI_U8 respReqd;
-    tANI_U8     sessionId; // PE session id for PE<->HAL interface
+    tANI_U8     sessionId; // PE session id for PE<->HAL interface 
     // PE session id now added to all HAL<->PE transacations
     // HAL Sends the sessionId unmodified.
 
@@ -499,7 +499,7 @@
 #endif
 
     tANI_U8   ucMaxProbeRespRetryLimit;  //probe Response Max retries
-    tANI_U8   bHiddenSSIDEn;             //To Enable Hidden ssid.
+    tANI_U8   bHiddenSSIDEn;             //To Enable Hidden ssid.      
     tANI_U8   bProxyProbeRespEn;         //To Enable Disable FW Proxy Probe Resp
     tANI_U8   halPersona;         //Persona for the BSS can be STA,AP,GO,CLIENT value same as tVOS_CON_MODE
 
@@ -509,7 +509,9 @@
     tANI_U8 vhtCapable;
     tANI_U8    vhtTxChannelWidthSet;
 #endif
-    tANI_U8 reassocReq;		// Set only during roaming reassociation
+    tANI_U8 reassocReq;    // Set only during roaming reassociation
+    tANI_U16 chainMask;
+    tANI_U16 smpsMode;
 } tAddBssParams, * tpAddBssParams;
 
 typedef struct
@@ -520,7 +522,7 @@
     //HAL will send the response message to LIM only when this flag is set.
     //LIM will set this flag, whereas DVT will not set this flag.
     tANI_U8 respReqd;
-    tANI_U8     sessionId; // PE session id for PE<->HAL interface
+    tANI_U8     sessionId; // PE session id for PE<->HAL interface 
                            // HAL sends it back unmodified.
     tSirMacAddr bssid; // Will be removed for PE-HAL integration
     tANI_U8 smesessionId;
@@ -528,7 +530,7 @@
 
 //
 // UAPSD AC mask: 1b per AC
-// LSB 4 bits for delivery enabled setting. msb 4 bits for trigger enabled settings.
+// LSB 4 bits for delivery enabled setting. msb 4 bits for trigger enabled settings. 
 // Encoded as follows:
 // b7 b6 b5 b4 b3 b2 b1 b0
 // BE  BK  VI  VO  BE BK VI VO
@@ -536,8 +538,8 @@
 typedef struct
 {
     tANI_U8 staIdx;
-    tANI_U8 uapsdACMask;
-    tANI_U8 maxSpLen;
+    tANI_U8 uapsdACMask; 
+    tANI_U8 maxSpLen;    
 } tUpdateUapsdParams, * tpUpdateUapsdParams;
 
 typedef struct sSirScanEntry
@@ -593,6 +595,13 @@
    HAL_DEL_STA_REASON_CODE_UNKNOWN_A2 = 0x4
 }tDelStaReasonCode;
 
+typedef enum  eSmpsModeValue{
+   STATIC_SMPS_MODE = 0x0,
+   DYNAMIC_SMPS_MODE = 0x1,
+   SMPS_MODE_RESERVED = 0x2,
+   SMPS_MODE_DISABLED = 0x3
+}tSmpsModeValue;
+
 //
 // Msg header is used from tSirMsgQ
 // Msg Type = SIR_LIM_DELETE_STA_CONTEXT_IND
@@ -600,10 +609,10 @@
 typedef struct {
     tANI_U16    assocId;
     tANI_U16    staId;
-    tSirMacAddr bssId; // TO SUPPORT BT-AMP
+    tSirMacAddr bssId; // TO SUPPORT BT-AMP    
                        // HAL copies bssid from the sta table.
-    tSirMacAddr addr2;        //
-    tANI_U16    reasonCode;   // To unify the keepalive / unknown A2 / tim-based disa
+    tSirMacAddr addr2;        //  
+    tANI_U16    reasonCode;   // To unify the keepalive / unknown A2 / tim-based disa                                                                                                 
 } tDeleteStaContext, * tpDeleteStaContext;
 
 
@@ -696,7 +705,7 @@
 
 } tFinishScanParams, * tpFinishScanParams;
 
-#ifdef FEATURE_OEM_DATA_SUPPORT
+#ifdef FEATURE_OEM_DATA_SUPPORT 
 
 #ifndef OEM_DATA_REQ_SIZE
 #ifdef QCA_WIFI_2_0
@@ -720,7 +729,7 @@
     tANI_U8              oemDataReq[OEM_DATA_REQ_SIZE];
 } tStartOemDataReq, *tpStartOemDataReq;
 
-typedef struct
+typedef struct 
 {
     tANI_U8             oemDataRsp[OEM_DATA_RSP_SIZE];
 } tStartOemDataRsp, *tpStartOemDataRsp;
@@ -761,7 +770,7 @@
 
 typedef struct sSendProbeRespParams {
     tSirMacAddr bssId;
-    tANI_U8      *pProbeRespTemplate;
+    tANI_U8      *pProbeRespTemplate; 
     tANI_U32     probeRespTemplateLen;
     tANI_U32     ucProxyProbeReqValidIEBmap[8];
 } tSendProbeRespParams, * tpSendProbeRespParams;
@@ -782,7 +791,7 @@
      * via response message. HAL does not read them.
      */
     eHalStatus  status;     // status of SIR_HAL_SET_BSSKEY_REQ is reported here
-    tANI_U8     sessionId;  // PE session id for PE<->HAL interface
+    tANI_U8     sessionId;  // PE session id for PE<->HAL interface 
                             // HAL sends this unmodified in the response
 } tSetBssKeyParams, *tpSetBssKeyParams;
 
@@ -799,10 +808,10 @@
      * Following parameter is for returning status
      * via response message. HAL does not read them.
      */
-    eHalStatus  status;     // return status of SIR_HAL_REMOVE_STAKEY_REQ
-    tANI_U8     sessionId;  // PE session id for PE<->HAL interface
-                            //  HAL Sends back the PE session
-                            //  id unmodified
+    eHalStatus  status;     // return status of SIR_HAL_REMOVE_STAKEY_REQ 
+    tANI_U8     sessionId;  // PE session id for PE<->HAL interface 
+                            //  HAL Sends back the PE session 
+                            //  id unmodified 
 } tRemoveStaKeyParams, *tpRemoveStaKeyParams;
 
 /*
@@ -818,10 +827,10 @@
      * Following parameter is for returning status
      * via response message. HAL does not read them.
      */
-    eHalStatus  status;    // return status of SIR_HAL_REMOVE_BSSKEY_REQ
-    tANI_U8     sessionId; // PE session id for PE<->HAL interface
-                           //  HAL Sends back the PE session
-                           //  id unmodified
+    eHalStatus  status;    // return status of SIR_HAL_REMOVE_BSSKEY_REQ 
+    tANI_U8     sessionId; // PE session id for PE<->HAL interface 
+                           //  HAL Sends back the PE session 
+                           //  id unmodified 
 } tRemoveBssKeyParams, *tpRemoveBssKeyParams;
 
 typedef struct
@@ -890,7 +899,7 @@
 }tUpdateBeaconParams, *tpUpdateBeaconParams;
 
 #ifdef WLAN_FEATURE_11AC
-typedef struct
+typedef struct 
 {
    tANI_U16   opMode;
    tANI_U16  staId;
@@ -964,7 +973,7 @@
 typedef struct
 {
     tANI_U8 channelNumber;
-#ifndef WLAN_FEATURE_VOWIFI
+#ifndef WLAN_FEATURE_VOWIFI    
     tANI_U8 localPowerConstraint;
 #endif /* WLAN_FEATURE_VOWIFI  */
     ePhyChanBondState secondaryChannelOffset;
@@ -975,7 +984,7 @@
 #endif
     tSirMacAddr selfStaMacAddr;
                         //the request has power constraints, this should be applied only to that session
-    /* VO Wifi comment: BSSID is needed to identify which session issued this request. As the
+    /* VO Wifi comment: BSSID is needed to identify which session issued this request. As the 
        request has power constraints, this should be applied only to that session */
     /* V IMP: Keep bssId field at the end of this msg. It is used to mantain backward compatbility
      * by way of ignoring if using new host/old FW or old host/new FW since it is at the end of this struct
@@ -984,6 +993,11 @@
 
     eHalStatus status;
 
+    tANI_U16 chainMask;
+
+    tANI_U16 smpsMode;
+
+
 }tSwitchChannelParams, *tpSwitchChannelParams;
 
 typedef struct CSAOffloadParams {
@@ -1027,8 +1041,7 @@
   tANI_U16 tspecIdx; //TSPEC identifier uniquely identifying a TSPEC for a STA in a BSS
   tSirMacAddr bssId; //TO SUPPORT BT-AMP
   tANI_U8 sessionId;
-  tANI_U8 userPrio; //TSPEC identifier uniquely identifying a TSPEC for a STA in a BSS
-
+  tANI_U8 userPrio;
 } tDelTsParams, *tpDelTsParams;
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -1042,7 +1055,7 @@
   tANI_U16 tspecIdx; //TSPEC handler uniquely identifying a TSPEC for a STA in a BSS
   tSirMacTspecIE   tspec[HAL_QOS_NUM_AC_MAX];
   eHalStatus       status[HAL_QOS_NUM_AC_MAX];
-  tANI_U8          sessionId;          //PE session id for PE<->HAL interface
+  tANI_U8          sessionId;          //PE session id for PE<->HAL interface 
 }tAggrAddTsParams, *tpAggrAddTsParams;
 
 #endif /* WLAN_FEATURE_VOWIFI_11R */
@@ -1125,9 +1138,9 @@
 
     // Indicating to HAL whether a response message is required.
     tANI_U8 respReqd;
-    tANI_U8    sessionId; // PE session id for PE<->HAL interface
-                          //  HAL Sends back the PE session
-                          //  id unmodified
+    tANI_U8    sessionId; // PE session id for PE<->HAL interface 
+                          //  HAL Sends back the PE session 
+                          //  id unmodified 
 
 } tAddBAParams, * tpAddBAParams;
 
@@ -1244,7 +1257,7 @@
 
     tANI_U32 reasonCode;
 
-    tSirMacAddr  bssId; // TO SUPPORT BT-AMP
+    tSirMacAddr  bssId; // TO SUPPORT BT-AMP    
                         // HAL copies the sta bssid to this.
 } tBADeleteParams, * tpBADeleteParams;
 
@@ -1255,10 +1268,19 @@
     tANI_U16 baCandidateCnt;
     //baCandidateCnt is followed by BA Candidate List ( tAddBaCandidate)
 
-    tSirMacAddr  bssId; // TO SUPPORT BT-AMP
+    tSirMacAddr  bssId; // TO SUPPORT BT-AMP    
 } tBaActivityInd, * tpBaActivityInd;
 
 
+// Mesg Type = SIR_LIM_IBSS_PEER_INACTIVITY_IND
+typedef struct sIbssPeerInactivityInd
+{
+   tANI_U8     bssIdx;
+   tANI_U8     staIdx;
+   tSirMacAddr staAddr;
+}tIbssPeerInactivityInd, *tpIbssPeerInactivityInd;
+
+
 typedef struct tHalIndCB
 {
 
@@ -1329,7 +1351,7 @@
 //
 typedef struct sMaxTxPowerParams
 {
-    tSirMacAddr bssId;  // BSSID is needed to identify which session issued this request. As
+    tSirMacAddr bssId;  // BSSID is needed to identify which session issued this request. As 
                         //the request has power constraints, this should be applied only to that session
     tSirMacAddr selfStaMacAddr;
     //In request,
@@ -1339,9 +1361,16 @@
     tPowerdBm  power;
 }tMaxTxPowerParams, *tpMaxTxPowerParams;
 
+typedef struct sMaxTxPowerPerBandParams
+{
+    eCsrBand   bandInfo;
+    tPowerdBm  power;
+}tMaxTxPowerPerBandParams, *tpMaxTxPowerPerBandParams;
+
 typedef struct sAddStaSelfParams
 {
    tSirMacAddr selfMacAddr;
+   tVOS_CON_MODE currDeviceMode;
    tANI_U32        type;
    tANI_U32        subType;
    tANI_U8         sessionId;
@@ -1364,14 +1393,24 @@
 {
    tANI_U8   opp_ps;
    tANI_U32  ctWindow;
-   tANI_U8   count;
+   tANI_U8   count; 
    tANI_U32  duration;
    tANI_U32  interval;
    tANI_U32  single_noa_duration;
    tANI_U8   psSelection;
 }tP2pPsParams, *tpP2pPsParams;
 
-static inline void halGetTxTSFtimer(tpAniSirGlobal pMac,
+typedef struct sTdlsLinkEstablishParams
+{
+   tANI_U16  staIdx;
+   tANI_U8   isResponder;
+   tANI_U8   uapsdQueues;
+   tANI_U8   maxSp;
+   tANI_U8   isBufsta;
+   tANI_U32  status;
+}tTdlsLinkEstablishParams, *tpTdlsLinkEstablishParams;
+
+static inline void halGetTxTSFtimer(tpAniSirGlobal pMac, 
                                                 tSirMacTimeStamp *pTime)
 {
 }
@@ -1398,7 +1437,7 @@
 } __ani_attr_packed tEidByteInfo, *tpEidByteInfo;
 
 
-/* The above structure would be followed by multiple of below mentioned
+/* The above structure would be followed by multiple of below mentioned 
 structure */
 typedef __ani_attr_pre_packed struct sBeaconFilterIe
 {
@@ -1407,7 +1446,7 @@
     tEidByteInfo    byte;
 } __ani_attr_packed tBeaconFilterIe, *tpBeaconFilterIe;
 
-typedef __ani_attr_pre_packed struct sRemBeaconFilterMsg
+typedef __ani_attr_pre_packed struct sRemBeaconFilterMsg  
 {
     tANI_U8  ucIeCount;
     tANI_U8  ucRemIeId[1];
diff --git a/CORE/WDA/inc/legacy/halTypes.h b/CORE/WDA/inc/legacy/halTypes.h
index a1da0dd..f35055c 100644
--- a/CORE/WDA/inc/legacy/halTypes.h
+++ b/CORE/WDA/inc/legacy/halTypes.h
@@ -225,6 +225,12 @@
 
 } eHalStatus;
 
+typedef enum
+{
+    HAL_STOP_TYPE_SYS_RESET,
+    HAL_STOP_TYPE_SYS_DEEP_SLEEP,
+    HAL_STOP_TYPE_RF_KILL,
+}tHalStopType;
 
 // macro to check for SUCCESS value of the halStatus
 #define HAL_STATUS_SUCCESS( variable ) ( eHAL_STATUS_SUCCESS == ( variable ) )
diff --git a/CORE/WDA/inc/legacy/palTypes.h b/CORE/WDA/inc/legacy/palTypes.h
index c9e5c87..d2e2297 100644
--- a/CORE/WDA/inc/legacy/palTypes.h
+++ b/CORE/WDA/inc/legacy/palTypes.h
@@ -24,7 +24,6 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
-
 #if !defined( PALTYPES_H__ )
 #define PALTYPES_H__
 
@@ -76,7 +75,7 @@
 #endif
 
 #elif !( defined( ANI_BUS_TYPE_PCIe ) || defined(ANI_BUS_TYPE_PCI) \
-	 || defined( ANI_BUS_TYPE_PLATFORM ) || defined(QCA_WIFI_2_0))
+         || defined( ANI_BUS_TYPE_PLATFORM ) || defined(QCA_WIFI_2_0))
 
 #error "NONE of the ANI_BUS_TYPE_xxx are defined for this build"
 
diff --git a/CORE/WDA/inc/legacy/wlan_qct_hal.h b/CORE/WDA/inc/legacy/wlan_qct_hal.h
index a438578..71317ba 100644
--- a/CORE/WDA/inc/legacy/wlan_qct_hal.h
+++ b/CORE/WDA/inc/legacy/wlan_qct_hal.h
@@ -341,6 +341,11 @@
 #ifdef FEATURE_WLAN_TDLS
 #define HAL_TDLS_PEER_STA_MASK              0x80 //bit 7 set for TDLS peer station 
 #endif
+
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+#define HAL_RELIABLE_MCAST_REQUESTED_MASK   0x100
+#define HAL_USE_BD_RATE_MASK 0x1000
+#endif
 /*==========================================================================
 
   FUNCTION    WLANHAL_FillTxBd
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index 7dbceea..c7d7117 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -158,6 +158,12 @@
 #define IS_ROAM_SCAN_OFFLOAD_FEATURE_ENABLE 0
 #endif
 
+#define IS_IBSS_HEARTBEAT_OFFLOAD_FEATURE_ENABLE 0
+
+#ifdef FEATURE_WLAN_TDLS
+#define IS_ADVANCE_TDLS_ENABLE 0
+#endif
+
 #else	/* #ifdef QCA_WIFI_2_0 */
 
 /*
@@ -178,6 +184,15 @@
 #define IS_ROAM_SCAN_OFFLOAD_FEATURE_ENABLE 0
 #endif
 
+/* Check if heartbeat offload is enabled */
+#define IS_IBSS_HEARTBEAT_OFFLOAD_FEATURE_ENABLE ((WDI_getHostWlanFeatCaps(IBSS_HEARTBEAT_OFFLOAD)) & (WDA_getFwWlanFeatCaps(IBSS_HEARTBEAT_OFFLOAD)))
+
+#ifdef FEATURE_WLAN_TDLS
+#define IS_ADVANCE_TDLS_ENABLE ((WDI_getHostWlanFeatCaps(ADVANCE_TDLS)) & (WDA_getFwWlanFeatCaps(ADVANCE_TDLS)))
+#else
+#define IS_ADVANCE_TDLS_ENABLE 0
+#endif
+
 #endif	/* #ifdef QCA_WIFI_2_0 */
 
 /*--------------------------------------------------------------------------
@@ -200,9 +215,9 @@
          WDA_TLI_802_3_HEADER_LEN:WDA_TLI_802_11_HEADER_LEN )
 
 /* TX channel enum type:
-
-   We have five types of TX packets so far and want to block/unblock each
-   traffic individually according to,  for example, low resouce condition.
+      
+   We have five types of TX packets so far and want to block/unblock each 
+   traffic individually according to,  for example, low resouce condition. 
    Define five TX channels for UMAC here. WDA can map these logical
    channels to physical DXE channels if needed.
 */
@@ -223,8 +238,8 @@
 /* ---------------------------------------------------------------------
    Libra and Volans specifics
 
-   TODO Consider refactoring it and put it into two separate headers,
-   one for Prima and one for Volans
+   TODO Consider refactoring it and put it into two separate headers, 
+   one for Prima and one for Volans 
  ----------------------------------------------------------------------*/
 
 /* For backward compatability with SDIO. It's BAL header size for SDIO
@@ -247,7 +262,7 @@
 #  define WDA_NUM_STA 8
 
 /* For backward compatability with SDIO.
-
+ 
    For SDIO interface, calculate the TX frame length and number of PDU
    to transfter the frame.
 
@@ -294,6 +309,7 @@
 #define WDA_DS_TX_START_XMIT  WLANTL_TX_START_XMIT
 #define WDA_DS_FINISH_ULA     WLANTL_FINISH_ULA
 
+#define VOS_TO_WPAL_PKT(_vos_pkt) ((wpt_packet*)_vos_pkt)
 
 #define WDA_TX_PACKET_FREED      0X0
 
@@ -306,10 +322,10 @@
 /* For data client */
 typedef VOS_STATUS (*WDA_DS_TxCompleteCallback) ( v_PVOID_t pContext, vos_pkt_t *pFrameDataBuff, VOS_STATUS txStatus );
 typedef VOS_STATUS (*WDA_DS_RxPacketCallback)   ( v_PVOID_t pContext, vos_pkt_t *pFrameDataBuff );
-typedef v_U32_t   (*WDA_DS_TxPacketCallback)   ( v_PVOID_t pContext,
-                                                  vos_pkt_t **ppFrameDataBuff,
-                                                  v_U32_t uSize,
-                                                  v_U8_t uFlowMask,
+typedef v_U32_t   (*WDA_DS_TxPacketCallback)   ( v_PVOID_t pContext, 
+                                                  vos_pkt_t **ppFrameDataBuff, 
+                                                  v_U32_t uSize, 
+                                                  v_U8_t uFlowMask, 
                                                   v_BOOL_t *pbUrgent );
 typedef VOS_STATUS (*WDA_DS_ResourceCB)      ( v_PVOID_t pContext, v_U32_t uCount );
 
@@ -326,14 +342,18 @@
 //parameter 2 - txComplete status : 1- success, 0 - failure.
 typedef eHalStatus (*pWDAAckFnTxComp)(tpAniSirGlobal, tANI_U32);
 
+#ifdef FEATURE_CESIUM_PROPRIETARY
+typedef void (*WDA_txFailIndCallback)(tANI_U8 *, tANI_U8);
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
 /* generic callback for updating parameters from target to UMAC */
 typedef void (*wda_tgt_cfg_cb) (void *context, void *param);
 
 typedef struct
 {
    tANI_U16 ucValidStaIndex ;
-   /*
-    * each bit in ucUseBaBitmap represent BA is enabled or not for this tid
+   /* 
+    * each bit in ucUseBaBitmap represent BA is enabled or not for this tid 
     * tid0 ..bit0, tid1..bit1 and so on..
     */
    tANI_U8    ucUseBaBitmap ;
@@ -362,7 +382,7 @@
 {
    v_PVOID_t            pVosContext;             /* global VOSS context*/
    v_PVOID_t            pWdiContext;             /* WDI context */
-   WDA_state            wdaState ;               /* WDA state tracking */
+   WDA_state            wdaState ;               /* WDA state tracking */ 
    v_PVOID_t            wdaWdiCfgApiMsgParam ;   /* WDI API paramter tracking */
    vos_event_t          wdaWdiEvent;             /* WDI API sync event */
 
@@ -372,7 +392,7 @@
    /* call back function for tx complete*/
    pWDATxRxCompFunc     pTxCbFunc;
    /* call back function for tx packet ack */
-   pWDAAckFnTxComp      pAckTxCbFunc;
+   pWDAAckFnTxComp      pAckTxCbFunc;   
    tANI_U32             frameTransRequired;
    tSirMacAddr          macBSSID;             /*BSSID of the network */
    tSirMacAddr          macSTASelf;     /*Self STA MAC*/
@@ -383,16 +403,16 @@
    /* TL's TX resource callback        */
    WDA_DS_ResourceCB    pfnTxResourceCB;
    /* TL's TX complete callback     */
-   WDA_DS_TxCompleteCallback pfnTxCompleteCallback;
+   WDA_DS_TxCompleteCallback pfnTxCompleteCallback; 
 #endif
-
+   
    tWdaStaInfo          wdaStaInfo[WDA_MAX_STA];
 
    tANI_U8              wdaMaxSta;
    tWdaTimers           wdaTimers;
 
    /* STA, AP, IBSS, MULTI-BSS etc.*/
-   tBssSystemRole       wdaGlobalSystemRole;
+   tBssSystemRole       wdaGlobalSystemRole; 
 
    /* driver mode, PRODUCTION or FTM */
    tDriverType          driverMode;
@@ -405,7 +425,7 @@
    /* Status frm TL after suspend/resume Tx */
    tANI_U8    txStatus;
    /* Flag set to true when TL suspend timesout.*/
-   tANI_U8    txSuspendTimedOut;
+   tANI_U8    txSuspendTimedOut;   
 
    vos_event_t          waitOnWdiIndicationCallBack;
 
@@ -415,7 +435,7 @@
    tSirVersionString    wcnssSoftwareVersionString;
    tSirVersionString    wcnssHardwareVersionString;
 
-
+   
    tSirLinkState        linkState;
    /* set, when BT AMP session is going on */
    v_BOOL_t             wdaAmpSessionOn;
@@ -423,14 +443,21 @@
    v_BOOL_t             needShutdown;
    v_BOOL_t             wdiFailed;
    v_BOOL_t             wdaTimersCreated;
-} tWDA_CbContext ;
+
+   /* Event to wait for WDA stop on FTM mode */
+   vos_event_t          ftmStopDoneEvent;
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+   WDA_txFailIndCallback txFailIndCallback;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+} tWDA_CbContext ; 
 
 typedef struct
 {
    v_PVOID_t            pWdaContext;             /* pointer to WDA context*/
    v_PVOID_t            wdaMsgParam;            /* PE parameter tracking */
    v_PVOID_t            wdaWdiApiMsgParam;      /* WDI API paramter tracking */
-} tWDA_ReqParams;
+} tWDA_ReqParams; 
 
 #ifdef QCA_WIFI_2_0
 typedef struct {
@@ -473,7 +500,7 @@
 #ifdef QCA_WIFI_ISOC
 #define WDA_NVDownload_Start wma_nv_download_start
 #else
-#define WDA_NVDownload_Start(x)	({ VOS_STATUS_SUCCESS; })
+#define WDA_NVDownload_Start(x)    ({ VOS_STATUS_SUCCESS; })
 #endif
 
 #define WDA_preStart wma_pre_start
@@ -487,16 +514,16 @@
 
 /*
  * FUNCTION: WDA_preStart
- * Trigger DAL-AL to start CFG download
- */
+ * Trigger DAL-AL to start CFG download 
+ */ 
 VOS_STATUS WDA_start(v_PVOID_t pVosContext) ;
 
 VOS_STATUS WDA_NVDownload_Start(v_PVOID_t pVosContext);
 
 /*
  * FUNCTION: WDA_preStart
- * Trigger WDA to start CFG download
- */
+ * Trigger WDA to start CFG download 
+ */ 
 VOS_STATUS WDA_preStart(v_PVOID_t pVosContext) ;
 /*
  * FUNCTION: WDA_stop
@@ -528,8 +555,8 @@
 
 /*
  * FUNCTION: WDA_McProcessMsg
- * DAL-AL message processing entry function
- */
+ * DAL-AL message processing entry function 
+ */ 
 
 VOS_STATUS WDA_McProcessMsg( v_CONTEXT_t pVosContext, vos_msg_t *pMsg ) ;
 
@@ -539,12 +566,12 @@
 /*
  * FUNCTION: WDA_MgmtDSRegister
  * Send Message back to PE
- */
+ */ 
 
-VOS_STATUS WDA_MgmtDSRegister(tWDA_CbContext *pWDA,
+VOS_STATUS WDA_MgmtDSRegister(tWDA_CbContext *pWDA, 
                               WDA_DS_TxCompleteCb WDA_TxCompleteCallback,
-                              WDA_DS_RxCompleteCb WDA_RxCompleteCallback,
-                              WDA_DS_TxFlowControlCb WDA_TxFlowCtrlCallback
+                              WDA_DS_RxCompleteCb WDA_RxCompleteCallback,  
+                              WDA_DS_TxFlowControlCb WDA_TxFlowCtrlCallback 
                              ) ;
 
 /*
@@ -556,14 +583,14 @@
 /* ---------------------------------------------------------
  * FUNCTION:  wdaGetGlobalSystemRole()
  *
- * Get the global HAL system role.
+ * Get the global HAL system role. 
  * ---------------------------------------------------------
  */
 tBssSystemRole wdaGetGlobalSystemRole(tpAniSirGlobal pMac);
 
 tANI_U8 WDA_MapChannel(tANI_U8);
 
-/* maximum wait time for WDA complete event (correct value has to be derived)
+/* maximum wait time for WDA complete event (correct value has to be derived) 
  * for now giving the value 1000 ms */
 #define WDA_WDI_COMPLETION_TIME_OUT 30000 /* in ms */
 
@@ -571,7 +598,7 @@
 #define WDA_TL_SUSPEND_TIMEOUT   2000  /* in ms unit */
 
 /*Tag used by WDA to mark a timed out frame*/
-#define WDA_TL_TX_MGMT_TIMED_OUT   0xDEAD
+#define WDA_TL_TX_MGMT_TIMED_OUT   0xDEAD 
 
 #define WDA_TL_TX_SUSPEND_SUCCESS   0
 #define WDA_TL_TX_SUSPEND_FAILURE   1
@@ -626,28 +653,30 @@
      (((t_packetmeta *)pRxMeta)->timestamp)
 
 #define WDA_IS_RX_IN_SCAN(pRxMeta) \
-	(((t_packetmeta *)pRxMeta)->scan)
+     (((t_packetmeta *)pRxMeta)->scan)
 
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 #define WDA_GET_OFFLOADSCANLEARN(pRxMeta) \
-	(((t_packetmeta *)pRxMeta)->offloadScanLearn)
+     (((t_packetmeta *)pRxMeta)->offloadScanLearn)
 #define WDA_GET_ROAMCANDIDATEIND(pRxMeta) \
-	(((t_packetmeta *)pRxMeta)->roamCandidateInd)
+     (((t_packetmeta *)pRxMeta)->roamCandidateInd)
 
 #endif
 
 #define WDA_GET_RX_SNR(pRxMeta) \
      (((t_packetmeta *)pRxMeta)->snr)
 
-#define WDA_GetWcnssWlanCompiledVersion	WMA_GetWcnssWlanCompiledVersion
+#define WDA_GetWcnssWlanCompiledVersion    WMA_GetWcnssWlanCompiledVersion
 #define WDA_GetWcnssWlanReportedVersion WMA_GetWcnssWlanReportedVersion
 #define WDA_GetWcnssSoftwareVersion WMA_GetWcnssSoftwareVersion
 #define WDA_GetWcnssHardwareVersion WMA_GetWcnssHardwareVersion
 
+#define WDA_GET_RX_RFBAND(pRxMeta) 0
+
 #else	/* #ifdef QCA_WIFI_2_0 */
 
 /* ---------------------------------------------------------------------------
-
+ 
    RX Meta info access for Integrated SOC
    RX BD header access for NON Integrated SOC
 
@@ -689,7 +718,7 @@
 #  define WDA_GET_RX_MPDU_DATA_OFFSET(pRxMeta)  WDA_GET_RX_MPDU_HEADER_LEN(pRxMeta)
 
 /* WDA_GET_RX_MPDU_HEADER_OFFSET *********************************************/
-// For Integrated SOC: We UMAC receive the frame,
+// For Integrated SOC: We UMAC receive the frame, 
 //                     BD is gone and MAC header at offset 0
 #  define WDA_GET_RX_MPDU_HEADER_OFFSET(pRxMeta)   0
 
@@ -709,13 +738,16 @@
 /* WDA_GET_RX_CH *************************************************************/
 #  define WDA_GET_RX_CH(pRxMeta) (((WDI_DS_RxMetaInfoType*)(pRxMeta))->rxChannel)
 
+/* WDA_GET_RX_RFBAND *********************************************************/
+#  define WDA_GET_RX_RFBAND(pRxMeta) (((WDI_DS_RxMetaInfoType*)(pRxMeta))->rfBand)
+
 /* WDA_GET_RX_DPUSIG *********************************************************/
 #  define WDA_GET_RX_DPUSIG(pRxMeta)  (((WDI_DS_RxMetaInfoType*)(pRxMeta))->dpuSig)
 
 /* WDA_IS_RX_BCAST ***********************************************************/
 #  define WDA_IS_RX_BCAST(pRxMeta)   \
       ( (1 == ((WDI_DS_RxMetaInfoType*)(pRxMeta))->bcast) ? VOS_TRUE : VOS_FALSE )
-
+    
 /* WDA_GET_RX_FT_DONE ********************************************************/
 #  define WDA_GET_RX_FT_DONE(pRxMeta) (((WDI_DS_RxMetaInfoType*)(pRxMeta))->ft)
 
@@ -778,7 +810,7 @@
 
 /* WDA_IS_RX_LAST_MPDU *******************************************************/
 #  define WDA_IS_RX_LAST_MPDU(pRxMeta)      \
-   ( ((WDI_DS_RxMetaInfoType*)(pRxMeta))->rxpFlags & WLANWDA_HO_LAST_MPDU_OF_AMPDU )
+   ( ((WDI_DS_RxMetaInfoType*)(pRxMeta))->rxpFlags & WLANWDA_HO_LAST_MPDU_OF_AMPDU ) 
 
 /* WDA_GET_RX_TIMESTAMP *****************************************************/
 #  define WDA_GET_RX_TIMESTAMP(pRxMeta) (((WDI_DS_RxMetaInfoType*)(pRxMeta))->mclkRxTimestamp)
@@ -807,7 +839,7 @@
 
 /* WDA_IS_RX_FC **************************************************************/
 // Flow control frames
-/* FIXME WDA should provide the meta info which indicates FC frame
+/* FIXME WDA should provide the meta info which indicates FC frame 
           In the meantime, use hardcoded FALSE, since we don't support FC yet */
 #  define WDA_IS_RX_FC(pRxMeta)    (((WDI_DS_RxMetaInfoType*)(pRxMeta))->fc)
 
@@ -901,7 +933,7 @@
 //#define WDA_BTC_SET_CFG SIR_HAL_BTC_SET_CFG
 
 //Required by PE
-#define WDA_HOST_MSG_START SIR_HAL_HOST_MSG_START
+#define WDA_HOST_MSG_START SIR_HAL_HOST_MSG_START 
 #define WDA_INITIAL_CAL_FAILED_NTF SIR_HAL_INITIAL_CAL_FAILED_NTF
 #define WDA_SHUTDOWN_REQ SIR_HAL_SHUTDOWN_REQ
 #define WDA_SHUTDOWN_CNF SIR_HAL_SHUTDOWN_CNF
@@ -911,7 +943,7 @@
     (eHalStatus halPhySetRegDomain(tHalHandle hHal, eRegDomainId regDomain))
 #endif
 
-#define WDA_APP_SETUP_NTF  SIR_HAL_APP_SETUP_NTF
+#define WDA_APP_SETUP_NTF  SIR_HAL_APP_SETUP_NTF 
 #define WDA_NIC_OPER_NTF   SIR_HAL_NIC_OPER_NTF
 #define WDA_INIT_START_REQ SIR_HAL_INIT_START_REQ
 #define WDA_RESET_REQ      SIR_HAL_RESET_REQ
@@ -925,14 +957,14 @@
 #define WDA_MSG_TYPES_BEGIN            SIR_HAL_MSG_TYPES_BEGIN
 #define WDA_ITC_MSG_TYPES_BEGIN        SIR_HAL_ITC_MSG_TYPES_BEGIN
 #define WDA_RADAR_DETECTED_IND         SIR_HAL_RADAR_DETECTED_IND
-#define WDA_WDT_KAM_RSP                SIR_HAL_WDT_KAM_RSP
+#define WDA_WDT_KAM_RSP                SIR_HAL_WDT_KAM_RSP 
 #define WDA_TIMER_TEMP_MEAS_REQ        SIR_HAL_TIMER_TEMP_MEAS_REQ
 #define WDA_TIMER_PERIODIC_STATS_COLLECT_REQ   SIR_HAL_TIMER_PERIODIC_STATS_COLLECT_REQ
 #define WDA_CAL_REQ_NTF                SIR_HAL_CAL_REQ_NTF
 #define WDA_MNT_OPEN_TPC_TEMP_MEAS_REQ SIR_HAL_MNT_OPEN_TPC_TEMP_MEAS_REQ
 #define WDA_CCA_MONITOR_INTERVAL_TO    SIR_HAL_CCA_MONITOR_INTERVAL_TO
 #define WDA_CCA_MONITOR_DURATION_TO    SIR_HAL_CCA_MONITOR_DURATION_TO
-#define WDA_CCA_MONITOR_START          SIR_HAL_CCA_MONITOR_START
+#define WDA_CCA_MONITOR_START          SIR_HAL_CCA_MONITOR_START 
 #define WDA_CCA_MONITOR_STOP           SIR_HAL_CCA_MONITOR_STOP
 #define WDA_CCA_CHANGE_MODE            SIR_HAL_CCA_CHANGE_MODE
 #define WDA_TIMER_WRAP_AROUND_STATS_COLLECT_REQ   SIR_HAL_TIMER_WRAP_AROUND_STATS_COLLECT_REQ
@@ -944,7 +976,7 @@
 #define WDA_ADD_STA_RSP                SIR_HAL_ADD_STA_RSP
 #define WDA_ADD_STA_SELF_RSP           SIR_HAL_ADD_STA_SELF_RSP
 #define WDA_DEL_STA_SELF_RSP           SIR_HAL_DEL_STA_SELF_RSP
-#define WDA_DELETE_STA_REQ             SIR_HAL_DELETE_STA_REQ
+#define WDA_DELETE_STA_REQ             SIR_HAL_DELETE_STA_REQ 
 #define WDA_DELETE_STA_RSP             SIR_HAL_DELETE_STA_RSP
 #define WDA_ADD_BSS_REQ                SIR_HAL_ADD_BSS_REQ
 #define WDA_ADD_BSS_RSP                SIR_HAL_ADD_BSS_RSP
@@ -971,7 +1003,7 @@
 #define WDA_SET_BSSKEY_RSP             SIR_HAL_SET_BSSKEY_RSP
 #define WDA_SET_STAKEY_REQ             SIR_HAL_SET_STAKEY_REQ
 #define WDA_SET_STAKEY_RSP             SIR_HAL_SET_STAKEY_RSP
-#define WDA_DPU_STATS_REQ              SIR_HAL_DPU_STATS_REQ
+#define WDA_DPU_STATS_REQ              SIR_HAL_DPU_STATS_REQ 
 #define WDA_DPU_STATS_RSP              SIR_HAL_DPU_STATS_RSP
 #define WDA_GET_DPUINFO_REQ            SIR_HAL_GET_DPUINFO_REQ
 #define WDA_GET_DPUINFO_RSP            SIR_HAL_GET_DPUINFO_RSP
@@ -991,7 +1023,7 @@
 #define WDA_MBOX_SENDMSG_COMPLETE_IND  SIR_HAL_MBOX_SENDMSG_COMPLETE_IND
 #define WDA_EXIT_BMPS_REQ              SIR_HAL_EXIT_BMPS_REQ
 #define WDA_EXIT_BMPS_RSP              SIR_HAL_EXIT_BMPS_RSP
-#define WDA_EXIT_BMPS_IND              SIR_HAL_EXIT_BMPS_IND
+#define WDA_EXIT_BMPS_IND              SIR_HAL_EXIT_BMPS_IND 
 #define WDA_ENTER_BMPS_REQ             SIR_HAL_ENTER_BMPS_REQ
 #define WDA_ENTER_BMPS_RSP             SIR_HAL_ENTER_BMPS_RSP
 #define WDA_BMPS_STATUS_IND            SIR_HAL_BMPS_STATUS_IND
@@ -1014,7 +1046,7 @@
 #define WDA_SOFTMAC_BULKREGREAD_RESPONSE      SIR_HAL_SOFTMAC_BULKREGREAD_RESPONSE
 #define WDA_SOFTMAC_HOSTMESG_MSGPROCESSRESULT SIR_HAL_SOFTMAC_HOSTMESG_MSGPROCESSRESULT
 
-#define WDA_ADDBA_REQ                  SIR_HAL_ADDBA_REQ
+#define WDA_ADDBA_REQ                  SIR_HAL_ADDBA_REQ 
 #define WDA_ADDBA_RSP                  SIR_HAL_ADDBA_RSP
 #define WDA_DELBA_IND                  SIR_HAL_DELBA_IND
 #define WDA_DEL_BA_IND                 SIR_HAL_DEL_BA_IND
@@ -1030,11 +1062,11 @@
 #define WDA_ENTER_IMPS_RSP             SIR_HAL_ENTER_IMPS_RSP
 #define WDA_EXIT_IMPS_RSP              SIR_HAL_EXIT_IMPS_RSP
 #define WDA_EXIT_IMPS_REQ              SIR_HAL_EXIT_IMPS_REQ
-#define WDA_SOFTMAC_HOSTMESG_PS_STATUS_IND  SIR_HAL_SOFTMAC_HOSTMESG_PS_STATUS_IND
+#define WDA_SOFTMAC_HOSTMESG_PS_STATUS_IND  SIR_HAL_SOFTMAC_HOSTMESG_PS_STATUS_IND  
 #define WDA_POSTPONE_ENTER_IMPS_RSP    SIR_HAL_POSTPONE_ENTER_IMPS_RSP
-#define WDA_STA_STAT_REQ               SIR_HAL_STA_STAT_REQ
+#define WDA_STA_STAT_REQ               SIR_HAL_STA_STAT_REQ 
 #define WDA_GLOBAL_STAT_REQ            SIR_HAL_GLOBAL_STAT_REQ
-#define WDA_AGGR_STAT_REQ              SIR_HAL_AGGR_STAT_REQ
+#define WDA_AGGR_STAT_REQ              SIR_HAL_AGGR_STAT_REQ 
 #define WDA_STA_STAT_RSP               SIR_HAL_STA_STAT_RSP
 #define WDA_GLOBAL_STAT_RSP            SIR_HAL_GLOBAL_STAT_RSP
 #define WDA_AGGR_STAT_RSP              SIR_HAL_AGGR_STAT_RSP
@@ -1044,7 +1076,7 @@
 #define WDA_REMOVE_BSSKEY_RSP          SIR_HAL_REMOVE_BSSKEY_RSP
 #define WDA_REMOVE_STAKEY_REQ          SIR_HAL_REMOVE_STAKEY_REQ
 #define WDA_REMOVE_STAKEY_RSP          SIR_HAL_REMOVE_STAKEY_RSP
-#define WDA_SET_STA_BCASTKEY_REQ       SIR_HAL_SET_STA_BCASTKEY_REQ
+#define WDA_SET_STA_BCASTKEY_REQ       SIR_HAL_SET_STA_BCASTKEY_REQ 
 #define WDA_SET_STA_BCASTKEY_RSP       SIR_HAL_SET_STA_BCASTKEY_RSP
 #define WDA_REMOVE_STA_BCASTKEY_REQ    SIR_HAL_REMOVE_STA_BCASTKEY_REQ
 #define WDA_REMOVE_STA_BCASTKEY_RSP    SIR_HAL_REMOVE_STA_BCASTKEY_RSP
@@ -1067,14 +1099,14 @@
 #define WDA_UPDATE_PROBE_RSP_IE_BITMAP_IND SIR_HAL_UPDATE_PROBE_RSP_IE_BITMAP_IND
 #define WDA_UPDATE_UAPSD_IND           SIR_HAL_UPDATE_UAPSD_IND
 
-#define WDA_SET_MIMOPS_REQ                      SIR_HAL_SET_MIMOPS_REQ
+#define WDA_SET_MIMOPS_REQ                      SIR_HAL_SET_MIMOPS_REQ 
 #define WDA_SET_MIMOPS_RSP                      SIR_HAL_SET_MIMOPS_RSP
 #define WDA_SYS_READY_IND                       SIR_HAL_SYS_READY_IND
 #define WDA_SET_TX_POWER_REQ                    SIR_HAL_SET_TX_POWER_REQ
 #define WDA_SET_TX_POWER_RSP                    SIR_HAL_SET_TX_POWER_RSP
 #define WDA_GET_TX_POWER_REQ                    SIR_HAL_GET_TX_POWER_REQ
 #define WDA_GET_TX_POWER_RSP                    SIR_HAL_GET_TX_POWER_RSP
-#define WDA_GET_NOISE_REQ                       SIR_HAL_GET_NOISE_REQ
+#define WDA_GET_NOISE_REQ                       SIR_HAL_GET_NOISE_REQ 
 #define WDA_GET_NOISE_RSP                       SIR_HAL_GET_NOISE_RSP
 #define WDA_SET_TX_PER_TRACKING_REQ    SIR_HAL_SET_TX_PER_TRACKING_REQ
 
@@ -1088,9 +1120,9 @@
 #define WDA_BEACON_PRE_IND             SIR_HAL_BEACON_PRE_IND
 #define WDA_ENTER_UAPSD_REQ            SIR_HAL_ENTER_UAPSD_REQ
 #define WDA_ENTER_UAPSD_RSP            SIR_HAL_ENTER_UAPSD_RSP
-#define WDA_EXIT_UAPSD_REQ             SIR_HAL_EXIT_UAPSD_REQ
+#define WDA_EXIT_UAPSD_REQ             SIR_HAL_EXIT_UAPSD_REQ 
 #define WDA_EXIT_UAPSD_RSP             SIR_HAL_EXIT_UAPSD_RSP
-#define WDA_LOW_RSSI_IND               SIR_HAL_LOW_RSSI_IND
+#define WDA_LOW_RSSI_IND               SIR_HAL_LOW_RSSI_IND 
 #define WDA_BEACON_FILTER_IND          SIR_HAL_BEACON_FILTER_IND
 /// PE <-> HAL WOWL messages
 #define WDA_WOWL_ADD_BCAST_PTRN        SIR_HAL_WOWL_ADD_BCAST_PTRN
@@ -1115,7 +1147,7 @@
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
 /* PE <-> HAL OEM_DATA RELATED MESSAGES */
-#define WDA_START_OEM_DATA_REQ         SIR_HAL_START_OEM_DATA_REQ
+#define WDA_START_OEM_DATA_REQ         SIR_HAL_START_OEM_DATA_REQ 
 #define WDA_START_OEM_DATA_RSP         SIR_HAL_START_OEM_DATA_RSP
 #define WDA_FINISH_OEM_DATA_REQ        SIR_HAL_FINISH_OEM_DATA_REQ
 #endif
@@ -1123,7 +1155,12 @@
 #define WDA_SET_MAX_TX_POWER_REQ       SIR_HAL_SET_MAX_TX_POWER_REQ
 #define WDA_SET_MAX_TX_POWER_RSP       SIR_HAL_SET_MAX_TX_POWER_RSP
 
-#define WDA_SEND_MSG_COMPLETE          SIR_HAL_SEND_MSG_COMPLETE
+#define WDA_SET_MAX_TX_POWER_PER_BAND_REQ \
+        SIR_HAL_SET_MAX_TX_POWER_PER_BAND_REQ
+#define WDA_SET_MAX_TX_POWER_PER_BAND_RSP \
+        SIR_HAL_SET_MAX_TX_POWER_PER_BAND_RSP
+
+#define WDA_SEND_MSG_COMPLETE          SIR_HAL_SEND_MSG_COMPLETE 
 
 /// PE <-> HAL Host Offload message
 #define WDA_SET_HOST_OFFLOAD           SIR_HAL_SET_HOST_OFFLOAD
@@ -1138,14 +1175,16 @@
 #define WDA_DEL_STA_SELF_REQ           SIR_HAL_DEL_STA_SELF_REQ
 
 #define WDA_SET_P2P_GO_NOA_REQ         SIR_HAL_SET_P2P_GO_NOA_REQ
+#define WDA_SET_TDLS_LINK_ESTABLISH_REQ SIR_HAL_TDLS_LINK_ESTABLISH_REQ
+#define WDA_SET_TDLS_LINK_ESTABLISH_REQ_RSP SIR_HAL_TDLS_LINK_ESTABLISH_REQ_RSP
 
 #define WDA_TX_COMPLETE_TIMEOUT_IND  (WDA_MSG_TYPES_END - 1)
 #define WDA_WLAN_SUSPEND_IND           SIR_HAL_WLAN_SUSPEND_IND
 #define WDA_WLAN_RESUME_REQ           SIR_HAL_WLAN_RESUME_REQ
 #define WDA_MSG_TYPES_END    SIR_HAL_MSG_TYPES_END
 
-#define WDA_MMH_TXMB_READY_EVT SIR_HAL_MMH_TXMB_READY_EVT
-#define WDA_MMH_RXMB_DONE_EVT  SIR_HAL_MMH_RXMB_DONE_EVT
+#define WDA_MMH_TXMB_READY_EVT SIR_HAL_MMH_TXMB_READY_EVT     
+#define WDA_MMH_RXMB_DONE_EVT  SIR_HAL_MMH_RXMB_DONE_EVT    
 #define WDA_MMH_MSGQ_NE_EVT    SIR_HAL_MMH_MSGQ_NE_EVT
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -1169,11 +1208,13 @@
 #endif // FEATURE_WLAN_SCAN_PNO
 
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+#define WDA_ROAM_SCAN_OFFLOAD_REQ   SIR_HAL_ROAM_SCAN_OFFLOAD_REQ
+#define WDA_ROAM_SCAN_OFFLOAD_RSP   SIR_HAL_ROAM_SCAN_OFFLOAD_RSP
 #define WDA_START_ROAM_CANDIDATE_LOOKUP_REQ             SIR_HAL_START_ROAM_CANDIDATE_LOOKUP_REQ
 #endif
 
 #ifdef WLAN_WAKEUP_EVENTS
-#define WDA_WAKE_REASON_IND    SIR_HAL_WAKE_REASON_IND
+#define WDA_WAKE_REASON_IND    SIR_HAL_WAKE_REASON_IND  
 #endif // WLAN_WAKEUP_EVENTS
 
 #ifdef WLAN_FEATURE_PACKET_FILTERING
@@ -1181,10 +1222,17 @@
 #define WDA_RECEIVE_FILTER_SET_FILTER_REQ               SIR_HAL_RECEIVE_FILTER_SET_FILTER_REQ
 #define WDA_PACKET_COALESCING_FILTER_MATCH_COUNT_REQ    SIR_HAL_PACKET_COALESCING_FILTER_MATCH_COUNT_REQ
 #define WDA_PACKET_COALESCING_FILTER_MATCH_COUNT_RSP    SIR_HAL_PACKET_COALESCING_FILTER_MATCH_COUNT_RSP
-#define WDA_RECEIVE_FILTER_CLEAR_FILTER_REQ             SIR_HAL_RECEIVE_FILTER_CLEAR_FILTER_REQ
+#define WDA_RECEIVE_FILTER_CLEAR_FILTER_REQ             SIR_HAL_RECEIVE_FILTER_CLEAR_FILTER_REQ   
 #endif // WLAN_FEATURE_PACKET_FILTERING
 
 #define WDA_SET_POWER_PARAMS_REQ   SIR_HAL_SET_POWER_PARAMS_REQ
+#define WDA_DHCP_START_IND              SIR_HAL_DHCP_START_IND
+#define WDA_DHCP_STOP_IND               SIR_HAL_DHCP_STOP_IND
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+#define WDA_TX_FAIL_MONITOR_IND         SIR_HAL_TX_FAIL_MONITOR_IND
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
 
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 #define WDA_GTK_OFFLOAD_REQ             SIR_HAL_GTK_OFFLOAD_REQ
@@ -1210,20 +1258,53 @@
 #define WDA_UPDATE_CHAN_LIST_REQ    SIR_HAL_UPDATE_CHAN_LIST_REQ
 #define WDA_UPDATE_CHAN_LIST_RSP    SIR_HAL_UPDATE_CHAN_LIST_RSP
 #define WDA_RX_SCAN_EVENT           SIR_HAL_RX_SCAN_EVENT
+#define WDA_IBSS_PEER_INACTIVITY_IND SIR_HAL_IBSS_PEER_INACTIVITY_IND
+
 #ifdef QCA_WIFI_2_0
 #define WDA_CLI_SET_CMD             SIR_HAL_CLI_SET_CMD
 #define WDA_CLI_GET_CMD             SIR_HAL_CLI_GET_CMD
+#endif
 #ifdef FEATURE_WLAN_SCAN_PNO
 #define WDA_SME_SCAN_CACHE_UPDATED  SIR_HAL_SME_SCAN_CACHE_UPDATED
 #endif
-#endif
 
 #ifndef REMOVE_PKT_LOG
 #define WDA_PKTLOG_ENABLE_REQ       SIR_HAL_PKTLOG_ENABLE_REQ
 #endif
 
+#ifdef FEATURE_WLAN_LPHB
+#define WDA_LPHB_CONF_REQ          SIR_HAL_LPHB_CONF_IND
+#define WDA_LPHB_WAIT_EXPIRE_IND   SIR_HAL_LPHB_WAIT_EXPIRE_IND
+#endif /* FEATURE_WLAN_LPHB */
+
+#define WDA_ADD_PERIODIC_TX_PTRN_IND    SIR_HAL_ADD_PERIODIC_TX_PTRN_IND
+#define WDA_DEL_PERIODIC_TX_PTRN_IND    SIR_HAL_DEL_PERIODIC_TX_PTRN_IND
+
 #define WDA_RATE_UPDATE_IND         SIR_HAL_RATE_UPDATE_IND
 
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+#define WDA_RMC_BECOME_LEADER       SIR_HAL_RMC_BECOME_LEADER
+#define WDA_RMC_LEADER_SELECT_RESP  SIR_HAL_RMC_LEADER_SELECT_RESP
+#define WDA_RMC_LEADER_REQ          SIR_HAL_RMC_LEADER_REQ
+#define WDA_RMC_UPDATE_IND          SIR_HAL_RMC_UPDATE_IND
+#endif /* defined WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/* IBSS peer info related message */
+#define WDA_GET_IBSS_PEER_INFO_REQ  SIR_HAL_IBSS_PEER_INFO_REQ
+#define WDA_GET_IBSS_PEER_INFO_RSP  SIR_HAL_IBSS_PEER_INFO_RSP
+
+/* IBSS Route table update indication */
+#define WDA_IBSS_ROUTE_TABLE_UPDATE_IND  SIR_HAL_IBSS_ROUTE_TABLE_UPDATE_IND
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+#define WDA_SET_BATCH_SCAN_REQ            SIR_HAL_SET_BATCH_SCAN_REQ
+#define WDA_SET_BATCH_SCAN_RSP            SIR_HAL_SET_BATCH_SCAN_RSP
+#define WDA_STOP_BATCH_SCAN_IND           SIR_HAL_STOP_BATCH_SCAN_IND
+#define WDA_TRIGGER_BATCH_SCAN_RESULT_IND SIR_HAL_TRIGGER_BATCH_SCAN_RESULT_IND
+#endif
+
 tSirRetStatus wdaPostCtrlMsg(tpAniSirGlobal pMac, tSirMsgQ *pMsg);
 
 #define HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME 0x40 // Bit 6 will be used to control BD rate for Management frames
@@ -1267,24 +1348,49 @@
 #define WDA_SetHTConfig wma_set_htconfig
 #define WDA_UpdateRssiBmps WMA_UpdateRssiBmps
 
+VOS_STATUS WDA_SetIdlePsConfig(void *wda_handle, tANI_U32 idle_ps);
+static inline void WDA_UpdateSnrBmps(v_PVOID_t pvosGCtx, v_U8_t staId,
+            v_S7_t snr)
+{
+
+}
+
+static inline int WDA_GetSnr(tANI_U8 ucSTAId, tANI_S8* pSnr)
+{
+     return VOS_STATUS_SUCCESS;
+}
+
+static inline void WDA_UpdateLinkCapacity(v_PVOID_t pvosGCtx, v_U8_t staId,
+           v_U32_t linkCapacity)
+{
+
+}
+
 #else
 
-eHalStatus WDA_SetRegDomain(void * clientCtxt, v_REGDOMAIN_t regId);
-static int WDA_SetHTConfig(tANI_U8 sessionId, tANI_U16 htCapab, int value)
-{
-   return 0;
-}
+eHalStatus WDA_SetRegDomain(void * clientCtxt, v_REGDOMAIN_t regId,
+		tAniBool sendRegHint);
 
 static inline eHalStatus WDA_SetCountryCode(v_VOID_t *client_ctx, tANI_U8 *countrycode)
 {
    return eHAL_STATUS_SUCCESS;
 }
 
+static inline int WDA_SetHTConfig(tANI_U8 sessionId, tANI_U16 htCapab,
+                                  int value)
+{
+   return 0;
+}
+
+static inline VOS_STATUS WDA_SetIdlePsConfig(void *wda_handle, tANI_U32 idle_ps)
+{
+   return VOS_STATUS_SUCCESS;
+}
 /* -----------------------------------------------------------------
   WDA data path API's for TL
  -------------------------------------------------------------------*/
 
-v_BOOL_t WDA_IsHwFrameTxTranslationCapable(v_PVOID_t pVosGCtx,
+v_BOOL_t WDA_IsHwFrameTxTranslationCapable(v_PVOID_t pVosGCtx, 
                                                       tANI_U8 staIdx);
 
 #  define WDA_EnableUapsdAcParams(vosGCtx, staId, uapsdInfo) \
@@ -1299,8 +1405,16 @@
 #define WDA_UpdateRssiBmps(pvosGCtx,  staId, rssi) \
         WLANTL_UpdateRssiBmps(pvosGCtx, staId, rssi)
 
-#endif	/* #ifdef QCA_WIFI_2_0 */
+#define WDA_UpdateSnrBmps(pvosGCtx,  staId, rssi) \
+        WLANTL_UpdateSnrBmps(pvosGCtx, staId, snr)
 
+#define WDA_GetSnr(staId, snr) \
+        WLANTL_GetSnr(staId, snr)
+
+#define WDA_UpdateLinkCapacity(pvosGCtx,  staId, linkCapacity) \
+        WLANTL_UpdateLinkCapacity(pvosGCtx, staId, linkCapacity)
+
+#endif	/* #ifdef QCA_WIFI_2_0 */
 /*==========================================================================
    FUNCTION    WDA_DS_PeekRxPacketInfo
 
@@ -1346,10 +1460,10 @@
 #define WDA_getFwWlanFeatCaps wma_getFwWlanFeatCaps
 
 #define WDA_TransportChannelDebug(mac, disp_snapshot, \
-				  toggle_stall_detect) ({ \
-			(void)mac;			  \
-			(void)disp_snapshot;		  \
-			(void)toggle_stall_detect;	  \
+                                  toggle_stall_detect) ({ \
+                                  (void)mac;              \
+                                  (void)disp_snapshot;    \
+                                  (void)toggle_stall_detect; \
 })
 
 #define WDA_TrafficStatsTimerActivate WMA_TrafficStatsTimerActivate
@@ -1357,42 +1471,42 @@
 
 #else	/* #ifdef QCA_WIFI_2_0 */
 
-#ifdef WLAN_PERF
+#ifdef WLAN_PERF 
 /*==========================================================================
   FUNCTION    WDA_TLI_FastHwFwdDataFrame
 
-  DESCRIPTION
+  DESCRIPTION 
     For NON integrated SOC, this function is called by TL.
 
-    Fast path function to quickly forward a data frame if HAL determines BD
-    signature computed here matches the signature inside current VOSS packet.
-    If there is a match, HAL and TL fills in the swapped packet length into
-    BD header and DxE header, respectively. Otherwise, packet goes back to
+    Fast path function to quickly forward a data frame if HAL determines BD 
+    signature computed here matches the signature inside current VOSS packet. 
+    If there is a match, HAL and TL fills in the swapped packet length into 
+    BD header and DxE header, respectively. Otherwise, packet goes back to 
     normal (slow) path and a new BD signature would be tagged into BD in this
     VOSS packet later by the WLANHAL_FillTxBd() function.
 
-  TODO  For integrated SOC, this function does nothing yet. Pima SLM/HAL
+  TODO  For integrated SOC, this function does nothing yet. Pima SLM/HAL 
         should provide the equivelant functionality.
 
-  DEPENDENCIES
-
-  PARAMETERS
+  DEPENDENCIES 
+     
+  PARAMETERS 
 
    IN
         pvosGCtx    VOS context
         vosDataBuff Ptr to VOSS packet
         pMetaInfo   For getting frame's TID
         pStaInfo    For checking STA type
-
+    
    OUT
         pvosStatus  returned status
         puFastFwdOK Flag to indicate whether frame could be fast forwarded
-
+   
   RETURN VALUE
-    No return.
+    No return.   
 
-  SIDE EFFECTS
-
+  SIDE EFFECTS 
+  
 ============================================================================*/
 void WDA_TLI_FastHwFwdDataFrame
 (
@@ -1408,7 +1522,7 @@
 /*==========================================================================
   FUNCTION    WDA_DS_Register
 
-  DESCRIPTION
+  DESCRIPTION 
     Register TL client to WDA. This function registers TL RX/TX functions
     to WDI by calling WDI_DS_Register.
 
@@ -1416,14 +1530,14 @@
     For NON integrated SOC, this function calls WLANBAL_RegTlCbFunctions
     to register TL's RX/TX functions to BAL
 
-  TODO
+  TODO 
     For Prima, pfnResourceCB gets called in WDTS_OOResourceNotification.
     The uCount parameter is AC mask. It should be redefined to use the
     same resource callback function.
 
-  DEPENDENCIES
-
-  PARAMETERS
+  DEPENDENCIES 
+     
+  PARAMETERS 
 
    IN
         pvosGCtx    VOS context
@@ -1434,22 +1548,22 @@
         pCallbackContext            WDI calls callback function with it
                                     VOS global context pointer
    OUT
-        uAvailableTxBuf       available TX PDU numbder.
+        uAvailableTxBuf       available TX PDU numbder. 
                               BAL returns it for NON integrated SOC
-
+   
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
-  SIDE EFFECTS
-
+  SIDE EFFECTS 
+  
 ============================================================================*/
-VOS_STATUS
-WDA_DS_Register
-(
-  v_PVOID_t                 pvosGCtx,
+VOS_STATUS 
+WDA_DS_Register 
+( 
+  v_PVOID_t                 pvosGCtx, 
   WDA_DS_TxCompleteCallback pfnTxCompleteCallback,
-  WDA_DS_RxPacketCallback   pfnRxPacketCallback,
+  WDA_DS_RxPacketCallback   pfnRxPacketCallback, 
   WDA_DS_TxPacketCallback   pfnTxPacketCallback,
   WDA_DS_ResourceCB         pfnResourceCB,
   v_U32_t                   uResTheshold,
@@ -1460,27 +1574,27 @@
 /*==========================================================================
   FUNCTION    WDA_DS_StartXmit
 
-  DESCRIPTION
-    Serialize TX transmit reques to TX thread.
+  DESCRIPTION 
+    Serialize TX transmit reques to TX thread. 
 
   TODO This sends TX transmit request to TL. It should send to WDI for
          abstraction.
 
     For NON integrated SOC, this function calls WLANBAL_StartXmit
 
-  DEPENDENCIES
-
-  PARAMETERS
+  DEPENDENCIES 
+     
+  PARAMETERS 
 
    IN
         pvosGCtx    VOS context
-
+   
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
-  SIDE EFFECTS
-
+  SIDE EFFECTS 
+  
 ============================================================================*/
 VOS_STATUS
 WDA_DS_StartXmit
@@ -1491,22 +1605,22 @@
 /*==========================================================================
   FUNCTION    WDA_DS_FinishULA
 
-  DESCRIPTION
-    Serialize Finish Upper Level Authentication reques to TX thread.
+  DESCRIPTION 
+    Serialize Finish Upper Level Authentication reques to TX thread. 
 
-  DEPENDENCIES
-
-  PARAMETERS
+  DEPENDENCIES 
+     
+  PARAMETERS 
 
    IN
         callbackRoutine    routine to be called in TX thread
-        callbackContext    user data for the above routine
-
+        callbackContext    user data for the above routine 
+   
   RETURN VALUE
     please see vos_tx_mq_serialize
 
-  SIDE EFFECTS
-
+  SIDE EFFECTS 
+  
 ============================================================================*/
 VOS_STATUS
 WDA_DS_FinishULA
@@ -1520,10 +1634,10 @@
 
   DESCRIPTION
     Build TX meta info for integrated SOC.
-
+    
     Same function calls HAL for reserve BD header space into VOS packet and
     HAL function to fill it.
-
+    
   DEPENDENCIES
 
   PARAMETERS
@@ -1549,7 +1663,7 @@
     *pusPktLen       Packet length
 
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
@@ -1581,7 +1695,7 @@
   DESCRIPTION
     Trim/Remove RX BD header for NON integrated SOC.
     It does nothing for integrated SOC.
-
+    
   DEPENDENCIES
 
   PARAMETERS
@@ -1590,7 +1704,7 @@
     vosDataBuff      vos data buffer
 
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
@@ -1598,7 +1712,7 @@
 ============================================================================*/
 VOS_STATUS
 WDA_DS_TrimRxPacketInfo
-(
+( 
   vos_pkt_t *vosDataBuff
 );
 
@@ -1610,19 +1724,19 @@
     Returning 0 will put TL in out-of-resource condition for TX.
 
     Return current PDU resources from BAL for NON integrated SOC.
-
+    
   DEPENDENCIES
 
   PARAMETERS
 
    IN
     vosDataBuff      vos data buffer
-
+   
    OUT
     puResCount        available PDU number for TX
 
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
@@ -1630,7 +1744,7 @@
 ============================================================================*/
 VOS_STATUS
 WDA_DS_GetTxResources
-(
+( 
   v_PVOID_t pvosGCtx,
   v_U32_t*  puResCount
 );
@@ -1639,7 +1753,7 @@
    FUNCTION    WDA_DS_GetRssi
 
   DESCRIPTION
-    Get RSSI
+    Get RSSI 
 
   TODO It returns hardcoded value in the meantime since WDA/WDI does nothing
        support it yet for Prima.
@@ -1655,7 +1769,7 @@
     puRssi           RSSI
 
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
@@ -1688,7 +1802,7 @@
    OUT
 
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
@@ -1710,7 +1824,7 @@
     back to BD header. So for NON integrated SOC, this function does
     the same.
 
-    For integrated SOC, WDI does the same, not TL.
+    For integrated SOC, WDI does the same, not TL. 
     It does return typeSubtype from RX meta info for integrated SOC.
 
   DEPENDENCIES
@@ -1726,7 +1840,7 @@
     ucTypeSubtype    typeSubtype
 
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
@@ -1788,7 +1902,7 @@
    OUT
 
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
@@ -1823,7 +1937,7 @@
    OUT
 
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
@@ -1831,8 +1945,8 @@
 ============================================================================*/
 VOS_STATUS
 WDA_DS_TxFrames
-(
-  v_PVOID_t pvosGCtx
+( 
+  v_PVOID_t pvosGCtx 
 );
 
 /*==========================================================================
@@ -1882,7 +1996,7 @@
                      Defined in WDA_TXFlowEnumType
 
   RETURN VALUE
-    VOS_STATUS_E_INVAL:  pointer is NULL and other errors
+    VOS_STATUS_E_INVAL:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
@@ -1900,7 +2014,7 @@
 
   DESCRIPTION
     Send Dump commandsto WDI
-
+    
   DEPENDENCIES
 
   PARAMETERS
@@ -1917,13 +2031,13 @@
        pBuffer          Dump command Response buffer
 
   RETURN VALUE
-    VOS_STATUS_E_FAULT:  pointer is NULL and other errors
+    VOS_STATUS_E_FAULT:  pointer is NULL and other errors 
     VOS_STATUS_SUCCESS:  Everything is good :)
 
   SIDE EFFECTS
 
 ============================================================================*/
-VOS_STATUS WDA_HALDumpCmdReq(tpAniSirGlobal   pMac,tANI_U32 cmd,
+VOS_STATUS WDA_HALDumpCmdReq(tpAniSirGlobal   pMac,tANI_U32 cmd, 
                  tANI_U32   arg1, tANI_U32   arg2, tANI_U32   arg3,
                  tANI_U32   arg4, tANI_U8   *pBuffer);
 
@@ -1945,7 +2059,7 @@
 
   RETURN VALUE
     NONE
-
+    
   SIDE EFFECTS
 ============================================================================*/
 void WDA_featureCapsExchange(v_PVOID_t pVosContext);
@@ -1971,7 +2085,7 @@
   RETURN VALUE
     0 - implies feature is NOT Supported
     any non zero value - implies feature is SUPPORTED
-
+    
   SIDE EFFECTS
 ============================================================================*/
 tANI_U8 WDA_getHostWlanFeatCaps(tANI_U8 featEnumValue);
@@ -1996,7 +2110,7 @@
   RETURN VALUE
     0 - implies feature is NOT Supported
     any non zero value - implies feature is SUPPORTED
-
+    
   SIDE EFFECTS
 ============================================================================*/
 tANI_U8 WDA_getFwWlanFeatCaps(tANI_U8 featEnumValue);
@@ -2126,5 +2240,4 @@
     tANI_U32   status;
 }tDisableUapsdParams, *tpDisableUapsdParams;
 
-VOS_STATUS WDA_SetIdlePsConfig(void *wda_handle, tANI_U32 idle_ps);
 #endif
diff --git a/CORE/WDA/src/wlan_qct_wda.c b/CORE/WDA/src/wlan_qct_wda.c
index 7a014a5..baed057 100644
--- a/CORE/WDA/src/wlan_qct_wda.c
+++ b/CORE/WDA/src/wlan_qct_wda.c
@@ -179,7 +179,7 @@
 static VOS_STATUS WDA_ProcessUpdateScanParams(tWDA_CbContext *pWDA, tSirUpdateScanParams *pUpdateScanParams);
 #endif // FEATURE_WLAN_SCAN_PNO
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-VOS_STATUS WDA_ProcessStartRoamCandidatelookupReq(tWDA_CbContext *pWDA,tSirRoamOffloadScanReq *pRoamOffloadScanReqParams);
+VOS_STATUS WDA_ProcessRoamScanOffloadReq(tWDA_CbContext *pWDA,tSirRoamOffloadScanReq *pRoamOffloadScanReqParams);
 void WDA_RoamOffloadScanReqCallback(WDI_Status status, void* pUserData);
 void WDA_ConvertSirAuthToWDIAuth(WDI_AuthType *AuthType, v_U8_t csrAuthType);
 void WDA_ConvertSirEncToWDIEnc(WDI_EdType *EncrType, v_U8_t csrEncrType);
@@ -222,6 +222,19 @@
                                    tUpdateVHTOpMode *pData);
 #endif
 
+#ifdef FEATURE_WLAN_LPHB
+VOS_STATUS WDA_ProcessLPHBConfReq(tWDA_CbContext *pWDA,
+                                  tSirLPHBReq *pData);
+#endif /* FEATURE_WLAN_LPHB */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+void WDA_IBSSPeerInfoRequestHandler(v_PVOID_t pVosContext,
+                                                v_PVOID_t pData);
+
+VOS_STATUS WDA_ProcessIBSSRouteTableUpdateInd(tWDA_CbContext *pWDA,
+                                              tAniIbssRouteTable *pData);
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
 /*
  * FUNCTION: WDA_open
  * Allocate the WDA context 
@@ -494,6 +507,10 @@
          wdaContext->wdaTimersCreated = VOS_TRUE;
       }
    }
+   else
+   {
+      vos_event_init(&wdaContext->ftmStopDoneEvent);
+   }
    return status;
 }
 
@@ -514,6 +531,8 @@
    tANI_U32       configParamSize;
    tANI_U32       *configDataValue;
    WDI_WlanVersionType wcnssCompiledApiVersion;
+   tANI_U8        i;
+
    if ((NULL == pMac)||(NULL == wdaContext))
    {
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
@@ -1359,6 +1378,68 @@
    tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct 
                             + sizeof(tHalCfg) + tlvStruct->length) ; 
 
+   for (i = 0; i < QWLAN_HAL_CFG_MWS_COEX_MAX_VICTIM; i++)
+   {
+      /* [COEX] QWLAN_HAL_CFG_MWS_COEX_VX_WAN_FREQ */
+      tlvStruct->type = QWLAN_HAL_CFG_MWS_COEX_V1_WAN_FREQ + i*4;
+      tlvStruct->length = sizeof(tANI_U32);
+      configDataValue = (tANI_U32 *)(tlvStruct + 1);
+      *configDataValue = pMac->btc.btcConfig.mwsCoexVictimWANFreq[i];
+      tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                               + sizeof(tHalCfg) + tlvStruct->length) ;
+
+      /* [COEX] QWLAN_HAL_CFG_MWS_COEX_VX_WLAN_FREQ */
+      tlvStruct->type = QWLAN_HAL_CFG_MWS_COEX_V1_WLAN_FREQ + i*4;
+      tlvStruct->length = sizeof(tANI_U32);
+      configDataValue = (tANI_U32 *)(tlvStruct + 1);
+      *configDataValue = pMac->btc.btcConfig.mwsCoexVictimWLANFreq[i];
+      tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                               + sizeof(tHalCfg) + tlvStruct->length) ;
+
+      /* [COEX] QWLAN_HAL_CFG_MWS_COEX_VX_CONFIG */
+      tlvStruct->type = QWLAN_HAL_CFG_MWS_COEX_V1_CONFIG + i*4;
+      tlvStruct->length = sizeof(tANI_U32);
+      configDataValue = (tANI_U32 *)(tlvStruct + 1);
+      *configDataValue = pMac->btc.btcConfig.mwsCoexVictimConfig[i];
+      tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                               + sizeof(tHalCfg) + tlvStruct->length) ;
+
+      /* [COEX] QWLAN_HAL_CFG_MWS_COEX_VX_CONFIG2 */
+      tlvStruct->type = QWLAN_HAL_CFG_MWS_COEX_V1_CONFIG2 + i*4;
+      tlvStruct->length = sizeof(tANI_U32);
+      configDataValue = (tANI_U32 *)(tlvStruct + 1);
+      *configDataValue = pMac->btc.btcConfig.mwsCoexVictimConfig2[i];
+      tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                               + sizeof(tHalCfg) + tlvStruct->length) ;
+   }
+
+   /* [COEX] QWLAN_HAL_CFG_MWS_COEX_MODEM_BACKOFF */
+   tlvStruct->type = QWLAN_HAL_CFG_MWS_COEX_MODEM_BACKOFF  ;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   *configDataValue = pMac->btc.btcConfig.mwsCoexModemBackoff;
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length) ;
+
+   for (i = 0; i < QWLAN_HAL_CFG_MWS_COEX_MAX_CONFIG; i++)
+   {
+      /* [COEX] QWLAN_HAL_CFG_MWS_COEX_CONFIGX */
+      tlvStruct->type = QWLAN_HAL_CFG_MWS_COEX_CONFIG1 + i;
+      tlvStruct->length = sizeof(tANI_U32);
+      configDataValue = (tANI_U32 *)(tlvStruct + 1);
+      *configDataValue = pMac->btc.btcConfig.mwsCoexConfig[i];
+      tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                               + sizeof(tHalCfg) + tlvStruct->length) ;
+   }
+
+   /* [COEX] QWLAN_HAL_CFG_SAR_POWER_BACKOFF */
+   tlvStruct->type = QWLAN_HAL_CFG_SAR_POWER_BACKOFF  ;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   *configDataValue = pMac->btc.btcConfig.SARPowerBackoff;
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length) ;
+
    /* QWLAN_HAL_CFG_WCNSS_API_VERSION */
    tlvStruct->type = QWLAN_HAL_CFG_WCNSS_API_VERSION  ;
    tlvStruct->length = sizeof(tANI_U32);
@@ -1475,6 +1556,119 @@
 
    tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
                             + sizeof(tHalCfg) + tlvStruct->length) ;
+#ifdef FEATURE_WLAN_TDLS
+   /* QWLAN_HAL_CFG_TDLS_PUAPSD_MASK  */
+   tlvStruct->type = QWLAN_HAL_CFG_TDLS_PUAPSD_MASK;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   if(wlan_cfgGetInt(pMac, WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK,
+                                            configDataValue ) != eSIR_SUCCESS)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failed to get value for WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK");
+      goto handle_failure;
+   }
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length) ;
+
+   /* QWLAN_HAL_CFG_TDLS_PUAPSD_BUFFER_STA_CAPABLE  */
+   tlvStruct->type = QWLAN_HAL_CFG_TDLS_PUAPSD_BUFFER_STA_CAPABLE;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   if(wlan_cfgGetInt(pMac, WNI_CFG_TDLS_BUF_STA_ENABLED,
+                                            configDataValue ) != eSIR_SUCCESS)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failed to get value for WNI_CFG_TDLS_BUF_STA_ENABLED");
+      goto handle_failure;
+   }
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length) ;
+   /* QWLAN_HAL_CFG_TDLS_PUAPSD_INACTIVITY_TIME */
+   tlvStruct->type = QWLAN_HAL_CFG_TDLS_PUAPSD_INACTIVITY_TIME;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   if(wlan_cfgGetInt(pMac, WNI_CFG_TDLS_PUAPSD_INACT_TIME,
+                                            configDataValue ) != eSIR_SUCCESS)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failed to get value for WNI_CFG_TDLS_PUAPSD_INACT_TIME");
+      goto handle_failure;
+   }
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length) ;
+   /* QWLAN_HAL_CFG_TDLS_PUAPSD_RX_FRAME_THRESHOLD_IN_SP */
+   tlvStruct->type = QWLAN_HAL_CFG_TDLS_PUAPSD_RX_FRAME_THRESHOLD_IN_SP;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   if(wlan_cfgGetInt(pMac, WNI_CFG_TDLS_RX_FRAME_THRESHOLD,
+                                            configDataValue ) != eSIR_SUCCESS)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failed to get value for WNI_CFG_TDLS_RX_FRAME_THRESHOLD");
+      goto handle_failure;
+   }
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length) ;
+#endif
+
+   /* QWLAN_HAL_CFG_ENABLE_ADAPTIVE_RX_DRAIN  */
+   tlvStruct->type = QWLAN_HAL_CFG_ENABLE_ADAPTIVE_RX_DRAIN_FEATURE ;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   if(wlan_cfgGetInt(pMac, WNI_CFG_ENABLE_ADAPT_RX_DRAIN,
+                                            configDataValue ) != eSIR_SUCCESS)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failed to get value for WNI_CFG_ENABLE_ADAPT_RX_DRAIN");
+      goto handle_failure;
+   }
+
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length) ;
+
+   /* QWLAN_HAL_CFG_FLEX_CONNECT_POWER_FACTOR */
+   tlvStruct->type = QWLAN_HAL_CFG_FLEXCONNECT_POWER_FACTOR;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   if(wlan_cfgGetInt(pMac, WNI_CFG_FLEX_CONNECT_POWER_FACTOR, configDataValue)
+                                                               != eSIR_SUCCESS)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "Failed to get value for WNI_CFG_FLEX_CONNECT_POWER_FACTOR");
+      goto handle_failure;
+   }
+   tlvStruct = (tHalCfg *)(((tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length));
+
+   /* QWLAN_HAL_CFG_ANTENNA_DIVERSITY */
+   tlvStruct->type = QWLAN_HAL_CFG_ANTENNA_DIVERSITY;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   if (wlan_cfgGetInt(pMac, WNI_CFG_ANTENNA_DIVESITY,
+                                            configDataValue ) != eSIR_SUCCESS)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failed to get value for WNI_CFG_ANTENNA_DIVESITY");
+      goto handle_failure;
+   }
+
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length) ;
+
+   /* QWLAN_HAL_CFG_GO_LINK_MONITOR_TIMEOUT   */
+   tlvStruct->type = QWLAN_HAL_CFG_GO_LINK_MONITOR_TIMEOUT  ;
+   tlvStruct->length = sizeof(tANI_U32);
+   configDataValue = (tANI_U32 *)(tlvStruct + 1);
+   if(wlan_cfgGetInt(pMac, WNI_CFG_GO_LINK_MONITOR_TIMEOUT,
+                                            configDataValue ) != eSIR_SUCCESS)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failed to get value for WNI_CFG_GO_LINK_MONITOR_TIMEOUT");
+      goto handle_failure;
+   }
+   tlvStruct = (tHalCfg *)( (tANI_U8 *) tlvStruct
+                            + sizeof(tHalCfg) + tlvStruct->length) ;
 
    wdiStartParams->usConfigBufferLen = (tANI_U8 *)tlvStruct - tlvStructStart ;
 #ifdef WLAN_DEBUG
@@ -1554,6 +1748,18 @@
       wdaContext->wdaState = WDA_STOP_STATE;
    }
 
+   /* FTM Driver stop procedure should be synced.
+    * Stop and Close will happen on same context */
+   if (eDRIVER_TYPE_MFG == wdaContext->driverMode)
+   {
+      if (VOS_STATUS_SUCCESS != vos_event_set(&wdaContext->ftmStopDoneEvent))
+      {
+         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   "%s: FTM Stop Event Set Fail", __func__);
+         VOS_ASSERT(0);
+      }
+   }
+
    /* Indicate VOSS about the start complete */
    vos_WDAComplete_cback(wdaContext->pVosContext);
 
@@ -1638,6 +1844,21 @@
       vos_mem_free(pWdaParams);
       status = VOS_STATUS_E_FAILURE;
    }
+
+   /* FTM Driver stop procedure should be synced.
+    * Stop and Close will happen on same context */
+   if (eDRIVER_TYPE_MFG == pWDA->driverMode)
+   {
+      status = vos_wait_single_event(&pWDA->ftmStopDoneEvent,
+                                     WDI_RESPONSE_TIMEOUT);
+      if (status != VOS_STATUS_SUCCESS)
+      {
+         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                   "%s: FTM Stop Timepoout", __func__);
+         VOS_ASSERT(0);
+         vos_event_reset(&pWDA->ftmStopDoneEvent);
+      }
+   }
    return status;
 }
 /*
@@ -2896,12 +3117,20 @@
                                          tAddBssParams* configBssReqParam)
 {
    WDI_Status status = WDI_STATUS_SUCCESS ;
-   WDI_ConfigBSSReqParamsType *wdiConfigBssReqParam =
-                             (WDI_ConfigBSSReqParamsType *)vos_mem_malloc(
-                                   sizeof(WDI_ConfigBSSReqParamsType)) ;
+   WDI_ConfigBSSReqParamsType *wdiConfigBssReqParam;
    tWDA_ReqParams *pWdaParams ;
    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
                                           "------> %s " ,__func__);
+   if (NULL == configBssReqParam)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_FATAL,
+                           "%s: configBssReqParam is NULL", __func__);
+      return VOS_STATUS_E_INVAL;
+   }
+
+   wdiConfigBssReqParam = (WDI_ConfigBSSReqParamsType *)vos_mem_malloc(
+                          sizeof(WDI_ConfigBSSReqParamsType)) ;
+
    if(NULL == wdiConfigBssReqParam) 
    {
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
@@ -3428,6 +3657,7 @@
    }
    wdiAddStaSelfReq->wdiReqStatusCB = NULL;
    vos_mem_copy( wdiAddStaSelfReq->wdiAddSTASelfInfo.selfMacAddr, pAddStaSelfReq->selfMacAddr, 6);
+   wdiAddStaSelfReq->wdiAddSTASelfInfo.currDeviceMode = pAddStaSelfReq->currDeviceMode;
    /* Store Init Req pointer, as this will be used for response */
    /* store Params pass it to WDI */
    pWdaParams->pWdaContext = pWDA;
@@ -4867,7 +5097,6 @@
    pGetPEStatsRspParams->msgType = wdiGetStatsRsp->usMsgType;
    pGetPEStatsRspParams->msgLen = sizeof(tAniGetPEStatsRsp) + 
                    (wdiGetStatsRsp->usMsgLen - sizeof(WDI_GetStatsRspParamsType));
-   pGetPEStatsRspParams->msgLen  = wdiGetStatsRsp->usMsgLen + sizeof(tANI_U8);
 
   //Fill the Session Id Properly in PE
    pGetPEStatsRspParams->sessionId = 0;
@@ -5042,10 +5271,10 @@
           VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
                            "%s: VOS MEM Alloc Failure", __func__);
           VOS_ASSERT(0);
-          vos_mem_free(pGetRoamRssiParams);
-          vos_mem_free(pWdaParams);
           return VOS_STATUS_E_NOMEM;
       }
+      vos_mem_free(pGetRoamRssiParams);
+      vos_mem_free(pWdaParams);
       pGetRoamRssiRspParams->staId = pGetRoamRssiParams->staId;
       pGetRoamRssiRspParams->rc    = eSIR_FAILURE;
       pGetRoamRssiRspParams->rssi    = 0;
@@ -5115,7 +5344,16 @@
       return VOS_STATUS_E_NOMEM;
    }
    wdiEdcaParam->wdiEDCAInfo.ucBssIdx = pEdcaParams->bssIdx;
-   wdiEdcaParam->wdiEDCAInfo.ucEDCAParamsValid = pEdcaParams->highPerformance;
+   /*
+    Since firmware is not using highperformance flag, we have removed
+    this flag from wdiEDCAInfo structure to match sizeof the structure
+    between host and firmware.In future if we are planning to use
+    highperformance flag then Please define this flag  in wdiEDCAInfo
+    structure, update it here and send it to firmware. i.e.
+    Following is the original line which we removed as part of the fix
+    wdiEdcaParam->wdiEDCAInfo.ucEDCAParamsValid =
+                  pEdcaParams->highPerformance;
+   */
    WDA_UpdateEdcaParamsForAC(pWDA, &wdiEdcaParam->wdiEDCAInfo.wdiEdcaBEInfo,
                                                            &pEdcaParams->acbe);
    WDA_UpdateEdcaParamsForAC(pWDA, &wdiEdcaParam->wdiEDCAInfo.wdiEdcaBKInfo,
@@ -5857,7 +6095,8 @@
 {
    tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData; 
    tWDA_CbContext *pWDA = NULL; 
-   tTSMStats *pTsmRspParams = NULL;
+   tpAniGetTsmStatsRsp pTsmRspParams = NULL;
+   tpAniGetTsmStatsReq  pGetTsmStatsReqParams = NULL;
  
    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
                                           "<------ Entering: %s " ,__func__);
@@ -5869,7 +6108,18 @@
       return ;
    }
    pWDA = (tWDA_CbContext *) pWdaParams->pWdaContext;
-   pTsmRspParams = (tTSMStats *)pWdaParams->wdaMsgParam ;
+   pGetTsmStatsReqParams = (tAniGetTsmStatsReq *)pWdaParams->wdaMsgParam;
+   if(NULL == pGetTsmStatsReqParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                  "%s: pGetTsmStatsReqParams received NULL", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams);
+      return;
+   }
+   pTsmRspParams =
+     (tAniGetTsmStatsRsp *)vos_mem_malloc(sizeof(tAniGetTsmStatsRsp));
    if( NULL == pTsmRspParams )
    {
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
@@ -5877,9 +6127,11 @@
       VOS_ASSERT( 0 );
       return ;
    }
-   vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
-   vos_mem_free(pWdaParams);
    
+   vos_mem_set(pTsmRspParams, sizeof(tAniGetTsmStatsRsp), 0);
+   pTsmRspParams->rc = pwdiTSMStatsRspParams->wdiStatus;
+   pTsmRspParams->staId = pGetTsmStatsReqParams->staId;
+
    pTsmRspParams->tsmMetrics.UplinkPktQueueDly = pwdiTSMStatsRspParams->UplinkPktQueueDly;
    vos_mem_copy(pTsmRspParams->tsmMetrics.UplinkPktQueueDlyHist,
                  pwdiTSMStatsRspParams->UplinkPktQueueDlyHist,
@@ -5890,6 +6142,13 @@
    pTsmRspParams->tsmMetrics.UplinkPktCount = pwdiTSMStatsRspParams->UplinkPktCount;
    pTsmRspParams->tsmMetrics.RoamingCount = pwdiTSMStatsRspParams->RoamingCount;
    pTsmRspParams->tsmMetrics.RoamingDly = pwdiTSMStatsRspParams->RoamingDly;
+
+   /* Assign get tsm stats req req (backup) in to the response */
+   pTsmRspParams->tsmStatsReq = pGetTsmStatsReqParams;
+   /* free WDI command buffer */
+   vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+   vos_mem_free(pWdaParams);
+
    WDA_SendMsg(pWDA, WDA_TSM_STATS_RSP, (void *)pTsmRspParams , 0) ;
    return ;
 }
@@ -5900,11 +6159,13 @@
  * Request to WDI to get the TSM Stats params.
  */ 
 VOS_STATUS WDA_ProcessTsmStatsReq(tWDA_CbContext *pWDA, 
-                                    tTSMStats *pTsmStats)
+                                  tpAniGetTsmStatsReq pTsmStats)
 {
-   WDI_Status status = WDI_STATUS_SUCCESS ;
+   WDI_Status                status = WDI_STATUS_SUCCESS ;
    WDI_TSMStatsReqParamsType *wdiTSMReqParam = NULL;
-   tWDA_ReqParams *pWdaParams = NULL;
+   tWDA_ReqParams            *pWdaParams = NULL;
+   tAniGetTsmStatsRsp        *pGetTsmStatsRspParams = NULL;
+
    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
                                           "------> Entering: %s " ,__func__);
    wdiTSMReqParam = (WDI_TSMStatsReqParamsType *)vos_mem_malloc(
@@ -5934,17 +6195,28 @@
    pWdaParams->pWdaContext = pWDA;
    /* Store TSM Stats pointer, as this will be used for response */
    pWdaParams->wdaMsgParam = (void *)pTsmStats ;
-   /* store Params pass it to WDI */
-   pWdaParams->wdaWdiApiMsgParam = (void *)wdiTSMReqParam ;
+   pWdaParams->wdaWdiApiMsgParam = NULL ;
    status = WDI_TSMStatsReq(wdiTSMReqParam,
                            (WDI_TsmRspCb)WDA_TSMStatsReqCallback, pWdaParams);
    if(IS_WDI_STATUS_FAILURE(status))
    {
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
              "Failure in TSM STATS REQ Params WDI API, free all the memory " );
-      vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
-      vos_mem_free(pWdaParams) ;
-      WDA_SendMsg(pWDA, WDA_TSM_STATS_RSP, (void *)pTsmStats , 0) ;
+      vos_mem_free(pWdaParams);
+      pGetTsmStatsRspParams =
+         (tAniGetTsmStatsRsp *)vos_mem_malloc(sizeof(tAniGetTsmStatsRsp));
+      if(NULL == pGetTsmStatsRspParams)
+      {
+          VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+          VOS_ASSERT(0);
+          vos_mem_free(pTsmStats);
+          return VOS_STATUS_E_NOMEM;
+      }
+      pGetTsmStatsRspParams->staId = pTsmStats->staId;
+      pGetTsmStatsRspParams->rc    = eSIR_FAILURE;
+      pGetTsmStatsRspParams->tsmStatsReq = pTsmStats;
+      WDA_SendMsg(pWDA, WDA_TSM_STATS_RSP, (void*)pGetTsmStatsRspParams, 0);
    }
   return CONVERT_WDI2VOS_STATUS(status) ;
 } 
@@ -6170,6 +6442,114 @@
 #endif
 
 /*
+ * FUNCTION: WDA_SetMaxTxPowerPerBandCallBack
+ * send the response to PE with power value received from WDI
+ */
+void WDA_SetMaxTxPowerPerBandCallBack(WDI_SetMaxTxPowerPerBandRspMsg
+                                      *pwdiSetMaxTxPowerPerBandRsp,
+                                      void* pUserData)
+{
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   tWDA_CbContext *pWDA = NULL;
+   tMaxTxPowerPerBandParams *pMxTxPwrPerBandParams = NULL;
+
+   VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+             "<------ %s ", __func__);
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0);
+      return ;
+   }
+   pWDA = (tWDA_CbContext *) pWdaParams->pWdaContext;
+   pMxTxPwrPerBandParams = (tMaxTxPowerPerBandParams*)pWdaParams->wdaMsgParam;
+   if ( NULL == pMxTxPwrPerBandParams )
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: pMxTxPwrPerBandParams received NULL ", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams);
+      return;
+   }
+
+  /*need to free memory for the pointers used in the
+    WDA Process.Set Max Tx Power Req function*/
+   vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+   vos_mem_free(pWdaParams);
+   pMxTxPwrPerBandParams->power = pwdiSetMaxTxPowerPerBandRsp->ucPower;
+
+  /* send response to UMAC*/
+   WDA_SendMsg(pWDA, WDA_SET_MAX_TX_POWER_PER_BAND_RSP,
+               pMxTxPwrPerBandParams, 0);
+
+   return;
+}
+
+/*
+ * FUNCTION: WDA_ProcessSetMaxTxPowerPerBandReq
+ * Request to WDI to send set Max Tx Power Per band Request
+ */
+ VOS_STATUS WDA_ProcessSetMaxTxPowerPerBandReq(tWDA_CbContext *pWDA,
+                                               tMaxTxPowerPerBandParams
+                                               *MaxTxPowerPerBandParams)
+{
+   WDI_Status status = WDI_STATUS_SUCCESS;
+   WDI_SetMaxTxPowerPerBandParamsType *wdiSetMxTxPwrPerBandParams = NULL;
+   tWDA_ReqParams *pWdaParams = NULL;
+
+   VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+             "------> %s ", __func__);
+
+   wdiSetMxTxPwrPerBandParams = vos_mem_malloc(
+                                sizeof(WDI_SetMaxTxPowerPerBandParamsType));
+
+   if (NULL == wdiSetMxTxPwrPerBandParams)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      return VOS_STATUS_E_NOMEM;
+   }
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams));
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: VOS MEM Alloc Failure", __func__);
+      vos_mem_free(wdiSetMxTxPwrPerBandParams);
+      VOS_ASSERT(0);
+      return VOS_STATUS_E_NOMEM;
+   }
+   /* Copy.Max.Tx.Power.Per.Band Params to WDI structure */
+   wdiSetMxTxPwrPerBandParams->wdiMaxTxPowerPerBandInfo.bandInfo = \
+                               MaxTxPowerPerBandParams->bandInfo;
+   wdiSetMxTxPwrPerBandParams->wdiMaxTxPowerPerBandInfo.ucPower = \
+                               MaxTxPowerPerBandParams->power;
+   wdiSetMxTxPwrPerBandParams->wdiReqStatusCB = NULL;
+   pWdaParams->pWdaContext = pWDA;
+   pWdaParams->wdaMsgParam = (void *)MaxTxPowerPerBandParams;
+   /* store Params pass it to WDI */
+   pWdaParams->wdaWdiApiMsgParam = (void *)wdiSetMxTxPwrPerBandParams;
+   status = WDI_SetMaxTxPowerPerBandReq(wdiSetMxTxPwrPerBandParams,
+                                        WDA_SetMaxTxPowerPerBandCallBack,
+                                        pWdaParams);
+   if (IS_WDI_STATUS_FAILURE(status))
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "Failure in SET MAX TX Power REQ Params WDI API,"
+                " free all the memory");
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams);
+      /* send response to UMAC*/
+      WDA_SendMsg(pWDA,
+                  WDA_SET_MAX_TX_POWER_PER_BAND_RSP,
+                  MaxTxPowerPerBandParams, 0);
+   }
+   return CONVERT_WDI2VOS_STATUS(status);
+}
+
+/*
  * FUNCTION: WDA_SetTxPowerCallBack
  * send the response to PE with power value received from WDI
  */
@@ -6367,6 +6747,121 @@
    return CONVERT_WDI2VOS_STATUS(status);
 
 }
+
+#ifdef FEATURE_WLAN_TDLS
+/*
+ * FUNCTION: WDA_SetP2PGONOAReqParamsCallback
+ *  Free the memory. No need to send any response to PE in this case
+ */
+void WDA_SetTDLSLinkEstablishReqParamsCallback(WDI_SetTdlsLinkEstablishReqResp *wdiSetTdlsLinkEstablishReqRsp,
+                                               void* pUserData)
+{
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   tWDA_CbContext *pWDA = NULL;
+   tTdlsLinkEstablishParams *pTdlsLinkEstablishParams;
+
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "<------ %s " ,__func__);
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return ;
+   }
+   pWDA = (tWDA_CbContext *) pWdaParams->pWdaContext;
+
+   if(NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return ;
+   }
+   pTdlsLinkEstablishParams = (tTdlsLinkEstablishParams *)pWdaParams->wdaMsgParam ;
+   if( NULL == pTdlsLinkEstablishParams )
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                                          "%s: pTdlsLinkEstablishParams "
+                                          "received NULL " ,__func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams);
+      return ;
+   }
+   pTdlsLinkEstablishParams->status = CONVERT_WDI2SIR_STATUS(
+                                               wdiSetTdlsLinkEstablishReqRsp->wdiStatus);
+   vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
+   vos_mem_free(pWdaParams);
+   /* send response to UMAC*/
+   WDA_SendMsg(pWDA, WDA_SET_TDLS_LINK_ESTABLISH_REQ_RSP, pTdlsLinkEstablishParams, 0) ;
+
+   return ;
+}
+
+VOS_STATUS WDA_ProcessSetTdlsLinkEstablishReq(tWDA_CbContext *pWDA,
+                                              tTdlsLinkEstablishParams *pTdlsLinkEstablishParams)
+{
+    WDI_Status status = WDI_STATUS_SUCCESS ;
+    WDI_SetTDLSLinkEstablishReqParamsType *wdiSetTDLSLinkEstablishReqParam =
+                                      (WDI_SetTDLSLinkEstablishReqParamsType *)vos_mem_malloc(
+                                           sizeof(WDI_SetTDLSLinkEstablishReqParamsType)) ;
+    tWDA_ReqParams *pWdaParams = NULL;
+    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+               "------> %s " ,__func__);
+    if(NULL == wdiSetTDLSLinkEstablishReqParam)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                   "%s: VOS MEM Alloc Failure", __func__);
+        VOS_ASSERT(0);
+        return VOS_STATUS_E_NOMEM;
+    }
+    pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams)) ;
+    if(NULL == pWdaParams)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                   "%s: VOS MEM Alloc Failure", __func__);
+        vos_mem_free(pTdlsLinkEstablishParams);
+        vos_mem_free(wdiSetTDLSLinkEstablishReqParam);
+        VOS_ASSERT(0);
+        return VOS_STATUS_E_NOMEM;
+    }
+    wdiSetTDLSLinkEstablishReqParam->wdiTDLSLinkEstablishInfo.uStaIdx =
+                                                  pTdlsLinkEstablishParams->staIdx;
+    wdiSetTDLSLinkEstablishReqParam->wdiTDLSLinkEstablishInfo.uIsResponder =
+                                                  pTdlsLinkEstablishParams->isResponder;
+    wdiSetTDLSLinkEstablishReqParam->wdiTDLSLinkEstablishInfo.uUapsdQueues =
+                                                  pTdlsLinkEstablishParams->uapsdQueues;
+    wdiSetTDLSLinkEstablishReqParam->wdiTDLSLinkEstablishInfo.uMaxSp =
+                                                  pTdlsLinkEstablishParams->maxSp;
+    wdiSetTDLSLinkEstablishReqParam->wdiTDLSLinkEstablishInfo.uIsBufSta =
+                                                  pTdlsLinkEstablishParams->isBufsta;
+
+    wdiSetTDLSLinkEstablishReqParam->wdiReqStatusCB = NULL ;
+    /* Store msg pointer from PE, as this will be used for response */
+    pWdaParams->wdaMsgParam = (void *)pTdlsLinkEstablishParams ;
+    /* store Params pass it to WDI */
+    pWdaParams->wdaWdiApiMsgParam = (void *)wdiSetTDLSLinkEstablishReqParam ;
+    pWdaParams->pWdaContext = pWDA;
+
+    status = WDI_SetTDLSLinkEstablishReq(wdiSetTDLSLinkEstablishReqParam,
+                                         (WDI_SetTDLSLinkEstablishReqParamsRspCb)
+                                         WDA_SetTDLSLinkEstablishReqParamsCallback,
+                                         pWdaParams);
+    if(IS_WDI_STATUS_FAILURE(status))
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                   "Failure in Set P2P GO NOA Req WDI API, free all the memory " );
+        vos_mem_free(pWdaParams->wdaWdiApiMsgParam) ;
+        vos_mem_free(pWdaParams->wdaMsgParam);
+        vos_mem_free(pWdaParams);
+    }
+    return CONVERT_WDI2VOS_STATUS(status);
+}
+#endif
+
+
 #ifdef WLAN_FEATURE_VOWIFI_11R
 /*
  * FUNCTION: WDA_AggrAddTSReqCallback
@@ -8908,6 +9403,9 @@
       vos_mem_free(wdiWowlEnterInfo);
       return VOS_STATUS_E_NOMEM;
    }
+
+   vos_mem_zero(pWdaParams, sizeof(tWDA_ReqParams));
+
    vos_mem_copy(wdiWowlEnterInfo->wdiWowlEnterInfo.magicPtrn,
                 pWowlEnterParams->magicPtrn,
                 sizeof(tSirMacAddr));
@@ -9159,7 +9657,8 @@
    }
    
    /* Get the NV structure base address and size from VOS */
-   vos_nv_getNVBuffer(&pNvBuffer,&bufferSize);
+   vos_nv_getNVEncodedBuffer(&pNvBuffer,&bufferSize);
+
    wdiNvDownloadReqParam = (WDI_NvDownloadReqParamsType *)vos_mem_malloc(
                                           sizeof(WDI_NvDownloadReqParamsType)) ;
    if(NULL == wdiNvDownloadReqParam) 
@@ -9794,7 +10293,7 @@
    tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
    tWDA_CbContext *pWDA;
    tpSirGtkOffloadGetInfoRspParams pGtkOffloadGetInfoReq;
-   tpSirGtkOffloadGetInfoRspParams pGtkOffloadGetInfoRsp = vos_mem_malloc(sizeof(tpSirGtkOffloadGetInfoRspParams)) ;
+   tpSirGtkOffloadGetInfoRspParams pGtkOffloadGetInfoRsp = vos_mem_malloc(sizeof(tSirGtkOffloadGetInfoRspParams)) ;
    vos_msg_t vosMsg;
 
    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
@@ -9810,7 +10309,7 @@
 
    /* Message Header */
    pGtkOffloadGetInfoRsp->mesgType = eWNI_PMC_GTK_OFFLOAD_GETINFO_RSP;
-   pGtkOffloadGetInfoRsp->mesgLen = sizeof(tpSirGtkOffloadGetInfoRspParams);
+   pGtkOffloadGetInfoRsp->mesgLen = sizeof(tSirGtkOffloadGetInfoRspParams);
 
    pGtkOffloadGetInfoRsp->ulStatus            = pwdiGtkOffloadGetInfoRsparams->ulStatus;
    pGtkOffloadGetInfoRsp->ullKeyReplayCounter = pwdiGtkOffloadGetInfoRsparams->ullKeyReplayCounter;
@@ -10100,6 +10599,382 @@
 #endif // WLAN_FEATURE_GTK_OFFLOAD
 
 /*
+ * FUNCTION: WDA_ProcessAddPeriodicTxPtrnInd
+ *
+ */
+VOS_STATUS WDA_ProcessAddPeriodicTxPtrnInd(tWDA_CbContext *pWDA,
+                               tSirAddPeriodicTxPtrn *pAddPeriodicTxPtrnParams)
+{
+   WDI_Status wdiStatus;
+   WDI_AddPeriodicTxPtrnParamsType *addPeriodicTxPtrnParams;
+
+   addPeriodicTxPtrnParams =
+      vos_mem_malloc(sizeof(WDI_AddPeriodicTxPtrnParamsType));
+
+   if (NULL == addPeriodicTxPtrnParams)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: Not able to allocate memory for addPeriodicTxPtrnParams!",
+                __func__);
+
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   vos_mem_copy(&(addPeriodicTxPtrnParams->wdiAddPeriodicTxPtrnParams),
+                pAddPeriodicTxPtrnParams, sizeof(tSirAddPeriodicTxPtrn));
+
+   addPeriodicTxPtrnParams->wdiReqStatusCB = WDA_WdiIndicationCallback;
+   addPeriodicTxPtrnParams->pUserData = pWDA;
+
+   wdiStatus = WDI_AddPeriodicTxPtrnInd(addPeriodicTxPtrnParams);
+
+   if (WDI_STATUS_PENDING == wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                "Pending received for %s:%d", __func__, __LINE__ );
+   }
+   else if (WDI_STATUS_SUCCESS_SYNC != wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "Failure in %s:%d", __func__, __LINE__ );
+   }
+
+   vos_mem_free(addPeriodicTxPtrnParams);
+
+   return CONVERT_WDI2VOS_STATUS(wdiStatus);
+}
+
+/*
+ * FUNCTION: WDA_ProcessDelPeriodicTxPtrnInd
+ *
+ */
+VOS_STATUS WDA_ProcessDelPeriodicTxPtrnInd(tWDA_CbContext *pWDA,
+                               tSirDelPeriodicTxPtrn *pDelPeriodicTxPtrnParams)
+{
+   WDI_Status wdiStatus;
+   WDI_DelPeriodicTxPtrnParamsType *delPeriodicTxPtrnParams;
+
+   delPeriodicTxPtrnParams =
+      vos_mem_malloc(sizeof(WDI_DelPeriodicTxPtrnParamsType));
+
+   if (NULL == delPeriodicTxPtrnParams)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: Not able to allocate memory for delPeriodicTxPtrnParams!",
+                __func__);
+
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   vos_mem_copy(&(delPeriodicTxPtrnParams->wdiDelPeriodicTxPtrnParams),
+                pDelPeriodicTxPtrnParams, sizeof(tSirDelPeriodicTxPtrn));
+
+   delPeriodicTxPtrnParams->wdiReqStatusCB = WDA_WdiIndicationCallback;
+   delPeriodicTxPtrnParams->pUserData = pWDA;
+
+   wdiStatus = WDI_DelPeriodicTxPtrnInd(delPeriodicTxPtrnParams);
+
+   if (WDI_STATUS_PENDING == wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                "Pending received for %s:%d", __func__, __LINE__ );
+   }
+   else if (WDI_STATUS_SUCCESS_SYNC != wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "Failure in %s:%d", __func__, __LINE__ );
+   }
+
+   vos_mem_free(delPeriodicTxPtrnParams);
+
+   return CONVERT_WDI2VOS_STATUS(wdiStatus);
+}
+
+/*
+ * FUNCTION: WDA_ProcessRateUpdateInd
+ *
+ */
+VOS_STATUS WDA_ProcessRateUpdateInd(tWDA_CbContext *pWDA,
+                               tSirRateUpdateInd *pRateUpdateParams)
+{
+   WDI_Status wdiStatus;
+   WDI_RateUpdateIndParams rateUpdateParams;
+
+   vos_mem_copy(rateUpdateParams.bssid,
+            pRateUpdateParams->bssid, sizeof(tSirMacAddr));
+
+   rateUpdateParams.ucastDataRateTxFlag =
+                     pRateUpdateParams->ucastDataRateTxFlag;
+   rateUpdateParams.reliableMcastDataRateTxFlag =
+                     pRateUpdateParams->reliableMcastDataRateTxFlag;
+   rateUpdateParams.mcastDataRate24GHzTxFlag =
+                     pRateUpdateParams->mcastDataRate24GHzTxFlag;
+   rateUpdateParams.mcastDataRate5GHzTxFlag =
+                     pRateUpdateParams->mcastDataRate5GHzTxFlag;
+
+   rateUpdateParams.ucastDataRate = pRateUpdateParams->ucastDataRate;
+   rateUpdateParams.reliableMcastDataRate =
+                                 pRateUpdateParams->reliableMcastDataRate;
+   rateUpdateParams.mcastDataRate24GHz = pRateUpdateParams->mcastDataRate24GHz;
+   rateUpdateParams.mcastDataRate5GHz = pRateUpdateParams->mcastDataRate5GHz;
+
+   rateUpdateParams.wdiReqStatusCB = WDA_WdiIndicationCallback;
+   rateUpdateParams.pUserData = pWDA;
+
+   wdiStatus = WDI_RateUpdateInd(&rateUpdateParams);
+
+   if (WDI_STATUS_PENDING == wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                "Pending received for %s:%d", __func__, __LINE__ );
+   }
+   else if (WDI_STATUS_SUCCESS_SYNC != wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "Failure in %s:%d", __func__, __LINE__ );
+   }
+
+   vos_mem_free(pRateUpdateParams);
+
+   return CONVERT_WDI2VOS_STATUS(wdiStatus);
+}
+
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/*
+ * FUNCTION: WDA_ProcessStopBatchScanInd
+ *
+ * DESCRIPTION: This function sends stop batch scan inidcation message to WDI
+ *
+ * PARAM:
+ * pWDA: pointer to WDA context
+ * pReq: pointer to stop batch scan request
+ */
+VOS_STATUS WDA_ProcessStopBatchScanInd(tWDA_CbContext *pWDA,
+                               tSirStopBatchScanInd *pReq)
+{
+   WDI_Status wdiStatus;
+   WDI_StopBatchScanIndType wdiReq;
+
+   wdiReq.param = pReq->param;
+
+   wdiStatus = WDI_StopBatchScanInd(&wdiReq);
+
+   if (WDI_STATUS_SUCCESS_SYNC != wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "Stop batch scan ind failed %s:%d", __func__, wdiStatus);
+   }
+
+   vos_mem_free(pReq);
+
+   return CONVERT_WDI2VOS_STATUS(wdiStatus);
+}
+/*==========================================================================
+  FUNCTION WDA_ProcessTriggerBatchScanResultInd
+
+  DESCRIPTION
+    API to pull batch scan result from FW
+
+  PARAMETERS
+    pWDA: Pointer to WDA context
+    pGetBatchScanReq: Pointer to get batch scan result indication
+
+  RETURN VALUE
+    NONE
+
+===========================================================================*/
+VOS_STATUS WDA_ProcessTriggerBatchScanResultInd(tWDA_CbContext *pWDA,
+       tSirTriggerBatchScanResultInd *pReq)
+{
+   WDI_Status wdiStatus;
+   WDI_TriggerBatchScanResultIndType wdiReq;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO_HIGH,
+                                          "------> %s " ,__func__);
+
+   wdiReq.param = pReq->param;
+
+   wdiStatus = WDI_TriggerBatchScanResultInd(&wdiReq);
+
+   if (WDI_STATUS_SUCCESS_SYNC != wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+          "Trigger batch scan result ind failed %s:%d",
+          __func__, wdiStatus);
+   }
+
+   vos_mem_free(pReq);
+
+   return CONVERT_WDI2VOS_STATUS(wdiStatus);
+}
+
+/*==========================================================================
+  FUNCTION WDA_SetBatchScanRespCallback
+
+  DESCRIPTION
+    API to process set batch scan response from FW
+
+  PARAMETERS
+    pRsp: Pointer to set batch scan response
+    pUserData: Pointer to user data
+
+  RETURN VALUE
+    NONE
+
+===========================================================================*/
+void WDA_SetBatchScanRespCallback
+(
+    WDI_SetBatchScanRspType *pRsp,
+    void* pUserData
+)
+{
+   tSirSetBatchScanRsp *pHddSetBatchScanRsp;
+   tpAniSirGlobal pMac;
+   void *pCallbackContext;
+   tWDA_CbContext *pWDA = NULL ;
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO_HIGH,
+                                          "<------ %s " ,__func__);
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return ;
+   }
+
+   /*extract WDA context*/
+   pWDA = pWdaParams->pWdaContext;
+   if (NULL == pWDA)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+          "%s:pWDA is NULL can't invole HDD callback",
+           __func__);
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams->wdaMsgParam);
+      vos_mem_free(pWdaParams);
+      VOS_ASSERT(0);
+      return;
+   }
+
+   vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+   vos_mem_free(pWdaParams->wdaMsgParam);
+   vos_mem_free(pWdaParams);
+
+   pMac = (tpAniSirGlobal )VOS_GET_MAC_CTXT(pWDA->pVosContext);
+   if (NULL == pMac)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+          "%s:pMac is NULL", __func__);
+      VOS_ASSERT(0);
+      return;
+   }
+
+   pHddSetBatchScanRsp =
+     (tSirSetBatchScanRsp *)vos_mem_malloc(sizeof(tSirSetBatchScanRsp));
+   if (NULL == pHddSetBatchScanRsp)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+          "%s: VOS MEM Alloc Failure can't invoke HDD callback", __func__);
+      VOS_ASSERT(0);
+      return;
+   }
+
+   pHddSetBatchScanRsp->nScansToBatch = pRsp->nScansToBatch;
+
+   pCallbackContext = pMac->pmc.setBatchScanReqCallbackContext;
+   /*call hdd callback with set batch scan response data*/
+   if(pMac->pmc.setBatchScanReqCallback)
+   {
+       pMac->pmc.setBatchScanReqCallback(pCallbackContext, pHddSetBatchScanRsp);
+   }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+          "%s:HDD callback is null", __func__);
+      VOS_ASSERT(0);
+   }
+
+   vos_mem_free(pHddSetBatchScanRsp);
+   return ;
+}
+
+/*==========================================================================
+  FUNCTION WDA_ProcessSetBatchScanReq
+
+  DESCRIPTION
+    API to send set batch scan request to WDI
+
+  PARAMETERS
+    pWDA: Pointer to WDA context
+    pSetBatchScanReq: Pointer to set batch scan req
+
+  RETURN VALUE
+    NONE
+
+===========================================================================*/
+VOS_STATUS WDA_ProcessSetBatchScanReq(tWDA_CbContext *pWDA,
+       tSirSetBatchScanReq *pSetBatchScanReq)
+{
+   WDI_Status status;
+   tWDA_ReqParams *pWdaParams ;
+   WDI_SetBatchScanReqType *pWdiSetBatchScanReq;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO_HIGH,
+                                          "------> %s " ,__func__);
+
+   pWdiSetBatchScanReq =
+     (WDI_SetBatchScanReqType *)vos_mem_malloc(sizeof(WDI_SetBatchScanReqType));
+   if (NULL == pWdiSetBatchScanReq)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      vos_mem_free(pSetBatchScanReq);
+      VOS_ASSERT(0);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams));
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pSetBatchScanReq);
+      vos_mem_free(pWdiSetBatchScanReq);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdiSetBatchScanReq->scanFrequency = pSetBatchScanReq->scanFrequency;
+   pWdiSetBatchScanReq->numberOfScansToBatch =
+               pSetBatchScanReq->numberOfScansToBatch;
+   pWdiSetBatchScanReq->bestNetwork = pSetBatchScanReq->bestNetwork;
+   pWdiSetBatchScanReq->rfBand = pSetBatchScanReq->rfBand;
+   pWdiSetBatchScanReq->rtt = pSetBatchScanReq->rtt;
+
+   pWdaParams->wdaWdiApiMsgParam = pWdiSetBatchScanReq;
+   pWdaParams->pWdaContext = pWDA;
+   pWdaParams->wdaMsgParam = pSetBatchScanReq;
+
+   status = WDI_SetBatchScanReq(pWdiSetBatchScanReq, pWdaParams,
+                (WDI_SetBatchScanCb)WDA_SetBatchScanRespCallback);
+   if (IS_WDI_STATUS_FAILURE(status))
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "Failure in Set Batch Scan REQ WDI API, free all the memory " );
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams->wdaMsgParam);
+      vos_mem_free(pWdaParams);
+   }
+   return CONVERT_WDI2VOS_STATUS(status);
+}
+
+#endif
+
+/*
  * -------------------------------------------------------------------------
  * DATA interface with WDI for Mgmt Frames
  * ------------------------------------------------------------------------- 
@@ -10142,7 +11017,7 @@
       /*check if packet is freed already*/
       if(vos_atomic_set_U32(&wdaContext->VosPacketToFree, (v_U32_t)WDA_TX_PACKET_FREED) == (v_U32_t)pData)
       {
-         wdaContext->pTxCbFunc(pMac, pData); 
+         wdaContext->pTxCbFunc(pMac, pData, 1);
       }
       else
       {
@@ -10173,7 +11048,7 @@
  * FUNCTION: WDA_TxPacket
  * Forward TX management frame to WDI
  */ 
-VOS_STATUS WDA_TxPacket(tWDA_CbContext *pWDA, 
+VOS_STATUS WDA_TxPacket(void *pWDA_handle,
                            void *pFrmBuf,
                            tANI_U16 frmLen,
                            eFrameType frmType,
@@ -10182,8 +11057,10 @@
                            pWDATxRxCompFunc pCompFunc,
                            void *pData,
                            pWDAAckFnTxComp pAckTxComp,
-                           tANI_U8 txFlag)
+                           tANI_U8 txFlag,
+                           tANI_U8 sessionId )
 {
+   tWDA_CbContext *pWDA = (tWDA_CbContext *)(pWDA_handle);
    VOS_STATUS status = VOS_STATUS_SUCCESS ;
    tpSirMacFrameCtl pFc = (tpSirMacFrameCtl ) pData;
    tANI_U8 ucTypeSubType = pFc->type <<4 | pFc->subType;
@@ -10255,7 +11132,7 @@
    {
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR, 
                             "VOS Event reset failed - status = %d\n",status);
-      pCompFunc(pWDA->pVosContext, (vos_pkt_t *)pFrmBuf);
+      pCompFunc(pWDA->pVosContext, (vos_pkt_t *)pFrmBuf, 1);
       if( pAckTxComp )
       {
          pWDA->pAckTxCbFunc = NULL;
@@ -10325,7 +11202,7 @@
    {
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR, 
                        "Sending Mgmt Frame failed - status = %d\n", status);
-      pCompFunc(VOS_GET_MAC_CTXT(pWDA->pVosContext), (vos_pkt_t *)pFrmBuf);
+      pCompFunc(VOS_GET_MAC_CTXT(pWDA->pVosContext), (vos_pkt_t *)pFrmBuf, 1);
       vos_atomic_set_U32(&pWDA->VosPacketToFree, (v_U32_t)WDA_TX_PACKET_FREED);/*reset the VosPacket_freed*/
       if( pAckTxComp )
       {
@@ -10381,9 +11258,552 @@
       }
       status = VOS_STATUS_E_FAILURE;
    }
+#ifdef WLAN_DUMP_MGMTFRAMES
+   if (VOS_IS_STATUS_SUCCESS(status))
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                      "%s() TX packet : SubType %d", __func__,pFc->subType);
+      VOS_TRACE_HEX_DUMP( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                          pData, frmLen);
+   }
+#endif
+
    return status;
 }
 /*
+ * FUNCTION: WDA_ProcessDHCPStartInd
+ * Forward DHCP Start to WDI
+ */
+static VOS_STATUS WDA_ProcessDHCPStartInd (tWDA_CbContext *pWDA,
+                                           tAniDHCPInd *dhcpStartInd)
+{
+   WDI_Status status;
+   WDI_DHCPInd *wdiDHCPInd = (WDI_DHCPInd*)vos_mem_malloc(sizeof(WDI_DHCPInd)) ;
+   if (NULL == wdiDHCPInd)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(dhcpStartInd);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   wdiDHCPInd->device_mode = dhcpStartInd->device_mode;
+   vos_mem_copy(wdiDHCPInd->macAddr, dhcpStartInd->macAddr,
+                                               sizeof(tSirMacAddr));
+
+   status = WDI_dhcpStartInd(wdiDHCPInd);
+
+   if (IS_WDI_STATUS_FAILURE(status))
+   {
+      vos_mem_free(wdiDHCPInd);
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "DHCP Start Indication failed");
+   }
+   vos_mem_free(dhcpStartInd);
+   return CONVERT_WDI2VOS_STATUS(status) ;
+}
+
+ /*
+  * FUNCTION: WDA_ProcessDHCPStopInd
+  * Forward DHCP Stop to WDI
+  */
+ static VOS_STATUS WDA_ProcessDHCPStopInd (tWDA_CbContext *pWDA,
+                                           tAniDHCPInd *dhcpStopInd)
+ {
+   WDI_Status status;
+   WDI_DHCPInd *wdiDHCPInd = (WDI_DHCPInd*)vos_mem_malloc(sizeof(WDI_DHCPInd)) ;
+   if (NULL == wdiDHCPInd)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(dhcpStopInd);
+      return VOS_STATUS_E_NOMEM;
+   }
+   wdiDHCPInd->device_mode = dhcpStopInd->device_mode;
+   vos_mem_copy(wdiDHCPInd->macAddr, dhcpStopInd->macAddr, sizeof(tSirMacAddr));
+   status = WDI_dhcpStopInd(wdiDHCPInd);
+   if (IS_WDI_STATUS_FAILURE(status))
+   {
+      vos_mem_free(wdiDHCPInd);
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "DHCP Start Indication failed");
+   }
+   vos_mem_free(dhcpStopInd);
+   return CONVERT_WDI2VOS_STATUS(status) ;
+ }
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+/*
+ * FUNCTION: WDA_RMCLeaderRspCallback
+ * Send LBP Leader Response back to PE
+ */
+void
+WDA_RMCLeaderRspCallback(WDI_LbpRspParamsType *wdiLbpResponse, void *pUserData)
+{
+    tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+    tWDA_CbContext *pWDA = pWdaParams->pWdaContext;
+
+    switch (wdiLbpResponse->cmd)
+    {
+        case eWDI_BECOME_LEADER_CMD :
+        {
+            tSirRmcBecomeLeaderInd *pRmcBecomeLeaderInd;
+
+            pRmcBecomeLeaderInd = (tSirRmcBecomeLeaderInd *)
+                                   vos_mem_malloc(sizeof(*pRmcBecomeLeaderInd));
+
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                        "Received eWDI_BECOME_LEADER_CMD from WDI");
+
+            pRmcBecomeLeaderInd->status = wdiLbpResponse->status;
+
+            /* Copy the mcast transmitter which should be us */
+            vos_mem_copy(pRmcBecomeLeaderInd->mcastTransmitter,
+                          wdiLbpResponse->mcastTransmitter,
+                          sizeof(tSirMacAddr));
+            /* Copy the mcast group address */
+            vos_mem_copy(pRmcBecomeLeaderInd->mcastGroup,
+                          wdiLbpResponse->mcastGroup,
+                          sizeof(tSirMacAddr));
+
+            WDA_SendMsg(pWDA, WDA_RMC_BECOME_LEADER,
+                               (void *)pRmcBecomeLeaderInd, 0) ;
+            break;
+        }
+        case eWDI_SUGGEST_LEADER_CMD :
+        {
+            tSirRmcLeaderSelectInd *pRmcLeaderSelectInd;
+
+            pRmcLeaderSelectInd = (tSirRmcLeaderSelectInd *)
+                                   vos_mem_malloc(sizeof(tSirRmcLeaderSelectInd));
+
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                              "Received eWDI_SUGGEST_LEADER_CMD from WDI");
+
+            pRmcLeaderSelectInd->status = wdiLbpResponse->status;
+
+            /* Copy the mcast transmitter which should be us */
+            vos_mem_copy(pRmcLeaderSelectInd->mcastTransmitter,
+                        wdiLbpResponse->mcastTransmitter,
+                        sizeof(tSirMacAddr));
+            /* Copy the mcast group address */
+            vos_mem_copy(pRmcLeaderSelectInd->mcastGroup,
+                        wdiLbpResponse->mcastGroup,
+                        sizeof(tSirMacAddr));
+            /* Copy the candidate leader list */
+            vos_mem_copy(pRmcLeaderSelectInd->leader,
+                        wdiLbpResponse->leader,
+                        sizeof(pRmcLeaderSelectInd->leader));
+
+            WDA_SendMsg(pWDA, WDA_RMC_LEADER_SELECT_RESP,
+                                       (void *)pRmcLeaderSelectInd, 0) ;
+            break;
+        }
+    }
+
+    /* free the config structure */
+    if (pWdaParams->wdaWdiApiMsgParam != NULL)
+    {
+        vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+    }
+    vos_mem_free(pWdaParams->wdaMsgParam);
+    vos_mem_free(pWdaParams);
+
+}
+
+/*
+ * FUNCTION: WDA_RMCLeaderReqCallback
+ * Free memory.
+ * Invoked when RMCLeader REQ failed in WDI and no RSP callback is generated.
+ */
+void WDA_RMCLeaderReqCallback(WDI_Status wdiStatus, void* pUserData)
+{
+    tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+
+    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+              "<------ %s, wdiStatus: %d", __func__, wdiStatus);
+
+    if (NULL == pWdaParams)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: pWdaParams received NULL", __func__);
+        VOS_ASSERT(0);
+        return;
+    }
+
+    if (IS_WDI_STATUS_FAILURE(wdiStatus))
+    {
+        vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+        vos_mem_free(pWdaParams->wdaMsgParam);
+        vos_mem_free(pWdaParams);
+    }
+
+   return;
+}
+
+/*
+ * FUNCTION: WDA_ProcessRMCLeaderReq
+ * Forward LBP Leader Request to WDI
+ */
+static VOS_STATUS
+WDA_ProcessRMCLeaderReq(tWDA_CbContext *pWDA,
+                        tSirRmcLeaderReq *lbpLeaderReq)
+{
+    WDI_Status status;
+    WDI_LbpLeaderReqParams *wdiLeaderReq;
+    tWDA_ReqParams *pWdaParams;
+
+    wdiLeaderReq = (WDI_LbpLeaderReqParams *)
+                        vos_mem_malloc(sizeof(*wdiLeaderReq));
+
+    if (NULL == wdiLeaderReq)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: VOS MEM Alloc Failure", __func__);
+        VOS_ASSERT(0);
+        vos_mem_free(lbpLeaderReq);
+        return VOS_STATUS_E_NOMEM;
+    }
+
+    pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams));
+    if (NULL == pWdaParams)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: VOS MEM Alloc Failure", __func__);
+        VOS_ASSERT(0);
+        vos_mem_free(lbpLeaderReq);
+        vos_mem_free(wdiLeaderReq);
+        return VOS_STATUS_E_NOMEM;
+    }
+
+    pWdaParams->wdaWdiApiMsgParam = (v_PVOID_t *)wdiLeaderReq;
+    /* Store param pointer as passed in by caller */
+    pWdaParams->wdaMsgParam = lbpLeaderReq;
+    pWdaParams->pWdaContext = pWDA;
+
+    wdiLeaderReq->cmd = lbpLeaderReq->cmd;
+
+    vos_mem_copy(wdiLeaderReq->mcastTransmitter,
+            lbpLeaderReq->mcastTransmitter, sizeof(tSirMacAddr));
+    vos_mem_copy(wdiLeaderReq->mcastGroup,
+            lbpLeaderReq->mcastGroup, sizeof(tSirMacAddr));
+    vos_mem_copy(wdiLeaderReq->blacklist,
+            lbpLeaderReq->blacklist, sizeof(wdiLeaderReq->blacklist));
+
+    wdiLeaderReq->wdiReqStatusCB = WDA_RMCLeaderReqCallback;
+
+    status = WDI_LbpLeaderReq(wdiLeaderReq,
+                 (WDI_LbpLeaderRspCb)WDA_RMCLeaderRspCallback,
+                 (void *)pWdaParams);
+    if (IS_WDI_STATUS_FAILURE(status))
+    {
+        vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+        vos_mem_free(pWdaParams->wdaMsgParam);
+        vos_mem_free(pWdaParams) ;
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                   "LBP Leader Request failed");
+    }
+    return CONVERT_WDI2VOS_STATUS(status) ;
+}
+
+/*
+ * FUNCTION: WDA_ProcessRMCUpdateInd
+ * Forward LBP Update Indication to WDI
+*/
+static VOS_STATUS
+WDA_ProcessRMCUpdateInd(tWDA_CbContext *pWDA,
+                         tSirRmcUpdateInd *lbpUpdateInd)
+{
+    WDI_Status status;
+    WDI_LbpUpdateIndParams wdiUpdateInd;
+
+    /* Copy the paramters for Update_Ind */
+
+    wdiUpdateInd.indication = lbpUpdateInd->indication;
+    wdiUpdateInd.role = lbpUpdateInd->role;
+
+    vos_mem_copy(wdiUpdateInd.mcastTransmitter,
+            lbpUpdateInd->mcastTransmitter, sizeof(tSirMacAddr));
+
+    vos_mem_copy(wdiUpdateInd.mcastGroup,
+            lbpUpdateInd->mcastGroup, sizeof(tSirMacAddr));
+
+    vos_mem_copy(wdiUpdateInd.mcastLeader,
+            lbpUpdateInd->mcastLeader, sizeof(tSirMacAddr));
+
+    wdiUpdateInd.wdiReqStatusCB = WDA_WdiIndicationCallback;
+    wdiUpdateInd.pUserData = pWDA;
+    status = WDI_LbpUpdateInd(&wdiUpdateInd);
+
+    if (WDI_STATUS_PENDING == status)
+    {
+        VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 "Pending received for %s:%d ",__func__,__LINE__ );
+    }
+    else if (WDI_STATUS_SUCCESS_SYNC != status)
+    {
+       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "Failure in %s:%d ",__func__,__LINE__ );
+    }
+
+    vos_mem_free(lbpUpdateInd);
+
+    return CONVERT_WDI2VOS_STATUS(status) ;
+}
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+void WDA_GetIbssPeerInfoRspCallback(WDI_IbssPeerInfoRspParams *peerInfoRspParams
+                                    ,void* pUserData)
+{
+
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   WDI_IbssPeerInfoParams *pIbssPeerInfoParams =
+       (WDI_IbssPeerInfoParams *)peerInfoRspParams->wdiPeerInfoParams;
+   tWDA_CbContext *pWDA;
+   tpSirIbssGetPeerInfoRspParams pIbssGetPeerInfoRsp;
+   vos_msg_t vosMsg;
+   v_U32_t wdaCnt = 0;
+
+   pIbssGetPeerInfoRsp =
+                  vos_mem_malloc(sizeof(tSirIbssGetPeerInfoRspParams));
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                                          "<------ %s " ,__func__);
+   VOS_ASSERT(NULL != pWdaParams);
+
+   pWDA = (tWDA_CbContext *)pWdaParams->pWdaContext ;
+
+
+   if (peerInfoRspParams->wdiNumPeers > 32)
+   {
+      pr_info("%s] Number of peers is more than 32, returning\n", __func__);
+      /* free the mem and return */
+      vos_mem_free((v_VOID_t *) pIbssGetPeerInfoRsp);
+      if(NULL != pWdaParams)
+      {
+         if(pWdaParams->wdaMsgParam)
+            vos_mem_free(pWdaParams->wdaMsgParam);
+         if(pWdaParams->wdaWdiApiMsgParam)
+            vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+         vos_mem_free(pWdaParams);
+      }
+      return;
+   }
+
+   /* Message Header */
+   pIbssGetPeerInfoRsp->mesgType = eWNI_SME_IBSS_PEER_INFO_RSP;
+   pIbssGetPeerInfoRsp->mesgLen = sizeof(tSirIbssGetPeerInfoRspParams);
+   pIbssGetPeerInfoRsp->ibssPeerInfoRspParams.status = peerInfoRspParams->wdiStatus;
+   pIbssGetPeerInfoRsp->ibssPeerInfoRspParams.numPeers = peerInfoRspParams->wdiNumPeers;
+
+   for (wdaCnt = 0; wdaCnt < peerInfoRspParams->wdiNumPeers; wdaCnt++)
+   {
+      WDI_IbssPeerInfoParams *pWdiTmp = &pIbssPeerInfoParams[wdaCnt];
+      tSirIbssPeerInfoParams *pSmeTmp =
+          &pIbssGetPeerInfoRsp->ibssPeerInfoRspParams.peerInfoParams[wdaCnt];
+
+      pSmeTmp->staIdx = pWdiTmp->wdiStaIdx;
+      pSmeTmp->mcsIndex = pWdiTmp->wdiMcsIndex;
+      pSmeTmp->rssi = pWdiTmp->wdiRssi;
+      pSmeTmp->txRate = pWdiTmp->wdiTxRate;
+      pSmeTmp->txRateFlags = pWdiTmp->wdiTxRateFlags;
+   }
+
+   /* VOS message wrapper */
+   vosMsg.type = eWNI_SME_IBSS_PEER_INFO_RSP;
+   vosMsg.bodyptr = (void *)pIbssGetPeerInfoRsp;
+   vosMsg.bodyval = 0;
+
+   if (VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MQ_ID_SME, (vos_msg_t*)&vosMsg))
+   {
+      /* free the mem and return */
+      vos_mem_free((v_VOID_t *) pIbssGetPeerInfoRsp);
+   }
+
+   if(NULL != pWdaParams)
+   {
+      if(pWdaParams->wdaMsgParam)
+         vos_mem_free(pWdaParams->wdaMsgParam);
+      if(pWdaParams->wdaWdiApiMsgParam)
+         vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams);
+   }
+
+   return;
+}
+
+static VOS_STATUS
+WDA_ProcessIbssPeerInfoReq(tWDA_CbContext *pWDA,
+                      tSirIbssGetPeerInfoReqParams *ibssPeerInfoReqParams)
+{
+   WDI_Status status;
+   WDI_IbssPeerInfoReqType *wdiPeerInfoReq;
+   tWDA_ReqParams *pWdaParams;
+
+   wdiPeerInfoReq = (WDI_IbssPeerInfoReqType *)
+                    vos_mem_malloc(sizeof(WDI_IbssPeerInfoReqType));
+   if (NULL == wdiPeerInfoReq)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(ibssPeerInfoReqParams);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams));
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                         "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(wdiPeerInfoReq);
+      vos_mem_free(ibssPeerInfoReqParams);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams->wdaWdiApiMsgParam = (v_PVOID_t *)wdiPeerInfoReq;
+   /* Store param pointer as passed in by caller */
+   pWdaParams->wdaMsgParam = ibssPeerInfoReqParams;
+   pWdaParams->pWdaContext = pWDA;
+
+   wdiPeerInfoReq->wdiAllPeerInfoReqd =
+                 ibssPeerInfoReqParams->allPeerInfoReqd;
+   wdiPeerInfoReq->wdiStaIdx =
+                 ibssPeerInfoReqParams->staIdx;
+
+   status = WDI_IbssPeerInfoReq(wdiPeerInfoReq,
+               (WDI_IbssPeerInfoReqCb)WDA_GetIbssPeerInfoRspCallback,
+               (void *)pWdaParams);
+   if (IS_WDI_STATUS_FAILURE(status))
+   {
+      vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      vos_mem_free(pWdaParams->wdaMsgParam);
+      vos_mem_free(pWdaParams) ;
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "IBSS Peer Info Request failed");
+   }
+   return CONVERT_WDI2VOS_STATUS(status) ;
+
+}
+
+VOS_STATUS WDA_ProcessIBSSRouteTableUpdateInd(tWDA_CbContext *pWDA,
+                                              tAniIbssRouteTable *pData)
+{
+   WDI_Status status;
+   WDI_IBSSRouteTable *wdiIBSSRouteTable = NULL;
+   tANI_U32 usWDI_IBSSRouteTableSize;
+   tANI_U16 i;
+
+   VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+             "<------ %s " ,__func__);
+
+   usWDI_IBSSRouteTableSize = sizeof(WDI_IBSSRouteTable) +
+                              ((pData->numEntries - 1) *
+                               sizeof(WDI_DestIpNextHopMacPair));
+   wdiIBSSRouteTable =
+      (WDI_IBSSRouteTable *)vos_mem_malloc(usWDI_IBSSRouteTableSize);
+
+   if (NULL == wdiIBSSRouteTable)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: VOS MEM Alloc Failure", __func__);
+      vos_mem_free(pData);
+      VOS_ASSERT(0);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   wdiIBSSRouteTable->numEntries = pData->numEntries;
+   for (i = 0; i < pData->numEntries; i++)
+   {
+      vos_mem_copy(&wdiIBSSRouteTable->destIpMacPair[i].destIpv4Addr,
+                   &pData->destIpNextHopPair[i].destIpv4Addr,
+                   WDI_IPV4_ADDR_LEN);
+      vos_mem_copy(&wdiIBSSRouteTable->destIpMacPair[i].nextHopMacAddr,
+                   &pData->destIpNextHopPair[i].nextHopMacAddr,
+                   WDI_MAC_ADDR_LEN);
+   }
+
+   wdiIBSSRouteTable->wdiReqStatusCB = WDA_WdiIndicationCallback;
+   wdiIBSSRouteTable->pUserData = pWDA;
+
+   status = WDI_IBSSRouteTableUpdateInd(wdiIBSSRouteTable);
+
+   if (WDI_STATUS_PENDING == status)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                "%s: Pending received for IBSS Route table update indication",
+                __func__);
+   }
+   else if (WDI_STATUS_SUCCESS_SYNC != status)
+   {
+      vos_mem_free(wdiIBSSRouteTable);
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: IBSS Route table update indication failed", __func__);
+   }
+   vos_mem_free(pData);
+   return CONVERT_WDI2VOS_STATUS(status) ;
+}
+
+/*
+ * FUNCTION: WDA_ProcessTXFailMonitorInd
+ * Forward TX Fail Monitor to WDI
+ */
+static VOS_STATUS WDA_ProcessTXFailMonitorInd(
+                                        tWDA_CbContext *pWDA,
+                                        tAniTXFailMonitorInd *txFailMonitorInd)
+{
+   WDI_Status status;
+   WDI_TXFailMonitorInd *wdiTXFailMonitorInd =
+         (WDI_TXFailMonitorInd *)vos_mem_malloc(sizeof(WDI_TXFailMonitorInd));
+
+   VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+             "<------ %s " ,__func__);
+
+   if (NULL == wdiTXFailMonitorInd)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(txFailMonitorInd);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   wdiTXFailMonitorInd->tx_fail_count = txFailMonitorInd->tx_fail_count;
+
+   wdiTXFailMonitorInd->wdiReqStatusCB = WDA_WdiIndicationCallback;
+   wdiTXFailMonitorInd->pUserData = pWDA;
+
+   status = WDI_TXFailMonitorStartStopInd(wdiTXFailMonitorInd);
+
+   if (WDI_STATUS_PENDING == status)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "TX Fail Monitor Indication Pending");
+   }
+   else if (WDI_STATUS_SUCCESS_SYNC == status)
+   {
+     if (0 == txFailMonitorInd->tx_fail_count)
+       pWDA->txFailIndCallback = NULL;
+     else
+       pWDA->txFailIndCallback = txFailMonitorInd->txFailIndCallback;
+   }
+   else
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                 "TX Fail Monitor Indication Failed");
+   }
+
+   vos_mem_free(txFailMonitorInd);
+
+   return CONVERT_WDI2VOS_STATUS(status) ;
+}
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+/*
  * FUNCTION: WDA_McProcessMsg
  * Trigger DAL-AL to start CFG download 
  */ 
@@ -10532,7 +11952,7 @@
 #ifdef FEATURE_WLAN_CCX
       case WDA_TSM_STATS_REQ:
       {
-         WDA_ProcessTsmStatsReq(pWDA, (tTSMStats *)pMsg->bodyptr);
+         WDA_ProcessTsmStatsReq(pWDA, (tpAniGetTsmStatsReq)pMsg->bodyptr);
          break;
       }
 #endif
@@ -10833,6 +12253,12 @@
          break;
       }
 #endif
+      case WDA_SET_MAX_TX_POWER_PER_BAND_REQ:
+      {
+         WDA_ProcessSetMaxTxPowerPerBandReq(pWDA, (tMaxTxPowerPerBandParams *)
+                                            pMsg->bodyptr);
+         break;
+      }
       case WDA_SET_TX_POWER_REQ:
       {
          WDA_ProcessSetTxPowerReq(pWDA,
@@ -10920,9 +12346,9 @@
       }
 #endif // FEATURE_WLAN_SCAN_PNO
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-      case WDA_START_ROAM_CANDIDATE_LOOKUP_REQ:
+      case WDA_ROAM_SCAN_OFFLOAD_REQ:
       {
-         WDA_ProcessStartRoamCandidatelookupReq(pWDA, (tSirRoamOffloadScanReq *)pMsg->bodyptr);
+         WDA_ProcessRoamScanOffloadReq(pWDA, (tSirRoamOffloadScanReq *)pMsg->bodyptr);
          break;
       }
 #endif
@@ -11009,6 +12435,101 @@
          break;
       }
 #endif
+#ifdef FEATURE_WLAN_TDLS
+      case WDA_SET_TDLS_LINK_ESTABLISH_REQ:
+      {
+          WDA_ProcessSetTdlsLinkEstablishReq(pWDA, (tTdlsLinkEstablishParams *)pMsg->bodyptr);
+          break;
+      }
+#endif
+      case WDA_DHCP_START_IND:
+      {
+          WDA_ProcessDHCPStartInd(pWDA, (tAniDHCPInd *)pMsg->bodyptr);
+          break;
+      }
+      case WDA_DHCP_STOP_IND:
+      {
+          WDA_ProcessDHCPStopInd(pWDA, (tAniDHCPInd *)pMsg->bodyptr);
+          break;
+      }
+#ifdef FEATURE_WLAN_LPHB
+      case WDA_LPHB_CONF_REQ:
+      {
+         WDA_ProcessLPHBConfReq(pWDA, (tSirLPHBReq *)pMsg->bodyptr);
+         break;
+      }
+#endif
+      case WDA_ADD_PERIODIC_TX_PTRN_IND:
+      {
+         WDA_ProcessAddPeriodicTxPtrnInd(pWDA,
+            (tSirAddPeriodicTxPtrn *)pMsg->bodyptr);
+         break;
+      }
+      case WDA_DEL_PERIODIC_TX_PTRN_IND:
+      {
+         WDA_ProcessDelPeriodicTxPtrnInd(pWDA,
+            (tSirDelPeriodicTxPtrn *)pMsg->bodyptr);
+         break;
+      }
+      case WDA_RATE_UPDATE_IND:
+      {
+          WDA_ProcessRateUpdateInd(pWDA, (tSirRateUpdateInd *)pMsg->bodyptr);
+          break;
+      }
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+      case WDA_RMC_LEADER_REQ:
+      {
+          WDA_ProcessRMCLeaderReq(pWDA, (tSirRmcLeaderReq *)pMsg->bodyptr);
+          break;
+      }
+      case WDA_RMC_UPDATE_IND:
+      {
+          WDA_ProcessRMCUpdateInd(pWDA, (tSirRmcUpdateInd *)pMsg->bodyptr);
+          break;
+      }
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+      case WDA_GET_IBSS_PEER_INFO_REQ:
+      {
+          WDA_ProcessIbssPeerInfoReq(pWDA,
+                            (tSirIbssGetPeerInfoReqParams *)pMsg->bodyptr);
+          break;
+      }
+      case WDA_IBSS_ROUTE_TABLE_UPDATE_IND:
+      {
+          WDA_ProcessIBSSRouteTableUpdateInd(pWDA,
+                            (tAniIbssRouteTable *)pMsg->bodyptr);
+         break;
+      }
+      case WDA_TX_FAIL_MONITOR_IND:
+      {
+         WDA_ProcessTXFailMonitorInd(pWDA, (tAniTXFailMonitorInd *)pMsg->bodyptr);
+         break;
+      }
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+      case WDA_SET_BATCH_SCAN_REQ:
+      {
+          WDA_ProcessSetBatchScanReq(pWDA,
+            (tSirSetBatchScanReq *)pMsg->bodyptr);
+          break;
+      }
+      case WDA_TRIGGER_BATCH_SCAN_RESULT_IND:
+      {
+          WDA_ProcessTriggerBatchScanResultInd(pWDA,
+            (tSirTriggerBatchScanResultInd *)pMsg->bodyptr);
+          break;
+      }
+      case WDA_STOP_BATCH_SCAN_IND:
+      {
+          WDA_ProcessStopBatchScanInd(pWDA,
+            (tSirStopBatchScanInd *)pMsg->bodyptr);
+          break;
+      }
+#endif
+
       default:
       {
          VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
@@ -11270,6 +12791,32 @@
           break;
       }
 
+#ifdef FEATURE_WLAN_TDLS
+      case WDI_TDLS_IND :
+      {
+          tSirTdlsInd  *pTdlsInd =
+             (tSirTdlsInd *)vos_mem_malloc(sizeof(tSirTdlsInd));
+
+          if (NULL == pTdlsInd)
+          {
+             VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                        "Memory allocation failure, "
+                        "WDI_TDLS_IND not forwarded");
+             break;
+          }
+          pTdlsInd->status            =
+                     wdiLowLevelInd->wdiIndicationData.wdiTdlsIndInfo.status;
+          pTdlsInd->assocId        =
+                     wdiLowLevelInd->wdiIndicationData.wdiTdlsIndInfo.assocId;
+          pTdlsInd->staIdx =
+                     wdiLowLevelInd->wdiIndicationData.wdiTdlsIndInfo.staIdx;
+          pTdlsInd->reasonCode    =
+                     wdiLowLevelInd->wdiIndicationData.wdiTdlsIndInfo.reasonCode;
+          WDA_SendMsg(pWDA, SIR_HAL_TDLS_IND,
+                                        (void *)pTdlsInd , 0) ;
+          break;
+      }
+#endif
       case WDI_P2P_NOA_ATTR_IND :
       {
          tSirP2PNoaAttr   *pP2pNoaAttr = 
@@ -11326,6 +12873,14 @@
             VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
                        "Memory allocation failure, "
                        "WDI_PREF_NETWORK_FOUND_IND not forwarded");
+            if (NULL !=
+                wdiLowLevelInd->wdiIndicationData.wdiPrefNetworkFoundInd.pData)
+            {
+                wpalMemoryFree(
+                 wdiLowLevelInd->wdiIndicationData.wdiPrefNetworkFoundInd.pData
+                );
+                wdiLowLevelInd->wdiIndicationData.wdiPrefNetworkFoundInd.pData = NULL;
+            }
             break;
          }
          /* Message Header */
@@ -11440,7 +12995,190 @@
          }
          break;
       }
-  
+#ifdef FEATURE_CESIUM_PROPRIETARY
+      case WDI_TX_FAIL_IND:
+      {
+         if (pWDA->txFailIndCallback)
+         {
+            pWDA->txFailIndCallback(
+                     wdiLowLevelInd->wdiIndicationData.wdiTXFailInd.macAddr,
+                     wdiLowLevelInd->wdiIndicationData.wdiTXFailInd.seqNo);
+         }
+  break;
+      }
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_LPHB
+      case WDI_LPHB_IND:
+      {
+         vos_msg_t     vosMsg;
+         tSirLPHBInd  *lphbInd;
+
+         lphbInd =
+           (tSirLPHBInd *)vos_mem_malloc(sizeof(tSirLPHBInd));
+         if (NULL == lphbInd)
+         {
+            VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                           "%s: LPHB IND buffer alloc Fail", __func__);
+            return ;
+         }
+
+         lphbInd->sessionIdx =
+              wdiLowLevelInd->wdiIndicationData.wdiLPHBTimeoutInd.sessionIdx;
+         lphbInd->protocolType =
+              wdiLowLevelInd->wdiIndicationData.wdiLPHBTimeoutInd.protocolType;
+         lphbInd->eventReason =
+              wdiLowLevelInd->wdiIndicationData.wdiLPHBTimeoutInd.eventReason;
+
+         VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                   "Get WDI_LPHB_IND bssIdx %d",
+                   wdiLowLevelInd->wdiIndicationData.wdiLPHBTimeoutInd.bssIdx);
+
+         vosMsg.type    = eWNI_SME_LPHB_IND;
+         vosMsg.bodyptr = lphbInd;
+         vosMsg.bodyval = 0;
+         /* Send message to SME */
+         if (VOS_STATUS_SUCCESS !=
+             vos_mq_post_message(VOS_MQ_ID_SME, (vos_msg_t*)&vosMsg))
+         {
+            VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_WARN,
+                      "post WDI_LPHB_WAIT_TIMEOUT_IND to SME Failed");
+            vos_mem_free(lphbInd);
+         }
+         break;
+      }
+#endif /* FEATURE_WLAN_LPHB */
+      case WDI_PERIODIC_TX_PTRN_FW_IND:
+      {
+         VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+            "%s: WDI_PERIODIC_TX_PTRN_FW_IND received, bssIdx: %d, "
+            "selfStaIdx: %d, status: %d, patternIdBitmap: %d", __func__,
+            (int)wdiLowLevelInd->wdiIndicationData.wdiPeriodicTxPtrnFwInd.bssIdx,
+            (int)wdiLowLevelInd->wdiIndicationData.wdiPeriodicTxPtrnFwInd.selfStaIdx,
+            (int)wdiLowLevelInd->wdiIndicationData.wdiPeriodicTxPtrnFwInd.status,
+            (int)wdiLowLevelInd->wdiIndicationData.wdiPeriodicTxPtrnFwInd.patternIdBitmap);
+
+         break;
+      }
+
+      case WDI_IBSS_PEER_INACTIVITY_IND:
+      {
+         tSirIbssPeerInactivityInd  *pIbssInd =
+            (tSirIbssPeerInactivityInd *)
+            vos_mem_malloc(sizeof(tSirIbssPeerInactivityInd));
+
+         if (NULL == pIbssInd)
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                  "Memory allocation failure, "
+                  "WDI_IBSS_PEER_INACTIVITY_IND not forwarded");
+            break;
+         }
+
+         pIbssInd->bssIdx =
+            wdiLowLevelInd->wdiIndicationData.wdiIbssPeerInactivityInd.bssIdx;
+         pIbssInd->staIdx =
+            wdiLowLevelInd->wdiIndicationData.wdiIbssPeerInactivityInd.staIdx;
+         vos_mem_copy(pIbssInd->peerAddr,
+               wdiLowLevelInd->wdiIndicationData.wdiIbssPeerInactivityInd.staMacAddr,
+               sizeof(tSirMacAddr));
+         WDA_SendMsg(pWDA, WDA_IBSS_PEER_INACTIVITY_IND, (void *)pIbssInd, 0) ;
+         break;
+      }
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+      case WDI_LBP_LEADER_PICK_NEW :
+      {
+         tSirRmcUpdateInd   *pRmcUpdateInd =
+            (tSirRmcUpdateInd *)vos_mem_malloc(sizeof(tSirRmcUpdateInd));
+
+         VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                              "Received WDI_LBP_UPDATE_IND from WDI");
+
+         pRmcUpdateInd->indication =
+           wdiLowLevelInd->wdiIndicationData.wdiLbpPickNewLeaderInd.indication;
+         pRmcUpdateInd->role =
+           wdiLowLevelInd->wdiIndicationData.wdiLbpPickNewLeaderInd.role;
+
+         /* Copy the mcast transmitter which should be us */
+         vos_mem_copy(pRmcUpdateInd->mcastTransmitter,
+              wdiLowLevelInd->wdiIndicationData.wdiLbpPickNewLeaderInd. \
+              mcastTransmitter,
+              sizeof(tSirMacAddr));
+         /* Copy the mcast group address */
+         vos_mem_copy(pRmcUpdateInd->mcastGroup,
+              wdiLowLevelInd->wdiIndicationData.wdiLbpPickNewLeaderInd.mcastGroup,
+              sizeof(tSirMacAddr));
+         /* Copy the mcast leader address */
+         vos_mem_copy(pRmcUpdateInd->mcastLeader,
+              wdiLowLevelInd->wdiIndicationData.wdiLbpPickNewLeaderInd.mcastLeader,
+              sizeof(tSirMacAddr));
+         /* Copy the candidate leader list */
+         vos_mem_copy(pRmcUpdateInd->leader,
+              wdiLowLevelInd->wdiIndicationData.wdiLbpPickNewLeaderInd.leader,
+              sizeof(pRmcUpdateInd->leader));
+
+         WDA_SendMsg(pWDA, WDA_RMC_UPDATE_IND, (void *)pRmcUpdateInd, 0) ;
+         break;
+      }
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+     case  WDI_BATCH_SCAN_RESULT_IND:
+     {
+         void *pBatchScanResult;
+         void *pCallbackContext;
+         tpAniSirGlobal pMac;
+
+         VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO_HIGH,
+                   "Received WDI_BATCHSCAN_RESULT_IND from FW");
+
+         /*sanity check*/
+         if(NULL == pWDA)
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s:pWDA is NULL", __func__);
+            VOS_ASSERT(0);
+            return;
+         }
+
+         pBatchScanResult =
+            (void *)wdiLowLevelInd->wdiIndicationData.pBatchScanResult;
+         if (NULL == pBatchScanResult)
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s:Batch scan result from FW is null can't invoke HDD callback",
+              __func__);
+            VOS_ASSERT(0);
+            return;
+         }
+
+         pMac = (tpAniSirGlobal )VOS_GET_MAC_CTXT(pWDA->pVosContext);
+         if (NULL == pMac)
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s:pMac is NULL", __func__);
+            VOS_ASSERT(0);
+            return;
+         }
+
+         pCallbackContext = pMac->pmc.batchScanResultCallbackContext;
+         /*call hdd callback with set batch scan response data*/
+         if(pMac->pmc.batchScanResultCallback)
+         {
+            pMac->pmc.batchScanResultCallback(pCallbackContext,
+               pBatchScanResult);
+         }
+         else
+         {
+            VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+               "%s:HDD callback is null", __func__);
+            VOS_ASSERT(0);
+         }
+         break;
+     }
+#endif
+
       default:
       {
          /* TODO error */
@@ -11963,9 +13701,10 @@
 /*
  * WDA Set REG Domain to VOS NV
  */
-eHalStatus WDA_SetRegDomain(void * clientCtxt, v_REGDOMAIN_t regId)
+eHalStatus WDA_SetRegDomain(void * clientCtxt, v_REGDOMAIN_t regId,
+                                                tAniBool sendRegHint)
 {
-   if(VOS_STATUS_SUCCESS != vos_nv_setRegDomain(clientCtxt, regId))
+   if(VOS_STATUS_SUCCESS != vos_nv_setRegDomain(clientCtxt, regId, sendRegHint))
    {
       return eHAL_STATUS_INVALID_PARAMETER;
    }
@@ -12269,22 +14008,22 @@
 }
 
 /*
- * FUNCTION: WDA_ProcessStartRoamCandidatelookupReq
+ * FUNCTION: WDA_ProcessRoamScanOffloadReq
  * Request to WDI to set Roam Offload Scan
  */
-VOS_STATUS WDA_ProcessStartRoamCandidatelookupReq(tWDA_CbContext *pWDA,
+VOS_STATUS WDA_ProcessRoamScanOffloadReq(tWDA_CbContext *pWDA,
                                                   tSirRoamOffloadScanReq *pRoamOffloadScanReqParams)
 {
    WDI_Status status;
-   WDI_RoamCandidateLookupReqParamsType *pwdiRoamCandidateLookupReqParams =
-   (WDI_RoamCandidateLookupReqParamsType *)vos_mem_malloc(sizeof(WDI_RoamCandidateLookupReqParamsType));
+   WDI_RoamScanOffloadReqParamsType *pwdiRoamScanOffloadReqParams =
+   (WDI_RoamScanOffloadReqParamsType *)vos_mem_malloc(sizeof(WDI_RoamScanOffloadReqParamsType));
    tWDA_ReqParams *pWdaParams ;
    v_U8_t csrAuthType;
    WDI_RoamNetworkType *pwdiRoamNetworkType;
    WDI_RoamOffloadScanInfo *pwdiRoamOffloadScanInfo;
    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
               "------> %s " ,__func__);
-   if (NULL == pwdiRoamCandidateLookupReqParams)
+   if (NULL == pwdiRoamScanOffloadReqParams)
    {
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
                            "%s: VOS MEM Alloc Failure", __func__);
@@ -12297,15 +14036,15 @@
       VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
                            "%s: VOS MEM Alloc Failure", __func__);
       VOS_ASSERT(0);
-      vos_mem_free(pwdiRoamCandidateLookupReqParams);
+      vos_mem_free(pwdiRoamScanOffloadReqParams);
       return VOS_STATUS_E_NOMEM;
    }
 
    pwdiRoamNetworkType =
-   &pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork;
+   &pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork;
    pwdiRoamOffloadScanInfo =
-   &pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo;
-   vos_mem_zero (pwdiRoamCandidateLookupReqParams,sizeof(WDI_RoamCandidateLookupReqParamsType));
+   &pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo;
+   vos_mem_zero (pwdiRoamScanOffloadReqParams,sizeof(WDI_RoamScanOffloadReqParamsType));
    csrAuthType = pRoamOffloadScanReqParams->ConnectedNetwork.authentication;
    pwdiRoamOffloadScanInfo->RoamScanOffloadEnabled =
           pRoamOffloadScanReqParams->RoamScanOffloadEnabled;
@@ -12322,6 +14061,8 @@
            pRoamOffloadScanReqParams->LookupThreshold ;
    pwdiRoamOffloadScanInfo->RoamRssiDiff =
            pRoamOffloadScanReqParams->RoamRssiDiff ;
+   pwdiRoamOffloadScanInfo->MAWCEnabled =
+           pRoamOffloadScanReqParams->MAWCEnabled ;
    pwdiRoamOffloadScanInfo->Command =
            pRoamOffloadScanReqParams->Command ;
    pwdiRoamOffloadScanInfo->StartScanReason =
@@ -12371,13 +14112,17 @@
            pRoamOffloadScanReqParams->MDID.mdiePresent;
    pwdiRoamOffloadScanInfo->MDID.mobilityDomain =
            pRoamOffloadScanReqParams->MDID.mobilityDomain;
-   pwdiRoamCandidateLookupReqParams->wdiReqStatusCB = NULL;
+   pwdiRoamOffloadScanInfo->nProbes =
+           pRoamOffloadScanReqParams->nProbes;
+   pwdiRoamOffloadScanInfo->HomeAwayTime =
+           pRoamOffloadScanReqParams->HomeAwayTime;
+   pwdiRoamScanOffloadReqParams->wdiReqStatusCB = NULL;
    /* Store Params pass it to WDI */
-   pWdaParams->wdaWdiApiMsgParam = (void *)pwdiRoamCandidateLookupReqParams;
+   pWdaParams->wdaWdiApiMsgParam = (void *)pwdiRoamScanOffloadReqParams;
    pWdaParams->pWdaContext = pWDA;
    /* Store param pointer as passed in by caller */
    pWdaParams->wdaMsgParam = pRoamOffloadScanReqParams;
-   status = WDI_StartRoamCandidateLookupReq(pwdiRoamCandidateLookupReqParams,
+   status = WDI_RoamScanOffloadReq(pwdiRoamScanOffloadReqParams,
                            (WDI_RoamOffloadScanCb)WDA_RoamOffloadScanReqCallback, pWdaParams);
    if(IS_WDI_STATUS_FAILURE(status))
    {
@@ -12537,7 +14282,7 @@
           "Update Scan Parameters b11dEnabled %d b11dResolved %d "
           "ucChannelCount %d usPassiveMinChTime %d usPassiveMaxChTime"
           " %d usActiveMinChTime %d usActiveMaxChTime %d sizeof "
-          "sir struct %d wdi struct %d",
+          "sir struct %zu wdi struct %zu",
               pUpdateScanParams->b11dEnabled,
               pUpdateScanParams->b11dResolved,
               pUpdateScanParams->ucChannelCount, 
@@ -12613,6 +14358,9 @@
 void WDA_RoamOffloadScanReqCallback(WDI_Status status, void* pUserData)
 {
    tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+   vos_msg_t vosMsg;
+   wpt_uint8 reason = 0;
+
    VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
                                           "<------ %s " ,__func__);
     if (NULL == pWdaParams)
@@ -12626,6 +14374,7 @@
    {
       if ( pWdaParams->wdaWdiApiMsgParam != NULL )
       {
+         reason = ((WDI_RoamScanOffloadReqParamsType *)pWdaParams->wdaWdiApiMsgParam)->wdiRoamOffloadScanInfo.StartScanReason;
          vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
       }
       if ( pWdaParams->wdaMsgParam != NULL)
@@ -12635,6 +14384,20 @@
 
       vos_mem_free(pWdaParams) ;
    }
+   vosMsg.type = eWNI_SME_ROAM_SCAN_OFFLOAD_RSP;
+   vosMsg.bodyptr = NULL;
+   if (WDI_STATUS_SUCCESS != status)
+   {
+      reason = 0;
+   }
+   vosMsg.bodyval = reason;
+   if (VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MQ_ID_SME, (vos_msg_t*)&vosMsg))
+   {
+      /* free the mem and return */
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+                 "Failed to post the rsp to UMAC" ,__func__);
+   }
+
    return ;
 }
 #endif
@@ -13496,6 +15259,7 @@
    return WDI_getFwWlanFeatCaps(featEnumValue);
 }
 
+
 /*
  * FUNCTION: WDA_shutdown
  * Shutdown WDA/WDI without handshaking with Riva.
@@ -13528,6 +15292,10 @@
       wdaDestroyTimers(pWDA);
       pWDA->wdaTimersCreated = VOS_FALSE;
    }
+   else
+   {
+      vos_event_destroy(&pWDA->ftmStopDoneEvent);
+  }
 
    /* call WDI shutdown */
    wdiStatus = WDI_Shutdown(closeTransport);
@@ -13731,14 +15499,94 @@
    WDI_SetEnableSSR(enableSSR);
 }
 
+#ifdef FEATURE_WLAN_LPHB
+/*
+ * FUNCTION: WDA_LPHBconfRspCallback
+ *
+ */
+void WDA_LPHBconfRspCallback(WDI_Status status, void* pUserData)
+{
+   tWDA_ReqParams *pWdaParams = (tWDA_ReqParams *)pUserData;
+
+   VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+              "<------ %s " ,__func__);
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "%s: pWdaParams received NULL", __func__);
+      VOS_ASSERT(0) ;
+      return ;
+   }
+
+   /* Do not need to send notification to upper layer
+    * Just free allocated resources */
+   if (pWdaParams != NULL)
+   {
+      if (pWdaParams->wdaWdiApiMsgParam != NULL)
+      {
+         vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
+      }
+      vos_mem_free(pWdaParams->wdaMsgParam) ;
+      vos_mem_free(pWdaParams) ;
+   }
+
+   return;
+}
+
+/*
+ * FUNCTION: WDA_ProcessLPHBConfReq
+ *
+ */
+VOS_STATUS WDA_ProcessLPHBConfReq(tWDA_CbContext *pWDA,
+                                  tSirLPHBReq *pData)
+{
+   WDI_Status wdiStatus;
+   tWDA_ReqParams *pWdaParams ;
+
+   VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+             "------> %s " , __func__);
+
+   pWdaParams = (tWDA_ReqParams *)vos_mem_malloc(sizeof(tWDA_ReqParams)) ;
+   if (NULL == pWdaParams)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+                "%s: VOS MEM Alloc Failure", __func__);
+      VOS_ASSERT(0);
+      vos_mem_free(pData);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   pWdaParams->pWdaContext = pWDA;
+   pWdaParams->wdaMsgParam = (void *)pData;
+   pWdaParams->wdaWdiApiMsgParam = NULL;
+
+   wdiStatus = WDI_LPHBConfReq(pData, pWdaParams, WDA_LPHBconfRspCallback);
+   if (WDI_STATUS_PENDING == wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_INFO,
+              "Pending received for %s:%d ", __func__, __LINE__);
+   }
+   else if (WDI_STATUS_SUCCESS != wdiStatus)
+   {
+      VOS_TRACE(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+              "Failure in %s:%d s %d", __func__, __LINE__, wdiStatus);
+      vos_mem_free(pWdaParams->wdaMsgParam);
+      vos_mem_free(pWdaParams);
+   }
+
+   return CONVERT_WDI2VOS_STATUS(wdiStatus);
+}
+#endif /* FEATURE_WLAN_LPHB */
+
 tANI_U8 WDA_MapChannel(tANI_U8 mapChannel)
 {
-   if(mapChannel > 0 && mapChannel < 25)
+   if(mapChannel >0 && mapChannel <25){
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-     if(IS_ROAM_SCAN_OFFLOAD_FEATURE_ENABLE)
-        return aUnsortedChannelList[mapChannel - 1];
+      if(IS_ROAM_SCAN_OFFLOAD_FEATURE_ENABLE)
+         return aUnsortedChannelList[mapChannel -1];
 #endif
-     return abChannel[mapChannel - 1];
+      return abChannel[mapChannel -1];
+   }
    else
-     return 0;
+      return 0;
 }
diff --git a/CORE/WDA/src/wlan_qct_wda_ds.c b/CORE/WDA/src/wlan_qct_wda_ds.c
index 4112e71..b383875 100644
--- a/CORE/WDA/src/wlan_qct_wda_ds.c
+++ b/CORE/WDA/src/wlan_qct_wda_ds.c
@@ -59,6 +59,7 @@
 
 when        who          what, where, why
 --------    ---         ----------------------------------------------
+08/19/2013  rajekuma    Added reliable multicast support in WDA
 12/08/2010  seokyoun    Created. Move down HAL interfaces from TL to WDA
                         for UMAC convergence btween Volans/Libra and Prima
 =========================================================================== */
@@ -70,8 +71,6 @@
 
 #define WDA_DS_DXE_RES_COUNT   (WDA_TLI_MIN_RES_DATA + 20)
 
-#define VOS_TO_WPAL_PKT(_vos_pkt) ((wpt_packet*)_vos_pkt)
-
 /* macro's for acessing TL API/data structures */
 #define WDA_TL_SET_TX_XMIT_PENDING(a) WLANTL_SetTxXmitPending(a)
 #define WDA_TL_IS_TX_XMIT_PENDING(a) WLANTL_IsTxXmitPending(a)
@@ -429,6 +428,11 @@
   VOS_STATUS             vosStatus;
   WDI_DS_TxMetaInfoType* pTxMetaInfo = NULL;
   v_SIZE_t               usMacAddrSize;
+  wpt_FrameCtrl          *pFrameControl;
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+  WLANTL_CbType*         pTLCb;
+  WLANTL_RMCAST_SESSION* pRMcastSession;
+#endif
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
 
   /*------------------------------------------------------------------------
@@ -442,6 +446,20 @@
     return VOS_STATUS_E_FAULT;
   }
 
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+/*----------------------------------------------------------------
+    Extract TL control block
+   --------------------------------------------------------------*/
+  pTLCb = VOS_GET_TL_CB(pvosGCtx);
+  if ( NULL == pTLCb )
+  {
+    TLLOGE(VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+      "WLAN TL %s: pTLCb is NULL", __func__));
+
+    return VOS_STATUS_E_FAILURE;
+  }
+#endif
+
   /*------------------------------------------------------------------------
     Extract TX Meta Info pointer from PAL packet
    ------------------------------------------------------------------------*/
@@ -472,6 +490,29 @@
   vos_pkt_get_packet_length( vosDataBuff, pusPktLen);
   pTxMetaInfo->fPktlen = *pusPktLen;
 
+  /* For management frames, peek into Frame Control
+     field to get value of Protected Frame bit */
+  pTxMetaInfo->fProtMgmtFrame = 0;
+  if ( WDA_TLI_MGMT_FRAME_TYPE == pTxMetaInfo->frmType )
+  {
+    if ( 1 == ucDisableFrmXtl )  /* should be 802.11, but check */
+    {
+      vosStatus = vos_pkt_peek_data( vosDataBuff, 0, (v_PVOID_t)&pFrameControl,
+                                     sizeof( wpt_FrameCtrl ));
+      if ( VOS_STATUS_SUCCESS != vosStatus )
+      {
+        VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_ERROR,
+                   "WDA: Failed while attempting to extract Protect Bit in "
+                   "Frame Control, status %d", vosStatus );
+        VOS_ASSERT( 0 );
+        return VOS_STATUS_E_FAULT;
+      }
+      pTxMetaInfo->fProtMgmtFrame = pFrameControl->wep;
+      VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_LOW,
+                 "WLAN TL: fProtMgmtFrame:%d", pTxMetaInfo->fProtMgmtFrame );
+    }
+  }
+
   // Dst address
   usMacAddrSize = VOS_MAC_ADDR_SIZE;
   vosStatus = vos_pkt_extract_data( vosDataBuff,
@@ -494,13 +535,55 @@
   // ADDR2
   vos_copy_macaddr( (v_MACADDR_t*)pTxMetaInfo->addr2MACAddress, pAddr2 );
 
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+  /*Check if relibale multicast data path is enabled*/
+  if (pTLCb->rmcDataPathEnabled)
+  {
+    /*look up for mcast transmitter MAC address in TL's active rmcast list*/
+    if (((WDA_TLI_DATA_FRAME_TYPE >> 4) == pTxMetaInfo->frmType) &&
+        (vos_is_macaddr_group(pvDestMacAddr)))
+    {
+        pRMcastSession =
+           WLANTL_RmcLookUpRmcastSession(pTLCb->reliableMcastSession,
+           (v_MACADDR_t*)pTxMetaInfo->addr2MACAddress);
+
+        if (pRMcastSession)
+        {
+            if (0xFF == pvDestMacAddr->bytes[0])
+            {
+               pTxMetaInfo->txFlags |= (HAL_USE_BD_RATE_MASK);
+            }
+            else
+            {
+                /*Route RMCAST data frames from QID which has ACK_POLICY=TRUE*/
+                pTxMetaInfo->txFlags |= (HAL_RELIABLE_MCAST_REQUESTED_MASK);
+
+                VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+                    "RMCAST active for " MAC_ADDRESS_STR " RMCAST session",
+                    MAC_ADDR_ARRAY(pRMcastSession->reliableMcastAddr.bytes));
+            }
+        }
+        else
+        {
+            /*Multicast transmitter address does not exist in TL's active
+              RMCAST sessions list. Route this mutlicast data frame from
+              QID which has ACK_POLICY = FALSE*/
+            VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO,
+               "RMCAST disabled for " MAC_ADDRESS_STR " RMCAST session",
+               MAC_ADDR_ARRAY(pTxMetaInfo->addr2MACAddress));
+        }
+    }
+  }
+#endif /*End of WLAN_FEATURE_RELIABLE_MCAST*/
+
   /* Dump TX meta infro for debugging */
   VOS_TRACE( VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO_LOW,
              "WLAN TL: Dump TX meta info: "
              "txFlags:%d, qosEnabled:%d, ac:%d, "
-             "isEapol:%d, fdisableFrmXlt:%d" "frmType%d",
+             "isEapol:%d, fdisableFrmXlt:%d, frmType:%d",
              pTxMetaInfo->txFlags, ucQosEnabled, pTxMetaInfo->ac,
-             pTxMetaInfo->isEapol, pTxMetaInfo->fdisableFrmXlt, pTxMetaInfo->frmType );
+             pTxMetaInfo->isEapol, pTxMetaInfo->fdisableFrmXlt,
+             pTxMetaInfo->frmType );
 
   return VOS_STATUS_SUCCESS;
 }
diff --git a/CORE/WDA/src/wlan_qct_wda_legacy.c b/CORE/WDA/src/wlan_qct_wda_legacy.c
index fa2ce68..5a2f86c 100644
--- a/CORE/WDA/src/wlan_qct_wda_legacy.c
+++ b/CORE/WDA/src/wlan_qct_wda_legacy.c
@@ -165,13 +165,14 @@
    // host buffer
 
    // second parameter, 'wait option', to palAllocateMemory is ignored on Windows
-   if( eHAL_STATUS_SUCCESS != palAllocateMemory( pMac->hHdd, (void **)&pMbLocal, pMb->msgLen))
+   pMbLocal = vos_mem_malloc(pMb->msgLen);
+   if ( NULL == pMbLocal )
    {
       WDALOGE( wdaLog(pMac, LOGE, FL("Buffer Allocation failed!\n")));
       return eSIR_FAILURE;
    }
 
-   palCopyMemory(pMac, (void *)pMbLocal, (void *)pMb, pMb->msgLen);
+   vos_mem_copy((void *)pMbLocal, (void *)pMb, pMb->msgLen);
    msg.bodyptr = pMbLocal;
 
    switch (msg.type & HAL_MMH_MB_MSG_TYPE_MASK)
@@ -202,12 +203,7 @@
              msg.type));
 
       // Release the memory.
-      if (palFreeMemory( pMac->hHdd, (void*)(msg.bodyptr))
-            != eHAL_STATUS_SUCCESS)
-      {
-         WDALOGE( wdaLog(pMac, LOGE, FL("Buffer Allocation failed!\n")));
-         return eSIR_FAILURE;
-      }
+      vos_mem_free(msg.bodyptr);
       break;
    }
 
@@ -215,7 +211,7 @@
 
 } // uMacPostCtrlMsg()
 
-#ifndef QCA_WIFI_2_0
+
 /* ---------------------------------------------------------
  * FUNCTION:  wdaGetGlobalSystemRole()
  *
@@ -238,4 +234,4 @@
              wdaContext->wdaGlobalSystemRole));
    return  wdaContext->wdaGlobalSystemRole;
 }
-#endif
+
diff --git a/CORE/WDI/CP/inc/wlan_qct_wdi.h b/CORE/WDI/CP/inc/wlan_qct_wdi.h
index 15a7499..2e366e2 100644
--- a/CORE/WDI/CP/inc/wlan_qct_wdi.h
+++ b/CORE/WDI/CP/inc/wlan_qct_wdi.h
@@ -90,6 +90,9 @@
 /* MAC ADDRESS LENGTH - per spec*/
 #define WDI_MAC_ADDR_LEN 6
 
+/* IPv4 Address Length */
+#define WDI_IPV4_ADDR_LEN 4
+
 /* Max number of 11b rates -> 1,2,5.5,11 */
 #define WDI_NUM_11B_RATES                 4  
 
@@ -148,6 +151,10 @@
 
 #define WDI_SET_POWER_STATE_TIMEOUT  10000 /* in msec a very high upper limit */
 
+/* Periodic Tx pattern offload feature */
+#define PERIODIC_TX_PTRN_MAX_SIZE 1536
+#define MAXNUM_PERIODIC_TX_PTRNS 6
+
 /*============================================================================
  *     GENERIC STRUCTURES 
   
@@ -376,6 +383,28 @@
   /* P2P_NOA_Start_Indication */
   WDI_P2P_NOA_START_IND,
 
+  /* TDLS_Indication */
+  WDI_TDLS_IND,
+
+  /* LPHB Indication from FW to umac */
+  WDI_LPHB_IND,
+
+  /* IBSS Peer Inactivity Indication */
+  WDI_IBSS_PEER_INACTIVITY_IND,
+
+  /* Periodic Tx Pattern FW Indication */
+  WDI_PERIODIC_TX_PTRN_FW_IND,
+
+  /* LBP_Leader_Pick_New Indication */
+  WDI_LBP_LEADER_PICK_NEW,
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  /*Batch scan result indication from FW*/
+  WDI_BATCH_SCAN_RESULT_IND,
+#endif
+
+  WDI_TX_FAIL_IND,
+
   WDI_MAX_IND
 }WDI_LowLevelIndEnumType;
 
@@ -481,6 +510,33 @@
 } WDI_CoexIndType;
 
 /*---------------------------------------------------------------------------
+  WDI_DHCPInd
+---------------------------------------------------------------------------*/
+
+typedef struct
+{
+  wpt_uint8       device_mode;
+  wpt_uint8       macAddr[WDI_MAC_ADDR_LEN];
+}WDI_DHCPInd;
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+typedef struct
+{
+   /*Request status callback offered by UMAC - it is called if the current
+    req has returned PENDING as status; it delivers the status of sending
+    the message over the BUS */
+  WDI_ReqStatusCb   wdiReqStatusCB;
+
+  /*The user data passed in by UMAC, it will be sent back when the above
+    function pointer will be called */
+  void*             pUserData;
+
+  wpt_uint8         tx_fail_count;
+}WDI_TXFailMonitorInd;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+/*---------------------------------------------------------------------------
+
   WDI_MacSSid
 ---------------------------------------------------------------------------*/
 typedef struct 
@@ -537,6 +593,16 @@
   wpt_uint32      bssIdx;
 }WDI_P2pNoaStartIndType;
 
+/*---------------------------------------------------------------------------
+ *WDI_TdlsIndType
+ *-------------------------------------------------------------------------*/
+typedef struct
+{
+  wpt_uint16      status;
+  wpt_uint16      assocId;
+  wpt_uint16      staIdx;
+  wpt_uint16      reasonCode;
+}WDI_TdlsIndType;
 
 #ifdef WLAN_WAKEUP_EVENTS
 /*---------------------------------------------------------------------------
@@ -563,6 +629,342 @@
     wpt_uint8       bssIdx;  /*bssidx on which beacon is missed*/
 } WDI_MissedBeaconIndType;
 
+#ifdef FEATURE_WLAN_LPHB
+/*---------------------------------------------------------------------------
+ WDI_LPHBTimeoutIndData
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+   wpt_uint8 bssIdx;
+   wpt_uint8 sessionIdx;
+   wpt_uint8 protocolType; /*TCP or UDP*/
+   wpt_uint8 eventReason;
+} WDI_LPHBTimeoutIndData;
+#endif /* FEATURE_WLAN_LPHB */
+
+/*-----------------------------------------------------------------------------
+WDI_PeriodicTxPtrnFwIndType
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8  bssIdx;
+    wpt_uint32 selfStaIdx;
+    wpt_uint32 status;
+    wpt_uint32 patternIdBitmap;
+} WDI_PeriodicTxPtrnFwIndType;
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/*---------------------------------------------------------------------------
+  WDI_SetBatchScanReqType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint32 scanFrequency;        /* how frequent to do scan default 30Sec*/
+    wpt_uint32 numberOfScansToBatch; /* number of scans to batch */
+    wpt_uint32 bestNetwork;          /* best networks in terms of rssi */
+    wpt_uint8  rfBand;               /* band to scan :
+                                      0 ->both Band, 1->2.4Ghz Only
+                                      and 2-> 5GHz Only */
+    wpt_uint32 rtt;                  /* set if required to do RTT it is not
+                                      supported in current version */
+}WDI_SetBatchScanReqType;
+
+/*---------------------------------------------------------------------------
+  WDI_SetBatchScanRspType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  /*max number of scans which FW can cache*/
+  wpt_uint32 nScansToBatch;
+}WDI_SetBatchScanRspType;
+
+/*---------------------------------------------------------------------------
+  WDI_TriggerBatchScanResultIndType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint32 param;
+}WDI_TriggerBatchScanResultIndType;
+
+/*---------------------------------------------------------------------------
+  WDI_StopBatchScanIndType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  /*max number of scans which FW can cache*/
+  wpt_uint32 param;
+}WDI_StopBatchScanIndType;
+
+
+/*---------------------------------------------------------------------------
+ * WDI_BatchScanResultIndType
+ *--------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint32   bssid[6];     /* BSSID */
+    wpt_uint32   ssid[32];     /* SSID */
+    wpt_uint32   ch;           /* Channel */
+    wpt_uint32   rssi;         /* RSSI or Level */
+    /* Timestamp when Network was found. Used to calculate age based on
+       timestamp in GET_RSP msg header */
+    wpt_uint32  timestamp;
+} tWDIBatchScanNetworkInfo, *tpWDIBatchScanNetworkInfo;
+
+typedef struct
+{
+    wpt_uint32   scanId; /*Scan List ID*/
+    /*No of AP in a Scan Result. Should be same as bestNetwork in SET_REQ msg*/
+    wpt_uint32   numNetworksInScanList;
+    /*Variable data ptr: Number of AP in Scan List*/
+    wpt_uint32    scanList[1];
+} tWDIBatchScanList, *tpWDIBatchScanList;
+
+typedef struct
+{
+    wpt_uint32      timestamp;
+    wpt_uint32      numScanLists;
+    wpt_boolean     isLastResult;
+    /* Variable Data ptr: Number of Scan Lists*/
+    wpt_uint32      scanResults[1];
+}  tWDIBatchScanResultParam, *tpWDIBatchScanResultParam;
+
+#endif
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+typedef struct
+{
+  wpt_uint8 seqNo;
+  wpt_uint8 macAddr[WDI_MAC_ADDR_LEN];
+} WDI_TXFailIndType;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+/*---------------------------------------------------------------------------
+ WDI_IbssPeerInactivityIndType
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+   wpt_uint8   bssIdx;
+   wpt_uint8   staIdx;
+   wpt_macAddr staMacAddr;
+}WDI_IbssPeerInactivityIndType;
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+/*---------------------------------------------------------------------------
+ WDI_LbpLeaderReqParams
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8       cmd;  /* command- suggest or become leader */
+
+    /* MAC address of MCAST Transmitter (source) */
+    wpt_macAddr mcastTransmitter;
+
+    /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+    wpt_macAddr mcastGroup;
+
+    /* List of candidates for cmd = WLAN_HAL_SUGGEST_LEADER*/
+    wpt_macAddr blacklist[16]; /* HAL_NUM_MAX_LEADERS */
+
+    /*
+     * Request status callback offered by UMAC - it is called if the current
+     * req has returned PENDING as status; it delivers the status of sending
+     * the message over the BUS
+     */
+    WDI_ReqStatusCb    wdiReqStatusCB;
+
+} WDI_LbpLeaderReqParams;
+
+/*---------------------------------------------------------------------------
+ WDI_LbpUpdateIndParams
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8       indication;  /* tLbpUpdateIndType */
+
+    wpt_uint8       role;  /* leader or transmitter */
+
+    /* MAC address of MCAST Transmitter (source) */
+    wpt_macAddr mcastTransmitter;
+
+    /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+    wpt_macAddr mcastGroup;
+
+    /* MAC address of MCAST Leader (destination) */
+    wpt_macAddr mcastLeader;
+
+    /* List of candidates for cmd = WLAN_HAL_SUGGEST_LEADER*/
+    wpt_macAddr leader[16]; /* HAL_NUM_MAX_LEADERS */
+
+    /*
+     * Request status callback offered by UMAC - it is called if the current
+     * req has returned PENDING as status; it delivers the status of sending
+     * the message over the BUS
+     */
+    WDI_ReqStatusCb   wdiReqStatusCB;
+
+    /*
+     * The user data passed in by UMAC, it will be sent back when the above
+     * function pointer will be called
+     */
+    void   *pUserData;
+
+} WDI_LbpUpdateIndParams;
+
+typedef enum
+{
+  eWDI_SUGGEST_LEADER_CMD = 0,
+  eWDI_BECOME_LEADER_CMD  = 1,
+} eWDI_LeaderRspCmdType;
+
+/*---------------------------------------------------------------------------
+ WDI_LbpRspParamsType
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8       status;  /* success or failure */
+
+    /*  Command Type */
+    eWDI_LeaderRspCmdType cmd;  /* suggest or become leader */
+
+    /* MAC address of MCAST Transmitter (source) */
+    wpt_macAddr mcastTransmitter;
+
+    /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+    wpt_macAddr mcastGroup;
+
+    /* List of candidates for cmd = WLAN_HAL_SUGGEST_LEADER*/
+    wpt_macAddr leader[16]; /* HAL_NUM_MAX_LEADERS */
+} WDI_LbpRspParamsType;
+
+/*---------------------------------------------------------------------------
+ WDI_LbpPickNewLeader
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8       indication;  /* pick_new */
+
+    wpt_uint8       role;  /* leader or transmitter */
+
+    /* MAC address of MCAST Transmitter (source) */
+    wpt_macAddr mcastTransmitter;
+
+    /* MAC Address of Multicast Group (01-00-5E-xx-xx-xx) */
+    wpt_macAddr mcastGroup;
+
+    /* MAC Address of Multicast Leader */
+    wpt_macAddr mcastLeader;
+
+    /* List of candidates for cmd = WLAN_HAL_LEADER_PICK_NEW*/
+    wpt_macAddr leader[16]; /* HAL_NUM_MAX_LEADERS */
+} WDI_LbpPickNewLeader;
+
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/*---------------------------------------------------------------------------
+  WDI_IBSSRouteTableInd
+---------------------------------------------------------------------------*/
+
+typedef struct
+{
+   wpt_uint8 destIpv4Addr[WDI_IPV4_ADDR_LEN];
+   wpt_uint8 nextHopMacAddr[WDI_MAC_ADDR_LEN];
+} WDI_DestIpNextHopMacPair;
+
+typedef struct
+{
+  /*
+   * Request status callback offered by UMAC - it is called if the current
+   * req has returned PENDING as status; it delivers the status of sending
+   * the message over the BUS
+   */
+  WDI_ReqStatusCb wdiReqStatusCB;
+
+  /*
+   * The user data passed in by UMAC, it will be sent back when the above
+   * function pointer will be called
+   */
+  void *pUserData;
+
+  wpt_uint16 numEntries;
+
+  WDI_DestIpNextHopMacPair destIpMacPair[1];
+} WDI_IBSSRouteTable;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+/*---------------------------------------------------------------------------
+ WDI_TxRateFlags
+-----------------------------------------------------------------------------*/
+typedef enum
+{
+   WDI_TX_RATE_LEGACY = 0x1,    /* Legacy rates */
+   WDI_TX_RATE_HT20   = 0x2,    /* HT20 rates */
+   WDI_TX_RATE_HT40   = 0x4,    /* HT40 rates */
+   WDI_TX_RATE_SGI    = 0x8,    /* Rate with Short guard interval */
+   WDI_TX_RATE_LGI    = 0x10,   /* Rate with Long guard interval */
+   WDI_TX_RATE_VHT20  = 0x20,   /* VHT 20 rates */
+   WDI_TX_RATE_VHT40  = 0x40,   /* VHT 20 rates */
+   WDI_TX_RATE_VHT80  = 0x80,   /* VHT 20 rates */
+   WDI_TX_RATE_VIRT   = 0x100,  /* Virtual Rate */
+} WDI_TxRateFlags;
+
+/*---------------------------------------------------------------------------
+ WDI_RateUpdateIndParams
+-----------------------------------------------------------------------------*/
+typedef struct
+{
+    /* 0 implies RA, positive value implies fixed rate, -1 implies ignore this
+     * param ucastDataRate can be used to control RA behavior of unicast data to
+     */
+    wpt_int32 ucastDataRate;
+
+    /* TX flag to differentiate between HT20, HT40 etc */
+    WDI_TxRateFlags ucastDataRateTxFlag;
+
+    /* BSSID - Optional. 00-00-00-00-00-00 implies apply to all BCAST STAs */
+    wpt_macAddr bssid;
+
+    /*
+     * 0 implies MCAST RA, positive value implies fixed rate,
+     * -1 implies ignore this param
+     */
+    wpt_int32 reliableMcastDataRate; //unit Mbpsx10
+
+    /* TX flag to differentiate between HT20, HT40 etc */
+    WDI_TxRateFlags reliableMcastDataRateTxFlag;
+
+    /*
+     * MCAST(or BCAST) fixed data rate in 2.4 GHz, unit Mbpsx10,
+     * 0 implies ignore
+     */
+    wpt_uint32 mcastDataRate24GHz;
+
+    /* TX flag to differentiate between HT20, HT40 etc */
+    WDI_TxRateFlags mcastDataRate24GHzTxFlag;
+
+    /*
+     * MCAST(or BCAST) fixed data rate in 5 GHz,
+     * unit Mbpsx10, 0 implies ignore
+     */
+    wpt_uint32 mcastDataRate5GHz;
+
+    /* TX flag to differentiate between HT20, HT40 etc */
+    WDI_TxRateFlags mcastDataRate5GHzTxFlag;
+
+    /*
+     * Request status callback offered by UMAC - it is called if the current
+     * req has returned PENDING as status; it delivers the status of sending
+     * the message over the BUS
+     */
+    WDI_ReqStatusCb   wdiReqStatusCB;
+
+    /*
+     * The user data passed in by UMAC, it will be sent back when the above
+     * function pointer will be called
+     */
+    void   *pUserData;
+
+} WDI_RateUpdateIndParams;
 
 /*---------------------------------------------------------------------------
   WDI_LowLevelIndType
@@ -601,6 +1003,8 @@
     /* P2P NOA ATTR Indication */
     WDI_P2pNoaAttrIndType        wdiP2pNoaAttrInfo;
     WDI_P2pNoaStartIndType       wdiP2pNoaStartInfo;
+    /* TDLS Indications */
+    WDI_TdlsIndType              wdiTdlsIndInfo;
 
 
 #ifdef FEATURE_WLAN_SCAN_PNO
@@ -611,6 +1015,30 @@
     WDI_WakeReasonIndType        wdiWakeReasonInd;
 #endif // WLAN_WAKEUP_EVENTS
     WDI_MissedBeaconIndType      wdiMissedBeaconInd;
+
+#ifdef FEATURE_WLAN_LPHB
+    WDI_LPHBTimeoutIndData       wdiLPHBTimeoutInd;
+#endif /* FEATURE_WLAN_LPHB */
+
+    /* IBSS Peer Inactivity Indication */
+    WDI_IbssPeerInactivityIndType   wdiIbssPeerInactivityInd;
+
+    /* Periodic TX Pattern FW Indication */
+    WDI_PeriodicTxPtrnFwIndType  wdiPeriodicTxPtrnFwInd;
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+    WDI_LbpPickNewLeader        wdiLbpPickNewLeaderInd;
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+    /*batch scan result indication from FW*/
+    void *pBatchScanResult;
+#endif
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+    WDI_TXFailIndType            wdiTXFailInd;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
   }  wdiIndicationData;
 }WDI_LowLevelIndType;
 
@@ -2125,13 +2553,8 @@
 ---------------------------------------------------------------------------*/
 typedef struct
 {
-   /*BSS Index of the BSS*/
-   wpt_uint8      ucBssIdx;
-
-  /* Boolean to indicate if EDCA params are valid. UMAC might not have valid 
-    EDCA params or might not desire to apply EDCA params during config BSS. 
-    0 implies Not Valid ; Non-Zero implies valid*/
-  wpt_uint8   ucEDCAParamsValid;
+  /*BSS Index of the BSS*/
+  wpt_uint16      ucBssIdx;
 
   /*EDCA params for BE*/
   WDI_EdcaParamRecord wdiEdcaBEInfo;
@@ -2583,6 +3006,7 @@
     WDI_LINK_INIT_CAL_STATE          = 12,
     WDI_LINK_FINISH_CAL_STATE        = 13,
     WDI_LINK_LISTEN_STATE            = 14,
+    WDI_LINK_SEND_ACTION_STATE       = 15,
     WDI_LINK_MAX                     = 0x7FFFFFFF
 } WDI_LinkStateType;
 
@@ -2964,6 +3388,45 @@
 }WDI_SetMaxTxPowerParamsType;
 
 /*---------------------------------------------------------------------------
+  WDI_Band
+---------------------------------------------------------------------------*/
+typedef enum
+{
+    WDI_BAND_ALL,
+    WDI_BAND_24,
+    WDI_BAND_5G,
+    WDI_BAND_MAX,
+}eWDIBand;
+
+/*---------------------------------------------------------------------------
+  WDI_MaxTxPowerPerBandInfoType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  eWDIBand   bandInfo;
+  /* In request  power == MaxTxpower to be used.*/
+  wpt_uint8  ucPower;
+}WDI_MaxTxPowerPerBandInfoType;
+
+/*---------------------------------------------------------------------------
+  WDI_SetMaxTxPowerPerBandParamsType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  /*Link Info*/
+  WDI_MaxTxPowerPerBandInfoType  wdiMaxTxPowerPerBandInfo;
+
+  /*Request status callback offered by UMAC - it is called if the current
+    req has returned PENDING as status; it delivers the status of sending
+    the message over the BUS */
+  WDI_ReqStatusCb   wdiReqStatusCB;
+
+  /*The user data passed in by UMAC, it will be sent back when the above
+    function pointer will be called */
+  void*             pUserData;
+}WDI_SetMaxTxPowerPerBandParamsType;
+
+/*---------------------------------------------------------------------------
   WDI_SetTxPowerParamsType
 ---------------------------------------------------------------------------*/
 typedef struct
@@ -2996,6 +3459,19 @@
 }WDI_SetMaxTxPowerRspMsg;
 
 /*---------------------------------------------------------------------------
+  WDI_SetMaxTxPowerPerBandRspMsg
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  /* In response, power==tx power used for management frames*/
+  wpt_int8  ucPower;
+
+  /*Result of the operation*/
+  WDI_Status wdiStatus;
+
+}WDI_SetMaxTxPowerPerBandRspMsg;
+
+/*---------------------------------------------------------------------------
   WDI_SetTxPowerRspMsg
 ---------------------------------------------------------------------------*/
 
@@ -3038,6 +3514,41 @@
   void*             pUserData;
 }WDI_SetP2PGONOAReqParamsType;
 
+typedef struct
+{
+    wpt_uint16 uStaIdx;
+    wpt_uint8  uIsResponder;
+    wpt_uint8  uUapsdQueues;
+    wpt_uint8  uMaxSp;
+    wpt_uint8  uIsBufSta;
+}WDI_SetTDLSLinkEstablishReqInfoType;
+/*---------------------------------------------------------------------------
+  WDI_SetTDLSLinkEstablishReqParamsType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  /*TDLS Link Establish Req*/
+  WDI_SetTDLSLinkEstablishReqInfoType  wdiTDLSLinkEstablishInfo;
+
+  /*Request status callback offered by UMAC - it is called if the current
+    req has returned PENDING as status; it delivers the status of sending
+    the message over the BUS */
+  WDI_ReqStatusCb   wdiReqStatusCB;
+
+  /*The user data passed in by UMAC, it will be sent back when the above
+    function pointer will be called */
+  void*             pUserData;
+}WDI_SetTDLSLinkEstablishReqParamsType;
+
+
+typedef struct
+{
+  /*Result of the operation*/
+  WDI_Status wdiStatus;
+
+  /*STA Idx*/
+  wpt_uint16 uStaIdx;
+}WDI_SetTdlsLinkEstablishReqResp;
 
 /*---------------------------------------------------------------------------
   WDI_SetAddSTASelfParamsType
@@ -3047,6 +3558,9 @@
   /*Self Station MAC address*/
   wpt_macAddr selfMacAddr;
 
+  /*Self STA device mode*/
+  wpt_uint32 currDeviceMode;
+
   /*Status of the operation*/
   wpt_uint32  uStatus;
 }WDI_AddSTASelfInfoType;
@@ -4240,28 +4754,85 @@
   WDI_Status   wdiStatus; 
 }WDI_SuspendResumeRspParamsType;
 
+#ifdef FEATURE_WLAN_LPHB
+/*---------------------------------------------------------------------------
+  WDI Low Power Heart Beat Config request
+  Copy from sirApi.h to avoid compile error
+---------------------------------------------------------------------------*/
+#define WDI_LPHB_FILTER_LEN   64
 
-#ifdef FEATURE_WLAN_SCAN_PNO
+typedef enum
+{
+   WDI_LPHB_SET_EN_PARAMS_INDID = 0x0001,
+   WDI_LPHB_SET_TCP_PARAMS_INDID,
+   WDI_LPHB_SET_TCP_PKT_FILTER_INDID,
+   WDI_LPHB_SET_UDP_PARAMS_INDID,
+   WDI_LPHB_SET_UDP_PKT_FILTER_INDID,
+   WDI_LPHB_SET_NETWORK_INFO_INDID,
+} WDI_LPHBIndType;
 
-/*Max number of channels for a given network supported by PNO*/
-#define WDI_PNO_MAX_NETW_CHANNELS  26
+typedef struct
+{
+   wpt_uint8 enable;
+   wpt_uint8 item;
+   wpt_uint8 session;
+} WDI_LPHBEnableStruct;
 
-/*Max number of channels for a given network supported by PNO*/
-#define WDI_PNO_MAX_NETW_CHANNELS_EX  60
+typedef struct
+{
+   wpt_uint32 srv_ip;
+   wpt_uint32 dev_ip;
+   wpt_uint16 src_port;
+   wpt_uint16 dst_port;
+   wpt_uint16 timeout;
+   wpt_uint8  session;
+   wpt_uint8  gateway_mac[WDI_MAC_ADDR_LEN];
+   wpt_uint16 timePeriodSec; // in seconds
+   wpt_uint32 tcpSn;
+} WDI_LPHBTcpParamStruct;
 
-/*The max number of programable networks for PNO*/
-#define WDI_PNO_MAX_SUPP_NETWORKS  16
+typedef struct
+{
+   wpt_uint16 length;
+   wpt_uint8  offset;
+   wpt_uint8  session;
+   wpt_uint8  filter[WDI_LPHB_FILTER_LEN];
+} WDI_LPHBTcpFilterStruct;
 
-/*The max number of scan timers programable in Riva*/
-#define WDI_PNO_MAX_SCAN_TIMERS    10
+typedef struct
+{
+   wpt_uint32 srv_ip;
+   wpt_uint32 dev_ip;
+   wpt_uint16 src_port;
+   wpt_uint16 dst_port;
+   wpt_uint16 interval;
+   wpt_uint16 timeout;
+   wpt_uint8  session;
+   wpt_uint8  gateway_mac[WDI_MAC_ADDR_LEN];
+} WDI_LPHBUdpParamStruct;
 
-#define WDI_PNO_MAX_PROBE_SIZE    450
+typedef struct
+{
+   wpt_uint16 length;
+   wpt_uint8  offset;
+   wpt_uint8  session;
+   wpt_uint8  filter[WDI_LPHB_FILTER_LEN];
+} WDI_LPHBUdpFilterStruct;
 
-#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-#define WDI_ROAM_SCAN_MAX_CHANNELS       80 /* NUM_RF_CHANNELS */
-#define WDI_ROAM_SCAN_MAX_PROBE_SIZE     450
-#define WDI_ROAM_SCAN_RESERVED_BYTES     64
-#endif
+typedef struct
+{
+   wpt_uint16 cmd;
+   wpt_uint16 dummy;
+   union
+   {
+      WDI_LPHBEnableStruct     lphbEnableReq;
+      WDI_LPHBTcpParamStruct   lphbTcpParamReq;
+      WDI_LPHBTcpFilterStruct  lphbTcpFilterReq;
+      WDI_LPHBUdpParamStruct   lphbUdpParamReq;
+      WDI_LPHBUdpFilterStruct  lphbUdpFilterReq;
+   } params;
+} WDI_LPHBReq;
+#endif /* FEATURE_WLAN_LPHB */
 
 /*---------------------------------------------------------------------------
   WDI_AuthType
@@ -4304,6 +4875,21 @@
     WDI_ED_MAX = 0xFFFFFFFF /*expanding the type to UINT32*/
 } WDI_EdType;
 
+#ifdef FEATURE_WLAN_SCAN_PNO
+
+/*Max number of channels for a given network supported by PNO*/
+#define WDI_PNO_MAX_NETW_CHANNELS  26
+
+/*Max number of channels for a given network supported by PNO*/
+#define WDI_PNO_MAX_NETW_CHANNELS_EX  60
+
+/*The max number of programable networks for PNO*/
+#define WDI_PNO_MAX_SUPP_NETWORKS  16
+
+/*The max number of scan timers programable in Riva*/
+#define WDI_PNO_MAX_SCAN_TIMERS    10
+
+#define WDI_PNO_MAX_PROBE_SIZE    450
 
 /*---------------------------------------------------------------------------
   WDI_PNOMode
@@ -4352,7 +4938,7 @@
   wpt_uint8    ucChannelCount;
 
   /*the actual channels*/
-  wpt_uint8    aChannels[WDI_PNO_MAX_NETW_CHANNELS];
+  wpt_uint8    aChannels[WDI_PNO_MAX_NETW_CHANNELS_EX];
 
   /*rssi threshold that a network must meet to be considered, 0 - for any*/
   wpt_uint8    rssiThreshold;
@@ -4429,8 +5015,80 @@
    void*                      pUserData; 
 } WDI_PNOScanReqParamsType;
 
+/*---------------------------------------------------------------------------
+  WDI_SetRssiFilterReqParamsType
+  PNO info passed to WDI form WDA
+---------------------------------------------------------------------------*/
+typedef struct
+{
+   /* RSSI Threshold */
+   wpt_uint8                  rssiThreshold;
+  /* Request status callback offered by UMAC - it is called if the current req
+   has returned PENDING as status; it delivers the status of sending the message
+   over the BUS */
+   WDI_ReqStatusCb            wdiReqStatusCB;
+   /* The user data passed in by UMAC, it will be sent back when the above
+   function pointer will be called */
+   void*                      pUserData;
+} WDI_SetRssiFilterReqParamsType;
+
+/*---------------------------------------------------------------------------
+  WDI_UpdateScanParamsInfo
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  /*Is 11d enabled*/
+  wpt_uint8    b11dEnabled;
+
+  /*Was UMAc able to find the regulatory domain*/
+  wpt_uint8    b11dResolved;
+
+  /*Number of channel allowed in the regulatory domain*/
+  wpt_uint8    ucChannelCount;
+
+  /*The actual channels allowed in the regulatory domain*/
+  wpt_uint8    aChannels[WDI_PNO_MAX_NETW_CHANNELS_EX];
+
+  /*Passive min channel time*/
+  wpt_uint16   usPassiveMinChTime;
+
+  /*Passive max channel time*/
+  wpt_uint16   usPassiveMaxChTime;
+
+  /*Active min channel time*/
+  wpt_uint16   usActiveMinChTime;
+
+  /*Active max channel time*/
+  wpt_uint16   usActiveMaxChTime;
+
+  /*channel bonding info*/
+  wpt_uint8    cbState;
+} WDI_UpdateScanParamsInfo;
+
+/*---------------------------------------------------------------------------
+  WDI_UpdateScanParamsInfoType
+  UpdateScanParams info passed to WDI form WDA
+---------------------------------------------------------------------------*/
+typedef struct
+{
+   /* PNO Info Type, same as tUpdateScanParams */
+   WDI_UpdateScanParamsInfo   wdiUpdateScanParamsInfo;
+   /* Request status callback offered by UMAC - it is called if the current req
+   has returned PENDING as status; it delivers the status of sending the message
+   over the BUS */
+   WDI_ReqStatusCb            wdiReqStatusCB;
+   /* The user data passed in by UMAC, it will be sent back when the above
+   function pointer will be called */
+   void*                      pUserData;
+} WDI_UpdateScanParamsInfoType;
+#endif //FEATURE_WLAN_SCAN_PNO
+
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 
+#define WDI_ROAM_SCAN_MAX_CHANNELS       80 /* NUM_RF_CHANNELS */
+#define WDI_ROAM_SCAN_MAX_PROBE_SIZE     450
+#define WDI_ROAM_SCAN_RESERVED_BYTES     61
+
 typedef struct
 {
   /*The SSID of the preferred network*/
@@ -4467,6 +5125,7 @@
 typedef struct
 {
   wpt_boolean RoamScanOffloadEnabled;
+  wpt_boolean MAWCEnabled;
   wpt_uint8   LookupThreshold;
   wpt_uint8   RoamRssiDiff;
   wpt_uint8   ChannelCacheType;
@@ -4487,10 +5146,12 @@
   /*Probe template for 5GHz band*/
   wpt_uint16  us5GProbeSize;
   wpt_uint8   a5GProbeTemplate[WDI_ROAM_SCAN_MAX_PROBE_SIZE];
-  /*LFR BG Scan will currently look for only on network to which it is initially connected.
+  /*LFR BG Scan will currently look for only one network to which it is initially connected.
    * As per requirement, later, the following structure can be used as an array of networks.*/
   WDI_RoamNetworkType     ConnectedNetwork;
   WDI_MobilityDomainInfo  MDID;
+  wpt_uint8               nProbes;
+  wpt_uint16              HomeAwayTime;
   wpt_uint8               ReservedBytes[WDI_ROAM_SCAN_RESERVED_BYTES];
 } WDI_RoamOffloadScanInfo;
 
@@ -4505,77 +5166,8 @@
    /* The user data passed in by UMAC, it will be sent back when the above
    function pointer will be called */
    void*                      pUserData;
-} WDI_RoamCandidateLookupReqParamsType;
-
-#endif
-
-/*---------------------------------------------------------------------------
-  WDI_SetRssiFilterReqParamsType
-  PNO info passed to WDI form WDA
----------------------------------------------------------------------------*/
-typedef struct 
-{ 
-   /* RSSI Threshold */ 
-   wpt_uint8                  rssiThreshold; 
-   /* Request status callback offered by UMAC - it is called if the current req
-   has returned PENDING as status; it delivers the status of sending the message
-   over the BUS */ 
-   WDI_ReqStatusCb            wdiReqStatusCB; 
-   /* The user data passed in by UMAC, it will be sent back when the above
-   function pointer will be called */ 
-   void*                      pUserData; 
-} WDI_SetRssiFilterReqParamsType;
-
-/*---------------------------------------------------------------------------
-  WDI_UpdateScanParamsInfo
----------------------------------------------------------------------------*/
-typedef struct 
-{
-  /*Is 11d enabled*/
-  wpt_uint8    b11dEnabled; 
-
-  /*Was UMAc able to find the regulatory domain*/
-  wpt_uint8    b11dResolved;
-
-  /*Number of channel allowed in the regulatory domain*/
-  wpt_uint8    ucChannelCount; 
-
-  /*The actual channels allowed in the regulatory domain*/
-  wpt_uint8    aChannels[WDI_PNO_MAX_NETW_CHANNELS_EX]; 
-
-  /*Passive min channel time*/
-  wpt_uint16   usPassiveMinChTime; 
-
-  /*Passive max channel time*/
-  wpt_uint16   usPassiveMaxChTime; 
-
-  /*Active min channel time*/
-  wpt_uint16   usActiveMinChTime; 
-
-  /*Active max channel time*/
-  wpt_uint16   usActiveMaxChTime; 
-
-  /*channel bonding info*/
-  wpt_uint8    cbState; 
-} WDI_UpdateScanParamsInfo;
-
-/*---------------------------------------------------------------------------
-  WDI_UpdateScanParamsInfoType
-  UpdateScanParams info passed to WDI form WDA
----------------------------------------------------------------------------*/
-typedef struct 
-{ 
-   /* PNO Info Type, same as tUpdateScanParams */ 
-   WDI_UpdateScanParamsInfo   wdiUpdateScanParamsInfo; 
-   /* Request status callback offered by UMAC - it is called if the current req
-   has returned PENDING as status; it delivers the status of sending the message
-   over the BUS */ 
-   WDI_ReqStatusCb            wdiReqStatusCB; 
-   /* The user data passed in by UMAC, it will be sent back when the above
-   function pointer will be called */ 
-   void*                      pUserData; 
-} WDI_UpdateScanParamsInfoType;
-#endif // FEATURE_WLAN_SCAN_PNO
+} WDI_RoamScanOffloadReqParamsType;
+#endif //WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 
 /*---------------------------------------------------------------------------
   WDI_UpdateScanParamsInfo
@@ -4922,6 +5514,129 @@
   void*            pUserData;
 }WDI_SetTmLevelRspType;
 
+#ifdef FEATURE_WLAN_LPHB
+/*---------------------------------------------------------------------------
+  WDI_LPHBConfigParamsType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  void*             pLphsConfIndData;
+}WDI_LPHBConfigParamsType;
+#endif /* FEATURE_WLAN_LPHB */
+
+/*---------------------------------------------------------------------------
+  WDI_AddPeriodicTxPtrnInfoType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  /* MAC Address for the adapter  */
+  wpt_macAddr macAddr;
+
+  wpt_uint8  ucPtrnId;           // Pattern ID
+  wpt_uint16 ucPtrnSize;         // Pattern size
+  wpt_uint32 usPtrnIntervalMs;   // In msec
+  wpt_uint8  ucPattern[PERIODIC_TX_PTRN_MAX_SIZE]; // Pattern buffer
+} WDI_AddPeriodicTxPtrnInfoType;
+
+/*---------------------------------------------------------------------------
+  WDI_DelPeriodicTxPtrnInfoType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  /* MAC Address for the adapter  */
+  wpt_macAddr macAddr;
+
+  /* Bitmap of pattern IDs that needs to be deleted */
+  wpt_uint32 ucPatternIdBitmap;
+} WDI_DelPeriodicTxPtrnInfoType;
+
+/*---------------------------------------------------------------------------
+  WDI_AddPeriodicTxPtrnParamsType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  WDI_AddPeriodicTxPtrnInfoType wdiAddPeriodicTxPtrnParams;
+
+  /*Request status callback offered by UMAC - it is called if the current
+    req has returned PENDING as status; it delivers the status of sending
+    the message over the BUS */
+  WDI_ReqStatusCb   wdiReqStatusCB;
+
+  /*The user data passed in by UMAC, it will be sent back when the above
+    function pointer will be called */
+  void*             pUserData;
+} WDI_AddPeriodicTxPtrnParamsType;
+
+/*---------------------------------------------------------------------------
+  WDI_DelPeriodicTxPtrnParamsType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+  WDI_DelPeriodicTxPtrnInfoType wdiDelPeriodicTxPtrnParams;
+
+  /*Request status callback offered by UMAC - it is called if the current
+    req has returned PENDING as status; it delivers the status of sending
+    the message over the BUS */
+  WDI_ReqStatusCb   wdiReqStatusCB;
+
+  /*The user data passed in by UMAC, it will be sent back when the above
+    function pointer will be called */
+  void*             pUserData;
+} WDI_DelPeriodicTxPtrnParamsType;
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/*---------------------------------------------------------------------------
+  WDI_IbssPeerInfoParams
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint8  wdiStaIdx;       //StaIdx
+    wpt_uint32 wdiTxRate;       //Tx Rate
+    wpt_uint32 wdiMcsIndex;     //MCS Index
+    wpt_uint32 wdiTxRateFlags;  //TxRate Flags
+    wpt_int8   wdiRssi;         //RSSI
+}WDI_IbssPeerInfoParams;
+
+/*---------------------------------------------------------------------------
+  WDI_IbssPeerInfoRspParams
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_uint32        wdiStatus;                  // Return status
+    wpt_uint8         wdiNumPeers;                // Number of peers
+    WDI_IbssPeerInfoParams *wdiPeerInfoParams; // Peer Info parameters
+}WDI_IbssPeerInfoRspParams;
+
+/*---------------------------------------------------------------------------
+  WDI_GetIbssPeerInfoRspType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    WDI_IbssPeerInfoRspParams  wdiPeerInfoRspParams;
+
+    /*Request status callback offered by UMAC - it is called if the current
+      req has returned PENDING as status; it delivers the status of sending
+      the message over the BUS */
+    WDI_ReqStatusCb   wdiReqStatusCB;
+
+    /*The user data passed in by UMAC, it will be sent back when the above
+      function pointer will be called */
+    void*             pUserData;
+}WDI_GetIbssPeerInfoRspType;
+
+/*---------------------------------------------------------------------------
+  WDI_IbssPeerInfoReqType
+---------------------------------------------------------------------------*/
+typedef struct
+{
+    wpt_boolean wdiAllPeerInfoReqd; // Request info for all peers
+    wpt_uint8   wdiStaIdx;          // STA Index
+    wpt_uint8   wdiBssIdx;          // BSS Index
+}WDI_IbssPeerInfoReqType;
+
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+
 /*----------------------------------------------------------------------------
  *   WDI callback types
  *--------------------------------------------------------------------------*/
@@ -5644,6 +6359,27 @@
                                              void* pUserData);
 
 /*---------------------------------------------------------------------------
+   WDA_SetMaxTxPowerPerBandRspCb
+
+   DESCRIPTION
+
+   This callback is invoked by DAL when it has received a
+   set max Tx Power Per Band response from the underlying device.
+
+   PARAMETERS
+
+    IN
+    wdiSetMaxTxPowerPerBandRsp:  response status received from HAL
+    pUserData:  user data
+
+  RETURN VALUE
+    The result code associated with performing the operation
+---------------------------------------------------------------------------*/
+typedef void (*WDA_SetMaxTxPowerPerBandRspCb)(WDI_SetMaxTxPowerPerBandRspMsg
+                                              *wdiSetMaxTxPowerPerBandRsp,
+                                              void* pUserData);
+
+/*---------------------------------------------------------------------------
    WDA_SetTxPowerRspCb
 
    DESCRIPTION
@@ -5707,6 +6443,28 @@
 typedef void  (*WDI_SetP2PGONOAReqParamsRspCb)(WDI_Status   wdiStatus,
                                 void*        pUserData);
 
+/*---------------------------------------------------------------------------
+   WDI_SetTDLSLinkEstablishReqParamsRspCb
+
+   DESCRIPTION
+
+   This callback is invoked by DAL when it has received a TDLS Link Establish Req response from
+   the underlying device.
+
+   PARAMETERS
+
+    IN
+    wdiStatus:  response status received from HAL
+    pUserData:  user data
+
+
+
+  RETURN VALUE
+    The result code associated with performing the operation
+---------------------------------------------------------------------------*/
+typedef void  (*WDI_SetTDLSLinkEstablishReqParamsRspCb)(WDI_SetTdlsLinkEstablishReqResp *
+                                wdiSetTdlsLinkEstablishReqRsp,
+                                void*        pUserData);
 
 /*---------------------------------------------------------------------------
    WDI_SetPwrSaveCfgCb
@@ -6699,6 +7457,47 @@
                                 void*        pUserData);
 #endif
 
+#ifdef FEATURE_WLAN_LPHB
+typedef void  (*WDI_LphbCfgCb)(WDI_Status   wdiStatus,
+                                void*        pUserData);
+#endif /* FEATURE_WLAN_LPHB */
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+typedef void  (*WDI_LbpLeaderRspCb)(WDI_LbpRspParamsType *wdiLbpResponse,
+                                    void*        pUserData);
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+typedef void  (*WDI_IbssPeerInfoReqCb)(WDI_IbssPeerInfoRspParams *pInfoRspParams,
+                                            void*        pUserData);
+
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/*---------------------------------------------------------------------------
+   WDI_SetBatchScanCb
+
+   DESCRIPTION
+
+   This callback is invoked by DAL when it has received a get batch scan
+   response from the underlying device.
+
+   PARAMETERS
+
+    IN
+    wdiStatus:  response status received from HAL
+    pUserData:  user data
+
+
+
+  RETURN VALUE
+    The result code associated with performing the operation
+---------------------------------------------------------------------------*/
+typedef void (*WDI_SetBatchScanCb)(void *pData, WDI_SetBatchScanRspType *pRsp);
+
+#endif
+
+
 
 /*========================================================================
  *     Function Declarations and Documentation
@@ -7423,6 +8222,37 @@
   void*                          pUserData
 );
 
+/**
+ @brief WDI_SetMaxTxPowerPerBandReq will be called when the upper
+        MAC wants to set Max Tx Power to HW for specific band. Upon the
+        call of this API the WLAN DAL will pack and send a HAL
+        Set Max Tx Power Per Band request message to the lower RIVA
+        sub-system if DAL is in state STARTED.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param WDI_SetMaxTxPowerPerBandParamsType: Max Tx Per Band Info
+
+        WDA_SetMaxTxPowerPerBandRspCb: This callback is invoked by DAL
+        when it has received a set max Tx Power Per Band response from
+        the underlying device.
+
+        pUserData: user data will be passed back with the
+        callback
+
+ @see WDI_SetMaxTxPowerPerBandReq
+ @return Result of the function call
+*/
+WDI_Status
+WDI_SetMaxTxPowerPerBandReq
+(
+  WDI_SetMaxTxPowerPerBandParamsType*   pwdiSetMaxTxPowerPerBandParams,
+  WDA_SetMaxTxPowerPerBandRspCb         wdiReqStatusCb,
+  void*                                 pUserData
+);
+
 #ifdef FEATURE_WLAN_CCX
 /**
  @brief WDI_TSMStatsReq will be called by the upper MAC to fetch 
@@ -7765,6 +8595,37 @@
   void*                            pUserData
 );
 
+/**
+ @brief WDI_SetTDLSLinkEstablishReq will be called when the
+        upper MAC wants to send TDLS Link Establish Request Parameters
+         Upon the call of this API the WLAN DAL will
+        pack and send the TDLS Link Establish Request  message to the
+        lower RIVA sub-system if DAL is in state STARTED.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param pwdiTDLSLinkEstablishReqParams: TDLS Peer Parameters
+        for Link Establishment (Used for PUAPSD , TDLS Off Channel ...)
+
+        wdiTDLSLinkEstablishReqRspCb: callback for passing back the
+        response of the TDLS Link Establish request received
+        from the device
+
+        pUserData: user data will be passed back with the
+        callback
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_SetTDLSLinkEstablishReq
+(
+  WDI_SetTDLSLinkEstablishReqParamsType*    pwdiTDLSLinkEstablishReqParams,
+  WDI_SetTDLSLinkEstablishReqParamsRspCb    wdiTDLSLinkEstablishReqRspCb,
+  void*                            pUserData
+);
 
 /*======================================================================== 
  
@@ -9040,6 +9901,36 @@
 );
 #endif
 
+/**
+ @brief WDI_AddPeriodicTxPtrnInd
+
+ @param WDI_AddPeriodicTxPtrnParamsType
+
+ @see
+
+ @return Status of the request
+*/
+WDI_Status
+WDI_AddPeriodicTxPtrnInd
+(
+  WDI_AddPeriodicTxPtrnParamsType *addPeriodicTxPtrnParams
+);
+
+/**
+ @brief WDI_DelPeriodicTxPtrnInd
+
+ @param WDI_DelPeriodicTxPtrnParamsType
+
+ @see
+
+ @return Status of the request
+*/
+WDI_Status
+WDI_DelPeriodicTxPtrnInd
+(
+  WDI_DelPeriodicTxPtrnParamsType *delPeriodicTxPtrnParams
+);
+
 #ifdef FEATURE_WLAN_SCAN_PNO
 /**
  @brief WDI_SetPreferredNetworkList
@@ -9116,9 +10007,9 @@
 
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 /**
- @brief WDI_StartRoamCandidateLookupReq
+ @brief WDI_RoamScanOffloadReq
 
- @param pwdiRoamCandidateLookupReqParams: Start Roam Candidate Lookup Req as specified
+ @param pwdiRoamScanOffloadReqParams: Start Roam Candidate Lookup Req as specified
         by the Device Interface
 
         wdiRoamOffloadScanCb: callback for passing back the response
@@ -9131,9 +10022,9 @@
  @return Result of the function call
 */
 WDI_Status
-WDI_StartRoamCandidateLookupReq
+WDI_RoamScanOffloadReq
 (
-  WDI_RoamCandidateLookupReqParamsType* pwdiRoamCandidateLookupReqParams,
+  WDI_RoamScanOffloadReqParamsType     *pwdiRoamScanOffloadReqParams,
   WDI_RoamOffloadScanCb                 wdiRoamOffloadScancb,
   void*                                 pUserData
 );
@@ -9330,6 +10221,123 @@
   WDI_SetPowerParamsCb             wdiPowerParamsCb,
   void*                            pUserData
 );
+/**
+ @brief WDI_dhcpStartInd
+       Forward the DHCP Start event
+
+ @param
+
+ wdiDHCPInd: device mode and MAC address is passed
+
+ @see
+ @return Result of the function call
+*/
+
+WDI_Status
+WDI_dhcpStartInd
+(
+  WDI_DHCPInd *wdiDHCPInd
+);
+/**
+ @brief WDI_dhcpStopReq
+       Forward the DHCP Stop event
+
+ @param
+
+     wdiDHCPInd: device mode and MAC address is passed
+
+ @see
+ @return Result of the function call
+*/
+
+WDI_Status
+WDI_dhcpStopInd
+(
+  WDI_DHCPInd *wdiDHCPInd
+);
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+/**
+ @brief WDI_lbpLeaderReq will be called when the upper MAC
+        requests the device to enable LBP reliable multicast.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param wdiLbpLeaderReq:
+
+ @see WDI_Start
+ @return Result of the function call
+*/
+WDI_Status
+WDI_LbpLeaderReq
+(
+  WDI_LbpLeaderReqParams  *wdiLbpLeaderReqParams,
+  WDI_LbpLeaderRspCb lbpLeaderRspCb,
+  void *usrData
+);
+
+/**
+ @brief WDI_lbpUpdateInd will be called when the upper MAC
+        requests the device to enable LBP reliable multicast.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param wdiLbpUpdateInd:
+
+
+ @see WDI_Start
+ @return Result of the function call
+*/
+WDI_Status
+WDI_LbpUpdateInd
+(
+  WDI_LbpUpdateIndParams  *wdiLbpUpdateIndParams
+);
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+/**
+ @brief WDI_RateUpdateInd will be called when the upper MAC
+        requests the device to update rates.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param wdiRateUpdateIndParams
+
+
+ @see WDI_Start
+ @return Result of the function call
+*/
+WDI_Status
+WDI_RateUpdateInd
+(
+  WDI_RateUpdateIndParams  *wdiRateUpdateIndParams
+);
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/**
+ @brief WDI_TXFailMonitorStartStopInd
+       Forward TX monitor start/stop event
+
+ @param
+
+     WDI_TXFailMonitorInd
+
+ @see
+ @return Result of the function call
+*/
+
+WDI_Status
+WDI_TXFailMonitorStartStopInd
+(
+  WDI_TXFailMonitorInd *wdiTXFailMonitorInd
+);
+#endif /* FEATURE_CESIUM_PROPRIETARY */
 
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 /**
@@ -9475,7 +10483,7 @@
 #ifdef QCA_WIFI_2_0
 static inline wpt_uint8 WDI_getFwWlanFeatCaps(wpt_uint8 feat_enum_value)
 {
-	return 0;
+        return 0;
 }
 #else
 wpt_uint8 WDI_getFwWlanFeatCaps(wpt_uint8 feat_enum_value);
@@ -9552,9 +10560,113 @@
 */
 void WDI_SetEnableSSR(wpt_boolean  enableSSR);
 
+#ifdef FEATURE_WLAN_LPHB
+/**
+ @brief WDI_LPHBConfReq
+    This API is called to config FW LPHB rule
+
+ @param lphbconfParam : LPHB rule should config to FW
+        usrData : Client context
+        lphbCfgCb : Configuration status callback
+ @see
+ @return SUCCESS or FAIL
+*/
+WDI_Status WDI_LPHBConfReq
+(
+   void *lphbconfParam,
+   void *usrData,
+   WDI_LphbCfgCb lphbCfgCb
+);
+#endif /* FEATURE_WLAN_LPHB */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/**
+ @brief WDI_SetBatchScanReq
+    This API is called to set batch scan request in FW
+
+ @param pBatchScanReqParam : pointer to set batch scan re param
+        usrData : Client context
+        setBatchScanRspCb : set batch scan resp callback
+ @see
+ @return SUCCESS or FAIL
+*/
+WDI_Status WDI_SetBatchScanReq
+(
+   void *pBatchScanReqParam,
+   void *usrData,
+   WDI_SetBatchScanCb setBatchScanRspCb
+);
+
+/**
+ @brief WDI_StopBatchScanInd
+
+ @param none
+
+ @see
+
+ @return Status of the request
+*/
+WDI_Status
+WDI_StopBatchScanInd(WDI_StopBatchScanIndType *pWdiReq);
+
+/**
+ @brief WDI_TriggerBatchScanResultInd
+    This API is called to pull batch scan result from FW
+
+ @param pBatchScanReqParam : pointer to trigger batch scan ind param
+        usrData : Client context
+        setBatchScanRspCb : get batch scan resp callback
+ @see
+ @return SUCCESS or FAIL
+*/
+WDI_Status
+WDI_TriggerBatchScanResultInd(WDI_TriggerBatchScanResultIndType *pWdiReq);
+
+
+#endif /*FEATURE_WLAN_BATCH_SCAN*/
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/**
+ @brief Process LBP Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+
+WDI_Status
+WDI_IbssPeerInfoReq
+(
+   WDI_IbssPeerInfoReqType*   wdiPeerInfoReqParams,
+   WDI_IbssPeerInfoReqCb      wdiIbssPeerInfoReqCb,
+  void*                         pUserData
+);
+
+
+/**
+ @brief WDI_IBSSRouteTableUpdateInd
+       Forward the IBSS Route Table Update Indication
+
+ @param
+
+ pwdiIBSSRouteTableInd: IBSS Route table
+
+ @see
+ @return Success or Failure
+*/
+
+WDI_Status
+WDI_IBSSRouteTableUpdateInd
+(
+  WDI_IBSSRouteTable *pwdiIBSSRouteTable
+);
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
 #ifdef __cplusplus
  }
-#endif 
+#endif
 
 
 #endif /* #ifndef WLAN_QCT_WDI_H */
diff --git a/CORE/WDI/CP/inc/wlan_qct_wdi_bd.h b/CORE/WDI/CP/inc/wlan_qct_wdi_bd.h
index a63157f..9db4b42 100644
--- a/CORE/WDI/CP/inc/wlan_qct_wdi_bd.h
+++ b/CORE/WDI/CP/inc/wlan_qct_wdi_bd.h
@@ -463,7 +463,8 @@
 #ifdef WPT_BIG_BYTE_ENDIAN
         /** reserved8 from a hardware perspective.
         Used by SW to propogate frame type/subtype information */
-        wpt_uint32 frameTypeSubtype:8;
+        wpt_uint32 frameTypeSubtype:6;
+        wpt_uint32 rfBand:2;
     
         /** Filled RPE gives the current sequence number in bitmap */
         wpt_uint32 currentPktSeqNo:12;
@@ -474,7 +475,8 @@
 #else
         wpt_uint32 expectedPktSeqNo:12;
         wpt_uint32 currentPktSeqNo:12;
-        wpt_uint32 frameTypeSubtype:8;
+        wpt_uint32 rfBand:2;
+        wpt_uint32 frameTypeSubtype:6;
 #endif
     
         /* 0x48 */
diff --git a/CORE/WDI/CP/inc/wlan_qct_wdi_dp.h b/CORE/WDI/CP/inc/wlan_qct_wdi_dp.h
index 18dc1ab..d3aa8df 100644
--- a/CORE/WDI/CP/inc/wlan_qct_wdi_dp.h
+++ b/CORE/WDI/CP/inc/wlan_qct_wdi_dp.h
@@ -115,6 +115,14 @@
 
 #define WDI_USE_BD_RATE2_FOR_MANAGEMENT_FRAME 0x40 // Bit 6 will be used to control BD rate for Management frames
 
+#ifdef FEATURE_WLAN_TDLS
+#define HAL_TDLS_PEER_STA_MASK              0x80 //bit 7 set for TDLS peer station
+#endif
+
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+#define WDI_RELIABLE_MCAST_REQUESTED_MASK 0x100
+#define WDI_USE_BD_RATE_MASK 0x1000
+#endif
 
 /*Macro for getting the size of the TX BD*/
 #define WDI_TX_BD_HEADER_SIZE        sizeof(WDI_TxBdType)
@@ -262,6 +270,8 @@
 
 #define WDI_RX_BD_GET_TID( _pvBDHeader )        (((WDI_RxBdType*)_pvBDHeader)->tid)
 
+#define WDI_RX_BD_GET_RFBAND( _pvBDHeader )        (((WDI_RxBdType*)_pvBDHeader)->rfBand)
+
 #define WDI_RX_BD_GET_ASF( _pvBDHeader )        (((WDI_RxBdType*)_pvBDHeader)->asf)
 
 #define WDI_RX_BD_GET_AEF( _pvBDHeader )        (((WDI_RxBdType*)_pvBDHeader)->aef)
@@ -389,6 +399,8 @@
      ucDisableFrmXtl: set to 1 if this frame is not to be translated by HW
      pTxBd:          pointer to the TX BD
      ucTxFlag:       can have appropriate bit setting as required
+     ucProtMgmtFrame: for management frames, whether the frame is
+                      protected (protect bit is set in FC)
      uTimestamp:     pkt timestamp
   
   
@@ -405,7 +417,8 @@
     wpt_uint8*             pTid, 
     wpt_uint8              ucDisableFrmXtl, 
     void*                  pTxBd, 
-    wpt_uint8              ucTxFlag, 
+    wpt_uint32             ucTxFlag,
+    wpt_uint8              ucProtMgmtFrame,
     wpt_uint32             uTimeStamp,
     wpt_uint8*             staIndex
 );
diff --git a/CORE/WDI/CP/inc/wlan_qct_wdi_i.h b/CORE/WDI/CP/inc/wlan_qct_wdi_i.h
index 3d6de0c..325a6d8 100644
--- a/CORE/WDI/CP/inc/wlan_qct_wdi_i.h
+++ b/CORE/WDI/CP/inc/wlan_qct_wdi_i.h
@@ -97,8 +97,10 @@
  
 #ifdef WLAN_SOFTAP_VSTA_FEATURE
 #define WDI_MAX_SUPPORTED_STAS   41
+#define WDI_MAX_IBSS_PEER_SUPPORED_STAS 32
 #else
 #define WDI_MAX_SUPPORTED_STAS   12
+#define WDI_MAX_IBSS_PEER_SUPPORED_STAS 11
 #endif
 #define WDI_MAX_SUPPORTED_BSS     5 
 
@@ -430,7 +432,27 @@
 
   /*WLAN DAL Set Tx Power Request*/
   WDI_SET_TX_POWER_REQ                          = 82,
-  WDI_START_ROAM_CANDIDATE_LOOKUP_REQ           = 83,
+  WDI_ROAM_SCAN_OFFLOAD_REQ                     = 83,
+
+  WDI_TDLS_LINK_ESTABLISH_REQ                   = 84,
+
+  /* WLAN FW LPHB config request */
+  WDI_LPHB_CFG_REQ                              = 85,
+  /* Send LBP Leader Request */
+  WDI_LBP_LEADER_REQ                            = 86,
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  WDI_HAL_IBSS_PEER_INFO_REQ                    = 87,
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  /* WLAN FW set batch scan request */
+  WDI_SET_BATCH_SCAN_REQ                        = 88,
+#endif
+
+  /*WLAN DAL Set Max Tx Power Per band Request*/
+  WDI_SET_MAX_TX_POWER_PER_BAND_REQ             = 89,
+
   WDI_MAX_REQ,
 
   /*Send a suspend Indication down to HAL*/
@@ -439,14 +461,47 @@
   /* Send a traffic stats indication to HAL */
   WDI_TRAFFIC_STATS_IND,
 
+  /* DHCP Start Indication */
+  WDI_DHCP_START_IND,
+
+  /* DHCP Stop Indication */
+  WDI_DHCP_STOP_IND,
+
   /* Drop/Receive unencrypted frames indication to HAL */
   WDI_EXCLUDE_UNENCRYPTED_IND,
 
+  /* Send an add periodic Tx pattern indication to HAL */
+  WDI_ADD_PERIODIC_TX_PATTERN_IND,
+
+  /* Send a delete periodic Tx pattern indicationto HAL */
+  WDI_DEL_PERIODIC_TX_PATTERN_IND,
+
+  /* Send LBP Update Indication */
+  WDI_LBP_UPDATE_IND,
+
+  /* Send Rate Update Indication */
+  WDI_RATE_UPDATE_IND,
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  /*Send stop batch scan indication to FW*/
+  WDI_STOP_BATCH_SCAN_IND,
+  /*Send stop batch scan indication to FW*/
+  WDI_TRIGGER_BATCH_SCAN_RESULT_IND,
+#endif
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  /* IBSS Route Table Update Indication */
+  WDI_IBSS_ROUTE_TABLE_UPDATE_IND,
+
+  /* TX Monitor start/stop indication */
+  WDI_TX_FAIL_MONITOR_IND,
+#endif
+
   /*Keep adding the indications to the max request
     such that we keep them sepparate */
 
   WDI_MAX_UMAC_IND
-}WDI_RequestEnumType; 
+}WDI_RequestEnumType;
 
 /*--------------------------------------------------------------------------- 
    WLAN DAL Supported Response Types
@@ -696,7 +751,26 @@
   WDI_GET_ROAM_RSSI_RESP                        = 80,
 
   WDI_SET_TX_POWER_RESP                         = 81,
-  WDI_START_ROAM_CANDIDATE_LOOKUP_RESP          = 82,
+  WDI_ROAM_SCAN_OFFLOAD_RESP                    = 82,
+
+  WDI_TDLS_LINK_ESTABLISH_REQ_RESP              = 83,
+
+  /* WLAN FW LPHB Config response */
+  WDI_LPHB_CFG_RESP                             = 84,
+
+  /* Reliable Multicast Leader Response from FW to Host */
+  WDI_LBP_LEADER_RESP                           = 85,
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  WDI_HAL_IBSS_PEER_INFO_RSP                    = 86,
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  WDI_SET_BATCH_SCAN_RESP                        = 87,
+#endif
+
+  WDI_SET_MAX_TX_POWER_PER_BAND_RSP             = 88,
+
   /*-------------------------------------------------------------------------
     Indications
      !! Keep these last in the enum if possible
@@ -744,13 +818,36 @@
   /* NOA Start Indication from FW to Host */
   WDI_HAL_P2P_NOA_START_IND            = WDI_HAL_IND_MIN + 12,
 
-  WDI_MAX_RESP
-}WDI_ResponseEnumType; 
+  /* TDLS Indication from FW to Host */
+  WDI_HAL_TDLS_IND                     = WDI_HAL_IND_MIN + 13,
 
-typedef struct 
+  /* LPHB timeout indication */
+  WDI_HAL_LPHB_IND                     = WDI_HAL_IND_MIN + 14,
+
+  /* IBSS Peer Inactivity Indication from FW to Host */
+  WDI_HAL_IBSS_PEER_INACTIVITY_IND     = WDI_HAL_IND_MIN + 15,
+
+  /* Periodic Tx Pattern Indication from FW to Host */
+  WDI_HAL_PERIODIC_TX_PTRN_FW_IND     = WDI_HAL_IND_MIN + 16,
+
+  /* Reliable Multicast Update Indication from FW to Host */
+  WDI_LBP_UPDATE_IND_TO_HOST           = WDI_HAL_IND_MIN + 17,
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  WDI_BATCHSCAN_RESULT_IND           =  WDI_HAL_IND_MIN + 18,
+#endif
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  WDI_HAL_TX_FAIL_IND                  = WDI_HAL_IND_MIN + 19,
+#endif
+
+  WDI_MAX_RESP
+}WDI_ResponseEnumType;
+
+typedef struct
 {
   /*Flag that marks a session as being in use*/
-  wpt_boolean         bInUse; 
+  wpt_boolean         bInUse;
 
   /*Flag that keeps track if a series of assoc requests for this BSS are
     currently pending in the queue or processed
@@ -2173,6 +2270,22 @@
 );
 
 /**
+ @brief Process Set Max Tx Power Per Band Request function (called when Main
+        FSM allows it)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status WDI_ProcessSetMaxTxPowerPerBandReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
  @brief Process Set Tx Power Request function (called when Main
         FSM allows it)
 
@@ -2206,6 +2319,23 @@
 );
 
 /**
+ @brief Process TDLS Link Establish Request function (called when Main FSM
+        allows it)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTdlsLinkEstablishReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
  @brief Process Enter IMPS Request function (called when 
         Main FSM allows it)
  
@@ -2682,6 +2812,59 @@
   WDI_EventInfoType*     pEventData
 );
 
+#ifdef FEATURE_WLAN_LPHB
+/**
+ @brief WDI_ProcessLPHBConfReq -
+    LPHB configuration request to FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return esult of the function call
+*/
+WDI_Status WDI_ProcessLPHBConfReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* FEATURE_WLAN_LPHB */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/**
+ @brief WDI_ProcessSetBatchScanReq -
+    Send set batch scan configuration request to FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return success or failure
+*/
+WDI_Status WDI_ProcessSetBatchScanReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief WDI_ProcessGetBatchScanReq -
+    Send get batch scan request to FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return success or failure
+*/
+WDI_Status WDI_ProcessGetBatchScanReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* FEATURE_WLAN_BATCH_SCAN */
+
+
 /*=========================================================================
                              Indications
 =========================================================================*/
@@ -2702,6 +2885,38 @@
   WDI_EventInfoType*     pEventData
 );
 
+/**
+ @brief DHCP Start Event Indication
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessDHCPStartInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief DHCP Stop Event Indication
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessDHCPStopInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
 
 /**
  @brief Process Traffic Stats Indications function (called when Main FSM allows it)
@@ -2738,6 +2953,95 @@
 );
 #endif
 
+/**
+ @brief Process Add Periodic Tx Pattern Indication function (called when
+           Main FSM allows it)
+
+ @param  pWDICtx:        pointer to the WLAN DAL context
+         pEventData:     pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessAddPeriodicTxPtrnInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Process Delete Periodic Tx Pattern Indication function (called when
+           Main FSM allows it)
+
+ @param  pWDICtx:        pointer to the WLAN DAL context
+         pEventData:     pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessDelPeriodicTxPtrnInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/**
+  @brief Process stop batch scan indications function
+         It is called when Main FSM allows it
+
+  @param  pWDICtx:         pointer to the WLAN DAL context
+          pEventData:      pointer to the event information structure
+
+  @see
+  @return Result of the function call
+ */
+ WDI_Status
+ WDI_ProcessStopBatchScanInd
+ (
+   WDI_ControlBlockType*  pWDICtx,
+   WDI_EventInfoType*     pEventData
+ );
+
+/**
+  @brief This API is called to trigger batch scan results from FW
+         It is called when Main FSM allows it
+
+  @param  pWDICtx:         pointer to the WLAN DAL context
+          pEventData:      pointer to the event information structure
+
+  @see
+  @return Result of the function call
+ */
+ WDI_Status
+ WDI_ProcessTriggerBatchScanResultInd
+ (
+   WDI_ControlBlockType*  pWDICtx,
+   WDI_EventInfoType*     pEventData
+ );
+
+#endif
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/**
+ @brief Process TX Fail monitor indication
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTXFailMonitor
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
 /*========================================================================
           Main DAL Control Path Response Processing API 
 ========================================================================*/
@@ -3392,6 +3696,23 @@
   WDI_EventInfoType*             pEventData
 );
 
+  /**
+ @brief Process TDLS Link Establish Req Rsp function (called when a response
+        is being received over the bus from HAL)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLinkEstablishReqRsp
+(
+  WDI_ControlBlockType*          pWDICtx,
+  WDI_EventInfoType*             pEventData
+);
+
 /**
  @brief Process Nv download(called when a response
         is being received over the bus from HAL)
@@ -4055,6 +4376,42 @@
 );
 
 /**
+*@brief Process Tdls Indication function (called when
+        an indication of this kind is being received over the
+        bus from HAL)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTdlsInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/**
+*@brief Process Tx Fail Indication
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTXFailInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+/**
 *@brief Process Noa Start Indication function (called when
         an indication of this kind is being received over the
         bus from HAL)
@@ -4108,6 +4465,42 @@
   WDI_EventInfoType*     pEventData
 );
 
+#ifdef FEATURE_WLAN_LPHB
+/**
+ @brief WDI_ProcessLphbInd -
+    This function will be invoked when FW detects low power
+    heart beat failure
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLphbInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* FEATURE_WLAN_LPHB */
+
+/**
+ @brief Process Periodic Tx Pattern Fw Indication function
+
+ @param  pWDICtx:        pointer to the WLAN DAL context
+         pEventData:     pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessPeriodicTxPtrnFwInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
 #ifdef WLAN_FEATURE_VOWIFI_11R
 /**
  @brief Process Aggrgated Add TSpec Request function (called when Main FSM
@@ -4211,6 +4604,26 @@
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 );
+
+/**
+ @brief WDI_ProcessIbssPeerInactivityInd
+        Process peer inactivity indication coming from HAL.
+
+  @param  pWDICtx:         pointer to the WLAN DAL context
+          pEventData:      pointer to the event information structure
+
+  @see
+  @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInactivityInd
+
+(
+ WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+
 /*========================================================================
          Internal Helper Routines 
 ========================================================================*/
@@ -4871,7 +5284,7 @@
  @return Result of the function call
 */
 WDI_Status
-WDI_ProcessStartRoamCandidatelookupReq
+WDI_ProcessRoamScanOffloadReq
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
@@ -4887,7 +5300,7 @@
  @return Result of the function call
 */
 WDI_Status
-WDI_ProcessStartRoamCandidatelookupRsp
+WDI_ProcessRoamScanOffloadRsp
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
@@ -5165,5 +5578,230 @@
 );
 #endif
 
+#ifdef FEATURE_WLAN_LPHB
+/**
+ @brief WDI_ProcessLphbCfgRsp -
+    LPHB configuration response from FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status WDI_ProcessLphbCfgRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* FEATURE_WLAN_LPHB */
+
+/**
+ @brief Process Rate Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData: pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessRateUpdateInd
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+/**
+ @brief Process LBP Leader Request and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+*/
+WDI_Status
+WDI_ProcessLBPLeaderReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
+/**
+*@brief Process Leader Selection response where the firmware
+        provides a list of candidates that can be used as leaders
+        a.k.a. a receiver that can ACK multicast frames
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLBPLeaderResp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Process LBP Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLBPUpdateInd
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief WDI_LbpUpdateInd will be called when the upper MAC
+        requests the device to enable LBP reliable multicast.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param wdiLbpUpdateIndParams:
+
+
+ @see WDI_Start
+ @return Result of the function call
+*/
+WDI_Status
+WDI_LbpUpdateInd
+(
+    WDI_LbpUpdateIndParams  *wdiLbpUpdateIndParams
+);
+
+/**
+*@brief Process Leader Selection response where the firmware
+        provides a list of candidates that can be used as leaders
+        a.k.a. a receiver that can ACK multicast frames
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLBPLeaderResp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+*@brief Process Update Indication where the firmware
+        provides a list of candidates that can be used as leaders
+        a.k.a. a receiver that can ACK multicast frames
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLBPUpdateIndToHost
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+
+/**
+ @brief Process LBP Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInfoReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Process LBP Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInfoRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Sends IBSS Route Table Update Indication to f/w
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIBSSRouteTableUpdateInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+/**
+ @brief WDI_ProcessSetBatchScanRsp -
+     Process set batch scan response from FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status WDI_ProcessSetBatchScanRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+/**
+ @brief Process batch scan response from FW
+
+ @param  pWDICtx:        pointer to the WLAN DAL context
+         pEventData:     pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessBatchScanResultInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+);
+
+#endif /* FEATURE_WLAN_BATCH_SCAN */
+
 #endif /*WLAN_QCT_WDI_I_H*/
 
diff --git a/CORE/WDI/CP/src/wlan_qct_wdi.c b/CORE/WDI/CP/src/wlan_qct_wdi.c
index dd65497..146effa 100644
--- a/CORE/WDI/CP/src/wlan_qct_wdi.c
+++ b/CORE/WDI/CP/src/wlan_qct_wdi.c
@@ -89,6 +89,7 @@
 #include "wlan_hal_msg.h"
 
 #include "pttMsgApi.h"
+#include "vos_trace.h"
 
 /*===========================================================================
    WLAN DAL Control Path Internal Data Definitions and Declarations
@@ -98,7 +99,6 @@
 #define MAC_ADDR_ARRAY(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
 #define MAC_ADDRESS_STR "%02x:%02x:%02x:%02x:%02x:%02x"
 
-
 #define FEATURE_NOT_SUPPORTED 127
 
 #ifdef FEATURE_WLAN_SCAN_PNO
@@ -115,26 +115,50 @@
 static placeHolderInCapBitmap supportEnabledFeatures[] =
    {MCC, P2P, DOT11AC, SLM_SESSIONIZATION, DOT11AC_OPMODE
 #ifdef WLAN_SOFTAP_VSTA_FEATURE
-    ,SAP32STA
+    ,SAP32STA                       //5
 #else
     ,FEATURE_NOT_SUPPORTED
 #endif
 #ifdef FEATURE_WLAN_TDLS
-    ,TDLS
+    ,TDLS                           //6
 #else
     ,FEATURE_NOT_SUPPORTED
 #endif
-    ,P2P_GO_NOA_DECOUPLE_INIT_SCAN
+    ,P2P_GO_NOA_DECOUPLE_INIT_SCAN  //7
 #ifdef WLAN_ACTIVEMODE_OFFLOAD_FEATURE
-    ,WLANACTIVE_OFFLOAD
+    ,WLANACTIVE_OFFLOAD             //8
 #else
     ,FEATURE_NOT_SUPPORTED
 #endif
+    ,FEATURE_NOT_SUPPORTED          //9
+    ,FEATURE_NOT_SUPPORTED          //10
+    ,FEATURE_NOT_SUPPORTED          //11
+    ,FEATURE_NOT_SUPPORTED          //12
+    ,FEATURE_NOT_SUPPORTED          //13
+    ,FEATURE_NOT_SUPPORTED          //14
+    ,FEATURE_NOT_SUPPORTED          //15
+    ,FEATURE_NOT_SUPPORTED          //16
+    ,FEATURE_NOT_SUPPORTED          //17
+    ,FEATURE_NOT_SUPPORTED          //18
+    ,FEATURE_NOT_SUPPORTED          //19
+    ,FEATURE_NOT_SUPPORTED          //20
+    ,FEATURE_NOT_SUPPORTED          //21
+    ,WOW                            //22
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-    ,WLAN_ROAM_SCAN_OFFLOAD
+    ,WLAN_ROAM_SCAN_OFFLOAD         //23
 #else
     ,FEATURE_NOT_SUPPORTED
 #endif
+    ,FEATURE_NOT_SUPPORTED          //24
+    ,FEATURE_NOT_SUPPORTED          //25
+    ,IBSS_HEARTBEAT_OFFLOAD         //26
+    ,FEATURE_NOT_SUPPORTED          //27
+    ,WLAN_PERIODIC_TX_PTRN          //28
+#ifdef FEATURE_WLAN_TDLS
+    ,ADVANCE_TDLS                   //29
+#else
+    ,FEATURE_NOT_SUPPORTED          //29
+#endif
    };
 
 /*-------------------------------------------------------------------------- 
@@ -342,20 +366,76 @@
 #endif
   WDI_ProcessSetTxPowerReq,             /* WDI_SET_TX_POWER_REQ*/
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-  WDI_ProcessStartRoamCandidatelookupReq,  /* WDI_START_ROAM_CANDIDATE_LOOKUP_REQ */
+  WDI_ProcessRoamScanOffloadReq,  /* WDI_ROAM_SCAN_OFFLOAD_REQ */
 #else
   NULL,
 #endif /* WLAN_FEATURE_ROAM_SCAN_OFFLOAD */
+#ifdef FEATURE_WLAN_TDLS
+  WDI_ProcessTdlsLinkEstablishReq,       /* WDI_TDLS_LINK_ESTABLISH_REQ */
+#else
+ NULL,
+#endif
+#ifdef FEATURE_WLAN_LPHB
+  WDI_ProcessLPHBConfReq,               /* WDI_LPHB_CFG_REQ */
+#else
+  NULL,
+#endif /* FEATURE_WLAN_LPHB */
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+  WDI_ProcessLBPLeaderReq,              /* WDI_LBP_LEADER_REQ */
+#else
+  NULL,
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  WDI_ProcessIbssPeerInfoReq,           /* WDI_HAL_IBSS_PEER_INFO_REQ */
+#else
+  NULL,
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  WDI_ProcessSetBatchScanReq,               /* WDI_SET_BATCH_SCAN_REQ */
+#else
+  NULL,
+#endif /* FEATURE_WLAN_BATCH_SCAN */
+
+  WDI_ProcessSetMaxTxPowerPerBandReq,   /* WDI_SET_MAX_TX_POWER_PER_BAND_REQ*/
   /*-------------------------------------------------------------------------
     Indications
   -------------------------------------------------------------------------*/
   WDI_ProcessHostSuspendInd,            /* WDI_HOST_SUSPEND_IND*/
   WDI_ProcessTrafficStatsInd,           /* WDI_TRAFFIC_STATS_IND*/
+  WDI_ProcessDHCPStartInd,              /* WDI_DHCP_START_IND*/
+  WDI_ProcessDHCPStopInd,               /* WDI_DHCP_STOP_IND*/
 #ifdef WLAN_FEATURE_11W
   WDI_ProcessExcludeUnencryptInd,       /* WDI_EXCLUDE_UNENCRYPTED_IND */
 #else
   NULL,
 #endif
+  WDI_ProcessAddPeriodicTxPtrnInd,      /* WDI_ADD_PERIODIC_TX_PATTERN_IND */
+  WDI_ProcessDelPeriodicTxPtrnInd,      /* WDI_DEL_PERIODIC_TX_PATTERN_IND */
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+  WDI_ProcessLBPUpdateInd,              /* WDI_LBP_UPDATE_IND */
+#else
+  NULL,
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+  WDI_ProcessRateUpdateInd,              /* WDI_RATE_UPDATE_IND */
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  WDI_ProcessStopBatchScanInd,          /* WDI_STOP_BATCH_SCAN_IND */
+  WDI_ProcessTriggerBatchScanResultInd, /* WDI_TRIGGER_BATCH_SCAN_RESULT_IND */
+#else
+  NULL,
+  NULL,
+#endif /* FEATURE_WLAN_BATCH_SCAN */
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  WDI_ProcessIBSSRouteTableUpdateInd,   /* WDI_IBSS_ROUTE_TABLE_UPDATE_IND */
+#else
+  NULL,
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  WDI_ProcessTXFailMonitor,
+#else
+  NULL,
+#endif
 };
 
 
@@ -525,10 +605,36 @@
 #endif
   WDI_ProcessSetTxPowerRsp,             /* WDI_SET_TX_POWER_RESP */
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-    WDI_ProcessStartRoamCandidatelookupRsp, /* WDI_START_ROAM_CANDIDATE_LOOKUP_RESP */
+    WDI_ProcessRoamScanOffloadRsp, /* WDI_ROAM_SCAN_OFFLOAD_RESP */
 #else
     NULL,
 #endif
+#ifdef FEATURE_WLAN_TDLS
+  WDI_ProcessLinkEstablishReqRsp,       /*WDI_TDLS_LINK_ESTABLISH_REQ_RESP*/
+#else
+  NULL,
+#endif
+#ifdef FEATURE_WLAN_LPHB
+    WDI_ProcessLphbCfgRsp,             /* WDI_LPHB_CFG_RESP */
+#else
+    NULL,
+#endif /* FEATURE_WLAN_LPHB */
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+    WDI_ProcessLBPLeaderResp,          /* WDI_LBP_LEADER_RESP */
+#else
+    NULL,
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  WDI_ProcessIbssPeerInfoRsp,       /* WDI_HAL_GET_IBSS_PEER_INFO_RSP */
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+    WDI_ProcessSetBatchScanRsp,        /* WDI_SET_BATCH_SCAN_RESP */
+#else
+    NULL,
+#endif /*FEATURE_WLAN_BATCH_SCAN*/
+
   /*---------------------------------------------------------------------
     Indications
   ---------------------------------------------------------------------*/
@@ -560,6 +666,39 @@
   WDI_ProcessTxPerHitInd,               /* WDI_HAL_TX_PER_HIT_IND  */
 
   WDI_ProcessP2pNoaStartInd,             /* WDI_NOA_START_IND */
+#ifdef FEATURE_WLAN_TDLS
+  WDI_ProcessTdlsInd,                   /* WDI_HAL_TDLS_IND */
+#else
+  NULL,
+#endif
+
+#ifdef FEATURE_WLAN_LPHB
+  WDI_ProcessLphbInd,                   /* WDI_HAL_LPHB_IND */
+#else
+  NULL,
+#endif /* FEATURE_WLAN_LPHB */
+
+  WDI_ProcessIbssPeerInactivityInd,     /* WDI_HAL_IBSS_PEER_INACTIVITY_IND */
+
+  WDI_ProcessPeriodicTxPtrnFwInd,   /* WDI_HAL_PERIODIC_TX_PTRN_FW_IND */
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+    WDI_ProcessLBPUpdateIndToHost,       /* WDI_LBP_UPDATE_IND_TO_HOST */
+#else
+    NULL,
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  WDI_ProcessBatchScanResultInd,     /* WDI_BATCHSCAN_RESULT_IND */
+#else
+  NULL,
+#endif
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  WDI_ProcessTXFailInd,                 /*WDI_HAL_TX_FAIL_IND*/
+#else
+  NULL,
+#endif /* FEATURE_CESIUM_PROPRIETARY */
 };
 
 
@@ -815,7 +954,11 @@
     CASE_RETURN_STRING( WDI_SET_STA_BCAST_KEY_REQ );
     CASE_RETURN_STRING( WDI_RMV_STA_BCAST_KEY_REQ );
     CASE_RETURN_STRING( WDI_SET_MAX_TX_POWER_REQ );
+    CASE_RETURN_STRING( WDI_SET_MAX_TX_POWER_PER_BAND_REQ );
     CASE_RETURN_STRING( WDI_P2P_GO_NOTICE_OF_ABSENCE_REQ );
+#ifdef FEATURE_WLAN_TDLS
+    CASE_RETURN_STRING( WDI_TDLS_LINK_ESTABLISH_REQ );
+#endif
     CASE_RETURN_STRING( WDI_ENTER_IMPS_REQ );
     CASE_RETURN_STRING( WDI_EXIT_IMPS_REQ );
     CASE_RETURN_STRING( WDI_ENTER_BMPS_REQ );
@@ -850,7 +993,7 @@
     CASE_RETURN_STRING( WDI_UPDATE_SCAN_PARAMS_REQ );
   #endif
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-    CASE_RETURN_STRING( WDI_START_ROAM_CANDIDATE_LOOKUP_REQ );
+    CASE_RETURN_STRING( WDI_ROAM_SCAN_OFFLOAD_REQ );
 #endif
     CASE_RETURN_STRING( WDI_SET_TX_PER_TRACKING_REQ );
     CASE_RETURN_STRING( WDI_8023_MULTICAST_LIST_REQ );
@@ -866,6 +1009,14 @@
 #ifdef WLAN_FEATURE_11W
     CASE_RETURN_STRING( WDI_EXCLUDE_UNENCRYPTED_IND );
 #endif
+#ifdef FEATURE_WLAN_BATCH_SCAN
+    CASE_RETURN_STRING( WDI_SET_BATCH_SCAN_REQ);
+    CASE_RETURN_STRING( WDI_STOP_BATCH_SCAN_IND );
+    CASE_RETURN_STRING( WDI_TRIGGER_BATCH_SCAN_RESULT_IND);
+#endif
+#ifdef FEATURE_CESIUM_PROPRIETARY
+    CASE_RETURN_STRING( WDI_TX_FAIL_MONITOR_IND );
+#endif /* FEATURE_CESIUM_PROPRIETARY */
     default:
         return "Unknown WDI MessageId";
   }
@@ -920,6 +1071,10 @@
     CASE_RETURN_STRING( WDI_RMV_STA_BCAST_KEY_RESP );
     CASE_RETURN_STRING( WDI_SET_MAX_TX_POWER_RESP );
     CASE_RETURN_STRING( WDI_P2P_GO_NOTICE_OF_ABSENCE_RESP );
+#ifdef FEATURE_WLAN_TDLS
+    CASE_RETURN_STRING( WDI_TDLS_LINK_ESTABLISH_REQ_RESP );
+    CASE_RETURN_STRING( WDI_HAL_TDLS_IND );
+#endif
     CASE_RETURN_STRING( WDI_ENTER_IMPS_RESP );
     CASE_RETURN_STRING( WDI_EXIT_IMPS_RESP );
     CASE_RETURN_STRING( WDI_ENTER_BMPS_RESP );
@@ -954,7 +1109,7 @@
     CASE_RETURN_STRING( WDI_UPDATE_SCAN_PARAMS_RESP );
   #endif
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-    CASE_RETURN_STRING( WDI_START_ROAM_CANDIDATE_LOOKUP_RESP );
+    CASE_RETURN_STRING( WDI_ROAM_SCAN_OFFLOAD_RESP );
 #endif
     CASE_RETURN_STRING( WDI_SET_TX_PER_TRACKING_RESP );
     CASE_RETURN_STRING( WDI_8023_MULTICAST_LIST_RESP );
@@ -965,12 +1120,118 @@
     CASE_RETURN_STRING( WDI_SHUTDOWN_RESP );
     CASE_RETURN_STRING( WDI_SET_POWER_PARAMS_RESP );
     CASE_RETURN_STRING( WDI_GET_ROAM_RSSI_RESP );
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+    CASE_RETURN_STRING( WDI_LBP_LEADER_RESP );
+    CASE_RETURN_STRING( WDI_LBP_UPDATE_IND_TO_HOST );
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+    CASE_RETURN_STRING( WDI_HAL_IBSS_PEER_INFO_RSP );
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+#ifdef FEATURE_WLAN_BATCH_SCAN
+    CASE_RETURN_STRING( WDI_SET_BATCH_SCAN_RESP);
+#endif
     default:
         return "Unknown WDI MessageId";
   }
 }
 
 /**
+  @brief WDI_TraceHostFWCapabilities - Parses both host and Firmware
+                                         Capability bitmap array.
+  @param capabilityBitmap - Base address of Bitmap array
+  @see
+  @returns  None
+  */
+void WDI_TraceHostFWCapabilities(tANI_U32 *capabilityBitmap)
+{
+     int i;
+     char capStr[512];
+     char *pCapStr = capStr;
+     for (i = 0; i < 32; i++) {
+          if ((*(capabilityBitmap + 0) & (1 << i))) {
+               switch(i) {
+                     case MCC: snprintf(pCapStr, sizeof("MCC"), "%s", "MCC");
+                          pCapStr += strlen("MCC");
+                          break;
+                     case P2P: snprintf(pCapStr, sizeof("P2P"), "%s", "P2P");
+                          pCapStr += strlen("P2P");
+                          break;
+                     case DOT11AC: snprintf(pCapStr, sizeof("DOT11AC") , "%s", "DOT11AC");
+                          pCapStr += strlen("DOT11AC");
+                          break;
+                     case SLM_SESSIONIZATION: snprintf(pCapStr, sizeof("SLM_SESSIONIZATION"), "%s", "SLM_SESSIONIZATION");
+                          pCapStr += strlen("SLM_SESSIONIZATION");
+                          break;
+                     case DOT11AC_OPMODE: snprintf(pCapStr,  sizeof("DOT11AC_OPMODE"), "%s", "DOT11AC_OPMODE");
+                          pCapStr += strlen("DOT11AC_OPMODE");
+                          break;
+                     case SAP32STA: snprintf(pCapStr, sizeof("SAP32STA"), "%s", "SAP32STA");
+                          pCapStr += strlen("SAP32STA");
+                          break;
+                     case TDLS: snprintf(pCapStr, sizeof("TDLS"), "%s", "TDLS");
+                          pCapStr += strlen("TDLS");
+                          break;
+                     case P2P_GO_NOA_DECOUPLE_INIT_SCAN: snprintf(pCapStr, sizeof("P2P_GO_NOA_DECOUPLE_INIT_SCAN"), "%s", "P2P_GO_NOA_DECOUPLE_INIT_SCAN");
+                          pCapStr += strlen("P2P_GO_NOA_DECOUPLE_INIT_SCAN");
+                          break;
+                     case WLANACTIVE_OFFLOAD: snprintf(pCapStr, sizeof("WLANACTIVE_OFFLOAD"), "%s", "WLANACTIVE_OFFLOAD");
+                          pCapStr += strlen("WLANACTIVE_OFFLOAD");
+                          break;
+                     case BEACON_OFFLOAD: snprintf(pCapStr, sizeof("BEACON_OFFLOAD"), "%s","BEACON_OFFLOAD");
+                          pCapStr += strlen("BEACON_OFFLOAD");
+                          break;
+                     case SCAN_OFFLOAD: snprintf(pCapStr, sizeof("SCAN_OFFLOAD"), "%s", "SCAN_OFFLOAD");
+                          pCapStr += strlen("SCAN_OFFLOAD");
+                          break;
+                     case ROAM_OFFLOAD: snprintf(pCapStr,  sizeof("ROAM_OFFLOAD"), "%s", "ROAM_OFFLOAD");
+                          pCapStr += strlen("ROAM_OFFLOAD");
+                          break;
+                     case BCN_MISS_OFFLOAD: snprintf(pCapStr, sizeof("BCN_MISS_OFFLOAD"), "%s", "BCN_MISS_OFFLOAD");
+                          pCapStr += strlen("BCN_MISS_OFFLOAD");
+                          break;
+                     case STA_POWERSAVE: snprintf(pCapStr, sizeof("STA_POWERSAVE"), "%s", "STA_POWERSAVE");
+                          pCapStr += strlen("STA_POWERSAVE");
+                          break;
+                     case AP_UAPSD: snprintf(pCapStr, sizeof("AP_UAPSD"), "%s", "AP_UAPSD");
+                          pCapStr += strlen("AP_UAPSD");
+                          break;
+                     case AP_DFS: snprintf(pCapStr, sizeof("AP_DFS"), "%s", "AP_DFS");
+                          pCapStr += strlen("AP_DFS");
+                          break;
+                     case BLOCKACK: snprintf(pCapStr, sizeof("BLOCKACK"), "%s", "BLOCKACK");
+                          pCapStr += strlen("BLOCKACK");
+                          break;
+                     case PHY_ERR: snprintf(pCapStr, sizeof("PHY_ERR"), "%s", "PHY_ERR");
+                          pCapStr += strlen("PHY_ERR");
+                          break;
+                     case BCN_FILTER: snprintf(pCapStr, sizeof("BCN_FILTER"), "%s", "BCN_FILTER");
+                          pCapStr += strlen("BCN_FILTER");
+                          break;
+                     case RTT: snprintf(pCapStr, sizeof("RTT"), "%s", "RTT");
+                          pCapStr += strlen("RTT");
+                          break;
+                     case RATECTRL: snprintf(pCapStr, sizeof("RATECTRL"), "%s", "RATECTRL");
+                          pCapStr += strlen("RATECTRL");
+                          break;
+                     case WOW: snprintf(pCapStr, sizeof("WOW"), "%s", "WOW");
+                          pCapStr += strlen("WOW");
+                          break;
+                     case WLAN_ROAM_SCAN_OFFLOAD: snprintf(pCapStr, sizeof("WLAN_ROAM_SCAN_OFFLOAD"), "%s", "WLAN_ROAM_SCAN_OFFLOAD");
+                          pCapStr += strlen("WLAN_ROAM_SCAN_OFFLOAD");
+                          break;
+              }
+              *pCapStr++ = ',';
+              *pCapStr++ = ' ';
+         }
+     }
+     pCapStr -= 2;
+     *pCapStr = '\0';
+     pCapStr = capStr;
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR, "\t\t%s", pCapStr);
+}
+
+/**
  @brief WDI_getHALStatusMsgString prints the HAL status in string.
 
  @param halStatusId: HAL status Id
@@ -2716,6 +2977,55 @@
 }
 
 /**
+ @brief WDI_SetMaxTxPowerPerBandReq will be called when the upper
+        MAC wants to set Max Tx Power to HW for specific band.
+
+ @param pwdiSetMaxTxPowerPerBandParams: Tx Power Information
+
+        wdiReqStatusCb: callback for passing back the
+        response msg from the device
+
+        pUserData: user data will be passed back with the
+        callback
+
+ @see WDI_SetMaxTxPowerPerBandReq
+ @return Result of the function call
+*/
+WDI_Status
+WDI_SetMaxTxPowerPerBandReq
+(
+  WDI_SetMaxTxPowerPerBandParamsType*   pwdiSetMaxTxPowerPerBandParams,
+  WDA_SetMaxTxPowerPerBandRspCb         wdiReqStatusCb,
+  void*                          pUserData
+)
+{
+  WDI_EventInfoType      wdiEventData;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*------------------------------------------------------------------------
+    Sanity Check
+  ------------------------------------------------------------------------*/
+  if ( eWLAN_PAL_FALSE == gWDIInitialized )
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+    return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  /*------------------------------------------------------------------------
+    Fill in Event data and post to the Main FSM
+  ------------------------------------------------------------------------*/
+  wdiEventData.wdiRequest      = WDI_SET_MAX_TX_POWER_PER_BAND_REQ;
+  wdiEventData.pEventData      = pwdiSetMaxTxPowerPerBandParams;
+  wdiEventData.uEventDataSize  = sizeof(*pwdiSetMaxTxPowerPerBandParams);
+  wdiEventData.pCBfnc          = wdiReqStatusCb;
+  wdiEventData.pUserData       = pUserData;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
  @brief WDI_SetTxPowerReq will be called when the upper
         MAC wants to set Tx Power to HW.
         In state BUSY this request will be queued. Request won't
@@ -5258,6 +5568,67 @@
 
 }/*WDI_SetP2PGONOAReq*/
 
+#ifdef FEATURE_WLAN_TDLS
+/**
+ @brief WDI_SetTDLSLinkEstablishReq will be called when the
+        upper MAC wants to send TDLS Link Establish Request Parameters
+         Upon the call of this API the WLAN DAL will
+        pack and send the TDLS Link Establish Request  message to the
+        lower RIVA sub-system if DAL is in state STARTED.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param pwdiTDLSLinkEstablishReqParams: TDLS Peer Parameters
+        for Link Establishment (Used for PUAPSD , TDLS Off Channel ...)
+
+        wdiTDLSLinkEstablishReqRspCb: callback for passing back the
+        response of the TDLS Link Establish request received
+        from the device
+
+        pUserData: user data will be passed back with the
+        callback
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_SetTDLSLinkEstablishReq
+(
+  WDI_SetTDLSLinkEstablishReqParamsType*    pwdiTDLSLinkEstablishReqParams,
+  WDI_SetTDLSLinkEstablishReqParamsRspCb    wdiTDLSLinkEstablishReqRspCb,
+  void*                            pUserData
+)
+{
+  WDI_EventInfoType      wdiEventData;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*------------------------------------------------------------------------
+    Sanity Check
+  ------------------------------------------------------------------------*/
+  if ( eWLAN_PAL_FALSE == gWDIInitialized )
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+              "WDI API call before module is initialized - Fail request");
+
+    return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  /*------------------------------------------------------------------------
+    Fill in Event data and post to the Main FSM
+  ------------------------------------------------------------------------*/
+  wdiEventData.wdiRequest      = WDI_TDLS_LINK_ESTABLISH_REQ;
+  wdiEventData.pEventData      = pwdiTDLSLinkEstablishReqParams;
+  wdiEventData.uEventDataSize  = sizeof(*pwdiTDLSLinkEstablishReqParams);
+  wdiEventData.pCBfnc          = wdiTDLSLinkEstablishReqRspCb;
+  wdiEventData.pUserData       = pUserData;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+
+}/*WDI_SetTDLSLinkEstablishReq*/
+#endif
+
 /**
  @brief WDI_AddSTASelfReq will be called when the
         UMAC wanted to add STA self while opening any new session
@@ -5769,6 +6140,86 @@
 #endif
 
 /**
+ @brief WDI_AddPeriodicTxPtrnInd: Add Periodic TX Pattern Indication to FW
+
+ @param addPeriodicTxPtrnParams: Add Pattern parameters
+
+ @see
+
+ @return Status of the request
+*/
+WDI_Status
+WDI_AddPeriodicTxPtrnInd
+(
+  WDI_AddPeriodicTxPtrnParamsType*    addPeriodicTxPtrnParams
+)
+{
+  WDI_EventInfoType      wdiEventData;
+
+  /*-------------------------------------------------------------------------
+    Sanity Check
+   ------------------------------------------------------------------------*/
+  if (eWLAN_PAL_FALSE == gWDIInitialized)
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request!");
+
+    return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  /*-------------------------------------------------------------------------
+    Fill in Event data and post to the Main FSM
+   ------------------------------------------------------------------------*/
+  wdiEventData.wdiRequest      = WDI_ADD_PERIODIC_TX_PATTERN_IND;
+  wdiEventData.pEventData      = addPeriodicTxPtrnParams;
+  wdiEventData.uEventDataSize  = sizeof(WDI_AddPeriodicTxPtrnParamsType);
+  wdiEventData.pCBfnc          = NULL;
+  wdiEventData.pUserData       = NULL;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief WDI_DelPeriodicTxPtrnInd: Delete Periodic TX Pattern Indication to FW
+
+ @param delPeriodicTxPtrnParams: Delete Pattern parameters
+
+ @see
+
+ @return Status of the request
+*/
+WDI_Status
+WDI_DelPeriodicTxPtrnInd
+(
+  WDI_DelPeriodicTxPtrnParamsType*    delPeriodicTxPtrnParams
+)
+{
+  WDI_EventInfoType      wdiEventData;
+
+  /*-------------------------------------------------------------------------
+    Sanity Check
+   ------------------------------------------------------------------------*/
+  if (eWLAN_PAL_FALSE == gWDIInitialized)
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request!");
+
+    return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  /*-------------------------------------------------------------------------
+    Fill in Event data and post to the Main FSM
+   ------------------------------------------------------------------------*/
+  wdiEventData.wdiRequest      = WDI_DEL_PERIODIC_TX_PATTERN_IND;
+  wdiEventData.pEventData      = delPeriodicTxPtrnParams;
+  wdiEventData.uEventDataSize  = sizeof(WDI_DelPeriodicTxPtrnParamsType);
+  wdiEventData.pCBfnc          = NULL;
+  wdiEventData.pUserData       = NULL;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
  @brief WDI_HALDumpCmdReq
         Post HAL DUMP Command Event
 
@@ -5959,7 +6410,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Invalid parameters on Main Start %x %x",
+               "Invalid parameters on Main Start Started %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6038,7 +6489,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Invalid parameters on Main Close %x %x",
+               "Invalid parameters on Main Close %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6076,7 +6527,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Invalid parameters on Main Start %x %x",
+               "Invalid parameters on Main Start %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6132,7 +6583,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-               "Invalid parameters on Main Start %x %x",
+               "Invalid parameters on Main Stop Started %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6171,7 +6622,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Invalid parameters on Main Req Started %x %x",
+               "Invalid parameters on Main Req Started %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6210,7 +6661,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Invalid parameters on Main Response %x %x",
+               "Invalid parameters on Main Response %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6289,7 +6740,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-               "Invalid parameters on Main Stop Stopped %x %x",
+               "Invalid parameters on Main Stop Stopped %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6333,7 +6784,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Invalid parameters on Main Start in BUSY %x %x",
+               "Invalid parameters on Main Start in BUSY %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6374,7 +6825,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Invalid parameters on Main Stop in BUSY %x %x",
+               "Invalid parameters on Main Stop in BUSY %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6413,7 +6864,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Invalid parameters on Main Request in BUSY %x %x",
+               "Invalid parameters on Main Request in BUSY %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6452,7 +6903,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Invalid parameters on Main Close in BUSY %x %x",
+               "Invalid parameters on Main Close in BUSY %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6491,7 +6942,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-               "Invalid parameters on Main Start %x %x",
+               "Invalid parameters on Main Start %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6530,7 +6981,7 @@
   if (( NULL ==  pWDICtx ) || ( NULL == pEventData ))
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-               "Invalid parameters on Main Start %x %x",
+               "Invalid parameters on Main Start %p %p",
                pWDICtx, pEventData);
      return WDI_STATUS_E_FAILURE;
   }
@@ -6609,7 +7060,7 @@
       ( usSendSize < (usDataOffset + usLen )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
-              "Unable to get send buffer in start req %x %x %x",
+              "Unable to get send buffer in start req %p %p %p",
                 pEventData, pwdiStartParams, wdiStartRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -6698,7 +7149,7 @@
       ( usSendSize < (usDataOffset + sizeof(halStopReq.stopReqParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in stop req %x %x %x",
+              "Unable to get send buffer in stop req %p %p %p",
                 pEventData, pwdiStopParams, wdiStopRspCb);
      WDI_ASSERT(0);
      goto failRequest;
@@ -6739,7 +7190,7 @@
      if( eWLAN_PAL_STATUS_SUCCESS != status ) 
      {
         WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Power Down state\n", status);
+                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Power Down state", status);
         WDI_ASSERT(0);
         goto fail;
      }
@@ -6918,7 +7369,7 @@
         ( usSendSize < (usDataOffset + sizeof(halInitScanConReqMsg.initScanParams) )))
     {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-          "Unable to get send buffer in init scan req %x %x %x",
+          "Unable to get send buffer in init scan req %p %p %p",
           pEventData, pwdiInitScanParams, wdiInitScanRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -6971,7 +7422,7 @@
         ( usSendSize < (usDataOffset + sizeof(halInitScanReqMsg.initScanParams) )))
     {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-          "Unable to get send buffer in init scan req %x %x %x",
+          "Unable to get send buffer in init scan req %p %p %p",
           pEventData, pwdiInitScanParams, wdiInitScanRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -7094,7 +7545,7 @@
       ( usSendSize < (usDataOffset + sizeof(halStartScanReqMsg.startScanParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in start scan req %x %x %x",
+              "Unable to get send buffer in start scan req %p %p %p",
                 pEventData, pwdiStartScanParams, wdiStartScanRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -7191,7 +7642,7 @@
       ( usSendSize < (usDataOffset + sizeof(halEndScanReqMsg.endScanParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in start scan req %x %x %x",
+              "Unable to get send buffer in start scan req %p %p %p",
                 pEventData, pwdiEndScanParams, wdiEndScanRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -7292,7 +7743,7 @@
      if( eWLAN_PAL_STATUS_SUCCESS != wptStatus ) 
      {
         WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering BMPS\n", wptStatus);
+                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering BMPS", wptStatus);
         WDI_ASSERT(0);
      }
   }
@@ -7306,7 +7757,7 @@
       ( usSendSize < (usDataOffset + sizeof(halFinishScanReqMsg.finishScanParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in start scan req %x %x %x",
+              "Unable to get send buffer in start scan req %p %p %p",
                 pEventData, pwdiFinishScanParams, wdiFinishScanRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -7448,7 +7899,7 @@
       ( usSendSize < (usDataOffset + sizeof(halJoinReqMsg.joinReqParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in join req %x %x %x",
+              "Unable to get send buffer in join req %p %p %p",
                 pUserData, pwdiJoinParams, wdiJoinRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -7728,7 +8179,7 @@
       ( usSendSize < (usDataOffset + uMsgSize )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in config bss req %x %x %x",
+              "Unable to get send buffer in config bss req %p %p %p",
                 pEventData, pwdiConfigBSSParams, wdiConfigBSSRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -7895,7 +8346,7 @@
       ( usSendSize < (usDataOffset + sizeof(halBssReqMsg.deleteBssParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in start req %x %x %x",
+              "Unable to get send buffer in start req %p %p %p",
                 pEventData, pwdiDelBSSParams, wdiDelBSSRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -8047,7 +8498,7 @@
       ( usSendSize < (usDataOffset + uMsgSize )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in start req %x %x %x",
+              "Unable to get send buffer in start req %p %p %p",
                 pEventData, pwdiPostAssocParams, wdiPostAssocRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -8064,7 +8515,9 @@
                                    (wpt_uint8*)&halPostAssocReqMsg.postAssocReqParams.configStaParams.staIdx ))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                MAC_ADDRESS_STR
+                ": This station does not exist in the WDI Station Table",
+                MAC_ADDR_ARRAY(pwdiPostAssocParams->wdiSTAParams.macSTA));
     wpalMutexRelease(&pWDICtx->wptMutex);
     wpalMemoryFree(pSendBuffer);
     return WDI_STATUS_E_FAILURE;
@@ -8085,7 +8538,9 @@
                                    (wpt_uint8*)&halPostAssocReqMsg.postAssocReqParams.configBssParams.staContext.staIdx))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                MAC_ADDRESS_STR
+                ": This station does not exist in the WDI Station Table",
+                MAC_ADDR_ARRAY(pwdiPostAssocParams->wdiBSSParams.wdiSTAContext.macSTA));
     wpalMutexRelease(&pWDICtx->wptMutex);
     wpalMemoryFree(pSendBuffer);
     return WDI_STATUS_E_FAILURE;
@@ -8182,7 +8637,8 @@
                                                          &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiDelSTAParams->ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -8223,7 +8679,7 @@
       ( usSendSize < (usDataOffset + sizeof(halDelStaReqMsg.delStaParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in start req %x %x %x",
+              "Unable to get send buffer in start req %p %p %p",
                 pEventData, pwdiDelSTAParams, wdiDelSTARspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -8342,7 +8798,7 @@
       ( usSendSize < (usDataOffset + sizeof(halSetBssKeyReqMsg.setBssKeyParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiSetBSSKeyParams, wdiSetBSSKeyRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -8489,7 +8945,7 @@
       ( usSendSize < (usDataOffset + sizeof(halRemoveBssKeyReqMsg.removeBssKeyParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiRemoveBSSKeyParams, wdiRemoveBSSKeyRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -8581,7 +9037,8 @@
                                   &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiSetSTAKeyParams->wdiKeyInfo.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -8623,7 +9080,7 @@
       ( usSendSize < (usDataOffset + sizeof(halSetStaKeyReqMsg.setStaKeyParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiSetSTAKeyParams, wdiSetSTAKeyRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -8737,7 +9194,8 @@
                              &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiRemoveSTAKeyParams->wdiKeyInfo.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -8780,7 +9238,7 @@
       ( usSendSize < (usDataOffset + sizeof(halRemoveStaKeyReqMsg.removeStaKeyParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiRemoveSTAKeyParams, wdiRemoveSTAKeyRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -8877,7 +9335,8 @@
                                   &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiSetSTAKeyParams->wdiKeyInfo.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -8886,7 +9345,7 @@
   if ( NULL == pBSSSes )
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-              "Association sequence for this BSS does not yet exist. macBSSID " MAC_ADDRESS_STR,
+              "%s: Association sequence for this BSS does not yet exist. macBSSID " MAC_ADDRESS_STR,
               __func__, MAC_ADDR_ARRAY(macBSSID));
 
     wpalMutexRelease(&pWDICtx->wptMutex);
@@ -8919,7 +9378,7 @@
       ( usSendSize < (usDataOffset + sizeof(halSetStaKeyReqMsg.setStaKeyParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiSetSTAKeyParams, wdiSetSTAKeyRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -9033,7 +9492,8 @@
                              &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiRemoveSTABcastKeyParams->wdiKeyInfo.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -9076,7 +9536,7 @@
       ( usSendSize < (usDataOffset + sizeof(halRemoveStaBcastKeyReqMsg.removeStaKeyParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiRemoveSTABcastKeyParams, wdiRemoveSTAKeyRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -9175,7 +9635,8 @@
                                         &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiAddTSParams->wdiTsInfo.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -9218,7 +9679,7 @@
       ( usSendSize < (usDataOffset + sizeof(halAddTsParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiAddTSParams, wdiAddTSRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -9391,7 +9852,7 @@
       ( usSendSize < (usDataOffset + sizeof(pwdiDelTSParams->wdiDelTSInfo) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiDelTSParams, wdiDelTSRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -9502,7 +9963,7 @@
       ( usSendSize < (usDataOffset + sizeof(pwdiUpdateEDCAParams->wdiEDCAInfo) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiUpdateEDCAParams, wdiUpdateEDCARspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -9583,7 +10044,8 @@
                    &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiAddBASessionParams->wdiBASessionInfoType.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -9629,7 +10091,7 @@
             (usDataOffset + sizeof(halAddBASessionReq.addBASessionParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in Add BA session req %x %x %x",
+              "Unable to get send buffer in Add BA session req %p %p %p",
                 pEventData, pwdiAddBASessionParams, wdiAddBASessionRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -9725,7 +10187,8 @@
                                      &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiDelBAParams->wdiBAInfo.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -9764,7 +10227,7 @@
       ( usSendSize < (usDataOffset + sizeof(halDelBAparam) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer for DEL BA req %x %x %x",
+              "Unable to get send buffer for DEL BA req %p %p %p",
                 pEventData, pwdiDelBAParams, wdiDelBARspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -9866,7 +10329,7 @@
       ( usSendSize < (usDataOffset + sizeof(halTsmStatsReqParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiTSMParams, wdiTSMRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE; 
@@ -9942,7 +10405,7 @@
        ( usSendSize < (usDataOffset + sizeof(pwdiFlushAcParams->wdiFlushAcInfo) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in set bss key req %x %x %x",
+               "Unable to get send buffer in set bss key req %p %p %p",
                  pEventData, pwdiFlushAcParams, wdiFlushAcRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -10012,7 +10475,7 @@
        ( usSendSize < (usDataOffset + sizeof(haltBtAmpEventMsg.btAmpEventParams) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in BT AMP event req %x %x %x",
+               "Unable to get send buffer in BT AMP event req %p %p %p",
                  pEventData, pwdiBtAmpEventParams, wdiBtAmpEventRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -10056,7 +10519,7 @@
   wpt_uint8*                            pSendBuffer         = NULL;
   wpt_uint16                            usDataOffset        = 0;
   wpt_uint16                            usSendSize          = 0;
-  tAddStaSelfParams                     halAddSTASelfParams;
+  tAddStaSelfParams_V1                  halAddSTASelfParams;
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
 
   /*-------------------------------------------------------------------------
@@ -10081,12 +10544,12 @@
   -----------------------------------------------------------------------*/
   if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
                         WDI_ADD_STA_SELF_REQ,
-                        sizeof(tAddStaSelfParams),
+                        sizeof(tAddStaSelfParams_V1),
                         &pSendBuffer, &usDataOffset, &usSendSize))||
-      ( usSendSize < (usDataOffset + sizeof(tAddStaSelfParams) )))
+      ( usSendSize < (usDataOffset + sizeof(tAddStaSelfParams_V1) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in ADD STA SELF REQ %x %x %x",
+              "Unable to get send buffer in ADD STA SELF REQ %p %p %p",
      pEventData, pwdiAddSTASelfReqParams, wdiAddSTASelfReqRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -10097,10 +10560,21 @@
                  sizeof(pWDICtx->wdiCacheAddSTASelfReq));
 
   wpalMemoryCopy(halAddSTASelfParams.selfMacAddr,
-                   pwdiAddSTASelfReqParams->wdiAddSTASelfInfo.selfMacAddr, 6) ;
-
+                   pwdiAddSTASelfReqParams->wdiAddSTASelfInfo.selfMacAddr, 6);
+  halAddSTASelfParams.iface_persona = HAL_IFACE_UNKNOWN;
+  if (pwdiAddSTASelfReqParams->wdiAddSTASelfInfo.currDeviceMode == VOS_STA_MODE)
+  {
+      halAddSTASelfParams.iface_persona = HAL_IFACE_STA_MODE;
+  }
+  else if ((pwdiAddSTASelfReqParams->wdiAddSTASelfInfo.currDeviceMode ==
+                          VOS_P2P_CLIENT_MODE) ||
+          (pwdiAddSTASelfReqParams->wdiAddSTASelfInfo.currDeviceMode ==
+                          VOS_P2P_DEVICE_MODE))
+  {
+      halAddSTASelfParams.iface_persona = HAL_IFACE_P2P_MODE;
+  }
   wpalMemoryCopy( pSendBuffer+usDataOffset, &halAddSTASelfParams,
-                                         sizeof(tAddStaSelfParams));
+                                         sizeof(tAddStaSelfParams_V1));
 
   pWDICtx->wdiReqStatusCB     = pwdiAddSTASelfReqParams->wdiReqStatusCB;
   pWDICtx->pReqStatusUserData = pwdiAddSTASelfReqParams->pUserData;
@@ -10167,7 +10641,7 @@
          (usDataOffset + sizeof(pwdiDelStaSelfReqParams->wdiDelStaSelfInfo) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Del Sta Self req %x %x %x",
+               "Unable to get send buffer in Del Sta Self req %p %p %p",
                  pEventData, pwdiDelStaSelfReqParams, wdiDelStaSelfRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -10244,7 +10718,7 @@
         (usSendSize < (usDataOffset + reqLen)))
   {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Start Oem Data req %x %x %x",
+               "Unable to get send buffer in Start Oem Data req %p %p %p",
                  pEventData, pwdiOemDataReqParams, wdiOemDataRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -10318,7 +10792,7 @@
         (usSendSize < (usDataOffset + sizeof(halResumeReqParams))))
   {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Start Oem Data req %x %x %x",
+               "Unable to get send buffer in Start Oem Data req %p %p %p",
                  pEventData, pwdiHostResumeParams, wdiHostResumeRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -10392,7 +10866,7 @@
        ( usSendSize < (usDataOffset + sizeof(halTxPerTrackingReqParam) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in set tx per tracking req %x %x %x",
+                  "Unable to get send buffer in set tx per tracking req %p %p %p",
                   pEventData, pwdiSetTxPerTrackingReqParams, pwdiSetTxPerTrackingRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -10644,6 +11118,184 @@
 }/*WDI_ProcessExcludeUnencryptInd*/
 #endif
 
+/**
+ @brief Process Add Periodic Tx Pattern Indication function (called when
+           Main FSM allows it)
+
+ @param pWDICtx:         pointer to the WLAN DAL context
+        pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessAddPeriodicTxPtrnInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_AddPeriodicTxPtrnParamsType   *pAddPeriodicTxPtrnParams;
+  wpt_uint8*                     pSendBuffer         = NULL;
+  wpt_uint16                     usDataOffset        = 0;
+  wpt_uint16                     usSendSize          = 0;
+  WDI_Status                     wdiStatus;
+  tHalAddPeriodicTxPtrn          *halAddPeriodicTxPtrn;
+  wpt_uint8                      selfStaIdx          = 0;
+
+  /*-------------------------------------------------------------------------
+     Sanity check
+  -------------------------------------------------------------------------*/
+  if ((NULL == pEventData) || (NULL == pEventData->pEventData))
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+               "%s: Invalid parameters in AddPeriodicTxPtrnInd!", __func__);
+    WDI_ASSERT(0);
+    return WDI_STATUS_E_FAILURE;
+  }
+
+  pAddPeriodicTxPtrnParams =
+    (WDI_AddPeriodicTxPtrnParamsType *)pEventData->pEventData;
+
+   /*------------------------------------------------------------------------
+     Get message buffer
+   ------------------------------------------------------------------------*/
+  if ((WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(pWDICtx,
+       WDI_ADD_PERIODIC_TX_PATTERN_IND, sizeof(tHalAddPeriodicTxPtrn),
+       &pSendBuffer, &usDataOffset, &usSendSize))||
+       (usSendSize < (usDataOffset + sizeof(tHalAddPeriodicTxPtrn))))
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+               "%s: Unable to get send buffer in AddPeriodicTxPtrnInd!",
+               __func__);
+    WDI_ASSERT(0);
+    return WDI_STATUS_E_FAILURE;
+  }
+
+  halAddPeriodicTxPtrn = (tHalAddPeriodicTxPtrn *)(pSendBuffer + usDataOffset);
+
+  if (WDI_STATUS_SUCCESS != WDI_STATableFindStaidByAddr(pWDICtx,
+      pAddPeriodicTxPtrnParams->wdiAddPeriodicTxPtrnParams.macAddr,
+      &selfStaIdx))
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "%s: Failed to get selfStaIdx!", __func__);
+    wpalMemoryFree(pSendBuffer);
+
+    return WDI_STATUS_E_FAILURE;
+  }
+
+  halAddPeriodicTxPtrn->selfStaIdx = selfStaIdx;
+  halAddPeriodicTxPtrn->ucPtrnId =
+    pAddPeriodicTxPtrnParams->wdiAddPeriodicTxPtrnParams.ucPtrnId;
+  halAddPeriodicTxPtrn->usPtrnSize =
+    pAddPeriodicTxPtrnParams->wdiAddPeriodicTxPtrnParams.ucPtrnSize;
+  halAddPeriodicTxPtrn->uPtrnIntervalMs =
+    pAddPeriodicTxPtrnParams->wdiAddPeriodicTxPtrnParams.usPtrnIntervalMs;
+
+  wpalMemoryCopy(halAddPeriodicTxPtrn->ucPattern,
+    pAddPeriodicTxPtrnParams->wdiAddPeriodicTxPtrnParams.ucPattern,
+    pAddPeriodicTxPtrnParams->wdiAddPeriodicTxPtrnParams.ucPtrnSize);
+
+  /*-------------------------------------------------------------------------
+    Send Indication to HAL
+  -------------------------------------------------------------------------*/
+  pWDICtx->wdiReqStatusCB     = pAddPeriodicTxPtrnParams->wdiReqStatusCB;
+  pWDICtx->pReqStatusUserData = pAddPeriodicTxPtrnParams->pUserData;
+
+  wdiStatus = WDI_SendIndication(pWDICtx, pSendBuffer, usSendSize);
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+             "%s: Sent WLAN_HAL_ADD_PERIODIC_TX_PTRN_IND to HAL.", __func__);
+
+  return (wdiStatus != WDI_STATUS_SUCCESS) ? wdiStatus : WDI_STATUS_SUCCESS_SYNC;
+} /* WDI_ProcessAddPeriodicTxPtrnInd */
+
+/**
+ @brief Process Delete Periodic Tx Pattern Indication function (called when
+           Main FSM allows it)
+
+ @param pWDICtx:         pointer to the WLAN DAL context
+        pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessDelPeriodicTxPtrnInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_DelPeriodicTxPtrnParamsType   *pDelPeriodicTxPtrnParams;
+  wpt_uint8*                     pSendBuffer         = NULL;
+  wpt_uint16                     usDataOffset        = 0;
+  wpt_uint16                     usSendSize          = 0;
+  WDI_Status                     wdiStatus;
+  tHalDelPeriodicTxPtrn          *halDelPeriodicTxPtrn;
+  wpt_uint8                      selfStaIdx          = 0;
+
+  /*-------------------------------------------------------------------------
+     Sanity check
+  -------------------------------------------------------------------------*/
+  if ((NULL == pEventData) || (NULL == pEventData->pEventData))
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+               "%s: Invalid parameters in DelPeriodicTxPtrnInd!", __func__);
+    WDI_ASSERT(0);
+    return WDI_STATUS_E_FAILURE;
+  }
+
+  pDelPeriodicTxPtrnParams =
+    (WDI_DelPeriodicTxPtrnParamsType *)pEventData->pEventData;
+
+   /*------------------------------------------------------------------------
+     Get message buffer
+   ------------------------------------------------------------------------*/
+  if ((WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(pWDICtx,
+       WDI_DEL_PERIODIC_TX_PATTERN_IND, sizeof(tHalDelPeriodicTxPtrn),
+       &pSendBuffer, &usDataOffset, &usSendSize))||
+       (usSendSize < (usDataOffset + sizeof(tHalDelPeriodicTxPtrn))))
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+               "%s: Unable to get send buffer in DelPeriodicTxPtrnInd!",
+               __func__);
+    WDI_ASSERT(0);
+    return WDI_STATUS_E_FAILURE;
+  }
+
+  halDelPeriodicTxPtrn = (tHalDelPeriodicTxPtrn *)(pSendBuffer + usDataOffset);
+
+  if (WDI_STATUS_SUCCESS != WDI_STATableFindStaidByAddr(pWDICtx,
+      pDelPeriodicTxPtrnParams->wdiDelPeriodicTxPtrnParams.macAddr,
+      &selfStaIdx))
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "%s: Failed to get selfStaIdx!", __func__);
+    wpalMemoryFree(pSendBuffer);
+
+    return WDI_STATUS_E_FAILURE;
+  }
+
+  halDelPeriodicTxPtrn->selfStaIdx = selfStaIdx;
+  halDelPeriodicTxPtrn->uPatternIdBitmap =
+    pDelPeriodicTxPtrnParams->wdiDelPeriodicTxPtrnParams.ucPatternIdBitmap;
+
+  /*-------------------------------------------------------------------------
+    Send Indication to HAL
+  -------------------------------------------------------------------------*/
+  pWDICtx->wdiReqStatusCB     = pDelPeriodicTxPtrnParams->wdiReqStatusCB;
+  pWDICtx->pReqStatusUserData = pDelPeriodicTxPtrnParams->pUserData;
+
+  wdiStatus = WDI_SendIndication(pWDICtx, pSendBuffer, usSendSize);
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+             "%s: Sent WLAN_HAL_DEL_PERIODIC_TX_PTRN_IND to HAL.", __func__);
+
+  return (wdiStatus != WDI_STATUS_SUCCESS) ? wdiStatus : WDI_STATUS_SUCCESS_SYNC;
+} /* WDI_ProcessDelPeriodicTxPtrnInd */
+
 /*==========================================================================
                   MISC CONTROL PROCESSING REQUEST API
 ==========================================================================*/
@@ -10696,7 +11348,7 @@
       ( usSendSize < (usDataOffset + sizeof(halSwitchChannelReq.switchChannelParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in channel switch req %x %x %x",
+              "Unable to get send buffer in channel switch req %p %p %p",
                 pEventData, pwdiSwitchChParams, wdiSwitchChRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -10836,7 +11488,7 @@
       ( usSendSize < (usDataOffset + uMsgSize )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in config sta req %x %x %x",
+              "Unable to get send buffer in config sta req %p %p %p",
                 pEventData, pwdiConfigSTAParams, wdiConfigSTARspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -10855,7 +11507,9 @@
                                      (wpt_uint8*)&halConfigStaReqMsg.uStaParams.configStaParams.staIdx ))
     {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "This station does not exist in the WDI Station Table %d");
+                  MAC_ADDRESS_STR
+                  ": This station does not exist in the WDI Station Table",
+                MAC_ADDR_ARRAY(pwdiConfigSTAParams->wdiReqInfo.macSTA));
       wpalMutexRelease(&pWDICtx->wptMutex);
       wpalMemoryFree(pSendBuffer);
       return WDI_STATUS_E_FAILURE;
@@ -10986,7 +11640,7 @@
       ( usSendSize < (usDataOffset + sizeof(halLinkStateReqMsg) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiSetLinkParams, wdiSetLinkRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -11057,6 +11711,7 @@
      return WDI_STATUS_E_FAILURE;
   }
 
+
   pwdiGetStatsParams = (WDI_GetStatsReqParamsType*)pEventData->pEventData;
   wdiGetStatsRspCb   = (WDI_GetStatsRspCb)pEventData->pCBfnc;
 
@@ -11074,7 +11729,8 @@
                         &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiGetStatsParams->wdiGetStatsParamsInfo.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -11117,7 +11773,7 @@
       ( usSendSize < (usDataOffset + sizeof(halStatsReqMsg.statsReqParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiGetStatsParams, wdiGetStatsRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -11199,7 +11855,8 @@
                         &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiGetRoamRssiParams->wdiGetRoamRssiParamsInfo.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -11241,7 +11898,7 @@
       ( usSendSize < (usDataOffset + sizeof(halRssiRoamReqMsg.roamRssiReqParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiGetRoamRssiParams, wdiGetStatsRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -11315,7 +11972,7 @@
       ( usSendSize < (usDataOffset +  pwdiUpdateCfgParams->uConfigBufferLen)))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiUpdateCfgParams, wdiUpdateCfgRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -11401,7 +12058,8 @@
                                   &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiAddBAParams->wdiBAInfoType.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -11444,7 +12102,7 @@
             (usDataOffset + sizeof(halAddBAReq.addBAParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in Add BA req %x %x %x",
+              "Unable to get send buffer in Add BA req %p %p %p",
                 pEventData, pwdiAddBAParams, wdiAddBARspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -11537,7 +12195,8 @@
                                   &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiTriggerBAParams->wdiTriggerBAInfoType.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -11585,7 +12244,7 @@
                pwdiTriggerBAParams->wdiTriggerBAInfoType.usBACandidateCnt) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in Trigger BA req %x %x %x",
+              "Unable to get send buffer in Trigger BA req %p %p %p",
                 pEventData, pwdiTriggerBAParams, wdiTriggerBARspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -11676,7 +12335,7 @@
       ( usSendSize < (usDataOffset + sizeof(halUpdateBeaconParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiUpdateBeaconParams, wdiUpdateBeaconParamsRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -11778,7 +12437,7 @@
       ( usSendSize < (usDataOffset + sizeof(halSendBeaconReq.sendBeaconParam) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in send beacon req %x %x %x",
+              "Unable to get send buffer in send beacon req %p %p %p",
                 pEventData, pwdiSendBeaconParams, wdiSendBeaconParamsRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -11874,7 +12533,7 @@
       ( usSendSize < (usDataOffset + sizeof(halUpdateProbeRspTmplParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
      pEventData, pwdiUpdateProbeRespTmplParams, wdiUpdateProbeRespTmplRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -12017,7 +12676,7 @@
 )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
-              "Unable to get Set Max Tx Power req %x %x %x",
+              "Unable to get Set Max Tx Power req %p %p %p",
                 pEventData, pwdiSetMaxTxPowerParams, wdiSetMaxTxPowerRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -12049,6 +12708,88 @@
 
 }
 
+/*
+ @brief Process Set Max Tx Power Per Band Request function (called when Main
+        FSM allows it)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status WDI_ProcessSetMaxTxPowerPerBandReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_SetMaxTxPowerPerBandParamsType*    pwdiSetMaxTxPowerPerBandParams = NULL;
+  WDA_SetMaxTxPowerPerBandRspCb          wdiSetMaxTxPowerPerBandRspCb;
+  wpt_uint8*                             pSendBuffer         = NULL;
+  wpt_uint16                             usDataOffset        = 0;
+  wpt_uint16                             usSendSize          = 0;
+  tpSetMaxTxPwrPerBandReq                phalSetMxTxPwrPerBand = NULL;
+  WDI_Status                             rValue = WDI_STATUS_SUCCESS;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData ) ||
+      ( NULL == pEventData->pCBfnc ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pwdiSetMaxTxPowerPerBandParams = \
+  (WDI_SetMaxTxPowerPerBandParamsType*)pEventData->pEventData;
+
+  wdiSetMaxTxPowerPerBandRspCb = \
+  (WDA_SetMaxTxPowerPerBandRspCb)pEventData->pCBfnc;
+
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+
+  rValue = WDI_GetMessageBuffer(pWDICtx,
+                                WDI_SET_MAX_TX_POWER_PER_BAND_REQ,
+                                sizeof(tSetMaxTxPwrPerBandParams),
+                                &pSendBuffer, &usDataOffset, &usSendSize);
+
+  if ((WDI_STATUS_SUCCESS != rValue)|| (usSendSize <
+      (usDataOffset + sizeof(tSetMaxTxPwrPerBandParams))))
+  {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
+                "Unable to get Set Max Tx Power Per Band req %p %p %p",
+                pEventData, pwdiSetMaxTxPowerPerBandParams,
+                wdiSetMaxTxPowerPerBandRspCb);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+
+  phalSetMxTxPwrPerBand = (tpSetMaxTxPwrPerBandReq)(pSendBuffer + usDataOffset);
+  phalSetMxTxPwrPerBand->setMaxTxPwrPerBandParams.bandInfo = \
+  pwdiSetMaxTxPowerPerBandParams->wdiMaxTxPowerPerBandInfo.bandInfo;
+
+  phalSetMxTxPwrPerBand->setMaxTxPwrPerBandParams.power = \
+  pwdiSetMaxTxPowerPerBandParams->wdiMaxTxPowerPerBandInfo.ucPower;
+
+  pWDICtx->wdiReqStatusCB     = pwdiSetMaxTxPowerPerBandParams->wdiReqStatusCB;
+  pWDICtx->pReqStatusUserData = pwdiSetMaxTxPowerPerBandParams->pUserData;
+
+  /*-------------------------------------------------------------------------
+    Send Set Max Tx Power Per Band Request to HAL
+  -------------------------------------------------------------------------*/
+  return  WDI_SendMsg(pWDICtx, pSendBuffer, usSendSize,
+                      wdiSetMaxTxPowerPerBandRspCb, pEventData->pUserData,
+                      WDI_SET_MAX_TX_POWER_PER_BAND_RSP);
+}
+
 /**
  @brief Process Set Tx Power Request function (called when Main
         FSM allows it)
@@ -12101,7 +12842,7 @@
   )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
-                 "Unable to get Set Max Tx Power req %x %x %x",
+                 "Unable to get Set Max Tx Power req %p %p %p",
                  pEventData, pwdiSetTxPowerParams, wdiSetTxPowerRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -12174,7 +12915,7 @@
       ( usSendSize < (usDataOffset + sizeof(halSetP2PGONOAParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set P2P GO NOA REQ %x %x %x",
+              "Unable to get send buffer in set P2P GO NOA REQ %p %p %p",
      pEventData, pwdiP2PGONOAReqParams, wdiP2PGONOAReqRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -12209,6 +12950,104 @@
                        WDI_P2P_GO_NOTICE_OF_ABSENCE_RESP);
 }/*WDI_ProcessP2PGONOAReq*/
 
+#ifdef FEATURE_WLAN_TDLS
+
+/**
+ @brief Process P2P Notice Of Absence Request function (called when Main FSM
+        allows it)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTdlsLinkEstablishReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_SetTDLSLinkEstablishReqParamsType* pwdiTDLSLinkEstablishReqParams;
+  WDI_SetTDLSLinkEstablishReqParamsRspCb wdiTDLSLinkEstablishReqRspCb;
+  wpt_uint8*                             pSendBuffer         = NULL;
+  wpt_uint16                             usDataOffset        = 0;
+  wpt_uint16                             usSendSize          = 0;
+
+  tTDLSLinkEstablishedType               halSetTDLSLinkEstablishParams;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData) ||
+      ( NULL == pEventData->pCBfnc))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pwdiTDLSLinkEstablishReqParams =
+    (WDI_SetTDLSLinkEstablishReqParamsType*)pEventData->pEventData;
+  wdiTDLSLinkEstablishReqRspCb =
+    (WDI_SetTDLSLinkEstablishReqParamsRspCb)pEventData->pCBfnc;
+
+
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                        WDI_TDLS_LINK_ESTABLISH_REQ,
+                        sizeof(halSetTDLSLinkEstablishParams),
+                        &pSendBuffer, &usDataOffset, &usSendSize))||
+      ( usSendSize < (usDataOffset + sizeof(halSetTDLSLinkEstablishParams) )))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+              "Unable to get send buffer in set P2P GO NOA REQ %p %p %p",
+     pEventData, pwdiTDLSLinkEstablishReqParams, wdiTDLSLinkEstablishReqRspCb);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  halSetTDLSLinkEstablishParams.staIdx =
+                           pwdiTDLSLinkEstablishReqParams->wdiTDLSLinkEstablishInfo.uStaIdx;
+  halSetTDLSLinkEstablishParams.bIsResponder =
+                           pwdiTDLSLinkEstablishReqParams->wdiTDLSLinkEstablishInfo.uIsResponder;
+  halSetTDLSLinkEstablishParams.acVOUAPSDFlag =
+   (pwdiTDLSLinkEstablishReqParams->wdiTDLSLinkEstablishInfo.uUapsdQueues & 0x08) >> 3;
+  halSetTDLSLinkEstablishParams.acVIUAPSDFlag =
+   (pwdiTDLSLinkEstablishReqParams->wdiTDLSLinkEstablishInfo.uUapsdQueues & 0x04) >> 2;
+  halSetTDLSLinkEstablishParams.acBKUAPSDFlag =
+   (pwdiTDLSLinkEstablishReqParams->wdiTDLSLinkEstablishInfo.uUapsdQueues & 0x02) >> 1;
+  halSetTDLSLinkEstablishParams.acBEUAPSDFlag =
+   pwdiTDLSLinkEstablishReqParams->wdiTDLSLinkEstablishInfo.uUapsdQueues & 0x01;
+  halSetTDLSLinkEstablishParams.aAck = 0;
+  halSetTDLSLinkEstablishParams.maxServicePeriodLength = (pwdiTDLSLinkEstablishReqParams->wdiTDLSLinkEstablishInfo.uMaxSp & 0x03);
+  halSetTDLSLinkEstablishParams.moreDataAck = 0;
+  halSetTDLSLinkEstablishParams.TPUBufferStaSupport =  pwdiTDLSLinkEstablishReqParams->wdiTDLSLinkEstablishInfo.uIsBufSta;
+
+  wpalMemoryCopy( pSendBuffer+usDataOffset,
+                  &halSetTDLSLinkEstablishParams,
+                  sizeof(halSetTDLSLinkEstablishParams));
+
+  pWDICtx->wdiReqStatusCB     = pwdiTDLSLinkEstablishReqParams->wdiReqStatusCB;
+  pWDICtx->pReqStatusUserData = pwdiTDLSLinkEstablishReqParams->pUserData;
+
+  /*-------------------------------------------------------------------------
+    Send Update Probe Resp Template Request to HAL
+  -------------------------------------------------------------------------*/
+  return  WDI_SendMsg( pWDICtx, pSendBuffer, usSendSize,
+                       wdiTDLSLinkEstablishReqRspCb, pEventData->pUserData,
+                       WDI_TDLS_LINK_ESTABLISH_REQ_RESP);
+  return 0;
+}/*WDI_ProcessTdlsLinkEstablishReq*/
+
+
+#endif
+
 
 
 /**
@@ -12306,7 +13145,7 @@
        ( usSendSize < (usDataOffset )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Enter IMPS req %x %x",
+               "Unable to get send buffer in Enter IMPS req %p %p",
                  pEventData, wdiEnterImpsRspCb);
       WDI_ASSERT(0);
       goto failRequest;
@@ -12327,7 +13166,7 @@
    wptStatus = WDTS_SetPowerState(pWDICtx, WDTS_POWER_STATE_IMPS, WDI_SetPowerStateCb);
    if( eWLAN_PAL_STATUS_SUCCESS != wptStatus ) {
         WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering IMPS\n", wptStatus);
+                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering IMPS", wptStatus);
         WDI_ASSERT(0);
         goto fail;
     }
@@ -12406,7 +13245,7 @@
        ( usSendSize < (usDataOffset )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Exit IMPS req %x %x",
+               "Unable to get send buffer in Exit IMPS req %p %p",
                  pEventData, wdiExitImpsRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -12469,7 +13308,7 @@
        ( usSendSize < (usDataOffset + sizeof(enterBmpsReq) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Enter BMPS req %x %x %x",
+               "Unable to get send buffer in Enter BMPS req %p %p %p",
                  pEventData, pwdiEnterBmpsReqParams, wdiEnterBmpsRspCb);
       WDI_ASSERT(0);
       goto failRequest;
@@ -12491,7 +13330,7 @@
    if( eWLAN_PAL_STATUS_SUCCESS != wptStatus ) 
    {
         WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                "WDTS_SetPowerState returned with status %d when trying to notify DTS that we are entering BMPS\n", wptStatus);
+                "WDTS_SetPowerState returned with status %d when trying to notify DTS that we are entering BMPS", wptStatus);
         WDI_ASSERT(0);
         goto fail;
     }
@@ -12592,7 +13431,7 @@
        ( usSendSize < (usDataOffset + sizeof(exitBmpsReq) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Exit BMPS req %x %x %x",
+               "Unable to get send buffer in Exit BMPS req %p %p %p",
                  pEventData, pwdiExitBmpsReqParams, wdiExitBmpsRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -12663,7 +13502,7 @@
        ( usSendSize < (usDataOffset + sizeof(enterUapsdReq) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Enter UAPSD req %x %x %x",
+               "Unable to get send buffer in Enter UAPSD req %p %p %p",
                  pEventData, pwdiEnterUapsdReqParams, wdiEnterUapsdRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -12742,7 +13581,7 @@
        ( usSendSize < (usDataOffset + sizeof(wpt_uint8))))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Exit UAPSD req %x %x",
+               "Unable to get send buffer in Exit UAPSD req %p %p",
                  pEventData, wdiExitUapsdRspCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -12812,7 +13651,7 @@
       ( usSendSize < (usDataOffset + sizeof(uapsdAcParamsReq) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in Set UAPSD params req %x %x %x",
+              "Unable to get send buffer in Set UAPSD params req %p %p %p",
                 pEventData, pwdiSetUapsdAcParams, wdiSetUapsdAcParamsCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -12886,7 +13725,7 @@
        ( usSendSize < (usDataOffset + sizeof(pwdiUpdateUapsdReqParams->wdiUpdateUapsdInfo) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Update UAPSD params req %x %x %x",
+               "Unable to get send buffer in Update UAPSD params req %p %p %p",
                  pEventData, pwdiUpdateUapsdReqParams, wdiUpdateUapsdParamsCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -12954,7 +13793,7 @@
       ( usSendSize < (usDataOffset + sizeof(halRxpFilterParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in Set UAPSD params req %x %x %x",
+              "Unable to get send buffer in Set UAPSD params req %p %p %p",
                 pEventData, pwdiRxpFilterParams, wdiConfigureRxpFilterCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -13026,7 +13865,7 @@
        ( usSendSize < (usDataOffset + sizeof(pwdiBeaconFilterParams->wdiBeaconFilterInfo) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Set beacon filter req %x %x %x",
+               "Unable to get send buffer in Set beacon filter req %p %p %p",
                  pEventData, pwdiBeaconFilterParams, wdiBeaconFilterCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -13096,7 +13935,7 @@
        ( usSendSize < (usDataOffset + sizeof(pwdiBeaconFilterParams->wdiBeaconFilterInfo) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in remove beacon filter req %x %x %x",
+                  "Unable to get send buffer in remove beacon filter req %p %p %p",
                   pEventData, pwdiBeaconFilterParams, wdiBeaconFilterCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -13165,7 +14004,7 @@
        ( usSendSize < (usDataOffset + sizeof(rssiThresholdsReq) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in remove beacon filter req %x %x %x",
+                  "Unable to get send buffer in remove beacon filter req %p %p %p",
                   pEventData, pwdiRSSIThresholdsParams, wdiRSSIThresholdsCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -13269,7 +14108,7 @@
        ( usSendSize < (usDataOffset + sizeof(hostOffloadParams) + sizeof(nsOffloadParams) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in host offload req %x %x %x",
+                  "Unable to get send buffer in host offload req %p %p %p",
                   pEventData, pwdiHostOffloadParams, wdiHostOffloadCb);
       WDI_ASSERT(0);
       goto failRequest;
@@ -13281,7 +14120,8 @@
    if ( NULL == pBSSSes )
    {
        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-                 " %s : Association for this BSSID does not exist",__func__);
+                 " %s : Association for this BSSID does not exist " MAC_ADDRESS_STR,
+                 __func__, MAC_ADDR_ARRAY(pwdiHostOffloadParams->wdiHostOffloadInfo.bssId));
        goto fail;
    }
 
@@ -13430,7 +14270,7 @@
        ( usSendSize < (usDataOffset + sizeof(keepAliveReq) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
-                  "Unable to get send buffer in keep alive req %x %x %x",
+                  "Unable to get send buffer in keep alive req %p %p %p",
                   pEventData, pwdiKeepAliveParams, wdiKeepAliveCb);
       WDI_ASSERT(0);
       goto failRequest;
@@ -13469,10 +14309,11 @@
                    sizeof(keepAliveReq));
 
    WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_INFO,
-               "Process keep alive req %d",sizeof(keepAliveReq));
+               "Process keep alive req %zu", sizeof(keepAliveReq));
 
    WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_INFO,
-               "Process keep alive req time period %d",keepAliveReq.timePeriod);
+               "Process keep alive req time period %d",
+               keepAliveReq.timePeriod);
 
    pWDICtx->wdiReqStatusCB     = pwdiKeepAliveParams->wdiReqStatusCB;
    pWDICtx->pReqStatusUserData = pwdiKeepAliveParams->pUserData;
@@ -13547,7 +14388,7 @@
        ( usSendSize < (usDataOffset + sizeof(wowlAddBcPtrnReq) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Wowl add bc ptrn req %x %x %x",
+                  "Unable to get send buffer in Wowl add bc ptrn req %p %p %p",
                   pEventData, pwdiWowlAddBcPtrnParams, wdiWowlAddBcPtrnCb);
       WDI_ASSERT(0);
       goto failRequest;
@@ -13671,7 +14512,7 @@
        ( usSendSize < (usDataOffset + sizeof(wowlDelBcPtrnReq) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Wowl del bc ptrn req %x %x %x",
+                  "Unable to get send buffer in Wowl del bc ptrn req %p %p %p",
                   pEventData, pwdiWowlDelBcPtrnParams, wdiWowlDelBcPtrnCb);
       WDI_ASSERT(0);
       goto failRequest;
@@ -13762,12 +14603,14 @@
        ( usSendSize < (usDataOffset + sizeof(wowlEnterReq) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Wowl enter req %x %x %x",
+                  "Unable to get send buffer in Wowl enter req %p %p %p",
                   pEventData, pwdiWowlEnterParams, wdiWowlEnterCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
    }
 
+   wpalMemoryZero(&wowlEnterReq, sizeof(tHalWowlEnterParams));
+
    wowlEnterReq.ucMagicPktEnable =
       pwdiWowlEnterParams->wdiWowlEnterInfo.ucMagicPktEnable;
    wowlEnterReq.ucPatternFilteringEnable =
@@ -13870,7 +14713,7 @@
        ( usSendSize < (usDataOffset + sizeof(wowlExitparams))))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Wowl Exit req %x %x",
+               "Unable to get send buffer in Wowl Exit req %p %p",
                  pEventData, wdiWowlExitCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -13935,7 +14778,7 @@
        ( usSendSize < (usDataOffset + sizeof(pwdiAppsCpuWakeupStateParams->bIsAppsAwake) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-               "Unable to get send buffer in Apps CPU Wakeup State req %x %x %x",
+               "Unable to get send buffer in Apps CPU Wakeup State req %p %p %p",
                  pEventData, pwdiAppsCpuWakeupStateParams, wdiConfigureAppsCpuWakeupStateCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -14018,7 +14861,8 @@
                                         &macBSSID))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-             "This station does not exist in the WDI Station Table %d");
+                "This station does not exist in the WDI Station Table %d",
+                pwdiAggrAddTSParams->wdiAggrTsInfo.ucSTAIdx);
     wpalMutexRelease(&pWDICtx->wptMutex);
     return WDI_STATUS_E_FAILURE;
   }
@@ -14060,7 +14904,7 @@
       ( usSendSize < (usDataOffset + sizeof(tAggrAddTsParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in set bss key req %x %x %x",
+              "Unable to get send buffer in set bss key req %p %p %p",
                 pEventData, pwdiAggrAddTSParams, wdiAggrAddTSRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -14286,7 +15130,7 @@
   {
      // not enough data was received
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                 "Invalid response length in Start Resp Expect %x Rcvd %x",
+                 "Invalid response length in Start Resp Expect %zx Rcvd %x",
                  sizeof(tHalMacStartRspParams), pEventData->uEventDataSize);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -14456,7 +15300,7 @@
   if ( sizeof(halMacStopRspMsg) < pEventData->uEventDataSize )
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Invalid response length in Stop Resp %x %x",
+              "Invalid response length in Stop Resp %u",
                 pEventData->uEventDataSize);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -14594,7 +15438,7 @@
      wptStatus = WDTS_SetPowerState(pWDICtx, WDTS_POWER_STATE_FULL, NULL);
      if( eWLAN_PAL_STATUS_SUCCESS != wptStatus ) {
         WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state\n", wptStatus);
+                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state", wptStatus);
         WDI_ASSERT(0);
     }
   }
@@ -15091,7 +15935,7 @@
         Add Broadcast STA only in AP mode
       -------------------------------------------------------------------------*/
     if( pWDICtx->wdiCachedConfigBssReq.wdiReqInfo.ucOperMode ==
-        WDI_BSS_OPERATIONAL_MODE_AP )
+        WDI_BSS_OPERATIONAL_MODE_AP || pBSSSes->wdiBssType == WDI_IBSS_MODE)
     {
        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
                   "Add BCAST STA to table for index: %d",
@@ -15220,7 +16064,8 @@
 
 
   /* Delete the BCAST STA entry from the STA table if SAP/GO session is deleted */
-  if(WDI_INFRA_AP_MODE == pBSSSes->wdiBssType)
+  if(WDI_INFRA_AP_MODE == pBSSSes->wdiBssType ||
+     pBSSSes->wdiBssType == WDI_IBSS_MODE)
   {
     (void)WDI_STATableDelSta( pWDICtx, pBSSSes->bcastStaIdx );
   }
@@ -16513,7 +17358,7 @@
   if(NULL == wdiOemDataRspParams)
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-            "Failed to allocate memory in OEM DATA Response %x %x %x ",
+            "Failed to allocate memory in OEM DATA Response %p %p %p ",
                 pWDICtx, pEventData, pEventData->pEventData);
     WDI_ASSERT(0);
     return WDI_STATUS_E_FAILURE;
@@ -16678,6 +17523,8 @@
         pWDICtx->wdiCachedConfigStaReq.wdiReqInfo.ucHTCapable;
       wdiAddSTAParam.ucStaType    =
         pWDICtx->wdiCachedConfigStaReq.wdiReqInfo.wdiSTAType;
+      wdiAddSTAParam.ucRmfEnabled =
+        pWDICtx->wdiCachedConfigStaReq.wdiReqInfo.ucRMFEnabled;
 
       /* MAC Address of STA */
       wpalMemoryCopy(wdiAddSTAParam.staMacAddr,
@@ -16710,7 +17557,6 @@
          halConfigStaRsp.configStaRspParams.bcastDpuIndex;
       wdiAddSTAParam.bcastDpuSignature =
          halConfigStaRsp.configStaRspParams.ucBcastSig;
-      wdiAddSTAParam.ucRmfEnabled          = pBSSSes->ucRmfEnabled;
       wdiAddSTAParam.ucBSSIdx              = ucCurrentBSSSesIdx;
 
       WDI_STATableAddSta(pWDICtx,&wdiAddSTAParam);
@@ -16907,7 +17753,7 @@
   if(NULL == wdiGetStatsRsp)
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
-                "Failed to allocate memory in Get Stats Response %x %x %x ",
+                "Failed to allocate memory in Get Stats Response %p %p %p ",
                  pWDICtx, pEventData, pEventData->pEventData);
     WDI_ASSERT(0);
     return WDI_STATUS_E_FAILURE;
@@ -17164,7 +18010,7 @@
     if(NULL == wdiTriggerBARsp)
     {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Failed to allocate memory in Trigger BA Response %x %x %x ",
+                  "Failed to allocate memory in Trigger BA Response %p %p %p ",
                    pWDICtx, pEventData, pEventData->pEventData);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -17201,7 +18047,7 @@
     if(NULL == wdiTriggerBARsp)
     {
        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Failed to allocate memory in Trigger BA Response %x %x %x ",
+                  "Failed to allocate memory in Trigger BA Response %p %p %p ",
                    pWDICtx, pEventData, pEventData->pEventData);
        WDI_ASSERT(0);
        return WDI_STATUS_E_FAILURE;
@@ -17421,7 +18267,6 @@
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
               "Error status returned in Set Max Tx Power Response ");
-     WDI_DetectedDeviceError( pWDICtx, WDI_ERR_BASIC_OP_FAILURE);
      return WDI_STATUS_E_FAILURE;
   }
 
@@ -17494,6 +18339,68 @@
 
   return WDI_STATUS_SUCCESS;
 }
+#ifdef FEATURE_WLAN_TDLS
+/**
+ @brief Process TDLS Link Establish Rsp function (called
+        when a response is being received over the bus from HAL)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLinkEstablishReqRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  eHalStatus       halStatus;
+  WDI_SetTDLSLinkEstablishReqParamsRspCb   wdiTDLSLinkEstablishReqParamsRspCb;
+  tTDLSLinkEstablishedRespMsg  halTdlsLinkEstablishedRespMsg;
+  WDI_SetTdlsLinkEstablishReqResp    wdiSetTdlsLinkEstablishReqResp;
+
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  /*-------------------------------------------------------------------------
+  Extract indication and send it to UMAC
+ -------------------------------------------------------------------------*/
+  wpalMemoryCopy( &halTdlsLinkEstablishedRespMsg.TDLSLinkEstablishedRespParams,
+                  pEventData->pEventData,
+                  sizeof(halTdlsLinkEstablishedRespMsg.TDLSLinkEstablishedRespParams) );
+
+  wdiTDLSLinkEstablishReqParamsRspCb = (WDI_SetTDLSLinkEstablishReqParamsRspCb)pWDICtx->pfncRspCB;
+
+  /*-------------------------------------------------------------------------
+    Extract response and send it to UMAC
+  -------------------------------------------------------------------------*/
+  wpalMemoryCopy( &halStatus,
+                  pEventData->pEventData,
+                  sizeof(halStatus));
+
+  wdiSetTdlsLinkEstablishReqResp.wdiStatus   =   WDI_HAL_2_WDI_STATUS(halStatus);
+  wdiSetTdlsLinkEstablishReqResp.uStaIdx   =   halTdlsLinkEstablishedRespMsg.TDLSLinkEstablishedRespParams.staIdx;
+
+  /*Notify UMAC*/
+  wdiTDLSLinkEstablishReqParamsRspCb( &wdiSetTdlsLinkEstablishReqResp, pWDICtx->pRspCBUserData);
+
+  return WDI_STATUS_SUCCESS;
+}/*WDI_ProcessLinkEstablishReqRsp*/
+#endif
 
 /**
  @brief Process P2P Group Owner Notice Of Absense Rsp function (called
@@ -17604,7 +18511,7 @@
      
      if( eWLAN_PAL_STATUS_SUCCESS != wptStatus ) {
           WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state\n", wptStatus);
+                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state", wptStatus);
           WDI_ASSERT(0);
      }
   }
@@ -17657,12 +18564,16 @@
   halStatus = *((eHalStatus*)pEventData->pEventData);
   wdiStatus   =   WDI_HAL_2_WDI_STATUS(halStatus);
 
+  if (halStatus != eHAL_STATUS_SUCCESS)
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                "%s: Exit IMPS response is a failure with halStatus %d", __func__, halStatus);
+
   // notify DTS that we are entering Full power
   wptStatus = WDTS_SetPowerState(pWDICtx, WDTS_POWER_STATE_FULL, NULL);
   if( eWLAN_PAL_STATUS_SUCCESS != wptStatus ) 
   {
     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state\n", wptStatus);
+                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state", wptStatus);
     WDI_ASSERT(0);
   }
   /*Notify UMAC*/
@@ -17745,7 +18656,7 @@
        if( eWLAN_PAL_STATUS_SUCCESS != wptStatus ) 
        {
            WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state\n", wptStatus);
+                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state", wptStatus);
            WDI_ASSERT(0);
        }
        pWDICtx->bInBmps = eWLAN_PAL_FALSE;
@@ -17819,7 +18730,7 @@
   if( eWLAN_PAL_STATUS_SUCCESS != wptStatus ) 
   {
     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
-                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state\n", wptStatus);
+                "WDTS_SetPowerState returned with status %d when trying to notify DTS that host is entering Full Power state", wptStatus);
     WDI_ASSERT(0);
   }
   pWDICtx->bInBmps = eWLAN_PAL_FALSE;
@@ -19380,6 +20291,123 @@
 
   return WDI_STATUS_SUCCESS;
 }/*WDI_ProcessTxCompleteInd*/
+#ifdef FEATURE_WLAN_TDLS
+/**
+*@brief Process TDLS Indication function (called when
+        an indication of this kind is being received over the
+        bus from HAL)
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTdlsInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_LowLevelIndType  wdiInd;
+  tTdlsIndMsg       halTdlsIndMsg;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*-------------------------------------------------------------------------
+  Sanity check
+ -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT( 0 );
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  /*-------------------------------------------------------------------------
+  Extract indication and send it to UMAC
+ -------------------------------------------------------------------------*/
+  wpalMemoryCopy( &halTdlsIndMsg.tdlsIndParams,
+                  pEventData->pEventData,
+                  sizeof(halTdlsIndMsg.tdlsIndParams) );
+
+  /*Fill in the indication parameters*/
+  wdiInd.wdiIndicationType = WDI_TDLS_IND;
+
+  wdiInd.wdiIndicationData.wdiTdlsIndInfo.status
+                          = halTdlsIndMsg.tdlsIndParams.status;
+
+  wdiInd.wdiIndicationData.wdiTdlsIndInfo.staIdx
+                          = halTdlsIndMsg.tdlsIndParams.staIdx;
+
+  wdiInd.wdiIndicationData.wdiTdlsIndInfo.reasonCode
+                          = halTdlsIndMsg.tdlsIndParams.reasonCode;
+
+  /*Notify UMAC*/
+  pWDICtx->wdiLowLevelIndCB( &wdiInd, pWDICtx->pIndUserData );
+
+  return WDI_STATUS_SUCCESS;
+}/*WDI_ProcessTdlsInd*/
+#endif
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/**
+*@brief Process Tx Fail Indication
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTXFailInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_LowLevelIndType  wdiInd;
+  tHalTXFailIndMsg     halTXFailIndMsg;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*-------------------------------------------------------------------------
+  Sanity check
+ -------------------------------------------------------------------------*/
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT( 0 );
+     return WDI_STATUS_E_FAILURE;
+  }
+  /*-------------------------------------------------------------------------
+  Extract indication and send it to UMAC
+ -------------------------------------------------------------------------*/
+  wpalMemoryCopy( &halTXFailIndMsg.txFailIndParams,
+                  pEventData->pEventData,
+                  sizeof(halTXFailIndMsg.txFailIndParams) );
+
+  /*Fill in the indication parameters*/
+  wdiInd.wdiIndicationType = WDI_TX_FAIL_IND;
+
+  wdiInd.wdiIndicationData.wdiTXFailInd.seqNo
+                          = halTXFailIndMsg.txFailIndParams.seqNo;
+
+  wpalMemoryCopy(wdiInd.wdiIndicationData.wdiTXFailInd.macAddr,
+                 halTXFailIndMsg.txFailIndParams.macAddr,
+                 sizeof(wdiInd.wdiIndicationData.wdiTXFailInd.macAddr));
+
+  /*Notify UMAC*/
+  if (pWDICtx->wdiLowLevelIndCB)
+     pWDICtx->wdiLowLevelIndCB( &wdiInd, pWDICtx->pIndUserData );
+
+  return WDI_STATUS_SUCCESS;
+}/*WDI_ProcessTdlsInd*/
+#endif /* FEATURE_CESIUM_PROPRIETARY */
 
 /**
 *@brief Process Noa Start Indication function (called when
@@ -19555,6 +20583,52 @@
 }/*WDI_ProcessTxPerHitInd*/
 
 /**
+ @brief Process Periodic Tx Pattern Fw Indication function
+
+ @param pWDICtx:         pointer to the WLAN DAL context
+        pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessPeriodicTxPtrnFwInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_LowLevelIndType  wdiInd;
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if ((NULL == pWDICtx) || (NULL == pEventData) ||
+      (NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  /*-------------------------------------------------------------------------
+    Extract indication and send it to UMAC
+  -------------------------------------------------------------------------*/
+  wpalMemoryCopy(&(wdiInd.wdiIndicationData.wdiPeriodicTxPtrnFwInd),
+                 (tHalPeriodicTxPtrnFwInd *)pEventData->pEventData,
+                 sizeof(tHalPeriodicTxPtrnFwInd));
+
+  if (pWDICtx->wdiLowLevelIndCB)
+  {
+    /*Notify UMAC*/
+    pWDICtx->wdiLowLevelIndCB(&wdiInd, pWDICtx->pIndUserData);
+  }
+
+  return WDI_STATUS_SUCCESS;
+}
+
+/**
  @brief WDI_ProcessFTMCommandReq
         Process FTM Command, simply route to HAL
 
@@ -19719,7 +20793,7 @@
             (usDataOffset + sizeof(halDumpCmdReqMsg.dumpCmdReqParams) )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-              "Unable to get send buffer in HAL Dump Command req %x %x %x",
+              "Unable to get send buffer in HAL Dump Command req %p %p %p",
                 pEventData, pwdiHALDumpCmdParams, wdiHALDumpCmdRspCb);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE;
@@ -19975,7 +21049,18 @@
                wdiEventData.wdiResponse,
                WDI_getRespMsgString(pWDICtx->wdiExpectedResponse),
                pWDICtx->wdiExpectedResponse);
-    /* WDI_DetectedDeviceError( pWDICtx, WDI_ERR_INVALID_RSP_FMT); */
+
+    if (gWDICb.bEnableSSR == false)
+    {
+       WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+            "SSR is not enabled on WDI timeout");
+       WDI_DetectedDeviceError(pWDICtx, WDI_ERR_BASIC_OP_FAILURE);
+       return;
+    }
+    wpalWcnssResetIntr();
+    /* if this timer fires, it means Riva did not receive the FIQ */
+    wpalTimerStart(&pWDICtx->ssrTimer, WDI_SSR_TIMEOUT);
+
     return;
   }
 
@@ -20047,7 +21132,7 @@
       ( NULL != pfnReqProcTbl[pEventData->wdiRequest] ))
   {
     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
-              "Calling request processing function for req %s (%d) %x",
+              "Calling request processing function for req %s (%d) %p",
               WDI_getReqMsgString(pEventData->wdiRequest),
               pEventData->wdiRequest, pfnReqProcTbl[pEventData->wdiRequest]);
     return pfnReqProcTbl[pEventData->wdiRequest](pWDICtx, pEventData);
@@ -20398,7 +21483,7 @@
   {
     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
                "WDI_ResponseTimerCB: timer in running state on timer event, "
-               "ignore tmr event, timeStampTmrStart: %ld, timeStampTmrExp: %ld",
+               "ignore tmr event, timeStampTmrStart: %u, timeStampTmrExp: %u",
                pWDICtx->uTimeStampRspTmrStart, pWDICtx->uTimeStampRspTmrExp);
     return;
   }
@@ -20408,7 +21493,7 @@
 
     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
             "Timeout occurred while waiting for %s (%d) message from device "
-            " - catastrophic failure, timeStampTmrStart: %ld, timeStampTmrExp: %ld",
+            " - catastrophic failure, timeStampTmrStart: %u, timeStampTmrExp: %u",
             WDI_getRespMsgString(pWDICtx->wdiExpectedResponse),
             pWDICtx->wdiExpectedResponse, pWDICtx->uTimeStampRspTmrStart,
             pWDICtx->uTimeStampRspTmrExp);
@@ -20439,7 +21524,7 @@
   {
      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "Timeout occurred but not waiting for any response %d "
-                 "timeStampTmrStart: %ld, timeStampTmrExp: %ld",
+                 "timeStampTmrStart: %u, timeStampTmrExp: %u",
                  pWDICtx->wdiExpectedResponse, pWDICtx->uTimeStampRspTmrStart,
                  pWDICtx->uTimeStampRspTmrExp);
   }
@@ -20475,7 +21560,7 @@
       ( NULL != pfnRspProcTbl[pEventData->wdiResponse] ))
   {
     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
-              "Calling response processing function for resp %s (%d) %x",
+              "Calling response processing function for resp %s (%d) %p",
               WDI_getRespMsgString(pEventData->wdiResponse),
               pEventData->wdiResponse, pfnRspProcTbl[pEventData->wdiResponse]);
     return pfnRspProcTbl[pEventData->wdiResponse](pWDICtx, pEventData);
@@ -21507,7 +22592,7 @@
            (usDataOffset + sizeof(halNvImgDownloadParam.nvImageReqParams) + usCurrentFragmentSize )))
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-         "Unable to get send buffer in NV Download req %x %x ",
+         "Unable to get send buffer in NV Download req %p %p ",
          pEventData, pwdiNvDownloadReqParams);
     WDI_ASSERT(0);
     return WDI_STATUS_E_FAILURE;
@@ -21713,10 +22798,16 @@
     return WLAN_HAL_UPDATE_PROBE_RSP_TEMPLATE_REQ;
    case WDI_SET_MAX_TX_POWER_REQ:
     return WLAN_HAL_SET_MAX_TX_POWER_REQ;
+  case WDI_SET_MAX_TX_POWER_PER_BAND_REQ:
+    return WLAN_HAL_SET_MAX_TX_POWER_PER_BAND_REQ;
    case WDI_SET_TX_POWER_REQ:
     return WLAN_HAL_SET_TX_POWER_REQ;
   case WDI_P2P_GO_NOTICE_OF_ABSENCE_REQ:
     return WLAN_HAL_SET_P2P_GONOA_REQ;
+#ifdef FEATURE_WLAN_TDLS
+  case WDI_TDLS_LINK_ESTABLISH_REQ:
+    return WLAN_HAL_TDLS_LINK_ESTABLISHED_REQ;
+#endif
   case WDI_ENTER_IMPS_REQ:
     return WLAN_HAL_ENTER_IMPS_REQ;
   case WDI_EXIT_IMPS_REQ:
@@ -21786,8 +22877,8 @@
   case WDI_KEEP_ALIVE_REQ:
     return WLAN_HAL_KEEP_ALIVE_REQ;
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-  case WDI_START_ROAM_CANDIDATE_LOOKUP_REQ:
-    return WLAN_START_ROAM_CANDIDATE_LOOKUP_REQ;
+  case WDI_ROAM_SCAN_OFFLOAD_REQ:
+    return WLAN_ROAM_SCAN_OFFLOAD_REQ;
 #endif
 #ifdef FEATURE_WLAN_SCAN_PNO
   case WDI_SET_PREF_NETWORK_REQ:
@@ -21832,6 +22923,47 @@
 #endif
   case WDI_GET_ROAM_RSSI_REQ:
     return WLAN_HAL_GET_ROAM_RSSI_REQ;
+  case WDI_DHCP_START_IND:
+    return WLAN_HAL_DHCP_START_IND;
+  case WDI_DHCP_STOP_IND:
+    return WLAN_HAL_DHCP_STOP_IND;
+#ifdef FEATURE_WLAN_LPHB
+   case WDI_LPHB_CFG_REQ:
+      return WLAN_HAL_LPHB_CFG_REQ;
+#endif /* FEATURE_WLAN_LPHB */
+  case WDI_ADD_PERIODIC_TX_PATTERN_IND:
+    return WLAN_HAL_ADD_PERIODIC_TX_PTRN_IND;
+  case WDI_DEL_PERIODIC_TX_PATTERN_IND:
+    return WLAN_HAL_DEL_PERIODIC_TX_PTRN_IND;
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+  case WDI_LBP_LEADER_REQ:
+    return WLAN_HAL_LBP_LEADER_REQ;
+  case WDI_LBP_UPDATE_IND:
+    return WLAN_HAL_LBP_UPDATE_IND;
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  case WDI_HAL_IBSS_PEER_INFO_REQ:
+    return WLAN_HAL_GET_IBSS_PEER_INFO_REQ;
+  case WDI_IBSS_ROUTE_TABLE_UPDATE_IND:
+    return WLAN_HAL_IP_FORWARD_TABLE_UPDATE_IND;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+  case WDI_RATE_UPDATE_IND:
+    return WLAN_HAL_RATE_UPDATE_IND;
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  case WDI_SET_BATCH_SCAN_REQ:
+       return WLAN_HAL_BATCHSCAN_SET_REQ;
+  case WDI_STOP_BATCH_SCAN_IND:
+       return WLAN_HAL_BATCHSCAN_STOP_IND;
+  case WDI_TRIGGER_BATCH_SCAN_RESULT_IND:
+       return WLAN_HAL_BATCHSCAN_TRIGGER_RESULT_IND;
+#endif
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  case WDI_TX_FAIL_MONITOR_IND:
+    return WLAN_HAL_TX_FAIL_MONITOR_IND;
+#endif
   default:
     return WLAN_HAL_MSG_MAX;
   }
@@ -21942,10 +23074,18 @@
     return WDI_HAL_TX_PER_HIT_IND;
   case WLAN_HAL_SET_MAX_TX_POWER_RSP:
     return WDI_SET_MAX_TX_POWER_RESP;
+  case WLAN_HAL_SET_MAX_TX_POWER_PER_BAND_RSP:
+    return WDI_SET_MAX_TX_POWER_PER_BAND_RSP;
   case WLAN_HAL_SET_TX_POWER_RSP:
     return WDI_SET_TX_POWER_RESP;
   case WLAN_HAL_SET_P2P_GONOA_RSP:
     return WDI_P2P_GO_NOTICE_OF_ABSENCE_RESP;
+#ifdef FEATURE_WLAN_TDLS
+  case WLAN_HAL_TDLS_LINK_ESTABLISHED_RSP:
+    return WDI_TDLS_LINK_ESTABLISH_REQ_RESP;
+  case WLAN_HAL_TDLS_IND:
+    return WDI_HAL_TDLS_IND;
+#endif
   case WLAN_HAL_ENTER_IMPS_RSP:
     return WDI_ENTER_IMPS_RESP;
   case WLAN_HAL_EXIT_IMPS_RSP:
@@ -22013,8 +23153,8 @@
     return WDI_HAL_PREF_NETWORK_FOUND_IND;
 #endif // FEATURE_WLAN_SCAN_PNO
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-  case WLAN_START_ROAM_CANDIDATE_LOOKUP_RSP:
-    return WDI_START_ROAM_CANDIDATE_LOOKUP_RESP;
+  case WLAN_ROAM_SCAN_OFFLOAD_RSP:
+    return WDI_ROAM_SCAN_OFFLOAD_RESP;
 #endif
   case WLAN_HAL_SET_TX_PER_TRACKING_RSP:
     return WDI_SET_TX_PER_TRACKING_RESP;
@@ -22061,6 +23201,43 @@
   case WLAN_HAL_GET_ROAM_RSSI_RSP:
     return WDI_GET_ROAM_RSSI_RESP;
 #endif
+
+#ifdef FEATURE_WLAN_LPHB
+  case WLAN_HAL_LPHB_IND:
+    return WDI_HAL_LPHB_IND;
+  case WLAN_HAL_LPHB_CFG_RSP:
+    return WDI_LPHB_CFG_RESP;
+#endif /* FEATURE_WLAN_LPHB */
+
+  case WLAN_HAL_IBSS_PEER_INACTIVITY_IND:
+    return WDI_HAL_IBSS_PEER_INACTIVITY_IND;
+  case WLAN_HAL_PERIODIC_TX_PTRN_FW_IND:
+    return WDI_HAL_PERIODIC_TX_PTRN_FW_IND;
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+  case WLAN_HAL_LBP_LEADER_RSP:
+    return WDI_LBP_LEADER_RESP;
+  case WLAN_HAL_LBP_UPDATE_IND:
+    return WDI_LBP_UPDATE_IND_TO_HOST;
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  case WLAN_HAL_GET_IBSS_PEER_INFO_RSP:
+    return WDI_HAL_IBSS_PEER_INFO_RSP;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+  case WLAN_HAL_BATCHSCAN_SET_RSP:
+    return WDI_SET_BATCH_SCAN_RESP;
+  case WLAN_HAL_BATCHSCAN_RESULT_IND:
+    return WDI_BATCHSCAN_RESULT_IND;
+#endif // FEATURE_WLAN_BATCH_SCAN
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+  case WLAN_HAL_TX_FAIL_IND:
+    return WDI_HAL_TX_FAIL_IND;
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
   default:
     return eDRIVER_TYPE_MAX;
   }
@@ -22441,6 +23618,9 @@
   case WDI_LINK_LISTEN_STATE:
     return eSIR_LINK_LISTEN_STATE;
 
+  case WDI_LINK_SEND_ACTION_STATE:
+    return eSIR_LINK_SEND_ACTION_STATE;
+
   default:
     return eSIR_LINK_MAX;
   }
@@ -23300,7 +24480,7 @@
        ( usSendSize < (usDataOffset + sizeof(tPrefNetwListParams) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Set PNO req %x ",
+                  "Unable to get send buffer in Set PNO req %p",
                    pwdiPNOScanReqParams);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -23453,7 +24633,7 @@
        ( usSendSize < (usDataOffset + sizeof(tPrefNetwListParamsNew) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Set PNO req %x  ",
+                  "Unable to get send buffer in Set PNO req %p",
                    pwdiPNOScanReqParams);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -23691,7 +24871,7 @@
        ( usSendSize < (usDataOffset + sizeof(ucRssiThreshold) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Set PNO req %x %x %x",
+                  "Unable to get send buffer in Set PNO req %p %p %p",
                   pEventData, pwdiRssiFilterReqParams, wdiRssiFilterCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -23714,9 +24894,9 @@
 }
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 /**
- @brief WDI_StartRoamCandidateLookupReq
+ @brief WDI_RoamScanOffloadReq
 
- @param pwdiRoamCandidateLookupReqParams: the  LookupReq as specified
+ @param pwdiRoamScanOffloadReqParams: the  LookupReq as specified
                       by the Device Interface
 
         wdiRoamOffloadScancb: callback for passing back the response
@@ -23728,9 +24908,9 @@
  @return Result of the function call
 */
 WDI_Status
-WDI_StartRoamCandidateLookupReq
+WDI_RoamScanOffloadReq
 (
-  WDI_RoamCandidateLookupReqParamsType* pwdiRoamCandidateLookupReqParams,
+  WDI_RoamScanOffloadReqParamsType* pwdiRoamScanOffloadReqParams,
   WDI_RoamOffloadScanCb                 wdiRoamOffloadScancb,
   void*                                 pUserData
 )
@@ -23752,9 +24932,9 @@
    /*------------------------------------------------------------------------
      Fill in Event data and post to the Main FSM
    ------------------------------------------------------------------------*/
-   wdiEventData.wdiRequest      = WDI_START_ROAM_CANDIDATE_LOOKUP_REQ;
-   wdiEventData.pEventData      = pwdiRoamCandidateLookupReqParams;
-   wdiEventData.uEventDataSize  = sizeof(*pwdiRoamCandidateLookupReqParams);
+   wdiEventData.wdiRequest      = WDI_ROAM_SCAN_OFFLOAD_REQ;
+   wdiEventData.pEventData      = pwdiRoamScanOffloadReqParams;
+   wdiEventData.uEventDataSize  = sizeof(*pwdiRoamScanOffloadReqParams);
    wdiEventData.pCBfnc          = wdiRoamOffloadScancb;
    wdiEventData.pUserData       = pUserData;
 
@@ -23803,7 +24983,7 @@
         Request parameters
 
  @param  pWDICtx:                               pointer to the WLAN DAL context
-         pwdiRoamCandidateLookupReqParams:      pointer to the info received
+         pwdiRoamScanOffloadReqParams:      pointer to the info received
          from upper layers
          ppSendBuffer, pSize - out pointers of the packed buffer
          and its size
@@ -23812,10 +24992,10 @@
 */
 
 WDI_Status
-WDI_PackStartRoamCandidateLookup
+WDI_PackRoamScanOffloadParams
 (
   WDI_ControlBlockType*                 pWDICtx,
-  WDI_RoamCandidateLookupReqParamsType* pwdiRoamCandidateLookupReqParams,
+  WDI_RoamScanOffloadReqParamsType*     pwdiRoamScanOffloadReqParams,
   wpt_uint8**                           ppSendBuffer,
   wpt_uint16*                           pSize
 )
@@ -23828,87 +25008,104 @@
    /*-----------------------------------------------------------------------
      Get message buffer
    -----------------------------------------------------------------------*/
-   if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx, WDI_START_ROAM_CANDIDATE_LOOKUP_REQ,
+   if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx, WDI_ROAM_SCAN_OFFLOAD_REQ,
                          sizeof(tRoamCandidateListParams),
                          &pSendBuffer, &usDataOffset, &usSendSize))||
-       ( usSendSize < (usDataOffset + sizeof(tpRoamCandidateListParams) )))
+       ( usSendSize < (usDataOffset + sizeof(tRoamCandidateListParams) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Start Roam Candidate Lookup Req %x ",
-                   pwdiRoamCandidateLookupReqParams);
+                  "Unable to get send buffer in Start Roam Candidate Lookup Req %p",
+                   pwdiRoamScanOffloadReqParams);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
    }
    pRoamCandidateListParams = (tpRoamCandidateListParams)(pSendBuffer + usDataOffset);
-   wpalMemoryZero(pRoamCandidateListParams, sizeof(tpRoamCandidateListParams));
-   pRoamCandidateListParams->RoamScanOffloadEnabled = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.RoamScanOffloadEnabled;
+   wpalMemoryZero(pRoamCandidateListParams, sizeof(tRoamCandidateListParams));
+   pRoamCandidateListParams->RoamScanOffloadEnabled = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.RoamScanOffloadEnabled;
    wpalMemoryCopy(pRoamCandidateListParams->ConnectedNetwork.currAPbssid,
-                  pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.currAPbssid,
+                  pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.currAPbssid,
                   HAL_MAC_ADDR_LEN);
-   pRoamCandidateListParams->ConnectedNetwork.authentication = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.authentication;
+   pRoamCandidateListParams->ConnectedNetwork.authentication = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.authentication;
    WDI_wdiEdTypeEncToEdTypeEnc(&pRoamCandidateListParams->ConnectedNetwork.encryption,
-                               pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.encryption);
+                               pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.encryption);
    WDI_wdiEdTypeEncToEdTypeEnc(&pRoamCandidateListParams->ConnectedNetwork.mcencryption,
-                               pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.mcencryption);
+                               pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.mcencryption);
 
    pRoamCandidateListParams->ConnectedNetwork.ssId.length
-                = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ssId.ucLength;
+                = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ssId.ucLength;
    wpalMemoryCopy( pRoamCandidateListParams->ConnectedNetwork.ssId.ssId,
-                   pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ssId.sSSID,
+                   pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ssId.sSSID,
                    pRoamCandidateListParams->ConnectedNetwork.ssId.length);
    wpalMemoryCopy(pRoamCandidateListParams->ConnectedNetwork.ChannelCache,
-                  pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ChannelCache,
-                  pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ChannelCount );
-   pRoamCandidateListParams->ConnectedNetwork.ChannelCount = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ChannelCount;
-   pRoamCandidateListParams->ChannelCacheType = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ChannelCacheType ;
-   pRoamCandidateListParams->LookupThreshold = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.LookupThreshold;
-   pRoamCandidateListParams->RoamRssiDiff = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.RoamRssiDiff ;
-   pRoamCandidateListParams->Command = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.Command ;
-   pRoamCandidateListParams->StartScanReason = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.StartScanReason ;
-   pRoamCandidateListParams->NeighborScanTimerPeriod = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.NeighborScanTimerPeriod ;
-   pRoamCandidateListParams->NeighborRoamScanRefreshPeriod = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.NeighborRoamScanRefreshPeriod ;
-   pRoamCandidateListParams->NeighborScanChannelMinTime = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.NeighborScanChannelMinTime ;
-   pRoamCandidateListParams->NeighborScanChannelMaxTime = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.NeighborScanChannelMaxTime ;
-   pRoamCandidateListParams->EmptyRefreshScanPeriod = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.EmptyRefreshScanPeriod ;
-   pRoamCandidateListParams->IsCCXEnabled = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.IsCCXEnabled ;
+                  pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ChannelCache,
+                  pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ChannelCount );
+   pRoamCandidateListParams->ConnectedNetwork.ChannelCount = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ConnectedNetwork.ChannelCount;
+   pRoamCandidateListParams->ChannelCacheType = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ChannelCacheType ;
+   pRoamCandidateListParams->LookupThreshold = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.LookupThreshold;
+   pRoamCandidateListParams->RoamRssiDiff = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.RoamRssiDiff ;
+   pRoamCandidateListParams->MAWCEnabled = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.MAWCEnabled ;
+   pRoamCandidateListParams->Command = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.Command ;
+   pRoamCandidateListParams->StartScanReason = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.StartScanReason ;
+   pRoamCandidateListParams->NeighborScanTimerPeriod = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.NeighborScanTimerPeriod ;
+   pRoamCandidateListParams->NeighborRoamScanRefreshPeriod = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.NeighborRoamScanRefreshPeriod ;
+   pRoamCandidateListParams->NeighborScanChannelMinTime = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.NeighborScanChannelMinTime ;
+   pRoamCandidateListParams->NeighborScanChannelMaxTime = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.NeighborScanChannelMaxTime ;
+   pRoamCandidateListParams->EmptyRefreshScanPeriod = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.EmptyRefreshScanPeriod ;
+   pRoamCandidateListParams->IsCCXEnabled = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.IsCCXEnabled ;
    wpalMemoryCopy(pRoamCandidateListParams->ValidChannelList,
-                  pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ValidChannelList,
-                  pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ValidChannelCount);
-   pRoamCandidateListParams->ValidChannelCount = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.ValidChannelCount;
+                  pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ValidChannelList,
+                  pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ValidChannelCount);
+   pRoamCandidateListParams->ValidChannelCount = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.ValidChannelCount;
 
-   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
-              "Values are ssid = %s, RoamOffloadScan=%d,Command=%d,StartScanReason=%d, NeighborScanTimerPeriod=%d, NeighborRoamScanRefreshPeriod=%d,NeighborScanChannelMinTime=%d,NeighborScanChannelMaxTime = %d,EmptyRefreshScanPeriod=%d, mdiePresent=%d,MDID=%d, auth=%d, uce=%d, mce=%d\n",
-                   pRoamCandidateListParams->ConnectedNetwork.ssId.ssId, pRoamCandidateListParams->RoamScanOffloadEnabled,
-                   pRoamCandidateListParams->Command,pRoamCandidateListParams->StartScanReason,
-                   pRoamCandidateListParams->NeighborScanTimerPeriod,pRoamCandidateListParams->NeighborRoamScanRefreshPeriod,
-                   pRoamCandidateListParams->NeighborScanChannelMinTime,pRoamCandidateListParams->NeighborScanChannelMaxTime,
-                   pRoamCandidateListParams->EmptyRefreshScanPeriod,pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.MDID.mdiePresent,
-                   pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.MDID.mobilityDomain,
-                   pRoamCandidateListParams->ConnectedNetwork.authentication, pRoamCandidateListParams->ConnectedNetwork.encryption,
-                   pRoamCandidateListParams->ConnectedNetwork.mcencryption);
+   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO_HIGH,
+              "Values are ssid = %s, RoamOffloadScan=%d,Command=%d,"
+              "StartScanReason=%d,NeighborScanTimerPeriod=%d,"
+              "NeighborRoamScanRefreshPeriod=%d,NeighborScanChannelMinTime=%d,"
+              "NeighborScanChannelMaxTime = %d,EmptyRefreshScanPeriod=%d,"
+              "mdiePresent=%d,MDID=%d, auth=%d, uce=%d, mce=%d, nProbes=%d,"
+              "HomeAwayTime=%d",
+              pRoamCandidateListParams->ConnectedNetwork.ssId.ssId,
+              pRoamCandidateListParams->RoamScanOffloadEnabled,
+              pRoamCandidateListParams->Command,
+              pRoamCandidateListParams->StartScanReason,
+              pRoamCandidateListParams->NeighborScanTimerPeriod,
+              pRoamCandidateListParams->NeighborRoamScanRefreshPeriod,
+              pRoamCandidateListParams->NeighborScanChannelMinTime,
+              pRoamCandidateListParams->NeighborScanChannelMaxTime,
+              pRoamCandidateListParams->EmptyRefreshScanPeriod,
+              pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.MDID.mdiePresent,
+                   pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.MDID.mobilityDomain,
+              pRoamCandidateListParams->ConnectedNetwork.authentication,
+              pRoamCandidateListParams->ConnectedNetwork.encryption,
+                   pRoamCandidateListParams->ConnectedNetwork.mcencryption,
+                   pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.nProbes,
+                   pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.HomeAwayTime);
    pRoamCandidateListParams->us24GProbeSize =
-           (pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.us24GProbeSize<
+           (pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.us24GProbeSize<
             WLAN_HAL_ROAM_SCAN_MAX_PROBE_SIZE)?
-           pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.us24GProbeSize:
+            pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.us24GProbeSize:
            WLAN_HAL_ROAM_SCAN_MAX_PROBE_SIZE;
    wpalMemoryCopy(pRoamCandidateListParams->a24GProbeTemplate,
-                  pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.a24GProbeTemplate,
+                  pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.a24GProbeTemplate,
                   pRoamCandidateListParams->us24GProbeSize);
    pRoamCandidateListParams->us5GProbeSize =
-           (pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.us5GProbeSize<
+           (pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.us5GProbeSize<
             WLAN_HAL_ROAM_SCAN_MAX_PROBE_SIZE)?
-           pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.us5GProbeSize:
+           pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.us5GProbeSize:
            WLAN_HAL_ROAM_SCAN_MAX_PROBE_SIZE;
    wpalMemoryCopy(pRoamCandidateListParams->a5GProbeTemplate,
-                  pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.a5GProbeTemplate,
+                  pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.a5GProbeTemplate,
                   pRoamCandidateListParams->us5GProbeSize);
-   pRoamCandidateListParams->MDID.mdiePresent = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.MDID.mdiePresent;
-   pRoamCandidateListParams->MDID.mobilityDomain = pwdiRoamCandidateLookupReqParams->wdiRoamOffloadScanInfo.MDID.mobilityDomain;
-
-   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,"Valid Channel List");
+   pRoamCandidateListParams->MDID.mdiePresent = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.MDID.mdiePresent;
+   pRoamCandidateListParams->MDID.mobilityDomain = pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.MDID.mobilityDomain;
+   pRoamCandidateListParams->nProbes =
+           pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.nProbes;
+   pRoamCandidateListParams->HomeAwayTime =
+           pwdiRoamScanOffloadReqParams->wdiRoamOffloadScanInfo.HomeAwayTime;
+   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO_HIGH,"Valid Channel List");
    for (i=0; i<pRoamCandidateListParams->ValidChannelCount ; i++)
    {
-      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,"%d", pRoamCandidateListParams->ValidChannelList[i]);
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO_HIGH,"%d", pRoamCandidateListParams->ValidChannelList[i]);
    }
 
 
@@ -23916,7 +25113,7 @@
    *ppSendBuffer = pSendBuffer;
    *pSize        = usSendSize;
    return WDI_STATUS_SUCCESS;
-}/*WDI_PackStartRoamCandidateLookup*/
+}/*WDI_PackRoamScanOffloadParams*/
 
 /**
  @brief Process Start Roam Candidate Lookup Request function
@@ -23927,13 +25124,13 @@
  @return Result of the function call
 */
 WDI_Status
-WDI_ProcessStartRoamCandidatelookupReq
+WDI_ProcessRoamScanOffloadReq
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
 )
 {
-   WDI_RoamCandidateLookupReqParamsType* pwdiRoamCandidateLookupReqParams = NULL;
+   WDI_RoamScanOffloadReqParamsType* pwdiRoamScanOffloadReqParams = NULL;
    WDI_RoamOffloadScanCb                 wdiRoamOffloadScancb  = NULL;
    wpt_uint8*                            pSendBuffer           = NULL;
    wpt_uint16                            usSendSize            = 0;
@@ -23942,7 +25139,7 @@
      Sanity check
    -------------------------------------------------------------------------*/
    if (( NULL == pEventData ) ||
-       ( NULL == (pwdiRoamCandidateLookupReqParams = (WDI_RoamCandidateLookupReqParamsType*)pEventData->pEventData)) ||
+       ( NULL == (pwdiRoamScanOffloadReqParams = (WDI_RoamScanOffloadReqParamsType*)pEventData->pEventData)) ||
        ( NULL == (wdiRoamOffloadScancb   = (WDI_RoamOffloadScanCb)pEventData->pCBfnc)))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
@@ -23957,7 +25154,7 @@
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
                   "%s: Packing Roam Candidate Lookup request ", __func__);
 
-     wdiStatus = WDI_PackStartRoamCandidateLookup( pWDICtx, pwdiRoamCandidateLookupReqParams,
+     wdiStatus = WDI_PackRoamScanOffloadParams( pWDICtx, pwdiRoamScanOffloadReqParams,
                                       &pSendBuffer, &usSendSize);
 
    if (( WDI_STATUS_SUCCESS != wdiStatus )||
@@ -23969,14 +25166,14 @@
       return wdiStatus;
    }
 
-   pWDICtx->wdiReqStatusCB     = pwdiRoamCandidateLookupReqParams->wdiReqStatusCB;
-   pWDICtx->pReqStatusUserData = pwdiRoamCandidateLookupReqParams->pUserData;
+   pWDICtx->wdiReqStatusCB     = pwdiRoamScanOffloadReqParams->wdiReqStatusCB;
+   pWDICtx->pReqStatusUserData = pwdiRoamScanOffloadReqParams->pUserData;
 
    /*-------------------------------------------------------------------------
-     Send WDI_START_ROAM_CANDIDATE_LOOKUP_REQ to HAL
+     Send WDI_ROAM_SCAN_OFFLOAD_REQ to HAL
    -------------------------------------------------------------------------*/
    return  WDI_SendMsg( pWDICtx, pSendBuffer, usSendSize,
-               wdiRoamOffloadScancb, pEventData->pUserData, WDI_START_ROAM_CANDIDATE_LOOKUP_RESP);
+               wdiRoamOffloadScancb, pEventData->pUserData, WDI_ROAM_SCAN_OFFLOAD_RESP);
 }
 
 /**
@@ -23990,7 +25187,7 @@
  @return Result of the function call
 */
 WDI_Status
-WDI_ProcessStartRoamCandidatelookupRsp
+WDI_ProcessRoamScanOffloadRsp
 (
   WDI_ControlBlockType*  pWDICtx,
   WDI_EventInfoType*     pEventData
@@ -24026,7 +25223,7 @@
    wdiRoamOffloadScancb(wdiStatus, pWDICtx->pRspCBUserData);
 
    return WDI_STATUS_SUCCESS;
-}/*WDI_ProcessStartRoamCandidatelookupRsp*/
+}/* WDI_ProcessRoamScanOffloadRsp  */
 #endif
 
 /**
@@ -24064,7 +25261,7 @@
        ( usSendSize < (usDataOffset + sizeof(updateScanParams) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Update Scan Params req %x",
+                  "Unable to get send buffer in Update Scan Params req %p",
                    pwdiUpdateScanParams);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -24144,7 +25341,7 @@
        ( usSendSize < (usDataOffset + sizeof(updateScanParams) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Update Scan Params Ex req %x",
+                  "Unable to get send buffer in Update Scan Params Ex req %p",
                   pwdiUpdateScanParams);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -24321,9 +25518,11 @@
 
   // DEBUG
   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
-              "[PNO WDI] PREF_NETWORK_FOUND_IND Type (%x) data (SSID=%s, RSSI=%d)",
+              "[PNO WDI] PREF_NETWORK_FOUND_IND Type (%x) data (SSID=%.*s, LENGTH=%u,  RSSI=%u)",
               wdiInd.wdiIndicationType,
+              wdiInd.wdiIndicationData.wdiPrefNetworkFoundInd.ssId.ucLength,
               wdiInd.wdiIndicationData.wdiPrefNetworkFoundInd.ssId.sSSID,
+              wdiInd.wdiIndicationData.wdiPrefNetworkFoundInd.ssId.ucLength,
               wdiInd.wdiIndicationData.wdiPrefNetworkFoundInd.rssi );
 
   if ( pWDICtx->wdiLowLevelIndCB )
@@ -24468,7 +25667,8 @@
    }
 
    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
-                  "Process UPD scan params ptr : %x", __func__);
+              "%s: Process UPD scan params ptr : %p",
+              __func__, pEventData->pEventData);
 
   wdiUpdateScanParamsCb = (WDI_UpdateScanParamsCb)pWDICtx->pfncRspCB;
 
@@ -24729,7 +25929,7 @@
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
                   "Unable to get send buffer in "
-                  "WDI_Process8023MulticastListReq() %x %x %x",
+                  "WDI_Process8023MulticastListReq() %p %p %p",
                   pEventData, pwdiFltPktSetMcListReqParamsType,
                   wdi8023MulticastListCb);
       wpalMemoryFree(pRcvFltMcAddrListType);
@@ -24835,7 +26035,7 @@
        {
          WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
                  "%s: Failed to allocate memory for "
-                 "tHalRcvPktFilterCfgType: %x %x %x ",
+                 "tHalRcvPktFilterCfgType: %p %p %p ",
                  __func__, pWDICtx, pEventData, pEventData->pEventData);
          WDI_ASSERT(0);
          return WDI_STATUS_E_FAILURE;
@@ -24854,7 +26054,7 @@
         {
            WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
                        "Unable to get send buffer in "
-                       "WDI_ProcessReceiveFilterSetFilterReq() %x %x %x",
+                       "WDI_ProcessReceiveFilterSetFilterReq() %p %p %p",
                        pEventData, pwdiSetRcvPktFilterReqInfo,
                        wdiReceiveFilterSetFilterCb);
            WDI_ASSERT(0);
@@ -24863,7 +26063,7 @@
         }
 
         WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-                   "UsData Off %d UsSend %d cfg %d",usDataOffset,
+                   "UsData Off %d UsSend %d cfg %p",usDataOffset,
                    usSendSize,pSessRcvPktFilterCfg);
        
         pSessRcvPktFilterCfg->filterId = pwdiSetRcvPktFilterReqInfo->wdiPktFilterCfg.filterId;
@@ -24899,17 +26099,17 @@
                          8);
        
            WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-                "Out:Proto %d Comp Flag %d \n",
+                "Out:Proto %d Comp Flag %d",
                 pSessRcvPktFilterCfg->paramsData[i].protocolLayer,
                 pSessRcvPktFilterCfg->paramsData[i].cmpFlag);
 
            WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-                "Data Offset %d Data Len %d\n",
+                "Data Offset %d Data Len %d",
                 pSessRcvPktFilterCfg->paramsData[i].dataOffset,
                 pSessRcvPktFilterCfg->paramsData[i].dataLength);
        
            WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-                "CData: %d:%d:%d:%d:%d:%d\n",
+                "CData: %d:%d:%d:%d:%d:%d",
                 pSessRcvPktFilterCfg->paramsData[i].compareData[0],
                 pSessRcvPktFilterCfg->paramsData[i].compareData[1],
                 pSessRcvPktFilterCfg->paramsData[i].compareData[2],
@@ -24918,7 +26118,7 @@
                 pSessRcvPktFilterCfg->paramsData[i].compareData[5]);
        
            WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-                "MData: %d:%d:%d:%d:%d:%d\n",
+                "MData: %d:%d:%d:%d:%d:%d",
                 pSessRcvPktFilterCfg->paramsData[i].dataMask[0],
                 pSessRcvPktFilterCfg->paramsData[i].dataMask[1],
                 pSessRcvPktFilterCfg->paramsData[i].dataMask[2],
@@ -24952,7 +26152,7 @@
       {
             WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
                 "%s: Failed to allocate memory for "
-                "tHalRcvPktFilterCfgType: %x %x %x ",
+                "tHalRcvPktFilterCfgType: %p %p %p ",
                 __func__, pWDICtx, pEventData, pEventData->pEventData);
             WDI_ASSERT(0);
             return WDI_STATUS_E_FAILURE;
@@ -24970,7 +26170,7 @@
         {
               WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
                   "Unable to get send buffer in "
-                  "WDI_ProcessReceiveFilterSetFilterReq() %x %x %x",
+                  "WDI_ProcessReceiveFilterSetFilterReq() %p %p %p",
                   pEventData, pwdiSetRcvPktFilterReqInfo,
                   wdiReceiveFilterSetFilterCb);
               WDI_ASSERT(0);
@@ -25013,17 +26213,17 @@
                     8);
 
           WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
-           "Out:Proto %d Comp Flag %d \n",
+           "Out:Proto %d Comp Flag %d",
            pRcvPktFilterCfg->paramsData[i].protocolLayer,
            pRcvPktFilterCfg->paramsData[i].cmpFlag);
 
           WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
-               "Data Offset %d Data Len %d\n",
+               "Data Offset %d Data Len %d",
                pRcvPktFilterCfg->paramsData[i].dataOffset,
                pRcvPktFilterCfg->paramsData[i].dataLength);
 
           WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
-               "CData: %d:%d:%d:%d:%d:%d\n",
+               "CData: %d:%d:%d:%d:%d:%d",
                pRcvPktFilterCfg->paramsData[i].compareData[0],
                pRcvPktFilterCfg->paramsData[i].compareData[1],
                pRcvPktFilterCfg->paramsData[i].compareData[2],
@@ -25032,7 +26232,7 @@
                pRcvPktFilterCfg->paramsData[i].compareData[5]);
 
           WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-               "MData: %d:%d:%d:%d:%d:%d\n",
+               "MData: %d:%d:%d:%d:%d:%d",
                pRcvPktFilterCfg->paramsData[i].dataMask[0],
                pRcvPktFilterCfg->paramsData[i].dataMask[1],
                pRcvPktFilterCfg->paramsData[i].dataMask[2],
@@ -25127,7 +26327,7 @@
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
                   "Unable to get send buffer in "
-                  "WDI_ProcessFilterMatchCountReq() %x %x %x",
+                  "WDI_ProcessFilterMatchCountReq() %p %p %p",
                   pEventData, pwdiRcvFltPktMatchCntReqParamsType,
                   wdiFilterMatchCountCb);
       WDI_ASSERT(0);
@@ -25219,7 +26419,7 @@
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
                   "Unable to get send buffer in "
-                  "WDI_ProcessReceiveFilterClearFilterReq() %x %x %x",
+                  "WDI_ProcessReceiveFilterClearFilterReq() %p %p %p",
                   pEventData, pwdiRcvFltPktClearReqParamsType,
                   wdiRcvFltPktClearFilterCb);
       WDI_ASSERT(0);
@@ -25627,7 +26827,7 @@
        ( usSendSize < (usDataOffset + sizeof(powerParams) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Set PNO req %x %x %x",
+                  "Unable to get send buffer in Set PNO req %p %p %p",
                   pEventData, pwdiPowerParamsReqParams, wdiPowerParamsCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE;
@@ -25723,6 +26923,337 @@
    return WDI_STATUS_SUCCESS;
 }/*WDI_ProcessSetPowerParamsRsp*/
 
+/**
+ @brief WDI_dhcpStartInd
+        Host will send an event to the FW when DHCP is initiated
+
+ @param
+        WDI_DHCPInd: DHCP Indication
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_dhcpStartInd
+(
+  WDI_DHCPInd *wdiDHCPInd
+)
+{
+   WDI_EventInfoType   wdiEventData;
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+      return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   wdiEventData.wdiRequest      = WDI_DHCP_START_IND;
+   wdiEventData.pEventData      = wdiDHCPInd;
+   wdiEventData.uEventDataSize  = sizeof(wdiDHCPInd);
+   wdiEventData.pCBfnc          = NULL;
+   wdiEventData.pUserData       = NULL;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+
+/**
+ @brief WDI_dhcpStopInd
+        Host will send an event to the FW when DHCP is completed
+
+ @param
+        WDI_DHCPInd: DHCP Indication
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_dhcpStopInd
+(
+  WDI_DHCPInd *wdiDHCPInd
+)
+{
+   WDI_EventInfoType   wdiEventData;
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+      return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   wdiEventData.wdiRequest      = WDI_DHCP_STOP_IND;
+   wdiEventData.pEventData      = wdiDHCPInd;
+   wdiEventData.uEventDataSize  = sizeof(wdiDHCPInd);
+   wdiEventData.pCBfnc          = NULL;
+   wdiEventData.pUserData       = NULL;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/**
+ @brief WDI_TXFailMonitorInd
+        Host will send an event to the FW to start TX Fail Monitor
+
+ @param
+        WDI_TXFailMonitorInd
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_TXFailMonitorStartStopInd
+(
+  WDI_TXFailMonitorInd *wdiTXFailMonitorInd
+)
+{
+   WDI_EventInfoType   wdiEventData;
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+      return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   wdiEventData.wdiRequest      = WDI_TX_FAIL_MONITOR_IND;
+   wdiEventData.pEventData      = wdiTXFailMonitorInd;
+   wdiEventData.uEventDataSize  = sizeof(wdiTXFailMonitorInd);
+   wdiEventData.pCBfnc          = NULL;
+   wdiEventData.pUserData       = NULL;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+/**
+ @brief Process DHCP Start Indication message and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessDHCPStartInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  wpt_uint8*              pSendBuffer        = NULL;
+  wpt_uint16              usDataOffset       = 0;
+  wpt_uint16              usSendSize         = 0;
+  wpt_uint16              usLen              = 0;
+  WDI_DHCPInd*            pwdiDHCPInd        = NULL;
+  tDHCPInfo*              pDHCPInfo;
+
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+         "%s", __func__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pwdiDHCPInd = (WDI_DHCPInd*)pEventData->pEventData;
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                        WDI_DHCP_START_IND,
+                        sizeof(tDHCPInfo),
+                        &pSendBuffer, &usDataOffset, &usSendSize))||
+      ( usSendSize < (usDataOffset + usLen )))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+              "Unable to get send buffer in DHCP Start req %p ",
+                pEventData);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pDHCPInfo = (tDHCPInfo*)pSendBuffer+usDataOffset;
+  pDHCPInfo->device_mode = pwdiDHCPInd->device_mode;
+  wpalMemoryCopy(pDHCPInfo->macAddr, pwdiDHCPInd->macAddr,
+                                        WDI_MAC_ADDR_LEN);
+
+  pWDICtx->pReqStatusUserData = NULL;
+  pWDICtx->pfncRspCB = NULL;
+
+ /*-------------------------------------------------------------------------
+    Send DHCP Start Indication to HAL
+  -------------------------------------------------------------------------*/
+  return  WDI_SendIndication( pWDICtx, pSendBuffer, usSendSize);
+
+}/*WDI_ProcessDHCPStartInd*/
+
+/**
+ @brief Process DHCP Stop indication message and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessDHCPStopInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  wpt_uint8*              pSendBuffer        = NULL;
+  wpt_uint16              usDataOffset       = 0;
+  wpt_uint16              usSendSize         = 0;
+  wpt_uint16              usLen              = 0;
+  WDI_DHCPInd*            pwdiDHCPInd        = NULL;
+  tDHCPInfo*              pDHCPInfo;
+
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+         "%s", __func__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+
+  if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pwdiDHCPInd = (WDI_DHCPInd*)pEventData->pEventData;
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                        WDI_DHCP_STOP_IND,
+                        sizeof(tDHCPInfo),
+                        &pSendBuffer, &usDataOffset, &usSendSize))||
+      ( usSendSize < (usDataOffset + usLen )))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+              "Unable to get send buffer in DHCP Start req %p ",
+                pEventData);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pDHCPInfo = (tDHCPInfo*)pSendBuffer+usDataOffset;
+  pDHCPInfo->device_mode = pwdiDHCPInd->device_mode;
+  wpalMemoryCopy(pDHCPInfo->macAddr, pwdiDHCPInd->macAddr,
+                                        WDI_MAC_ADDR_LEN);
+
+  pWDICtx->pReqStatusUserData = NULL;
+  pWDICtx->pfncRspCB = NULL;
+ /*-------------------------------------------------------------------------
+    Send DHCP Stop indication to HAL
+  -------------------------------------------------------------------------*/
+  return  WDI_SendIndication( pWDICtx, pSendBuffer, usSendSize);
+
+}/*WDI_ProcessDHCPStopInd*/
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/**
+ @brief Process TX Fail monitor indication
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTXFailMonitor
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  wpt_uint8*              pSendBuffer           = NULL;
+  wpt_uint16              usDataOffset          = 0;
+  wpt_uint16              usSendSize            = 0;
+  wpt_uint16              usLen                 = 0;
+  WDI_TXFailMonitorInd*   pwdiTxFailMonitorInd  = NULL;
+  tTXFailMonitorInfo*     pTXFailMonitorInfo;
+  WDI_Status           wdiStatus;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+         "%s", __func__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+
+  if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pwdiTxFailMonitorInd = (WDI_TXFailMonitorInd*)pEventData->pEventData;
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                        WDI_TX_FAIL_MONITOR_IND,
+                        sizeof(tDHCPInfo),
+                        &pSendBuffer, &usDataOffset, &usSendSize))||
+      ( usSendSize < (usDataOffset + usLen )))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+              "Unable to get send buffer in DHCP Start req %p ",
+                pEventData);
+     wpalMemoryFree(pwdiTxFailMonitorInd);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pTXFailMonitorInfo = (tTXFailMonitorInfo*)pSendBuffer+usDataOffset;
+  pTXFailMonitorInfo->tx_fail_count = pwdiTxFailMonitorInd->tx_fail_count;
+
+  pWDICtx->pReqStatusUserData = pwdiTxFailMonitorInd->pUserData;
+  pWDICtx->wdiReqStatusCB = pwdiTxFailMonitorInd->wdiReqStatusCB;
+ /*-------------------------------------------------------------------------
+    Send TX Fail Monitor start/stop indication to HAL
+  -------------------------------------------------------------------------*/
+  wdiStatus = WDI_SendIndication( pWDICtx, pSendBuffer, usSendSize);
+
+  wpalMemoryFree(pwdiTxFailMonitorInd);
+
+  return  (wdiStatus != WDI_STATUS_SUCCESS)?wdiStatus:WDI_STATUS_SUCCESS_SYNC;
+}/*WDI_ProcessTXFailMonitor*/
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 /**
  @brief WDI_GTKOffloadReq will be called when the upper MAC 
@@ -25893,7 +27424,7 @@
        ( usSendSize < (usDataOffset + sizeof(gtkOffloadReqParams) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in GTK offload req %x %x %x",
+                  "Unable to get send buffer in GTK offload req %p %p %p",
                   pEventData, pwdiGtkOffloadReqMsg, wdiGtkOffloadCb);
       WDI_ASSERT(0);
       goto failRequest;
@@ -25992,7 +27523,7 @@
        ( usSendSize < ( usDataOffset + sizeof(halGtkOffloadGetInfoReqParams))))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in WDI_ProcessGTKOffloadGetInfoReq() %x %x %x",
+                  "Unable to get send buffer in WDI_ProcessGTKOffloadGetInfoReq() %p %p %p",
                   pEventData, pwdiGtkOffloadGetInfoReqMsg, wdiGtkOffloadGetInfoCb);
       WDI_ASSERT(0);
       goto failRequest;
@@ -26053,9 +27584,6 @@
    WDI_GtkOffloadCb    wdiGtkOffloadCb   = NULL;
    tHalGtkOffloadRspParams halGtkOffloadRspParams;
    WDI_GtkOffloadRspParams  wdiGtkOffloadRsparams;
-   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
-
-   wdiGtkOffloadCb = (WDI_GtkOffloadCb)pWDICtx->pfncRspCB; 
 
    /*-------------------------------------------------------------------------
      Sanity check 
@@ -26069,6 +27597,8 @@
       return WDI_STATUS_E_FAILURE; 
    }
 
+   wdiGtkOffloadCb = (WDI_GtkOffloadCb)pWDICtx->pfncRspCB;
+
    /*-------------------------------------------------------------------------
      Extract response and send it to UMAC
    -------------------------------------------------------------------------*/
@@ -26117,9 +27647,6 @@
    WDI_GtkOffloadGetInfoRspParams wdiGtkOffloadGetInfoRsparams;
    WDI_BSSSessionType*              pBSSSes = NULL;
 
-   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
-
-   wdiGtkOffloadGetInfoCb = (WDI_GtkOffloadGetInfoCb)pWDICtx->pfncRspCB; 
 
    /*-------------------------------------------------------------------------
      Sanity check 
@@ -26133,6 +27660,8 @@
       return WDI_STATUS_E_FAILURE; 
    }
 
+   wdiGtkOffloadGetInfoCb = (WDI_GtkOffloadGetInfoCb)pWDICtx->pfncRspCB;
+
    /*-------------------------------------------------------------------------
      Extract response and send it to UMAC
    -------------------------------------------------------------------------*/
@@ -26224,7 +27753,7 @@
   if(NULL == pWdiInd)
   {
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-            "%s: Failed to allocate memory for WDI_WakeReasonIndType: %x %x %x ",
+            "%s: Failed to allocate memory for WDI_WakeReasonIndType: %p %p %p ",
                 __func__, pWDICtx, pEventData, pEventData->pEventData);
     WDI_ASSERT(0);
     return WDI_STATUS_E_FAILURE; 
@@ -26364,7 +27893,7 @@
        ( usSendSize < (usDataOffset + sizeof(halTmMsg) )))
    {
       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-                  "Unable to get send buffer in Set PNO req %x %x %x",
+                  "Unable to get send buffer in Set PNO req %p %p %p",
                   pEventData, pwdiSetTmLevelReq, wdiSetTmLevelCb);
       WDI_ASSERT(0);
       return WDI_STATUS_E_FAILURE; 
@@ -26444,7 +27973,7 @@
    if ( NULL ==  gpHostWlanFeatCaps )
    {
       WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-               "Cannot allocate memory for host capability info\n"); 
+               "Cannot allocate memory for host capability info");
       WDI_ASSERT(0);
       return WDI_STATUS_MEM_FAILURE;
    }
@@ -26456,14 +27985,15 @@
    ------------------------------------------------------------------------*/
    FillAllFeatureCaps(gpHostWlanFeatCaps, supportEnabledFeatures,
       (sizeof(supportEnabledFeatures)/sizeof(supportEnabledFeatures[0])));
-   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_INFO,
-      "Host caps %x %x %x %x\n",
+   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
+      "Host caps %x %x %x %x",
       gpHostWlanFeatCaps->featCaps[0],
       gpHostWlanFeatCaps->featCaps[1],
       gpHostWlanFeatCaps->featCaps[2],
       gpHostWlanFeatCaps->featCaps[3]
    );
-   
+   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR, "Host Capability");
+   WDI_TraceHostFWCapabilities(gpHostWlanFeatCaps->featCaps);
    wdiEventData.wdiRequest      = WDI_FEATURE_CAPS_EXCHANGE_REQ;
    wdiEventData.pEventData      = gpHostWlanFeatCaps; 
    wdiEventData.uEventDataSize  = fCapsStructSize; 
@@ -26538,14 +28068,14 @@
       ( usSendSize < (usDataOffset + usLen )))
   {
      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
-              "Unable to get send buffer in feat caps exchange req %x %x",
+              "Unable to get send buffer in feat caps exchange req %p %p",
                 pEventData, (tWlanFeatCaps *)pEventData->pEventData);
      WDI_ASSERT(0);
      return WDI_STATUS_E_FAILURE; 
   }
 
   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_INFO,
-       "Host Caps - %x %x %x %x\n",
+       "Host Caps - %x %x %x %x",
       ((tWlanFeatCaps *)pEventData->pEventData)->featCaps[0],
       ((tWlanFeatCaps *)pEventData->pEventData)->featCaps[1],
       ((tWlanFeatCaps *)pEventData->pEventData)->featCaps[2],
@@ -26608,7 +28138,7 @@
    if ( NULL ==  gpFwWlanFeatCaps )
    {
       WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-               "Cannot allocate memory for host capability info\n"); 
+               "Cannot allocate memory for host capability info");
       WDI_ASSERT(0);
       return WDI_STATUS_MEM_FAILURE;
    }
@@ -26623,13 +28153,15 @@
 
    wpalMemoryCopy(gpFwWlanFeatCaps,(tWlanFeatCaps *) pEventData -> pEventData,
                     fCapsStructSize);
-   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_INFO,
-      "FW caps %x %x %x %x\n",
+   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
+      "FW caps %x %x %x %x",
       gpFwWlanFeatCaps->featCaps[0],
       gpFwWlanFeatCaps->featCaps[1],
       gpFwWlanFeatCaps->featCaps[2],
       gpFwWlanFeatCaps->featCaps[3]
-     );
+   );
+   WPAL_TRACE(  eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR, "Firmware Capability");
+   WDI_TraceHostFWCapabilities(gpFwWlanFeatCaps->featCaps);
    wdiFeatureCapsExchangeCb = (WDI_featureCapsExchangeCb) pWDICtx -> pfncRspCB; 
 
    /*Notify UMAC - there is no callback right now but can be used in future if reqd */
@@ -26790,7 +28322,7 @@
   }
 
   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-            "pwdiVHTOpModeParams->opMode=%d, pwdiVHTOpModeParams->staId=%d\n", pwdiVHTOpModeParams->opMode, pwdiVHTOpModeParams->staId);
+            "pwdiVHTOpModeParams->opMode=%d, pwdiVHTOpModeParams->staId=%d", pwdiVHTOpModeParams->opMode, pwdiVHTOpModeParams->staId);
 
   wpalMemoryCopy( pSendBuffer+usDataOffset, pwdiVHTOpModeParams,
                   sizeof(WDI_UpdateVHTOpMode));
@@ -26835,7 +28367,7 @@
   wdiEventData.pUserData       = pUserData;
   
   WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
-            "pData->opMode=%d, pData->staId=%d\n", pData->opMode, pData->staId);
+            "pData->opMode=%d, pData->staId=%d", pData->opMode, pData->staId);
 
   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
 
@@ -26909,3 +28441,1769 @@
 {
    gWDICb.bEnableSSR = enableSSR;
 }
+
+
+#ifdef FEATURE_WLAN_LPHB
+/**
+ @brief WDI_ProcessLphbInd -
+    This function will be invoked when FW detects low power
+    heart beat failure
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLphbInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_LowLevelIndType  wdiInd;
+  tHalLowPowerHeartBeatIndParam lphbIndicationParam;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*-------------------------------------------------------------------------
+  Sanity check
+ -------------------------------------------------------------------------*/
+  if ((NULL == pWDICtx) || (NULL == pEventData) ||
+      (NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  /*-------------------------------------------------------------------------
+  Extract indication and send it to UMAC
+ -------------------------------------------------------------------------*/
+   wpalMemoryCopy(&lphbIndicationParam,
+                  pEventData->pEventData,
+                  sizeof(tHalLowPowerHeartBeatIndParam));
+
+  wdiInd.wdiIndicationType = WDI_LPHB_IND;
+  wdiInd.wdiIndicationData.wdiLPHBTimeoutInd.bssIdx =
+               lphbIndicationParam.bssIdx;
+  wdiInd.wdiIndicationData.wdiLPHBTimeoutInd.sessionIdx =
+               lphbIndicationParam.sessionIdx;
+  wdiInd.wdiIndicationData.wdiLPHBTimeoutInd.protocolType =
+               lphbIndicationParam.protocolType;
+  wdiInd.wdiIndicationData.wdiLPHBTimeoutInd.eventReason =
+               lphbIndicationParam.eventReason;
+  /*Notify UMAC*/
+  if (pWDICtx->wdiLowLevelIndCB)
+  {
+    pWDICtx->wdiLowLevelIndCB(&wdiInd, pWDICtx->pIndUserData);
+  }
+
+  return WDI_STATUS_SUCCESS;
+}
+
+/**
+ @brief WDI_ProcessLphbCfgRsp -
+    LPHB configuration response from FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status WDI_ProcessLphbCfgRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+   WDI_Status           wdiStatus;
+   eHalStatus           halStatus;
+   WDI_LphbCfgCb        wdiLphbCfgCb;
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+   /*-------------------------------------------------------------------------
+     Sanity check
+   -------------------------------------------------------------------------*/
+   if ((NULL == pWDICtx) || (NULL == pEventData) ||
+       (NULL == pEventData->pEventData))
+   {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                  "%s: Invalid parameters", __func__);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+   }
+
+   wdiLphbCfgCb = (WDI_LphbCfgCb)pWDICtx->pfncRspCB;
+
+   /*-------------------------------------------------------------------------
+     Extract response and send it to UMAC
+   -------------------------------------------------------------------------*/
+   halStatus = *((eHalStatus*)pEventData->pEventData);
+   wdiStatus = WDI_HAL_2_WDI_STATUS(halStatus);
+
+   WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+              "LPHB Cfg Rsp Return status %d", wdiStatus);
+   /*Notify UMAC*/
+   if (NULL != wdiLphbCfgCb)
+   {
+      wdiLphbCfgCb(wdiStatus, pWDICtx->pRspCBUserData);
+   }
+
+   return WDI_STATUS_SUCCESS;
+}
+
+/**
+ @brief WDI_ProcessLPHBConfReq -
+    LPHB configuration request to FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return none
+*/
+WDI_Status WDI_ProcessLPHBConfReq
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_LPHBReq                   *pLphbReqParams;
+  WDI_Status                     wdiStatus;
+  wpt_uint8*                     pSendBuffer        = NULL;
+  wpt_uint16                     usDataOffset       = 0;
+  wpt_uint16                     usSendSize         = 0;
+  tHalLowPowerHeartBeatReq      *halLphbReqRarams;
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  /*-------------------------------------------------------------------------
+     Sanity check
+  -------------------------------------------------------------------------*/
+  if ((NULL == pEventData) || (NULL == pEventData->pEventData))
+  {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+               "%s: Invalid parameters in Suspend ind",__func__);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+  }
+
+  pLphbReqParams = (WDI_LPHBReq *)pEventData->pEventData;
+
+   /*-----------------------------------------------------------------------
+     Get message buffer
+   -----------------------------------------------------------------------*/
+  if ((WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(pWDICtx,
+                              WDI_LPHB_CFG_REQ,
+                              sizeof(tHalLowPowerHeartBeatReqMsg),
+                              &pSendBuffer, &usDataOffset, &usSendSize))||
+      (usSendSize < (usDataOffset + sizeof(tHalLowPowerHeartBeatReqMsg))))
+  {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+                  "Unable to get send buffer in LPHB Ind ");
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+  }
+
+  halLphbReqRarams = (tHalLowPowerHeartBeatReq *)(pSendBuffer + usDataOffset);
+  wpalMemoryZero(halLphbReqRarams, sizeof(tHalLowPowerHeartBeatReq));
+
+  halLphbReqRarams->lowPowerHeartBeatCmdType =
+                     (tANI_U16)(++pLphbReqParams->cmd);
+  switch ((tANI_U16)pLphbReqParams->cmd)
+  {
+    case WDI_LPHB_SET_EN_PARAMS_INDID:
+      halLphbReqRarams->sessionIdx =
+                                pLphbReqParams->params.lphbEnableReq.session;
+      halLphbReqRarams->options.control.heartBeatEnable =
+                                pLphbReqParams->params.lphbEnableReq.enable;
+      halLphbReqRarams->options.control.heartBeatType =
+                                pLphbReqParams->params.lphbEnableReq.item;
+      break;
+
+    case WDI_LPHB_SET_TCP_PARAMS_INDID:
+      halLphbReqRarams->sessionIdx =
+                                pLphbReqParams->params.lphbTcpParamReq.session;
+      halLphbReqRarams->options.tcpParams.timeOutSec =
+                                pLphbReqParams->params.lphbTcpParamReq.timeout;
+      wpalMemoryCopy(&halLphbReqRarams->options.tcpParams.hostIpv4Addr,
+                     &pLphbReqParams->params.lphbTcpParamReq.dev_ip,
+                     sizeof(v_U32_t));
+      wpalMemoryCopy(&halLphbReqRarams->options.tcpParams.destIpv4Addr,
+                     &pLphbReqParams->params.lphbTcpParamReq.srv_ip,
+                     sizeof(v_U32_t));
+
+      wpalMemoryCopy(halLphbReqRarams->options.tcpParams.gatewayMacAddr,
+                     pLphbReqParams->params.lphbTcpParamReq.gateway_mac,
+                     WDI_MAC_ADDR_LEN);
+
+      halLphbReqRarams->options.tcpParams.hostPort =
+                                pLphbReqParams->params.lphbTcpParamReq.src_port;
+      halLphbReqRarams->options.tcpParams.destPort =
+                                pLphbReqParams->params.lphbTcpParamReq.dst_port;
+      halLphbReqRarams->options.tcpParams.timePeriodSec =
+                                pLphbReqParams->params.lphbTcpParamReq.timePeriodSec;
+      halLphbReqRarams->options.tcpParams.tcpSn =
+                                pLphbReqParams->params.lphbTcpParamReq.tcpSn;
+      break;
+
+    case WDI_LPHB_SET_TCP_PKT_FILTER_INDID:
+      halLphbReqRarams->sessionIdx =
+                               pLphbReqParams->params.lphbTcpFilterReq.session;
+      halLphbReqRarams->options.tcpUdpFilter.offset =
+                               pLphbReqParams->params.lphbTcpFilterReq.offset;
+      halLphbReqRarams->options.tcpUdpFilter.filterLength =
+                               pLphbReqParams->params.lphbTcpFilterReq.length;
+      wpalMemoryCopy(halLphbReqRarams->options.tcpUdpFilter.filter,
+                     pLphbReqParams->params.lphbTcpFilterReq.filter,
+                     WDI_LPHB_FILTER_LEN);
+      break;
+
+    case WDI_LPHB_SET_UDP_PARAMS_INDID:
+      halLphbReqRarams->sessionIdx =
+                                pLphbReqParams->params.lphbUdpParamReq.session;
+      halLphbReqRarams->options.udpParams.timeOutSec =
+                                pLphbReqParams->params.lphbUdpParamReq.timeout;
+      halLphbReqRarams->options.udpParams.timePeriodSec =
+                                pLphbReqParams->params.lphbUdpParamReq.interval;
+      wpalMemoryCopy(&halLphbReqRarams->options.udpParams.hostIpv4Addr,
+                     &pLphbReqParams->params.lphbUdpParamReq.dev_ip,
+                     sizeof(v_U32_t));
+      wpalMemoryCopy(&halLphbReqRarams->options.udpParams.destIpv4Addr,
+                     &pLphbReqParams->params.lphbUdpParamReq.srv_ip,
+                     sizeof(v_U32_t));
+
+      wpalMemoryCopy(halLphbReqRarams->options.udpParams.gatewayMacAddr,
+                     pLphbReqParams->params.lphbUdpParamReq.gateway_mac,
+                     WDI_MAC_ADDR_LEN);
+
+      halLphbReqRarams->options.udpParams.hostPort =
+                                pLphbReqParams->params.lphbUdpParamReq.src_port;
+      halLphbReqRarams->options.udpParams.destPort =
+                                pLphbReqParams->params.lphbUdpParamReq.dst_port;
+      break;
+
+    case WDI_LPHB_SET_UDP_PKT_FILTER_INDID:
+      halLphbReqRarams->sessionIdx =
+                                pLphbReqParams->params.lphbUdpFilterReq.session;
+      halLphbReqRarams->options.tcpUdpFilter.offset =
+                                pLphbReqParams->params.lphbUdpFilterReq.offset;
+      halLphbReqRarams->options.tcpUdpFilter.filterLength =
+                                pLphbReqParams->params.lphbUdpFilterReq.length;
+      wpalMemoryCopy(halLphbReqRarams->options.tcpUdpFilter.filter,
+                     pLphbReqParams->params.lphbUdpFilterReq.filter,
+                     WDI_LPHB_FILTER_LEN);
+      break;
+
+    case WDI_LPHB_SET_NETWORK_INFO_INDID:
+      /* NA */
+      break;
+
+    default:
+      break;
+  }
+
+  /*-------------------------------------------------------------------------
+    Send Suspend Request to HAL
+  -------------------------------------------------------------------------*/
+  pWDICtx->pfncRspCB          = pEventData->pCBfnc;
+  pWDICtx->pReqStatusUserData = pEventData->pUserData;
+
+  wdiStatus = WDI_SendMsg(pWDICtx, pSendBuffer,
+                          usSendSize, pWDICtx->pfncRspCB,
+                          pWDICtx->pReqStatusUserData,
+                          WDI_LPHB_CFG_RESP);
+
+  return wdiStatus;
+}
+
+/**
+ @brief WDI_LPHBConfReq -
+    LPHB configuration request API
+
+ @param  lphbconfParam : configuration parameter
+         usrData : client context
+         lphbCfgCb : callback function pointer
+
+ @see
+ @return Success or fail status code
+*/
+WDI_Status WDI_LPHBConfReq(void *lphbconfParam,
+                           void *usrData, WDI_LphbCfgCb lphbCfgCb)
+{
+  WDI_EventInfoType      wdiEventData;
+
+  /*------------------------------------------------------------------------
+    Sanity Check
+  ------------------------------------------------------------------------*/
+  if (eWLAN_PAL_FALSE == gWDIInitialized)
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+              "WDI API call before module is initialized - Fail request");
+
+    return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  /*------------------------------------------------------------------------
+    Fill in Event data and post to the Main FSM
+  ------------------------------------------------------------------------*/
+  wdiEventData.wdiRequest      = WDI_LPHB_CFG_REQ;
+  wdiEventData.pEventData      = lphbconfParam;
+  wdiEventData.uEventDataSize  = sizeof(WDI_LPHBReq);
+  wdiEventData.pCBfnc          = lphbCfgCb;
+  wdiEventData.pUserData       = usrData;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+#endif /* FEATURE_WLAN_LPHB */
+
+/**
+  @brief WDI_ProcessIbssPeerInactivityInd
+  Process peer inactivity indication coming from HAL
+
+  @param pWDICtx: pointer to the WLAN DAL context
+         pEventData: pointer to the event information structure
+  @see
+  @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInactivityInd
+(
+   WDI_ControlBlockType* pWDICtx,
+   WDI_EventInfoType* pEventData
+)
+{
+   WDI_LowLevelIndType  wdiInd;
+   tIbssPeerInactivityIndMsg halIbssIndMsg;
+
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+   /*-------------------------------------------------------------------------
+   Sanity check
+   -------------------------------------------------------------------------*/
+   if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData ))
+   {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT( 0 );
+     return WDI_STATUS_E_FAILURE;
+   }
+
+   /*-------------------------------------------------------------------------
+   Extract indication and send it to UMAC
+   -------------------------------------------------------------------------*/
+   wpalMemoryCopy( &halIbssIndMsg.ibssPeerInactivityIndParams,
+                  pEventData->pEventData,
+                  sizeof(halIbssIndMsg.ibssPeerInactivityIndParams) );
+
+   /*Fill in the indication parameters*/
+   wdiInd.wdiIndicationType = WDI_IBSS_PEER_INACTIVITY_IND;
+
+   wdiInd.wdiIndicationData.wdiIbssPeerInactivityInd.bssIdx
+                          = halIbssIndMsg.ibssPeerInactivityIndParams.bssIdx;
+
+   wdiInd.wdiIndicationData.wdiIbssPeerInactivityInd.staIdx
+                          = halIbssIndMsg.ibssPeerInactivityIndParams.staIdx;
+
+   wpalMemoryCopy(wdiInd.wdiIndicationData.wdiIbssPeerInactivityInd.staMacAddr,
+                 halIbssIndMsg.ibssPeerInactivityIndParams.staAddr,
+                 sizeof(tSirMacAddr));
+
+   /*Notify UMAC*/
+   pWDICtx->wdiLowLevelIndCB( &wdiInd, pWDICtx->pIndUserData );
+
+   return WDI_STATUS_SUCCESS;
+
+} /*WDI_ProcessIbssPeerInactivityInd*/
+
+
+/**
+*@brief WDI_RateUpdateInd will be called when the upper MAC
+        requests the device to set rates.
+
+
+ @param wdiRateUpdateIndParams:
+
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_RateUpdateInd
+(
+    WDI_RateUpdateIndParams  *wdiRateUpdateIndParams
+)
+{
+   WDI_EventInfoType      wdiEventData;
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+   /*------------------------------------------------------------------------
+    Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+       WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                  "WDI API call before module is initialized - Fail request");
+
+       return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   /*------------------------------------------------------------------------
+     Fill in Event data and post to the Main FSM
+   ------------------------------------------------------------------------*/
+    wdiEventData.wdiRequest      = WDI_RATE_UPDATE_IND;
+    wdiEventData.pEventData      = wdiRateUpdateIndParams;
+    wdiEventData.uEventDataSize  = sizeof(WDI_RateUpdateIndParams);
+    wdiEventData.pCBfnc          = NULL;
+    wdiEventData.pUserData       = NULL;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+
+}/* WDI_RateUpdateInd */
+
+/**
+ @brief Process Rate Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData: pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessRateUpdateInd
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+    wpt_uint8*              pSendBuffer        = NULL;
+    wpt_uint16              usDataOffset       = 0;
+    wpt_uint16              usSendSize         = 0;
+    WDI_RateUpdateIndParams *pwdiRateUpdateInd = NULL;
+    tHalRateUpdateInd       *pRateUpdateInd;
+    WDI_Status              wdiStatus;
+
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+           "%s", __func__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+    -------------------------------------------------------------------------*/
+    if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "%s: Invalid parameters", __func__);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+    pwdiRateUpdateInd = (WDI_RateUpdateIndParams *)pEventData->pEventData;
+    /*-----------------------------------------------------------------------
+      Get message buffer
+    -----------------------------------------------------------------------*/
+
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                          WDI_RATE_UPDATE_IND,
+                          sizeof(tHalRateUpdateParams),
+                          &pSendBuffer, &usDataOffset, &usSendSize))||
+                          ( usSendSize < (usDataOffset +
+                                 sizeof(tHalRateUpdateParams) )))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in Rate Update Indication %p ",
+                  pEventData);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+
+    pRateUpdateInd = (tHalRateUpdateInd *)pSendBuffer;
+
+    /* Copy the bssid */
+    wpalMemoryCopy(pRateUpdateInd->halRateUpdateParams.bssid,
+                     pwdiRateUpdateInd->bssid, WDI_MAC_ADDR_LEN);
+
+    /* Copy the tx flags */
+    pRateUpdateInd->halRateUpdateParams.ucastDataRateTxFlag =
+                             pwdiRateUpdateInd->ucastDataRateTxFlag;
+    pRateUpdateInd->halRateUpdateParams.reliableMcastDataRateTxFlag =
+                             pwdiRateUpdateInd->reliableMcastDataRateTxFlag;
+    pRateUpdateInd->halRateUpdateParams.mcastDataRate24GHzTxFlag =
+                             pwdiRateUpdateInd->mcastDataRate24GHzTxFlag;
+    pRateUpdateInd->halRateUpdateParams.mcastDataRate5GHzTxFlag =
+                             pwdiRateUpdateInd->mcastDataRate5GHzTxFlag;
+
+    /* Copy the tx rates */
+    pRateUpdateInd->halRateUpdateParams.ucastDataRate =
+                             pwdiRateUpdateInd->ucastDataRate;
+    pRateUpdateInd->halRateUpdateParams.reliableMcastDataRate =
+                             pwdiRateUpdateInd->reliableMcastDataRate;
+    pRateUpdateInd->halRateUpdateParams.mcastDataRate24GHz =
+                             pwdiRateUpdateInd->mcastDataRate24GHz;
+    pRateUpdateInd->halRateUpdateParams.mcastDataRate5GHz =
+                             pwdiRateUpdateInd->mcastDataRate5GHz;
+
+    /*-------------------------------------------------------------------------
+     Send Rate Update Indication to HAL
+    -------------------------------------------------------------------------*/
+    pWDICtx->wdiReqStatusCB     = pwdiRateUpdateInd->wdiReqStatusCB;
+    pWDICtx->pReqStatusUserData = pwdiRateUpdateInd->pUserData;
+
+    wdiStatus = WDI_SendIndication(pWDICtx, pSendBuffer, usSendSize);
+
+    return (wdiStatus != WDI_STATUS_SUCCESS) ?
+                 wdiStatus : WDI_STATUS_SUCCESS_SYNC;
+
+} /* WDI_ProcessRateUpdateInd */
+
+#if defined WLAN_FEATURE_RELIABLE_MCAST
+/**
+*@brief Process Leader Selection response where the firmware
+        provides a list of candidates that can be used as leaders
+        a.k.a. a receiver that can ACK multicast frames
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLBPLeaderResp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  tHalLbpLeaderRspMsg halLbpLeaderRspMsg;
+  WDI_LbpLeaderRspCb wdiLbpLeaderRspCb;
+  WDI_LbpRspParamsType wdiLbpRsp;
+
+  /* Sanity check */
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT( 0 );
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  wdiLbpLeaderRspCb = (WDI_LbpLeaderRspCb)pWDICtx->pfncRspCB;
+
+  /* Extract indication and send it to UMAC */
+  wpalMemoryCopy( &halLbpLeaderRspMsg.leaderRspParams,
+                  pEventData->pEventData,
+                  sizeof(halLbpLeaderRspMsg.leaderRspParams) );
+
+  wdiLbpRsp.status = halLbpLeaderRspMsg.leaderRspParams.status;
+  wpalMemoryCopy(wdiLbpRsp.mcastTransmitter,
+                      &halLbpLeaderRspMsg.leaderRspParams.mcastTransmitter,
+                      sizeof(wdiLbpRsp.mcastTransmitter));
+  wpalMemoryCopy(wdiLbpRsp.mcastGroup,
+                      &halLbpLeaderRspMsg.leaderRspParams.mcastGroup,
+                      sizeof(wdiLbpRsp.mcastGroup));
+
+  switch (halLbpLeaderRspMsg.leaderRspParams.cmd)
+  {
+    default:
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid command %d", __func__,
+                  halLbpLeaderRspMsg.leaderRspParams.cmd);
+      return WDI_STATUS_E_FAILURE;
+
+    case WLAN_HAL_SUGGEST_LEADER:
+    {
+      /* Fill in the indication parameters */
+      wdiLbpRsp.cmd = eWDI_SUGGEST_LEADER_CMD;
+      wpalMemoryCopy(wdiLbpRsp.leader,
+                      &halLbpLeaderRspMsg.leaderRspParams.leader,
+                      sizeof(wdiLbpRsp.leader));
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+               "%s Suggest_Leader", __func__);
+      break;
+    }
+
+    case WLAN_HAL_BECOME_LEADER:
+    {
+      /* Fill in the indication parameters */
+      wdiLbpRsp.cmd = eWDI_BECOME_LEADER_CMD;
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+               "%s Become_Leader", __func__);
+      break;
+    }
+  }
+
+  /* Notify UMAC */
+  wdiLbpLeaderRspCb(&wdiLbpRsp, pWDICtx->pRspCBUserData);
+
+  return WDI_STATUS_SUCCESS;
+}
+
+/**
+*@brief Process Update Indication where the firmware
+        provides a list of candidates that can be used as leaders
+        a.k.a. a receiver that can ACK multicast frames
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLBPUpdateIndToHost
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_LowLevelIndType wdiInd;
+  tHalLbpUpdateInd halLbpUpdateInd;
+
+  /* Sanity check */
+  if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT( 0 );
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  /* Extract indication and send it to UMAC */
+  wpalMemoryCopy( &halLbpUpdateInd.leaderIndParams,
+                  pEventData->pEventData,
+                  sizeof(halLbpUpdateInd.leaderIndParams) );
+
+  switch (halLbpUpdateInd.leaderIndParams.indication)
+  {
+    default:
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid command %d", __func__,
+                  halLbpUpdateInd.leaderIndParams.indication);
+      return WDI_STATUS_E_FAILURE;
+
+    case WLAN_HAL_LEADER_PICK_NEW:
+    {
+      /* Fill in the indication parameters */
+      wdiInd.wdiIndicationType = WDI_LBP_LEADER_PICK_NEW;
+      wdiInd.wdiIndicationData.wdiLbpPickNewLeaderInd.indication
+                        = halLbpUpdateInd.leaderIndParams.indication;
+      wdiInd.wdiIndicationData.wdiLbpPickNewLeaderInd.role
+                        = halLbpUpdateInd.leaderIndParams.role;
+      wpalMemoryCopy(wdiInd.wdiIndicationData.wdiLbpPickNewLeaderInd. \
+                      mcastTransmitter,
+                      &halLbpUpdateInd.leaderIndParams.mcastTransmitter,
+                      sizeof(tSirMacAddr) );
+      wpalMemoryCopy(wdiInd.wdiIndicationData.wdiLbpPickNewLeaderInd.mcastGroup,
+                      &halLbpUpdateInd.leaderIndParams.mcastGroup,
+                      sizeof(tSirMacAddr) );
+      wpalMemoryCopy(wdiInd.wdiIndicationData.wdiLbpPickNewLeaderInd.mcastLeader,
+                      &halLbpUpdateInd.leaderIndParams.mcastLeader,
+                      sizeof(tSirMacAddr) );
+      wpalMemoryCopy(wdiInd.wdiIndicationData.wdiLbpPickNewLeaderInd.leader,
+                      &halLbpUpdateInd.leaderIndParams.leader,
+                      sizeof(tSirMacAddr) * HAL_NUM_MAX_LEADERS );
+      break;
+    }
+  }
+
+
+  /* Notify UMAC */
+  pWDICtx->wdiLowLevelIndCB( &wdiInd, pWDICtx->pIndUserData );
+
+  return WDI_STATUS_SUCCESS;
+}
+
+/**
+ @brief WDI_LbpLeaderReq will be called when the upper MAC
+        requests the device to enable LBP reliable multicast.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param wdiLbpLeaderReqParams:
+
+ @see WDI_Start
+ @return Result of the function call
+*/
+WDI_Status
+WDI_LbpLeaderReq
+(
+    WDI_LbpLeaderReqParams  *wdiLbpLeaderReqParams,
+    WDI_LbpLeaderRspCb wdiLbpLeaderRspCb,
+    void *usrData
+)
+{
+   WDI_EventInfoType      wdiEventData;
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+    if ( eWLAN_PAL_FALSE == gWDIInitialized )
+    {
+        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+              "WDI API call before module is initialized - Fail request");
+
+        return WDI_STATUS_E_NOT_ALLOWED;
+    }
+
+    /*------------------------------------------------------------------------
+      Fill in Event data and post to the Main FSM
+     ------------------------------------------------------------------------*/
+    wdiEventData.wdiRequest      = WDI_LBP_LEADER_REQ;
+    wdiEventData.pEventData      = wdiLbpLeaderReqParams;
+    wdiEventData.uEventDataSize  = sizeof(WDI_LbpLeaderReqParams);
+    wdiEventData.pCBfnc          = wdiLbpLeaderRspCb;
+    wdiEventData.pUserData       = usrData;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+
+} /* WDI_LbpLeaderReq */
+
+/**
+ @brief WDI_LbpUpdateInd will be called when the upper MAC
+        requests the device to enable LBP reliable multicast.
+
+        In state BUSY this request will be queued. Request won't
+        be allowed in any other state.
+
+
+ @param wdiLbpUpdateIndParams:
+
+
+ @see WDI_Start
+ @return Result of the function call
+*/
+WDI_Status
+WDI_LbpUpdateInd
+(
+    WDI_LbpUpdateIndParams  *wdiLbpUpdateIndParams
+)
+{
+   WDI_EventInfoType      wdiEventData;
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+   /*------------------------------------------------------------------------
+    Sanity Check
+   ------------------------------------------------------------------------*/
+   if ( eWLAN_PAL_FALSE == gWDIInitialized )
+   {
+       WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                  "WDI API call before module is initialized - Fail request");
+
+       return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   /*------------------------------------------------------------------------
+     Fill in Event data and post to the Main FSM
+   ------------------------------------------------------------------------*/
+    wdiEventData.wdiRequest      = WDI_LBP_UPDATE_IND;
+    wdiEventData.pEventData      = wdiLbpUpdateIndParams;
+    wdiEventData.uEventDataSize  = sizeof(WDI_LbpUpdateIndParams);
+    wdiEventData.pCBfnc          = NULL;
+    wdiEventData.pUserData       = NULL;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+
+}/* WDI_LbpUpdateInd */
+
+/**
+ @brief Process LBP Leader Request and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLBPLeaderReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+    WDI_Status              wdiStatus;
+    wpt_uint8*              pSendBuffer        = NULL;
+    wpt_uint16              usDataOffset       = 0;
+    wpt_uint16              usSendSize         = 0;
+    WDI_LbpLeaderReqParams *pwdiLeaderReq      = NULL;
+    tHalLbpLeaderReqMsg    *pLeaderReq;
+
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+           "%s", __func__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+    -------------------------------------------------------------------------*/
+    if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "%s: Invalid parameters", __func__);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+    pwdiLeaderReq = (WDI_LbpLeaderReqParams *)pEventData->pEventData;
+    /*-----------------------------------------------------------------------
+      Get message buffer
+    -----------------------------------------------------------------------*/
+
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                          WDI_LBP_LEADER_REQ,
+                          sizeof(tHalLbpLeaderReqParams),
+                          &pSendBuffer, &usDataOffset, &usSendSize))||
+                          ( usSendSize < (usDataOffset +
+                                 sizeof(tHalLbpLeaderReqParams) )))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in LBP Leader Req %p ",
+                  pEventData);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+
+    pLeaderReq = (tHalLbpLeaderReqMsg *)pSendBuffer;
+    pLeaderReq->leaderReqParams.cmd = pwdiLeaderReq->cmd;
+    wpalMemoryCopy(pLeaderReq->leaderReqParams.mcastTransmitter,
+                     pwdiLeaderReq->mcastTransmitter, WDI_MAC_ADDR_LEN);
+    wpalMemoryCopy(pLeaderReq->leaderReqParams.mcastGroup,
+                     pwdiLeaderReq->mcastGroup, WDI_MAC_ADDR_LEN);
+    wpalMemoryCopy(pLeaderReq->leaderReqParams.blacklist,
+                     pwdiLeaderReq->blacklist,
+                     WDI_MAC_ADDR_LEN * HAL_NUM_MAX_LEADERS);
+
+    pWDICtx->pReqStatusUserData = pEventData->pUserData;
+    pWDICtx->pfncRspCB = pEventData->pCBfnc;
+
+    /*-------------------------------------------------------------------------
+     Send LBP Leader Request to HAL
+    -------------------------------------------------------------------------*/
+    wdiStatus = WDI_SendMsg(pWDICtx, pSendBuffer,
+                            usSendSize, pWDICtx->pfncRspCB,
+                            pWDICtx->pReqStatusUserData,
+                            WDI_LBP_LEADER_RESP);
+    return wdiStatus;
+
+} /* WDI_ProcessLBPLeaderReq */
+
+/**
+ @brief Process LBP Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessLBPUpdateInd
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+    wpt_uint8*              pSendBuffer        = NULL;
+    wpt_uint16              usDataOffset       = 0;
+    wpt_uint16              usSendSize         = 0;
+    WDI_LbpUpdateIndParams *pwdiUpdateInd      = NULL;
+    tHalLbpUpdateInd       *pUpdateInd;
+    WDI_Status              wdiStatus;
+
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+           "%s", __func__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+    -------------------------------------------------------------------------*/
+    if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "%s: Invalid parameters", __func__);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+    pwdiUpdateInd = (WDI_LbpUpdateIndParams *)pEventData->pEventData;
+    /*-----------------------------------------------------------------------
+      Get message buffer
+    -----------------------------------------------------------------------*/
+
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                          WDI_LBP_UPDATE_IND,
+                          sizeof(tHalLbpUpdateIndParams),
+                          &pSendBuffer, &usDataOffset, &usSendSize))||
+                          ( usSendSize < (usDataOffset +
+                                 sizeof(tHalLbpUpdateIndParams) )))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in LBP Update Indication %p ",
+                  pEventData);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+
+    pUpdateInd = (tHalLbpUpdateInd *)pSendBuffer;
+
+    pUpdateInd->leaderIndParams.indication = pwdiUpdateInd->indication;
+    pUpdateInd->leaderIndParams.role = pwdiUpdateInd->role;
+
+    wpalMemoryCopy(pUpdateInd->leaderIndParams.mcastTransmitter,
+                     pwdiUpdateInd->mcastTransmitter, WDI_MAC_ADDR_LEN);
+    wpalMemoryCopy(pUpdateInd->leaderIndParams.mcastGroup,
+                     pwdiUpdateInd->mcastGroup, WDI_MAC_ADDR_LEN);
+    wpalMemoryCopy(pUpdateInd->leaderIndParams.mcastLeader,
+                     pwdiUpdateInd->mcastLeader, WDI_MAC_ADDR_LEN);
+    /* Zero out parameters not needed for this command */
+    wpalMemoryZero(pUpdateInd->leaderIndParams.leader,
+                     WDI_MAC_ADDR_LEN * HAL_NUM_MAX_LEADERS);
+
+
+    /*-------------------------------------------------------------------------
+     Send LBP Update Indication to HAL
+    -------------------------------------------------------------------------*/
+    pWDICtx->wdiReqStatusCB     = pwdiUpdateInd->wdiReqStatusCB;
+    pWDICtx->pReqStatusUserData = pwdiUpdateInd->pUserData;
+
+    wdiStatus = WDI_SendIndication(pWDICtx, pSendBuffer, usSendSize);
+
+    return (wdiStatus != WDI_STATUS_SUCCESS) ?
+                 wdiStatus : WDI_STATUS_SUCCESS_SYNC;
+
+} /* WDI_ProcessLBPUpdateInd */
+
+#endif /* WLAN_FEATURE_RELIABLE_MCAST */
+
+#ifdef FEATURE_CESIUM_PROPRIETARY
+/**
+ @brief Process LBP Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_IbssPeerInfoReq
+(
+   WDI_IbssPeerInfoReqType*   wdiPeerInfoReqParams,
+   WDI_IbssPeerInfoReqCb      wdiIbssPeerInfoReqCb,
+   void*                      pUserData
+)
+{
+
+   WDI_EventInfoType  wdiEventData;
+
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+    if ( eWLAN_PAL_FALSE == gWDIInitialized )
+    {
+        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+              "WDI API call before module is initialized - Fail request");
+
+        return WDI_STATUS_E_NOT_ALLOWED;
+    }
+
+    /*------------------------------------------------------------------------
+      Fill in Event data and post to the Main FSM
+     ------------------------------------------------------------------------*/
+    wdiEventData.wdiRequest      = WDI_HAL_IBSS_PEER_INFO_REQ;
+    wdiEventData.pEventData      = wdiPeerInfoReqParams;
+    wdiEventData.uEventDataSize  = sizeof(WDI_IbssPeerInfoReqType);
+    wdiEventData.pCBfnc          = wdiIbssPeerInfoReqCb;
+    wdiEventData.pUserData       = pUserData;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief Process LBP Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInfoReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+    WDI_Status              wdiStatus;
+    wpt_uint8*              pSendBuffer        = NULL;
+    wpt_uint16              usDataOffset       = 0;
+    wpt_uint16              usSendSize         = 0;
+    WDI_IbssPeerInfoReqType *pwdiInfoReq        = NULL;
+    tHalIbssPeerInfoReq     *pPeerInfoReq;
+    WDI_StaStruct*   pSTATable = (WDI_StaStruct*) pWDICtx->staTable;
+
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+           "%s", __func__);
+
+    /*-------------------------------------------------------------------------
+      Sanity check
+    -------------------------------------------------------------------------*/
+    if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "%s: Invalid parameters", __func__);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+    pwdiInfoReq = (WDI_IbssPeerInfoReqType *)pEventData->pEventData;
+    /*-----------------------------------------------------------------------
+      Get message buffer
+    -----------------------------------------------------------------------*/
+
+    if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                          WDI_HAL_IBSS_PEER_INFO_REQ,
+                          sizeof(tHalIbssPeerInfoReqParams),
+                          &pSendBuffer, &usDataOffset, &usSendSize))||
+                          ( usSendSize < (usDataOffset +
+                                 sizeof(tHalIbssPeerInfoReqParams) )))
+    {
+       WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                "Unable to get send buffer in IBSS Peer Info Req %p ",
+                  pEventData);
+       WDI_ASSERT(0);
+       return WDI_STATUS_E_FAILURE;
+    }
+
+    pPeerInfoReq = (tHalIbssPeerInfoReq *)pSendBuffer;
+    if (VOS_FALSE == pwdiInfoReq->wdiAllPeerInfoReqd)
+    {
+       if (pSTATable[pwdiInfoReq->wdiStaIdx].valid)
+       {
+          pPeerInfoReq->ibssPeerInfoReqParams.bssIdx =
+                        pSTATable[pwdiInfoReq->wdiStaIdx].bssIdx;
+       }
+       else
+       {
+          WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "Unable to find BSSIDX for STAIDX %d ",
+                    pwdiInfoReq->wdiStaIdx);
+          return WDI_STATUS_E_FAILURE;
+       }
+    }
+    else
+      pPeerInfoReq->ibssPeerInfoReqParams.bssIdx = 0;
+
+    pPeerInfoReq->ibssPeerInfoReqParams.staIdx = pwdiInfoReq->wdiStaIdx;
+    pPeerInfoReq->ibssPeerInfoReqParams.allPeerInfoReqd = pwdiInfoReq->wdiAllPeerInfoReqd;
+
+    pWDICtx->pReqStatusUserData = pEventData->pUserData;
+    pWDICtx->pfncRspCB = pEventData->pCBfnc;
+
+    /*-------------------------------------------------------------------------
+     Send IBSS Peer Info request to HAL
+    -------------------------------------------------------------------------*/
+    wdiStatus = WDI_SendMsg(pWDICtx, pSendBuffer,
+                            usSendSize, pWDICtx->pfncRspCB,
+                            pWDICtx->pReqStatusUserData,
+                            WDI_HAL_IBSS_PEER_INFO_RSP);
+    return wdiStatus;
+}
+
+/**
+ @brief Process LBP Update Indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIbssPeerInfoRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+   WDI_IbssPeerInfoReqCb     wdiPeerInfoCb   = NULL;
+   tHalIbssPeerParams        *pHalPeerInfoParams;
+   WDI_IbssPeerInfoRspParams wdiPeerInfoRspParams;
+   wpt_uint32                allocSize=0;
+   WDI_IbssPeerInfoParams   *pPeerInfoParams;
+   wpt_uint8                 wdiCount=0;
+
+   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+   wdiPeerInfoCb = (WDI_IbssPeerInfoReqCb)pWDICtx->pfncRspCB;
+
+   /*-------------------------------------------------------------------------
+     Sanity check
+   -------------------------------------------------------------------------*/
+   if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+       ( NULL == pEventData->pEventData))
+   {
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                  "%s: Invalid parameters", __func__);
+      WDI_ASSERT(0);
+      return WDI_STATUS_E_FAILURE;
+   }
+
+   /*-------------------------------------------------------------------------
+     Extract response and send it to UMAC
+   -------------------------------------------------------------------------*/
+   pHalPeerInfoParams =
+             ((tHalIbssPeerInfoRspParams *)pEventData->pEventData)->ibssPeerParams;
+   wdiPeerInfoRspParams.wdiStatus =
+             WDI_HAL_2_WDI_STATUS(((tHalIbssPeerInfoRspParams *)pEventData->pEventData)->status);
+   wdiPeerInfoRspParams.wdiNumPeers =
+             ((tHalIbssPeerInfoRspParams *)pEventData->pEventData)->numOfPeers;
+
+   /* Size of peer info data received from DAL */
+   allocSize = (sizeof(WDI_IbssPeerInfoParams) * (wdiPeerInfoRspParams.wdiNumPeers));
+
+   pPeerInfoParams = (WDI_IbssPeerInfoParams*)wpalMemoryAllocate(allocSize);
+
+   if (NULL == pPeerInfoParams ||
+       wdiPeerInfoRspParams.wdiNumPeers > WDI_MAX_IBSS_PEER_SUPPORED_STAS)
+   {
+      WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                   "Number of stations %d exceed max supported stations %d ",
+                    wdiPeerInfoRspParams.wdiNumPeers,
+                    WDI_MAX_IBSS_PEER_SUPPORED_STAS);
+      return WDI_STATUS_MEM_FAILURE;
+   }
+
+   for (wdiCount = 0; wdiCount < wdiPeerInfoRspParams.wdiNumPeers; wdiCount++)
+   {
+      tHalIbssPeerParams        *pHalTemp = &pHalPeerInfoParams[wdiCount];
+      WDI_IbssPeerInfoParams    *pWdiTemp = &pPeerInfoParams[wdiCount];
+      pWdiTemp->wdiStaIdx = pHalTemp->staIdx;
+      pWdiTemp->wdiRssi = pHalTemp->rssi;
+      pWdiTemp->wdiMcsIndex = pHalTemp->mcsIndex;
+      pWdiTemp->wdiTxRate = pHalTemp->txRate;
+      pWdiTemp->wdiTxRateFlags = pHalTemp->txRateFlags;
+   }
+
+   wdiPeerInfoRspParams.wdiPeerInfoParams = pPeerInfoParams;
+
+   /*Notify UMAC*/
+   if (wdiPeerInfoCb)
+   {
+      wdiPeerInfoCb(&wdiPeerInfoRspParams, pWDICtx->pRspCBUserData);
+   }
+
+   /* Free the allocation */
+   vos_mem_free (pPeerInfoParams);
+
+   return WDI_STATUS_SUCCESS;
+}
+
+/**
+ @brief Process IBSS Route table update indication and post it to HAL
+
+ @param  pWDICtx:    pointer to the WLAN DAL context
+         pEventData: pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessIBSSRouteTableUpdateInd
+(
+  WDI_ControlBlockType *pWDICtx,
+  WDI_EventInfoType *pEventData
+)
+{
+  WDI_IBSSRouteTable *pwdiIBSSRouteTable = NULL;
+  wpt_uint8 *pSendBuffer = NULL;
+  wpt_uint16 usDataOffset = 0;
+  wpt_uint16 usSendSize = 0;
+  WDI_Status wdiStatus;
+  tWlanIpForwardTableUpdateIndParam *pUpdateIndParam = NULL;
+  wpt_uint32 usUpdateIndParamSize;
+  wpt_uint16 i = 0;
+
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+             "%s", __func__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+  if ((NULL == pEventData) || (NULL == pEventData->pEventData))
+  {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pwdiIBSSRouteTable =
+     (WDI_IBSSRouteTable*)pEventData->pEventData;
+
+  usUpdateIndParamSize = sizeof(tWlanIpForwardTableUpdateIndParam) +
+                         ((pwdiIBSSRouteTable->numEntries - 1) *
+                          sizeof(tDestIpNextHopMacPair));
+
+  pUpdateIndParam = (tWlanIpForwardTableUpdateIndParam *)wpalMemoryAllocate(
+                                                     usUpdateIndParamSize);
+
+  if (NULL == pUpdateIndParam)
+  {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+            "%s: failed to allocate mem for tWlanIpForwardTableUpdateIndParam",
+            __func__);
+     wpalMemoryFree(pwdiIBSSRouteTable);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  wpalMemoryZero(pUpdateIndParam, usUpdateIndParamSize);
+
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+
+  if ((WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(pWDICtx,
+                        WDI_IBSS_ROUTE_TABLE_UPDATE_IND,
+                        usUpdateIndParamSize,
+                        &pSendBuffer, &usDataOffset, &usSendSize))||
+      (usSendSize < (usDataOffset + usUpdateIndParamSize)))
+  {
+     WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+                "Unable to get send buffer in IBSS Route Table Update Ind");
+     wpalMemoryFree(pwdiIBSSRouteTable);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pUpdateIndParam->numEntries = pwdiIBSSRouteTable->numEntries;
+
+  for (i = 0; i < pwdiIBSSRouteTable->numEntries; i++)
+  {
+     wpalMemoryCopy(&pUpdateIndParam->destIpMacPair[i].destIpv4Addr,
+                    &pwdiIBSSRouteTable->destIpMacPair[i].destIpv4Addr,
+                    HAL_IPV4_ADDR_LEN);
+     wpalMemoryCopy(&pUpdateIndParam->destIpMacPair[i].nextHopMacAddr,
+                    &pwdiIBSSRouteTable->destIpMacPair[i].nextHopMacAddr,
+                    HAL_MAC_ADDR_LEN);
+  }
+
+  wpalMemoryCopy(pSendBuffer+usDataOffset, pUpdateIndParam,
+                 usUpdateIndParamSize);
+
+  pWDICtx->wdiReqStatusCB = pwdiIBSSRouteTable->wdiReqStatusCB;
+  pWDICtx->pReqStatusUserData = pwdiIBSSRouteTable->pUserData;
+
+  wpalMemoryFree(pwdiIBSSRouteTable);
+  wpalMemoryFree(pUpdateIndParam);
+
+ /*-------------------------------------------------------------------------
+    Send IBSS Route Table Update Indication to HAL
+  -------------------------------------------------------------------------*/
+  wdiStatus = WDI_SendIndication(pWDICtx, pSendBuffer, usSendSize);
+
+  return (wdiStatus != WDI_STATUS_SUCCESS) ?
+          wdiStatus : WDI_STATUS_SUCCESS_SYNC;
+}/*WDI_ProcessIBSSRouteTableUpdateInd*/
+
+/**
+ @brief WDI_IBSSRouteTableUpdateInd
+       Forward the IBSS Route Table Update Indication
+
+ @param
+
+ wdiIBSSRouteTableInd: IBSS Route table
+
+ @see
+ @return Result of the function call
+*/
+
+WDI_Status
+WDI_IBSSRouteTableUpdateInd
+(
+  WDI_IBSSRouteTable *pwdiIBSSRouteTable
+)
+{
+   WDI_EventInfoType wdiEventData;
+
+   /*------------------------------------------------------------------------
+     Sanity Check
+   ------------------------------------------------------------------------*/
+   if (eWLAN_PAL_FALSE == gWDIInitialized)
+   {
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request");
+
+      wpalMemoryFree(pwdiIBSSRouteTable);
+      return WDI_STATUS_E_NOT_ALLOWED;
+   }
+
+   wdiEventData.wdiRequest      = WDI_IBSS_ROUTE_TABLE_UPDATE_IND;
+   wdiEventData.pEventData      = pwdiIBSSRouteTable;
+   wdiEventData.uEventDataSize  = sizeof(*pwdiIBSSRouteTable);
+   wdiEventData.pCBfnc          = NULL;
+   wdiEventData.pUserData       = NULL;
+
+   return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+#endif /* FEATURE_CESIUM_PROPRIETARY */
+
+#ifdef FEATURE_WLAN_BATCH_SCAN
+
+/**
+ @brief Process stop batch indication from WDA
+
+ @param pWDICtx:         pointer to the WLAN DAL context
+        pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessStopBatchScanInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  wpt_uint8*                pSendBuffer        = NULL;
+  wpt_uint16                usDataOffset       = 0;
+  wpt_uint16                usSendSize         = 0;
+  WDI_Status                wdiStatus;
+  tHalBatchScanStopIndParam *pHalInd           = NULL;
+  WDI_StopBatchScanIndType  *pWdiInd           = NULL;
+
+
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+         "%s", __func__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+
+  if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pWdiInd = (WDI_StopBatchScanIndType *)pEventData->pEventData;
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                        WDI_STOP_BATCH_SCAN_IND,
+                        sizeof(tHalBatchScanStopIndParam),
+                        &pSendBuffer, &usDataOffset, &usSendSize))||
+      ( usSendSize < (usDataOffset + sizeof(tHalBatchScanStopIndParam))))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+              "Unable to get send buffer in stop batch scan ind %p ",
+                pEventData);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pHalInd = (tHalBatchScanStopIndParam *)(pSendBuffer + usDataOffset);
+  pHalInd->param = pWdiInd->param;
+
+  pWDICtx->pReqStatusUserData = NULL;
+  pWDICtx->pfncRspCB = NULL;
+  /*-------------------------------------------------------------------------
+    Send Stop batch scan indication to HAL
+  -------------------------------------------------------------------------*/
+  wdiStatus =  WDI_SendIndication( pWDICtx, pSendBuffer, usSendSize);
+  return (wdiStatus != WDI_STATUS_SUCCESS) ? wdiStatus:WDI_STATUS_SUCCESS_SYNC;
+}
+
+/**
+ @brief This API is called to trigger batch scan results from FW
+
+ @param pWDICtx:         pointer to the WLAN DAL context
+        pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessTriggerBatchScanResultInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+  WDI_Status                        wdiStatus;
+  wpt_uint8*                        pSendBuffer        = NULL;
+  wpt_uint16                        usDataOffset       = 0;
+  wpt_uint16                        usSendSize         = 0;
+  tHalBatchScanTriggerResultParam   *pHalInd           = NULL;
+  WDI_TriggerBatchScanResultIndType *pWdiInd           = NULL;
+
+
+  /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+  WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+         "%s", __func__);
+
+  /*-------------------------------------------------------------------------
+    Sanity check
+  -------------------------------------------------------------------------*/
+
+  if (( NULL == pEventData ) || ( NULL == pEventData->pEventData ))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+                 "%s: Invalid parameters", __func__);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+  pWdiInd = (WDI_TriggerBatchScanResultIndType *)pEventData->pEventData;
+  /*-----------------------------------------------------------------------
+    Get message buffer
+  -----------------------------------------------------------------------*/
+
+  if (( WDI_STATUS_SUCCESS != WDI_GetMessageBuffer( pWDICtx,
+                        WDI_TRIGGER_BATCH_SCAN_RESULT_IND,
+                        sizeof(tHalBatchScanTriggerResultParam),
+                        &pSendBuffer, &usDataOffset, &usSendSize))||
+      ( usSendSize < (usDataOffset + sizeof(tHalBatchScanTriggerResultParam))))
+  {
+     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_FATAL,
+              "Unable to get send buffer in stop batch scan ind %p ",
+                pEventData);
+     WDI_ASSERT(0);
+     return WDI_STATUS_E_FAILURE;
+  }
+
+  pHalInd = (tHalBatchScanTriggerResultParam *)(pSendBuffer + usDataOffset);
+  pHalInd->param = pWdiInd->param;
+
+  pWDICtx->pReqStatusUserData = NULL;
+  pWDICtx->pfncRspCB = NULL;
+  /*-------------------------------------------------------------------------
+    Send trigger batch scan result indication to HAL
+  -------------------------------------------------------------------------*/
+  wdiStatus =  WDI_SendIndication( pWDICtx, pSendBuffer, usSendSize);
+  return (wdiStatus != WDI_STATUS_SUCCESS) ? wdiStatus:WDI_STATUS_SUCCESS_SYNC;
+}
+
+
+/**
+ @brief Process set batch scan response from FW
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessSetBatchScanRsp
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+    WDI_SetBatchScanCb   wdiSetBatchScanCb;
+    WDI_SetBatchScanRspType *pSetBatchScanRsp;
+
+    tHalBatchScanSetRspParam *pHalSetBatchScanRsp;
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    /*sanity check*/
+    if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                 "%s: Invalid parameters", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    wdiSetBatchScanCb = (WDI_SetBatchScanCb)pWDICtx->pfncRspCB;
+    if ( NULL == wdiSetBatchScanCb)
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_FATAL,
+            "%s: call back function is NULL", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    pSetBatchScanRsp = wpalMemoryAllocate(sizeof(WDI_SetBatchScanRspType));
+
+    if (NULL == pSetBatchScanRsp)
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+            "Failed to allocate memory in set batch scan response %p %p %p ",
+            pWDICtx, pEventData, pEventData->pEventData);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    /*extract response and send it to UMAC*/
+    pHalSetBatchScanRsp = (tHalBatchScanSetRspParam *)pEventData->pEventData;
+
+    pSetBatchScanRsp->nScansToBatch = pHalSetBatchScanRsp->supportedMscan;
+
+    /*Notify UMAC*/
+    wdiSetBatchScanCb(pSetBatchScanRsp, pWDICtx->pRspCBUserData);
+
+    wpalMemoryFree(pSetBatchScanRsp);
+
+    return WDI_STATUS_SUCCESS;
+}/*WDI_ProcessSetBatchScanRsp*/
+
+/**
+ @brief Process batch scan result indication from FW
+
+ @param  pWDICtx:         pointer to the WLAN DAL context
+         pEventData:      pointer to the event information structure
+
+ @see
+ @return Result of the function call
+*/
+WDI_Status
+WDI_ProcessBatchScanResultInd
+(
+  WDI_ControlBlockType*  pWDICtx,
+  WDI_EventInfoType*     pEventData
+)
+{
+    void *pBatchScanResultInd;
+    WDI_LowLevelIndType wdiInd;
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    /*sanity check*/
+    if (( NULL == pWDICtx ) || ( NULL == pEventData ) ||
+      ( NULL == pEventData->pEventData))
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                 "%s: Invalid parameters", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    /*extract response and send it to UMAC*/
+    pBatchScanResultInd = (void *)pEventData->pEventData;
+
+    /*Fill in the indication parameters*/
+    wdiInd.wdiIndicationType = WDI_BATCH_SCAN_RESULT_IND;
+
+    wdiInd.wdiIndicationData.pBatchScanResult = pBatchScanResultInd;
+
+    /*Notify UMAC*/
+    if (pWDICtx->wdiLowLevelIndCB)
+    {
+        pWDICtx->wdiLowLevelIndCB( &wdiInd, pWDICtx->pIndUserData );
+    }
+    else
+    {
+        WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                 "%s: WDILowLevelIndCb is null", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    return WDI_STATUS_SUCCESS;
+} /*End of WDI_ProcessBatchScanResultInd*/
+
+/**
+ @brief WDI_ProcessSetBatchScanReq -
+    Set batch scan request to FW
+
+ @param  pWDICtx : wdi context
+         pEventData : indication data
+
+ @see
+ @return none
+*/
+WDI_Status WDI_ProcessSetBatchScanReq
+(
+    WDI_ControlBlockType*  pWDICtx,
+    WDI_EventInfoType*     pEventData
+)
+{
+    WDI_SetBatchScanReqType *pWdiReq;
+    WDI_Status               wdiStatus;
+    wpt_uint8*               pSendBuffer        = NULL;
+    wpt_uint16               usDataOffset       = 0;
+    wpt_uint16               usSendSize         = 0;
+    tHalBatchScanSetParams  *pHalReq;
+    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
+
+    /*sanity check*/
+    if ((NULL == pEventData) || (NULL == pEventData->pEventData))
+    {
+        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_WARN,
+            "%s: Invalid parameters in set batch scan request", __func__);
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+
+    pWdiReq = (WDI_SetBatchScanReqType *)pEventData->pEventData;
+
+
+    /*get message buffer*/
+    if ((WDI_STATUS_SUCCESS != WDI_GetMessageBuffer(pWDICtx,
+                              WDI_SET_BATCH_SCAN_REQ,
+                              sizeof(tHalBatchScanSetParams),
+                              &pSendBuffer, &usDataOffset, &usSendSize))||
+      (usSendSize < (usDataOffset + sizeof(tHalBatchScanSetParams))))
+    {
+        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL,  eWLAN_PAL_TRACE_LEVEL_ERROR,
+            "Unable to get send buffer for SET_BATCH_SCAN_REQ ");
+        WDI_ASSERT(0);
+        return WDI_STATUS_E_FAILURE;
+    }
+
+    pHalReq = (tHalBatchScanSetParams *)(pSendBuffer + usDataOffset);
+
+    pHalReq->rtt = pWdiReq->rtt;
+    pHalReq->rfBand = pWdiReq->rfBand;
+    pHalReq->bestNetworks = pWdiReq->bestNetwork;
+    pHalReq->scanInterval = pWdiReq->scanFrequency;
+    pHalReq->numScan2Batch = pWdiReq->numberOfScansToBatch;
+
+    /*send set batch scan request to fw*/
+    pWDICtx->pfncRspCB          = pEventData->pCBfnc;
+    pWDICtx->pReqStatusUserData = pEventData->pUserData;
+
+    wdiStatus = WDI_SendMsg(pWDICtx, pSendBuffer,
+                          usSendSize, pWDICtx->pfncRspCB,
+                          pWDICtx->pReqStatusUserData,
+                          WDI_SET_BATCH_SCAN_RESP);
+
+    return wdiStatus;
+}
+
+/**
+ @brief WDI_SetBatchScanReq
+    This API is called to set batch scan request in FW
+
+ @param pBatchScanReqParam : pointer to set batch scan re param
+        usrData : Client context
+        setBatchScanRspCb : set batch scan resp callback
+ @see
+ @return SUCCESS or FAIL
+*/
+WDI_Status WDI_SetBatchScanReq
+(
+    void *pBatchScanReqParam,
+    void *usrData,
+    WDI_SetBatchScanCb setBatchScanRspCb
+)
+{
+    WDI_EventInfoType      wdiEventData;
+
+    /*sanity check*/
+    if (eWLAN_PAL_FALSE == gWDIInitialized)
+    {
+        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+            "WDI API call before module is initialized - Fail request");
+
+        return WDI_STATUS_E_NOT_ALLOWED;
+    }
+
+    /* fill in event data and post to the main FSM */
+    wdiEventData.wdiRequest      = WDI_SET_BATCH_SCAN_REQ;
+    wdiEventData.pEventData      = pBatchScanReqParam;
+    wdiEventData.uEventDataSize  = sizeof(WDI_SetBatchScanReqType);
+    wdiEventData.pCBfnc          = setBatchScanRspCb;
+    wdiEventData.pUserData       = usrData;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief WDI_StopbatchScanInd: Send stop batch scan indication to FW
+
+ @param None
+
+ @see
+
+ @return Status of the request
+*/
+WDI_Status
+WDI_StopBatchScanInd(WDI_StopBatchScanIndType *pWdiReq)
+{
+  WDI_EventInfoType      wdiEventData;
+
+  /*-------------------------------------------------------------------------
+    Sanity Check
+   ------------------------------------------------------------------------*/
+  if (eWLAN_PAL_FALSE == gWDIInitialized)
+  {
+    WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+               "WDI API call before module is initialized - Fail request!");
+
+    return WDI_STATUS_E_NOT_ALLOWED;
+  }
+
+  /*-------------------------------------------------------------------------
+    Fill in Event data and post to the Main FSM
+   ------------------------------------------------------------------------*/
+  wdiEventData.wdiRequest      = WDI_STOP_BATCH_SCAN_IND;
+  wdiEventData.pEventData      = pWdiReq;
+  wdiEventData.uEventDataSize  = sizeof(WDI_StopBatchScanIndType);
+  wdiEventData.pCBfnc          = NULL;
+  wdiEventData.pUserData       = NULL;
+
+  return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+/**
+ @brief WDI_TriggerBatchScanResultInd
+    This API is called to pull batch scan result from FW
+
+ @param pWdiReq : pointer to get batch scan ind param
+ @see
+ @return SUCCESS or FAIL
+*/
+WDI_Status WDI_TriggerBatchScanResultInd
+(
+    WDI_TriggerBatchScanResultIndType *pWdiReq
+)
+{
+    WDI_EventInfoType      wdiEventData;
+    /*-------------------------------------------------------------------------
+      Sanity Check
+    ------------------------------------------------------------------------*/
+    if (eWLAN_PAL_FALSE == gWDIInitialized)
+    {
+        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+             "WDI API call before module is initialized - Fail request!");
+
+        return WDI_STATUS_E_NOT_ALLOWED;
+    }
+
+    /*-------------------------------------------------------------------------
+      Fill in Event data and post to the Main FSM
+     ------------------------------------------------------------------------*/
+    wdiEventData.wdiRequest      = WDI_TRIGGER_BATCH_SCAN_RESULT_IND;
+    wdiEventData.pEventData      = pWdiReq;
+    wdiEventData.uEventDataSize  = sizeof(WDI_TriggerBatchScanResultIndType);
+    wdiEventData.pCBfnc          = NULL;
+    wdiEventData.pUserData       = NULL;
+
+    return WDI_PostMainEvent(&gWDICb, WDI_REQUEST_EVENT, &wdiEventData);
+}
+
+#endif /*FEATURE_WLAN_BATCH_SCAN*/
diff --git a/CORE/WDI/CP/src/wlan_qct_wdi_dp.c b/CORE/WDI/CP/src/wlan_qct_wdi_dp.c
index 156ba2e..6adad68 100644
--- a/CORE/WDI/CP/src/wlan_qct_wdi_dp.c
+++ b/CORE/WDI/CP/src/wlan_qct_wdi_dp.c
@@ -362,6 +362,9 @@
 
     ucTxFlag:    different option setting for TX.
 
+    ucProtMgmtFrame: for management frames, whether the frame is
+                     protected (protect bit is set in FC)
+
     uTimeStamp:      Timestamp when the frame was received from HDD. (usec)
    
    @return
@@ -379,7 +382,8 @@
     wpt_uint8*             pTid, 
     wpt_uint8              ucDisableFrmXtl, 
     void*                  pTxBd, 
-    wpt_uint8              ucTxFlag, 
+    wpt_uint32             ucTxFlag,
+    wpt_uint8              ucProtMgmtFrame,
     wpt_uint32             uTimeStamp,
     wpt_uint8*             staIndex
 )
@@ -406,7 +410,7 @@
     ucSubType = (ucTypeSubtype & WDI_FRAME_SUBTYPE_MASK);
 
     WPAL_TRACE( eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_WARN, 
-               "Type: %d/%d, MAC S: %08x. MAC D: %08x., Tid=%d, frmXlat=%d, pTxBD=%08x ucTxFlag 0x%X\n", 
+               "Type: %d/%d, MAC S: %08x. MAC D: %08x., Tid=%d, frmXlat=%d, pTxBD=%p ucTxFlag 0x%X",
                 ucType, ucSubType, 
                 *((wpt_uint32 *) pAddr2), 
                *((wpt_uint32 *) pDestMacAddr), 
@@ -533,6 +537,13 @@
            pBd->bdRate = WDI_BDRATE_CTRL_FRAME;
         }
 #endif
+
+#ifdef FEATURE_WLAN_RELIABLE_MCAST
+        if(ucTxFlag & WDI_USE_BD_RATE_MASK)
+        {
+            pBd->bdRate = WDI_BDRATE_BCDATA_FRAME;
+        }
+#endif
         pBd->rmf    = WDI_RMF_DISABLED;     
 
         /* sanity: Might already be set by caller, but enforce it here again */
@@ -593,16 +604,23 @@
          * Sanity: Force HW frame translation OFF for mgmt frames.
          --------------------------------------------------------------------*/
          /* apply to both ucast/mcast mgmt frames */
-         if (useStaRateForBcastFrames)
-         {
-             pBd->bdRate = (ucUnicastDst)? WDI_BDRATE_BCMGMT_FRAME : WDI_TXBD_BDRATE_DEFAULT; 
-         }
-         else
+         /* Probe requests are sent using BD rate */
+         if( ucSubType ==  WDI_MAC_MGMT_PROBE_REQ )
          {
              pBd->bdRate = WDI_BDRATE_BCMGMT_FRAME;
          }
-
-         if ( ucTxFlag & WDI_USE_BD_RATE2_FOR_MANAGEMENT_FRAME) 
+         else
+         {
+             if (useStaRateForBcastFrames)
+             {
+                 pBd->bdRate = (ucUnicastDst)? WDI_BDRATE_BCMGMT_FRAME : WDI_TXBD_BDRATE_DEFAULT;
+             }
+             else
+             {
+                 pBd->bdRate = WDI_BDRATE_BCMGMT_FRAME;
+             }
+         }
+         if ( ucTxFlag & WDI_USE_BD_RATE2_FOR_MANAGEMENT_FRAME)
          {
            pBd->bdRate = WDI_BDRATE_CTRL_FRAME;
          }
@@ -654,7 +672,8 @@
         /* Mark the BD could not be reused */
         uTxBdSignature = WDI_TXBD_SIG_MGMT_MAGIC; 
 #endif
-        if(ucTxFlag & WDI_USE_SELF_STA_REQUESTED_MASK)
+        if((ucTxFlag & WDI_USE_SELF_STA_REQUESTED_MASK) &&
+            !(ucIsRMF && ucProtMgmtFrame))
         {
 #ifdef HAL_SELF_STA_PER_BSS
             // Get the (self) station index from ADDR2, which should be the self MAC addr
@@ -826,29 +845,12 @@
 
             if(ucIsRMF && pSta->rmfEnabled)
             {
+                pBd->dpuNE = !ucProtMgmtFrame;
                 pBd->rmf = 1;
                 if(!ucUnicastDst)
                     pBd->dpuDescIdx = pSta->bcastMgmtDpuIndex; /* IGTK */
                 else
-                {
-                    wpt_uint8 peerStaId;
-
-                    //We need to find the peer's station's DPU index to send this
-                    //frame using PTK
-                    wdiStatus = WDI_STATableFindStaidByAddr( pWDICtx,
-                                        *(wpt_macAddr*)pDestMacAddr, &peerStaId );
-                    if (WDI_STATUS_SUCCESS != wdiStatus)
-                    {
-                        WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
-                           "%s failed to find peer sta %02X-%02X-%02X-%02X-%02X-%02X",
-                           __FUNCTION__, ((wpt_uint8 *)pDestMacAddr)[0],
-                           ((wpt_uint8 *)pDestMacAddr)[1], ((wpt_uint8 *)pDestMacAddr)[5],
-                           ((wpt_uint8 *)pDestMacAddr)[3], ((wpt_uint8 *)pDestMacAddr)[4],
-                           ((wpt_uint8 *)pDestMacAddr)[5]);
-                        return WDI_STATUS_E_FAILURE;
-                    }
-                    pBd->dpuDescIdx = ((WDI_StaStruct*)pWDICtx->staTable)[peerStaId].dpuIndex; /* PTK */
-                }
+                    pBd->dpuDescIdx = pSta->dpuIndex; /* PTK */
             }
             else
             {
@@ -866,6 +868,13 @@
    
             WDI_STATableGetStaType(pWDICtx, ucStaId, &ucSTAType);
             if(!ucUnicastDst)
+#ifdef WLAN_FEATURE_RELIABLE_MCAST
+              /*Check for reliable MCAST enabled bit if set then
+                queue frames in QID 1 else 0*/
+              if ( ucTxFlag & WDI_RELIABLE_MCAST_REQUESTED_MASK )
+                pBd->queueId = BTQM_QID1;
+              else
+#endif
                 pBd->queueId = BTQM_QID0;
 #ifndef HAL_SELF_STA_PER_BSS
             else if( ucUnicastDst && (ucStaId == pWDICtx->ucSelfStaId))
@@ -905,16 +914,22 @@
             return VOS_STATUS_E_FAILURE;
         } */
 #ifdef WLAN_SOFTAP_VSTA_FEATURE
-       // if this is a Virtual Station then change the DPU Routing Flag so
+       // if this is a Virtual Station or statype is TDLS and trig enabled mask
+       // set then change the DPU Routing Flag so
        // that the frame will be routed to Firmware for queuing & transmit
-       if (IS_VSTA_IDX(ucStaId))
+       if (IS_VSTA_IDX(ucStaId) ||
+                 (
+#ifdef FEATURE_WLAN_TDLS
+                  (ucSTAType == WDI_STA_ENTRY_TDLS_PEER ) &&
+#endif
+                  (ucTxFlag & WDI_TRIGGER_ENABLED_AC_MASK)))
        {
            pBd->dpuRF = BMUWQ_FW_DPU_TX;
        }
 #endif
 
-    } 
-    
+    }
+
     /*------------------------------------------------------------------------
        Over SDIO bus, SIF won't swap data bytes to/from data FIFO. 
        In order for MAC modules to recognize BD in Riva's default endian
@@ -928,7 +943,7 @@
        byte order */
     pBd->txBdSignature = uTxBdSignature ;
 #endif        
-    
+
     return wdiStatus;
 }/*WDI_FillTxBd*/
 
@@ -1013,10 +1028,10 @@
 /**
  @brief WDI_RxAmsduBdFix - fix for HW issue for AMSDU 
 
-  
+
  @param   pWDICtx:       Context to the WDI
           pBDHeader - pointer to the BD header
-  
+
  @return None
 */
 void 
diff --git a/CORE/WDI/DP/inc/wlan_qct_wdi_ds.h b/CORE/WDI/DP/inc/wlan_qct_wdi_ds.h
index 0319357..ce29737 100644
--- a/CORE/WDI/DP/inc/wlan_qct_wdi_ds.h
+++ b/CORE/WDI/DP/inc/wlan_qct_wdi_ds.h
@@ -66,7 +66,7 @@
    wpt_uint8 addr2MACAddress[6];
    wpt_uint8 frmType;
    wpt_uint8 fStaType;
-   wpt_uint8 fProtectedFrame;
+   wpt_uint8 fProtMgmtFrame;
    wpt_uint16 fPktlen;
    wpt_status txCompleteStatus;
    wpt_uint8  staIdx;
@@ -95,7 +95,7 @@
    wpt_uint8 rxChannel;
    wpt_uint8 type:2;
    wpt_uint8 subtype:4;
-   wpt_uint8 reserved0:2;
+   wpt_uint8 rfBand:2;
 
    wpt_uint16 rtsf:1;  //For beacon only. 1 ~V Riva TSF is bigger(later) than the one received
    wpt_uint16 bsf:1;   //1 Riva sends the last beacon, 0 not.
diff --git a/CORE/WDI/DP/inc/wlan_qct_wdi_ds_i.h b/CORE/WDI/DP/inc/wlan_qct_wdi_ds_i.h
index c4d13d3..5f80db2 100644
--- a/CORE/WDI/DP/inc/wlan_qct_wdi_ds_i.h
+++ b/CORE/WDI/DP/inc/wlan_qct_wdi_ds_i.h
@@ -46,6 +46,7 @@
 #include "wlan_qct_pal_type.h"
 #include "wlan_qct_pal_status.h"
 #include "wlan_qct_pal_packet.h"
+#include "wlan_qct_pal_trace.h"
 #include "wlan_qct_wdi_ds.h"
 #include "wlan_qct_dxe.h"
 
diff --git a/CORE/WDI/DP/src/wlan_qct_wdi_ds.c b/CORE/WDI/DP/src/wlan_qct_wdi_ds.c
index d2395c6..4d3652c 100644
--- a/CORE/WDI/DP/src/wlan_qct_wdi_ds.c
+++ b/CORE/WDI/DP/src/wlan_qct_wdi_ds.c
@@ -129,7 +129,8 @@
   wpt_uint8      ucUP;
   wpt_uint8      ucTypeSubtype;
   wpt_uint8      alignment;
-  wpt_uint8      ucTxFlag;
+  wpt_uint32     ucTxFlag;
+  wpt_uint8      ucProtMgmtFrame;
   wpt_uint8*     pSTAMACAddress;
   wpt_uint8*     pAddr2MACAddress;
   WDI_DS_TxMetaInfoType     *pTxMetadata;
@@ -158,6 +159,7 @@
   ucTypeSubtype = pTxMetadata->typeSubtype;
   ucUP = pTxMetadata->fUP;
   ucTxFlag = pTxMetadata->txFlags;
+  ucProtMgmtFrame = pTxMetadata->fProtMgmtFrame;
   pSTAMACAddress = &(pTxMetadata->fSTAMACAddress[0]);
   pAddr2MACAddress = &(pTxMetadata->addr2MACAddress[0]);
 
@@ -204,7 +206,7 @@
   WDI_DS_PrepareBDHeader(pFrame, ucSwFrameTXXlation, alignment);
 
   wdiStatus = WDI_FillTxBd(pContext, ucTypeSubtype, pSTAMACAddress, pAddr2MACAddress,
-    &ucUP, 1, pvBDHeader, ucTxFlag /* No ACK */, 0, &staId);
+    &ucUP, 1, pvBDHeader, ucTxFlag /* No ACK */, ucProtMgmtFrame, 0, &staId);
 
   if(WDI_STATUS_SUCCESS != wdiStatus)
   {
diff --git a/CORE/WDI/TRP/CTS/src/wlan_qct_wdi_cts.c b/CORE/WDI/TRP/CTS/src/wlan_qct_wdi_cts.c
index df1bf74..a0affa6 100644
--- a/CORE/WDI/TRP/CTS/src/wlan_qct_wdi_cts.c
+++ b/CORE/WDI/TRP/CTS/src/wlan_qct_wdi_cts.c
@@ -569,7 +569,7 @@
       return;
 
    case SMD_EVENT_REOPEN_READY:
-      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
+      WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "%s: received SMD_EVENT_REOPEN_READY from SMD", __func__);
 
       /* unlike other events which occur when our kernel threads are
@@ -645,7 +645,7 @@
     * the SMD port was never closed during SSR*/
    if (gwctsHandle) {
        WPAL_TRACE(eWLAN_MODULE_DAL_CTRL, eWLAN_PAL_TRACE_LEVEL_INFO,
-               "WCTS_OpenTransport port is already open\n");
+               "WCTS_OpenTransport port is already open");
 
        pWCTSCb = gwctsHandle;
        if (WCTS_CB_MAGIC != pWCTSCb->wctsMagic) {
diff --git a/CORE/WDI/TRP/DTS/inc/wlan_qct_wdi_dts.h b/CORE/WDI/TRP/DTS/inc/wlan_qct_wdi_dts.h
index e86f1f8..f374415 100644
--- a/CORE/WDI/TRP/DTS/inc/wlan_qct_wdi_dts.h
+++ b/CORE/WDI/TRP/DTS/inc/wlan_qct_wdi_dts.h
@@ -261,4 +261,11 @@
  */
 wpt_uint32 WDTS_GetFreeTxDataResNumber(void *pContext);
 
+/* API to fill Rate Info based on the mac efficiency passed to it
+ * macEff si used to caclulate mac throughput based on each rate index/PHY rate.
+ * This is eventually used by MAS to calculate RX stats periodically sent to FW
+ * The start and end Rate Index are the other arguments to this API - the new mac
+ * efficiency passed to this API (Arg1)  is only applied between startRateIndex (arg2) and endRateIndex (arg3).
+ */
+void WDTS_FillRateInfo(wpt_uint8 macEff, wpt_int16 startRateIndex, wpt_int16 endRateIndex);
 #endif
diff --git a/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c b/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c
index 51a3907..59f005b 100644
--- a/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c
+++ b/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c
@@ -72,8 +72,9 @@
    uint32 tputBpus;  //unit in Bytes per usec: round off to integral value
 }WDTS_RateInfo;
 
-#define WDTS_MAX_RATE_NUM  137
-#define WDTS_MAX_11B_RATE_NUM  8
+#define WDTS_MAX_RATE_NUM               137
+#define WDTS_MAX_11B_RATE_NUM           8
+#define MB_PER_SEC_TO_BYTES_PER_MSEC    13
 
 WDTS_RateInfo g11bRateInfo[WDTS_MAX_11B_RATE_NUM]  = {
     //11b rates
@@ -173,79 +174,79 @@
     { 1350, 1137,  14781, 15}, //index 63
 
     //11AC  
-    { 1350, 1137, 14781, 15}, //reserved 64
-    { 1350, 1137, 14781, 15}, //reserved 65
-    { 65,     65,   845,  1}, //index 66
-    { 130,   130,  1690,  2}, //index 67
-    { 195,   195,  2535,  3}, //index 68
-    { 260,   260,  3380,  3}, //index 69
-    { 390,   390,  5070,  5}, //index 70
-    { 520,   520,  6760,  7}, //index 71
-    { 585,   585,  7605,  8}, //index 72
-    { 650,   650,  8450,  8}, //index 73
-    { 780,   780,  2340,  2}, //index 74
-    { 1350, 1137, 14781, 15}, //reserved 75
-    { 1350, 1137, 14781, 15}, //reserved 76
-    { 1350, 1137, 14781, 15}, //reserved 77
-    { 1350, 1137, 14781, 15}, //index 78
-    { 1350, 1137, 14781, 15}, //index 79
-    { 1350, 1137, 14781, 15}, //index 80
-    { 1350, 1137, 14781, 15}, //index 81
-    { 1350, 1137, 14781, 15}, //index 82
-    { 1350, 1137, 14781, 15}, //index 83
-    { 655,   655,  8515,  9}, //index 84
-    { 722,   722,  9386,  9}, //index 85
-    { 866,   866, 11258, 11}, //index 86
-    { 1350, 1137, 14781, 15}, //reserved 87
-    { 1350, 1137, 14781, 15}, //reserved 88
-    { 1350, 1137, 14781, 15}, //reserved 89
-    { 135,   135,  1755,  2}, //index 90
-    { 270,   270,  3510,  4}, //index 91
-    { 405,   405,  5265,  5}, //index 92
-    { 540,   540,  7020,  7}, //index 93
-    { 810,   810, 10530, 11}, //index 94
-    { 1080, 1080, 14040, 14}, //index 95
-    { 1215, 1215, 15795, 16}, //index 96
-    { 1350, 1350, 17550, 18}, //index 97
-    { 1350, 1137, 14781, 15}, //index 98
-    { 1620, 1620, 21060, 21}, //index 99
-    { 1800, 1800, 23400, 23}, //index 100
-    { 1350, 1137, 14781, 15}, //reserved 101
-    { 1350, 1137, 14781, 15}, //index 102
-    { 1350, 1137, 14781, 15}, //index 103
-    { 1350, 1137, 14781, 15}, //index 104
-    { 1350, 1137, 14781, 15}, //index 105
-    { 1350, 1137, 14781, 15}, //index 106
-    { 1200, 1200, 15600, 16}, //index 107
-    { 1350, 1350, 17550, 18}, //index 108
-    { 1500, 1500, 19500, 20}, //index 109
-    { 1350, 1137, 14781, 15}, //index 110
-    { 1800, 1800, 23400, 23}, //index 111
-    { 2000, 2000, 26000, 26}, //index 112
-    { 1350, 1137, 14781, 15}, //index 113
-    { 292,   292,  3796,  4}, //index 114
-    { 585,   585,  7605,  8}, //index 115
-    { 877,   877, 11401, 11}, //index 116
-    { 1170, 1170, 15210, 15}, //index 117
-    { 1755, 1755, 22815, 23}, //index 118
-    { 2340, 2340, 30420, 30}, //index 119
-    { 2632, 2632, 34216, 34}, //index 120
-    { 2925, 2925, 38025, 38}, //index 121
-    { 1350, 1137, 14781, 15}, //index 122
-    { 3510, 3510, 45630, 46}, //index 123
-    { 3900, 3900, 50700, 51}, //index 124
-    { 1350, 1137, 14781, 15}, //reserved 125
-    { 1350, 1137, 14781, 15}, //index 126
-    { 1350, 1137, 14781, 15}, //index 127
-    { 1350, 1137, 14781, 15}, //index 128
-    { 1350, 1137, 14781, 15}, //index 129
-    { 1350, 1137, 14781, 15}, //index 130
-    { 1350, 1137, 14781, 15}, //index 131
-    { 2925, 2925, 38025, 38}, //index 132
-    { 3250, 3250, 42250, 42}, //index 133
-    { 1350, 1137, 14781, 15}, //index 134
-    { 3900, 3900, 50700, 51}, //index 135
-    { 4333, 4333, 56329, 56}  //index 136
+    { 1350,  675,  8775,  9}, //reserved 64
+    { 1350,  675,  8775,  9}, //reserved 65
+    {   65,   45,   585,  1}, //index 66
+    {  130,   91,  1183,  1}, //index 67
+    {  195,  136,  1768,  2}, //index 68
+    {  260,  182,  2366,  2}, //index 69
+    {  390,  273,  3549,  4}, //index 70
+    {  520,  364,  4732,  5}, //index 71
+    {  585,  409,  5317,  5}, //index 72
+    {  650,  455,  5915,  6}, //index 73
+    {  780,  546,  7098,  7}, //index 74
+    { 1350,  675,  8775,  9}, //reserved 75
+    { 1350,  675,  8775,  9}, //reserved 76
+    { 1350,  675,  8775,  9}, //reserved 77
+    { 1350,  675,  8775,  9}, //index 78
+    { 1350,  675,  8775,  9}, //index 79
+    { 1350,  675,  8775,  9}, //index 80
+    { 1350,  675,  8775,  9}, //index 81
+    { 1350,  675,  8775,  9}, //index 82
+    { 1350,  675,  8775,  9}, //index 83
+    {  655,  458,  5954,  6}, //index 84
+    {  722,  505,  6565,  7}, //index 85
+    {  866,  606,  7878,  8}, //index 86
+    { 1350,  675,  8775,  9}, //reserved 87
+    { 1350,  675,  8775,  9}, //reserved 88
+    { 1350,  675,  8775,  9}, //reserved 89
+    {  135,   94,  1222,  1}, //index 90
+    {  270,  189,  2457,  2}, //index 91
+    {  405,  283,  3679,  4}, //index 92
+    {  540,  378,  4914,  5}, //index 93
+    {  810,  567,  7371,  7}, //index 94
+    { 1080,  756,  9828, 10}, //index 95
+    { 1215,  850, 11050, 11}, //index 96
+    { 1350,  675,  8775,  9}, //index 97
+    { 1350,  675,  8775,  9}, //index 98
+    { 1620,  810, 10530, 11}, //index 99
+    { 1800,  900, 11700, 12}, //index 100
+    { 1350,  675,  8775,  9}, //reserved 101
+    { 1350,  675,  8775,  9}, //index 102
+    { 1350,  675,  8775,  9}, //index 103
+    { 1350,  675,  8775,  9}, //index 104
+    { 1350,  675,  8775,  9}, //index 105
+    { 1350,  675,  8775,  9}, //index 106
+    { 1200,  840, 10920, 11}, //index 107
+    { 1350,  675,  8775,  9}, //index 108
+    { 1500,  750,  9750, 10}, //index 109
+    { 1350,  675,  8775,  9}, //index 110
+    { 1800,  900, 11700, 12}, //index 111
+    { 2000, 1000, 13000, 13}, //index 112
+    { 1350,  675,  8775,  9}, //index 113
+    {  292,  204,  2652,  3}, //index 114
+    {  585,  409,  5317,  5}, //index 115
+    {  877,  613,  7969,  8}, //index 116
+    { 1170,  819, 10647, 11}, //index 117
+    { 1755,  877, 11401, 11}, //index 118
+    { 2340, 1170, 15210, 15}, //index 119
+    { 2632, 1316, 17108, 17}, //index 120
+    { 2925, 1462, 19006, 19}, //index 121
+    { 1350,  675,  8775,  9}, //index 122
+    { 3510, 1755, 22815, 23}, //index 123
+    { 3900, 1950, 25350, 25}, //index 124
+    { 1350,  675,  8775,  9}, //reserved 125
+    { 1350,  675,  8775,  9}, //index 126
+    { 1350,  675,  8775,  9}, //index 127
+    { 1350,  675,  8775,  9}, //index 128
+    { 1350,  675,  8775,  9}, //index 129
+    { 1350,  675,  8775,  9}, //index 130
+    { 1350,  675,  8775,  9}, //index 131
+    { 2925, 1462, 19006, 19}, //index 132
+    { 3250, 1625, 21125, 21}, //index 133
+    { 1350,  675,  8775,  9}, //index 134
+    { 3900, 1950, 25350, 25}, //index 135
+    { 4333, 2166, 28158, 28}  //index 136
  };
 
 /* TX stats */
@@ -274,6 +275,40 @@
 #define DTS_RATE_TPUT(x) gRateInfo[x].tputBpus
 #define DTS_11BRATE_TPUT_MULTIPLIER(x) g11bRateInfo[x].tputBpus
 
+/* RX thread frame size threshold to delay frame drain */
+#define DTS_RX_DELAY_FRAMESIZE_THRESHOLD  500
+
+/* API to fill Rate Info based on the mac efficiency passed to it
+ * macEff si used to caclulate mac throughput based on each rate index/PHY rate.
+ * This is eventually used by MAS to calculate RX stats periodically sent to FW
+ * The start and end Rate Index are the other arguments to this API - the new mac
+ * efficiency passed to this API (Arg1)  is only applied between startRateIndex (arg2) and endRateIndex (arg3).
+ */
+void WDTS_FillRateInfo(wpt_uint8 macEff, wpt_int16 startRateIndex, wpt_int16 endRateIndex)
+{
+    int i;
+
+    DTI_TRACE( DTI_TRACE_LEVEL_ERROR, "Change only 11ac rates");
+
+    for (i=startRateIndex; i<=endRateIndex; i++)
+    {
+        // tputRate --> unit in Mega bits per sec X 10
+        gRateInfo[i].tputRate = ((gRateInfo[i].phyRate * macEff)/100);
+        // tputBmps --> unit in Bytes per msec = (tputRateX1024x1024)/(8x10X1000) ~= (tputRate*13)
+        gRateInfo[i].tputBpms = gRateInfo[i].tputRate * MB_PER_SEC_TO_BYTES_PER_MSEC;
+        // tputBpus --> unit in Bytes per usec: (+ 500) to round off to integral value
+        gRateInfo[i].tputBpus = ((gRateInfo[i].tputBpms + 500) / 1000);
+        if (gRateInfo[i].tputBpus == 0)
+            gRateInfo[i].tputBpus = 1;
+
+        DTI_TRACE( DTI_TRACE_LEVEL_ERROR, "%4u, %4u, %5u, %2u",
+                            gRateInfo[i].phyRate,
+                            gRateInfo[i].tputRate,
+                            gRateInfo[i].tputBpms,
+                            gRateInfo[i].tputBpus );
+    }
+}
+
 /* Tx/Rx stats function
  * This function should be invoked to fetch the current stats
   * Parameters:
@@ -519,6 +554,18 @@
   ucMPDUHLen    = (wpt_uint8)WDI_RX_BD_GET_MPDU_H_LEN(pBDHeader);
   ucTid         = (wpt_uint8)WDI_RX_BD_GET_TID(pBDHeader);
 
+  /* If RX thread drain small size of frame from HW too fast
+   * Sometimes HW cannot handle interrupt fast enough
+   * And system crash might happen
+   * To avoid system crash, input 1usec delay each frame draining
+   * within host side, if frame size is smaller that threshold.
+   * This is SW work around, to fix HW problem
+   * Throughput and SnS test done successfully */
+  if (usMPDULen < DTS_RX_DELAY_FRAMESIZE_THRESHOLD)
+  {
+    wpalBusyWait(1);
+  }
+
   /*------------------------------------------------------------------------
     Gather AMSDU information 
     ------------------------------------------------------------------------*/
@@ -561,6 +608,12 @@
       if(VPKT_SIZE_BUFFER < (usMPDULen+ucMPDUHOffset)){
         DTI_TRACE( DTI_TRACE_LEVEL_FATAL,
                    "Invalid Frame size, might memory corrupted");
+
+        /* Size of the packet tranferred by the DMA engine is
+         * greater than the the memory allocated for the skb
+         */
+        WPAL_BUG(0);
+
         wpalPacketFree(pFrame);
         return eWLAN_PAL_STATUS_SUCCESS;
       }
@@ -584,6 +637,7 @@
       pRxMetadata->staId = WDI_RX_BD_GET_STA_ID(pBDHeader);
       pRxMetadata->addr3Idx = WDI_RX_BD_GET_ADDR3_IDX(pBDHeader);
       pRxMetadata->rxChannel = WDI_RX_BD_GET_RX_CHANNEL(pBDHeader);
+      pRxMetadata->rfBand = WDI_RX_BD_GET_RFBAND(pBDHeader);
       pRxMetadata->rtsf = WDI_RX_BD_GET_RTSF(pBDHeader);
       pRxMetadata->bsf = WDI_RX_BD_GET_BSF(pBDHeader);
       pRxMetadata->scan = WDI_RX_BD_GET_SCAN(pBDHeader);
@@ -633,7 +687,7 @@
       pRxMetadata->ampdu_reorderOpcode  = (wpt_uint8)WDI_RX_BD_GET_BA_OPCODE(pBDHeader);
       pRxMetadata->ampdu_reorderSlotIdx = (wpt_uint8)WDI_RX_BD_GET_BA_SI(pBDHeader);
       pRxMetadata->ampdu_reorderFwdIdx  = (wpt_uint8)WDI_RX_BD_GET_BA_FI(pBDHeader);
-      pRxMetadata->currentPktSeqNo       = (wpt_uint8)WDI_RX_BD_GET_BA_CSN(pBDHeader);
+      pRxMetadata->currentPktSeqNo       = (wpt_uint16)WDI_RX_BD_GET_BA_CSN(pBDHeader);
 
 
       /*------------------------------------------------------------------------
diff --git a/CORE/WDI/WPAL/inc/wlan_qct_os_trace.h b/CORE/WDI/WPAL/inc/wlan_qct_os_trace.h
index cf17b3e..3f4b525 100644
--- a/CORE/WDI/WPAL/inc/wlan_qct_os_trace.h
+++ b/CORE/WDI/WPAL/inc/wlan_qct_os_trace.h
@@ -28,6 +28,7 @@
 #if !defined( __WLAN_QCT_OS_TRACE_H )
 #define __WLAN_QCT_OS_TRACE_H
 
+#include <vos_trace.h>
 
 #ifdef WLAN_DEBUG
 
@@ -82,9 +83,6 @@
 void wpalDump( wpt_moduleid module, wpt_tracelevel level,
                wpt_uint8 *memory, wpt_uint32 length);
 
-#define WPAL_TRACE wpalTrace
-#define WPAL_DUMP wpalDump
-
 #define WPAL_ASSERT( _condition )   do {                                \
         if ( ! ( _condition ) )                                         \
         {                                                               \
@@ -94,10 +92,18 @@
     } while (0)
 #else //WLAN_DEBUG
 
-#define WPAL_TRACE
-#define WPAL_DUMP
-#define WPAL_ASSERT
+static inline void wpalTrace( wpt_moduleid module, wpt_tracelevel level,
+                              char *strFormat, ... ){};
+static inline void wpalDump( wpt_moduleid module, wpt_tracelevel level,
+                             wpt_uint8 *memory, wpt_uint32 length) {};
+static inline void wpalTraceSetLevel( wpt_moduleid module,
+                         wpt_tracelevel level, wpt_boolean on ) {};
+static inline void wpalTraceDisplay(void) {};
+#define WPAL_ASSERT(x) do {} while (0);
 
 #endif //WLAN_DEBUG
 
+#define WPAL_TRACE wpalTrace
+#define WPAL_DUMP wpalDump
+
 #endif // __WLAN_QCT_OS_TRACE_H
diff --git a/CORE/WDI/WPAL/inc/wlan_qct_os_type.h b/CORE/WDI/WPAL/inc/wlan_qct_os_type.h
index c6dfaab..edaa153 100644
--- a/CORE/WDI/WPAL/inc/wlan_qct_os_type.h
+++ b/CORE/WDI/WPAL/inc/wlan_qct_os_type.h
@@ -42,26 +42,27 @@
   
   ========================================================================*/
 
+#include <linux/types.h>
 
-typedef unsigned long wpt_uint32;
+typedef u32 wpt_uint32;
 
-typedef signed long wpt_int32;
+typedef s32 wpt_int32;
 
-typedef unsigned short wpt_uint16;
+typedef u16 wpt_uint16;
 
-typedef signed short wpt_int16;
+typedef s16 wpt_int16;
 
-typedef unsigned char wpt_uint8;
+typedef u8 wpt_uint8;
 
 typedef wpt_uint8 wpt_byte;
 
-typedef signed char wpt_int8;
+typedef s8 wpt_int8;
 
-typedef wpt_uint8 wpt_boolean; 
+typedef wpt_uint8 wpt_boolean;
 
-typedef unsigned long long wpt_uint64;
+typedef u64 wpt_uint64;
 
-typedef long long wpt_int64;
+typedef s64 wpt_int64;
 
 #define WPT_INLINE __inline__
 #define WPT_STATIC static
diff --git a/CORE/WDI/WPAL/inc/wlan_qct_pal_api.h b/CORE/WDI/WPAL/inc/wlan_qct_pal_api.h
index 82539fa..2fd3fc4 100644
--- a/CORE/WDI/WPAL/inc/wlan_qct_pal_api.h
+++ b/CORE/WDI/WPAL/inc/wlan_qct_pal_api.h
@@ -232,7 +232,7 @@
 #ifdef QCA_WIFI_2_0
 static inline wpt_status wpalDbgReadRegister(wpt_uint32 regAddr, wpt_uint32 *pregValue)
 {
-	return eWLAN_PAL_STATUS_SUCCESS;
+        return eWLAN_PAL_STATUS_SUCCESS;
 }
 #else
 wpt_status wpalDbgReadRegister(wpt_uint32 regAddr, wpt_uint32 *pregValue);
@@ -248,9 +248,9 @@
 ---------------------------------------------------------------------------*/
 #ifdef QCA_WIFI_2_0
 static inline wpt_status wpalDbgWriteRegister(wpt_uint32 regAddr,
-					      wpt_uint32 regValue)
+                                              wpt_uint32 regValue)
 {
-	return eWLAN_PAL_STATUS_SUCCESS;
+        return eWLAN_PAL_STATUS_SUCCESS;
 }
 #else
 wpt_status wpalDbgWriteRegister(wpt_uint32 regAddr, wpt_uint32 regValue);
@@ -267,9 +267,9 @@
 ---------------------------------------------------------------------------*/
 #ifdef QCA_WIFI_2_0
 static inline wpt_status wpalDbgReadMemory(wpt_uint32 memAddr, wpt_uint8 *buf,
-					   wpt_uint32 len)
+                                           wpt_uint32 len)
 {
-	return eWLAN_PAL_STATUS_SUCCESS;
+        return eWLAN_PAL_STATUS_SUCCESS;
 }
 #else
 wpt_status wpalDbgReadMemory(wpt_uint32 memAddr, wpt_uint8 *buf, wpt_uint32 len);
@@ -286,9 +286,9 @@
 ---------------------------------------------------------------------------*/
 #ifdef QCA_WIFI_2_0
 static inline wpt_status wpalDbgWriteMemory(wpt_uint32 memAddr, wpt_uint8 *buf,
-					    wpt_uint32 len)
+                                            wpt_uint32 len)
 {
-	return eWLAN_PAL_STATUS_SUCCESS;
+        return eWLAN_PAL_STATUS_SUCCESS;
 }
 #else
 wpt_status wpalDbgWriteMemory(wpt_uint32 memAddr, wpt_uint8 *buf, wpt_uint32 len);
@@ -352,4 +352,19 @@
 ---------------------------------------------------------------------------*/
 void wpalWcnssResetIntr(void);
 
+/*---------------------------------------------------------------------------
+    wpalFwDumpReq -  Trigger the dump commands to Firmware
+
+    Param:
+       cmd - Command No. to execute
+       arg1 - argument 1 to cmd
+       arg2 - argument 2 to cmd
+       arg3 - argument 3 to cmd
+       arg4 - argument 4 to cmd
+    Return:
+       NONE
+---------------------------------------------------------------------------*/
+void wpalFwDumpReq(wpt_uint32 cmd, wpt_uint32 arg1, wpt_uint32 arg2,
+                    wpt_uint32 arg3, wpt_uint32 arg4);
+
 #endif // __WLAN_QCT_PAL_API_H
diff --git a/CORE/WDI/WPAL/inc/wlan_qct_pal_device.h b/CORE/WDI/WPAL/inc/wlan_qct_pal_device.h
index 09a5bb8..9a12bb0 100644
--- a/CORE/WDI/WPAL/inc/wlan_qct_pal_device.h
+++ b/CORE/WDI/WPAL/inc/wlan_qct_pal_device.h
@@ -217,7 +217,7 @@
    wpt_uint32                          *data
 )
 {
-	return eWLAN_PAL_STATUS_SUCCESS;
+        return eWLAN_PAL_STATUS_SUCCESS;
 }
 #else
 wpt_status wpalReadRegister
@@ -243,7 +243,7 @@
    wpt_uint32                           data
 )
 {
-	return eWLAN_PAL_STATUS_SUCCESS;
+        return eWLAN_PAL_STATUS_SUCCESS;
 }
 #else
 wpt_status wpalWriteRegister
@@ -272,7 +272,7 @@
    wpt_uint32                            len
 )
 {
-	return eWLAN_PAL_STATUS_SUCCESS;
+        return eWLAN_PAL_STATUS_SUCCESS;
 }
 #else
 wpt_status wpalReadDeviceMemory
@@ -302,7 +302,7 @@
    wpt_uint32                            len
 )
 {
-	return eWLAN_PAL_STATUS_SUCCESS;
+        return eWLAN_PAL_STATUS_SUCCESS;
 }
 #else
 wpt_status wpalWriteDeviceMemory
diff --git a/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h b/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h
index f6eb149..3144503 100644
--- a/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h
+++ b/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h
@@ -44,6 +44,10 @@
 
 #include "wlan_qct_pal_type.h"
 #include "wlan_qct_pal_status.h"
+#include "vos_types.h"
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+#include "vos_diag_core_log.h"
+#endif /* FEATURE_WLAN_DIAG_SUPPORT */
 
 // The size of the data buffer in vos/pal packets
 // Explanation:
@@ -75,6 +79,11 @@
 // we must add the size of the 802.11 header to that 
 #define VPKT_SIZE_BUFFER  ((30 * 128) + 32)
 
+/* Transport channel count to report DIAG */
+#define WPT_NUM_TRPT_CHANNEL      4
+/* Transport channel name string size */
+#define WPT_TRPT_CHANNEL_NAME     4
+
 typedef enum
 {
    ///Packet is used to transmit 802.11 Management frames.
@@ -117,6 +126,28 @@
    void *pContext;
 } wpt_iterator;
 
+/* Each specific channel dedicated information should be logged */
+typedef struct
+{
+   char         channelName[WPT_TRPT_CHANNEL_NAME];
+   v_U32_t      numDesc;
+   v_U32_t      numFreeDesc;
+   v_U32_t      numRsvdDesc;
+   v_U32_t      headDescOrder;
+   v_U32_t      tailDescOrder;
+   v_U32_t      ctrlRegVal;
+   v_U32_t      statRegVal;
+   v_U32_t      numValDesc;
+   v_U32_t      numInvalDesc;
+} wpt_log_data_stall_channel_type;
+
+/* Transport log context */
+typedef struct
+{
+   v_U32_t                          PowerState;
+   v_U32_t                          numFreeBd;
+   wpt_log_data_stall_channel_type  dxeChannelInfo[WPT_NUM_TRPT_CHANNEL];
+} wpt_log_data_stall_type;
 
 //pPkt is a pointer to wpt_packet
 #define WPAL_PACKET_SET_BD_POINTER(pPkt, pBd)   ( (pPkt)->pBD = (pBd) )
@@ -315,4 +346,54 @@
 ---------------------------------------------------------------------------*/
 wpt_status wpalIsPacketLocked( wpt_packet *pPacket);
 
+/*---------------------------------------------------------------------------
+   wpalGetNumRxRawPacket   Query available RX RAW total buffer count
+   param:
+       numRxResource  pointer of queried value
+
+   return:
+       eWLAN_PAL_STATUS_SUCCESS
+---------------------------------------------------------------------------*/
+wpt_status wpalGetNumRxRawPacket(wpt_uint32 *numRxResource);
+
+/*---------------------------------------------------------------------------
+    wpalPacketStallUpdateInfo – Update each channel information when stall
+       detected, also power state and free resource count
+
+    Param:
+       powerState  ? WLAN system power state when stall detected
+       numFreeBd   ? Number of free resource count in HW
+       channelInfo ? Each channel specific information when stall happen
+       channelNum  ? Channel number update information
+
+    Return:
+       NONE
+
+---------------------------------------------------------------------------*/
+void wpalPacketStallUpdateInfo
+(
+   v_U32_t                         *powerState,
+   v_U32_t                         *numFreeBd,
+   wpt_log_data_stall_channel_type *channelInfo,
+   v_U8_t                           channelNum
+);
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/*---------------------------------------------------------------------------
+    wpalPacketStallDumpLog – Trigger to send log packet to DIAG
+       Updated transport system information will be sent to DIAG
+
+    Param:
+        NONE
+
+    Return:
+        NONE
+
+---------------------------------------------------------------------------*/
+void wpalPacketStallDumpLog
+(
+   void
+);
+#endif /* FEATURE_WLAN_DIAG_SUPPORT */
+
 #endif // __WLAN_QCT_PAL_PACKET_H
diff --git a/CORE/WDI/WPAL/inc/wlan_qct_pal_timer.h b/CORE/WDI/WPAL/inc/wlan_qct_pal_timer.h
index 6eebf1a..495cf9f 100644
--- a/CORE/WDI/WPAL/inc/wlan_qct_pal_timer.h
+++ b/CORE/WDI/WPAL/inc/wlan_qct_pal_timer.h
@@ -125,6 +125,13 @@
 ---------------------------------------------------------------------------*/
 wpt_status wpalSleep(wpt_uint32 timeout);
 
-
+/*---------------------------------------------------------------------------
+    wpalBusyWait - Thread busy wait with specified usec
+    Param:
+        usecDelay - amount of time to wait. In unit of micro-seconds.
+    Return:
+        NONE
+---------------------------------------------------------------------------*/
+void wpalBusyWait(wpt_uint32 usecDelay);
 
 #endif // __WLAN_QCT_PAL_TIMER_H
diff --git a/CORE/WDI/WPAL/inc/wlan_qct_pal_trace.h b/CORE/WDI/WPAL/inc/wlan_qct_pal_trace.h
index 24cf137..e3a6188 100644
--- a/CORE/WDI/WPAL/inc/wlan_qct_pal_trace.h
+++ b/CORE/WDI/WPAL/inc/wlan_qct_pal_trace.h
@@ -134,5 +134,5 @@
   --------------------------------------------------------------------------*/
 void wpalTraceDisplay(void);
 
-
+#define WPAL_BUG VOS_BUG
 #endif // __WLAN_QCT_PAL_TRACE_H
diff --git a/CORE/WDI/WPAL/src/wlan_qct_pal_api.c b/CORE/WDI/WPAL/src/wlan_qct_pal_api.c
index efccd89..93a270e 100644
--- a/CORE/WDI/WPAL/src/wlan_qct_pal_api.c
+++ b/CORE/WDI/WPAL/src/wlan_qct_pal_api.c
@@ -220,7 +220,7 @@
    if ( NULL == pv ) 
    {
      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                 "%s Unable to allocate DMA buffer\n", __func__);
+                 "%s Unable to allocate DMA buffer", __func__);
      return NULL;
    }
 
@@ -413,3 +413,23 @@
 #endif
    return;
 }
+
+
+/*---------------------------------------------------------------------------
+    wpalFwDumpReq -  Trigger the dump commands to Firmware
+
+    Param:
+       cmd - Command No. to execute
+       arg1 - argument 1 to cmd
+       arg2 - argument 2 to cmd
+       arg3 - argument 3 to cmd
+       arg4 - argument 4 to cmd
+    Return:
+       NONE
+---------------------------------------------------------------------------*/
+void wpalFwDumpReq(wpt_uint32 cmd, wpt_uint32 arg1, wpt_uint32 arg2,
+                    wpt_uint32 arg3, wpt_uint32 arg4)
+{
+   vos_fwDumpReq(cmd, arg1, arg2, arg3, arg4);
+   return;
+}
diff --git a/CORE/WDI/WPAL/src/wlan_qct_pal_device.c b/CORE/WDI/WPAL/src/wlan_qct_pal_device.c
index 4666dbf..0aa9b7e 100644
--- a/CORE/WDI/WPAL/src/wlan_qct_pal_device.c
+++ b/CORE/WDI/WPAL/src/wlan_qct_pal_device.c
@@ -448,7 +448,11 @@
    wpt_uint32   data
 )
 {
-   if (NULL == gpEnv) {
+   /* if SSR is in progress, and WCNSS is not out of reset (re-init
+    * not invoked), then do not access WCNSS registers */
+   if (NULL == gpEnv ||
+        (vos_is_logp_in_progress(VOS_MODULE_ID_WDI, NULL) &&
+            !vos_is_reinit_in_progress(VOS_MODULE_ID_WDI, NULL))) {
       WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "%s: invoked before subsystem initialized",
                  __func__);
@@ -460,7 +464,8 @@
       WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "%s: Register address 0x%0x out of range 0x%0x - 0x%0x",
                  __func__, address,
-                 gpEnv->wcnss_memory->start, gpEnv->wcnss_memory->end);
+                 (u32) gpEnv->wcnss_memory->start,
+                 (u32) gpEnv->wcnss_memory->end);
       return eWLAN_PAL_STATUS_E_INVAL;
    }
 
@@ -492,7 +497,11 @@
    wpt_uint32  *data
 )
 {
-   if (NULL == gpEnv) {
+   /* if SSR is in progress, and WCNSS is not out of reset (re-init
+    * not invoked), then do not access WCNSS registers */
+   if (NULL == gpEnv ||
+        (vos_is_logp_in_progress(VOS_MODULE_ID_WDI, NULL) &&
+            !vos_is_reinit_in_progress(VOS_MODULE_ID_WDI, NULL))) {
       WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "%s: invoked before subsystem initialized",
                  __func__);
@@ -504,7 +513,8 @@
       WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "%s: Register address 0x%0x out of range 0x%0x - 0x%0x",
                  __func__, address,
-                 gpEnv->wcnss_memory->start, gpEnv->wcnss_memory->end);
+                 (u32) gpEnv->wcnss_memory->start,
+                 (u32) gpEnv->wcnss_memory->end);
       return eWLAN_PAL_STATUS_E_INVAL;
    }
 
@@ -539,7 +549,11 @@
   wpt_uint32 len
 )
 {
-   if (NULL == gpEnv) {
+   /* if SSR is in progress, and WCNSS is not out of reset (re-init
+    * not invoked), then do not access WCNSS registers */
+   if (NULL == gpEnv ||
+        (vos_is_logp_in_progress(VOS_MODULE_ID_WDI, NULL) &&
+            !vos_is_reinit_in_progress(VOS_MODULE_ID_WDI, NULL))) {
       WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "%s: invoked before subsystem initialized",
                  __func__);
@@ -551,7 +565,8 @@
       WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "%s: Memory address 0x%0x len %d out of range 0x%0x - 0x%0x",
                  __func__, address, len,
-                 gpEnv->wcnss_memory->start, gpEnv->wcnss_memory->end);
+                 (u32) gpEnv->wcnss_memory->start,
+                 (u32) gpEnv->wcnss_memory->end);
       return eWLAN_PAL_STATUS_E_INVAL;
    }
 
@@ -579,7 +594,11 @@
   wpt_uint32 len
 )
 {
-   if (NULL == gpEnv) {
+   /* if SSR is in progress, and WCNSS is not out of reset (re-init
+    * not invoked), then do not access WCNSS registers */
+   if (NULL == gpEnv ||
+        (vos_is_logp_in_progress(VOS_MODULE_ID_WDI, NULL) &&
+            !vos_is_reinit_in_progress(VOS_MODULE_ID_WDI, NULL))) {
       WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "%s: invoked before subsystem initialized",
                  __func__);
@@ -591,7 +610,8 @@
       WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_ERROR,
                  "%s: Memory address 0x%0x len %d out of range 0x%0x - 0x%0x",
                  __func__, address, len,
-                 gpEnv->wcnss_memory->start, gpEnv->wcnss_memory->end);
+                 (u32) gpEnv->wcnss_memory->start,
+                 (u32) gpEnv->wcnss_memory->end);
       return eWLAN_PAL_STATUS_E_INVAL;
    }
 
diff --git a/CORE/WDI/WPAL/src/wlan_qct_pal_msg.c b/CORE/WDI/WPAL/src/wlan_qct_pal_msg.c
index 2eb5c6c..f999139 100644
--- a/CORE/WDI/WPAL/src/wlan_qct_pal_msg.c
+++ b/CORE/WDI/WPAL/src/wlan_qct_pal_msg.c
@@ -75,7 +75,7 @@
    }
    else
    {
-      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s fail to post msg %d\n",
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s fail to post msg %d",
                   __func__, pMsg->type);
    }
 
@@ -113,7 +113,7 @@
    }
    else
    {
-      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s fail to post msg %d\n",
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s fail to post msg %d",
                   __func__, pMsg->type);
    }
 
@@ -150,7 +150,7 @@
    }
    else
    {
-      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s fail to post msg %d\n",
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s fail to post msg %d",
                   __func__, pMsg->type);
    }
 
diff --git a/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c b/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c
index ea9534f..8181731 100644
--- a/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c
+++ b/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c
@@ -25,8 +25,6 @@
  * to the Linux Foundation.
  */
 
-
-
 /**=========================================================================
   
   \file  wlan_qct_pal_packet.c
@@ -70,6 +68,12 @@
 /* Storage for DXE CB function pointer */
 static wpalPacketLowPacketCB wpalPacketAvailableCB;
 
+/* Temp storage for transport channel DIAG/LOG information
+ * Each channel will update information with different context
+ * Before send stored date to DIAG,
+ * temporary it should be stored */
+static wpt_log_data_stall_type wpalTrasportStallInfo;
+
 /*
    wpalPacketInit is no-op for VOSS-support wpt_packet
 */
@@ -123,6 +127,9 @@
    }
 
    wpalPacketAvailableCB( (wpt_packet *)pPacket, userData );
+
+   wpalPacketAvailableCB = NULL;
+
    return VOS_STATUS_SUCCESS;
 }
 
@@ -144,8 +151,6 @@
    v_U16_t      allocLen;
    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
 
-   /* Initialize DXE CB function pointer storage */
-   wpalPacketAvailableCB = NULL;
    switch (pktType)
    {
    case eWLAN_PAL_PKT_TYPE_TX_802_11_MGMT:
@@ -185,7 +190,7 @@
 
    default:
       WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                  " try to allocate unsupported packet type (%d)\n", pktType);
+                  " try to allocate unsupported packet type (%d)", pktType);
       break;
    }
 
@@ -255,7 +260,7 @@
    }
    else
    {
-      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s  failed\n",
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s  failed",
          __func__);
    }
 
@@ -291,7 +296,7 @@
 
    if( !VOS_IS_STATUS_SUCCESS(vos_pkt_trim_head(WPAL_TO_VOS_PKT(pPkt), (v_SIZE_t)size)) )
    {
-      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s  Invalid trim(%d)\n",
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s  Invalid trim(%d)",
          __func__, size);
       status = eWLAN_PAL_STATUS_E_INVAL;
    }
@@ -323,7 +328,7 @@
                (eWLAN_PAL_PKT_TYPE_RX_RAW == WPAL_PACKET_GET_TYPE(pPkt)) );
    if( !VOS_IS_STATUS_SUCCESS(vos_pkt_trim_tail(WPAL_TO_VOS_PKT(pPkt), (v_SIZE_t)size)) )
    {
-      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s  Invalid trim(%d)\n",
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, "%s  Invalid trim(%d)",
          __func__, size);
       status = eWLAN_PAL_STATUS_E_INVAL;
    }
@@ -390,7 +395,7 @@
    if( (eWLAN_PAL_PKT_TYPE_RX_RAW != WPAL_PACKET_GET_TYPE(pPkt)))
    {
      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                "%s  Invalid packet type(%d)\n",  __func__, 
+                "%s  Invalid packet type(%d)",  __func__,
                 WPAL_PACKET_GET_TYPE(pPkt));
      return eWLAN_PAL_STATUS_E_INVAL;
    }
@@ -483,7 +488,7 @@
    if (unlikely((NULL == pPacket)||(NULL==pIter)))
    {
       WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
-                "%s : NULL input pointers %x %x", __func__, pPacket, pIter);
+                "%s : NULL input pointers %p %p", __func__, pPacket, pIter);
       return eWLAN_PAL_STATUS_E_INVAL;
    }
 
@@ -551,7 +556,7 @@
       ( NULL == ppAddr ) || ( NULL == pLen )))
    {
      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                "%s  Invalid input parameters \n",  __func__ );
+                "%s  Invalid input parameters",  __func__ );
      return eWLAN_PAL_STATUS_E_INVAL;
    }
 
@@ -783,7 +788,7 @@
    /* Validate the parameter pointers */
    if (NULL == pPacket)
    {
-      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_WARN,
                 "%s : NULL input pointer", __func__);
       return eWLAN_PAL_STATUS_E_INVAL;
    }
@@ -794,3 +799,97 @@
                     eWLAN_PAL_STATUS_SUCCESS;
 }/*wpalIsPacketLocked*/
 
+/*---------------------------------------------------------------------------
+   wpalGetNumRxRawPacket   Query available RX RAW total buffer count
+   param:
+       numRxResource  pointer of queried value
+
+   return:
+       eWLAN_PAL_STATUS_SUCCESS
+---------------------------------------------------------------------------*/
+wpt_status wpalGetNumRxRawPacket(wpt_uint32 *numRxResource)
+{
+   *numRxResource = (wpt_uint32)vos_pkt_get_num_of_rx_raw_pkts();
+
+   return eWLAN_PAL_STATUS_SUCCESS;
+}
+
+/*---------------------------------------------------------------------------
+    wpalPacketStallUpdateInfo – Update each channel information when stall
+       detected, also power state and free resource count
+
+    Param:
+       powerState  ? WLAN system power state when stall detected
+       numFreeBd   ? Number of free resource count in HW
+       channelInfo ? Each channel specific information when stall happen
+       channelNum  ? Channel number update information
+
+    Return:
+       NONE
+
+---------------------------------------------------------------------------*/
+void wpalPacketStallUpdateInfo
+(
+   v_U32_t                         *powerState,
+   v_U32_t                         *numFreeBd,
+   wpt_log_data_stall_channel_type *channelInfo,
+   v_U8_t                           channelNum
+)
+{
+   /* Update power state when stall detected */
+   if(NULL != powerState)
+   {
+      wpalTrasportStallInfo.PowerState = *powerState;
+   }
+
+   /* Update HW free resource count */
+   if(NULL != numFreeBd)
+   {
+      wpalTrasportStallInfo.numFreeBd  = *numFreeBd;
+   }
+
+   /* Update channel information */
+   if(NULL != channelInfo)
+   {
+      wpalMemoryCopy(&wpalTrasportStallInfo.dxeChannelInfo[channelNum],
+                     channelInfo,
+                     sizeof(wpt_log_data_stall_channel_type));
+   }
+
+   return;
+}
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/*---------------------------------------------------------------------------
+    wpalPacketStallDumpLog – Trigger to send log packet to DIAG
+       Updated transport system information will be sent to DIAG
+
+    Param:
+        NONE
+
+    Return:
+        NONE
+
+---------------------------------------------------------------------------*/
+void wpalPacketStallDumpLog
+(
+   void
+)
+{
+   vos_log_data_stall_type  *log_ptr = NULL;
+
+   WLAN_VOS_DIAG_LOG_ALLOC(log_ptr, vos_log_data_stall_type, LOG_TRSP_DATA_STALL_C);
+   if(log_ptr)
+   {
+      log_ptr->PowerState = wpalTrasportStallInfo.PowerState;
+      log_ptr->numFreeBd  = wpalTrasportStallInfo.numFreeBd;
+      wpalMemoryCopy(&log_ptr->dxeChannelInfo[0],
+                     &wpalTrasportStallInfo.dxeChannelInfo[0],
+                     WPT_NUM_TRPT_CHANNEL * sizeof(vos_log_data_stall_channel_type));
+      pr_info("Stall log dump");
+      WLAN_VOS_DIAG_LOG_REPORT(log_ptr);
+   }
+
+   return;
+}
+#endif /* FEATURE_WLAN_DIAG_SUPPORT */
diff --git a/CORE/WDI/WPAL/src/wlan_qct_pal_sync.c b/CORE/WDI/WPAL/src/wlan_qct_pal_sync.c
index c79697e..d6f6a7c 100644
--- a/CORE/WDI/WPAL/src/wlan_qct_pal_sync.c
+++ b/CORE/WDI/WPAL/src/wlan_qct_pal_sync.c
@@ -25,8 +25,6 @@
  * to the Linux Foundation.
  */
 
-
-
 /**=========================================================================
   
   \file  wlan_qct_pal_sync.c
@@ -64,7 +62,7 @@
    if( vos_lock_init( (vos_lock_t*)pMutex  ) != VOS_STATUS_SUCCESS )
    {
       WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                 " mutex init fail\n");
+                 " mutex init fail");
       return eWLAN_PAL_STATUS_E_FAILURE;
    }
 
@@ -85,7 +83,7 @@
    if( vos_lock_destroy( (vos_lock_t*)pMutex  ) != VOS_STATUS_SUCCESS )
    {
       WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                 " mutex delete fail\n");
+                 " mutex delete fail");
       return eWLAN_PAL_STATUS_E_FAILURE;
    }
 
@@ -106,7 +104,7 @@
    if( vos_lock_acquire( (vos_lock_t*)pMutex  ) != VOS_STATUS_SUCCESS )
    {
       WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                 " mutex acquire fail\n");
+                 " mutex acquire fail");
       return eWLAN_PAL_STATUS_E_FAILURE;
    }
 
@@ -127,7 +125,7 @@
    if( vos_lock_release( (vos_lock_t*)pMutex ) != VOS_STATUS_SUCCESS )
    {
       WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                 " mutex release\n");
+                 " mutex release");
       return eWLAN_PAL_STATUS_E_FAILURE;
    }
 
@@ -148,7 +146,7 @@
    if( vos_event_init( (vos_event_t*)pEvent ) != VOS_STATUS_SUCCESS )
    {
       WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                 " create event fail\n");
+                 " create event fail");
       return eWLAN_PAL_STATUS_E_FAILURE;
    }
 
@@ -170,7 +168,7 @@
    if( vos_event_destroy( (vos_event_t*)pEvent ) != VOS_STATUS_SUCCESS )
    {
       WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, 
-                 " delete event fail\n");
+                 " delete event fail");
       return eWLAN_PAL_STATUS_E_FAILURE;
    }
 
diff --git a/CORE/WDI/WPAL/src/wlan_qct_pal_timer.c b/CORE/WDI/WPAL/src/wlan_qct_pal_timer.c
index a6fe427..9b386ec 100644
--- a/CORE/WDI/WPAL/src/wlan_qct_pal_timer.c
+++ b/CORE/WDI/WPAL/src/wlan_qct_pal_timer.c
@@ -25,8 +25,6 @@
  * to the Linux Foundation.
  */
 
-
-
 /**=========================================================================
   
   \file  wlan_qct_pal_timer.c
@@ -46,6 +44,8 @@
 #include "wlan_qct_os_status.h"
 #include "vos_threads.h"
 
+#include <linux/delay.h>
+
 /*---------------------------------------------------------------------------
  \brief wpalTimerCback - VOS timer callback function
 
@@ -61,8 +61,9 @@
    }
    else
    {
-      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_WARN, " %s pTimer(%d) callback after deleted \n",
-         __func__, (wpt_uint32)pTimer );
+      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_WARN,
+                  " %s pTimer(%p) callback after deleted",
+                  __func__, pTimer );
    }
 }/*wpalTimerCback*/
 
@@ -80,8 +81,9 @@
    /* Sanity Checks */
    if( pTimer == NULL || callback == NULL )
    {
-      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, " %s Wrong param pTimer(%d) callback(%d)\n",
-         __func__, (wpt_uint32)pTimer, (wpt_uint32)callback );
+      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                  " %s Wrong param pTimer(%p) callback(%p)",
+                  __func__, pTimer, callback );
       return eWLAN_PAL_STATUS_E_INVAL;
    }
 
@@ -111,8 +113,9 @@
    /* Sanity Checks */
    if( pTimer == NULL )
    {
-      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, " %s Wrong param pTimer(%d)\n",
-         __func__, (wpt_uint32)pTimer );
+      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                  " %s Wrong param pTimer(%p)",
+                  __func__, pTimer );
       return eWLAN_PAL_STATUS_E_INVAL;
    }
 
@@ -142,8 +145,9 @@
    /* Sanity Checks */
    if( pTimer == NULL )
    {
-      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, " %s Wrong param pTimer(%d)\n",
-         __func__, (wpt_uint32)pTimer );
+      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                  " %s Wrong param pTimer(%p)",
+                  __func__, pTimer );
       return eWLAN_PAL_STATUS_E_INVAL;
    }
    return ( WPAL_VOS_TO_WPAL_STATUS( vos_timer_start( &pTimer->timer.timerObj,
@@ -165,8 +169,9 @@
    /* Sanity Checks */
    if( pTimer == NULL )
    {
-      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, " %s Wrong param pTimer(%d)\n",
-         __func__, (wpt_uint32)pTimer );
+      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                  " %s Wrong param pTimer(%p)",
+                  __func__, pTimer );
       return eWLAN_PAL_STATUS_E_INVAL;
    }
    return (WPAL_VOS_TO_WPAL_STATUS( vos_timer_stop( &pTimer->timer.timerObj )));
@@ -185,8 +190,9 @@
    /* Sanity Checks */
    if( pTimer == NULL )
    {
-      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR, " %s Wrong param pTimer(%d)\n",
-         __func__, (wpt_uint32)pTimer );
+      WPAL_TRACE( eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                  " %s Wrong param pTimer(%p)",
+                  __func__, pTimer );
       return eWLAN_PAL_STATUS_E_INVAL;
    }
    return vos_timer_getCurrentState( &pTimer->timer.timerObj );
@@ -215,3 +221,16 @@
    vos_sleep( timeout );
    return eWLAN_PAL_STATUS_SUCCESS;
 }
+
+/*---------------------------------------------------------------------------
+    wpalBusyWait - Thread busy wait with specified usec
+    Param:
+        usecDelay - amount of time to wait. In unit of micro-seconds.
+    Return:
+        NONE
+---------------------------------------------------------------------------*/
+void wpalBusyWait(wpt_uint32 usecDelay)
+{
+   vos_busy_wait(usecDelay);
+   return;
+}
diff --git a/firmware_bin/WCNSS_cfg.dat b/firmware_bin/WCNSS_cfg.dat
old mode 100644
new mode 100755
index ae35674..b815530
--- a/firmware_bin/WCNSS_cfg.dat
+++ b/firmware_bin/WCNSS_cfg.dat
Binary files differ
diff --git a/firmware_bin/WCNSS_qcom_cfg.ini b/firmware_bin/WCNSS_qcom_cfg.ini
index b64cc86..158584f 100644
--- a/firmware_bin/WCNSS_qcom_cfg.ini
+++ b/firmware_bin/WCNSS_qcom_cfg.ini
@@ -34,11 +34,6 @@
 gDot11Mode=0
 
 
-# Handoff Enable(1) Disable(0)
-
-gEnableHandoff=0
-
-
 # CSR Roaming Enable(1) Disable(0)
 
 gRoamingTime=0
@@ -65,6 +60,8 @@
 
 InfraUapsdBkSrvIntv=0
 
+# Flag to allow STA send AddTspec even when ACM is Off
+gAddTSWhenACMIsOff=1
 
 # Make 1x1 the default antenna configuration
 
@@ -87,7 +84,7 @@
 
 # 2: Filter all Broadcast. 3: Filter all Mcast abd Bcast
 
-McastBcastFilter=0
+McastBcastFilter=3
 
 
 #Flag to enable HostARPOffload feature or not
@@ -169,7 +166,7 @@
 # CCX Support and fast transition
 CcxEnabled=0
 FastTransitionEnabled=1
-ImplicitQosIsEnabled=1
+ImplicitQosIsEnabled=0
 gNeighborScanTimerPeriod=200
 
 gNeighborLookupThreshold=76
@@ -318,12 +315,31 @@
 
 gStaKeepAlivePeriod = 30
 
-#AP LINK MONITOR TIMEOUT is used for both SAP and GO mode.
-#It is used to change the frequency of keep alive packets in the AP Link Monitor period which is by
-#default 20s. Currently the keep alive packets are sent as an interval of 3s but after this change
-#the keep alive packet frequency can be changed.
+#Say gGoKeepAlivePeriod(5 seconds) and gGoLinkMonitorPeriod(10 seconds).
+#For every 10 seconds DUT send Qos Null frame(i.e., Keep Alive frame if link is idle for last 10 seconds.)
+#For both active and power save clients.
 
-#gApLinkMonitorPeriod = 3
+#Power save clients: DUT set TIM bit from 10th second onwards and till client honors TIM bit.
+#If doesn't honor for 5 seconds then DUT remove client.
+
+#Active clients: DUT send Qos Null frame for 10th seconds onwards if it is not success still we try on
+#11th second if not tries on 12th and so on till 15th second. Hence before disconnection DUT will send 5 NULL frames.
+#Hence in any case DUT will detect client got removed in (10+5) seconds. i.e., (gGoKeepAlivePeriod + gGoLinkMonitorPeriod)..
+
+#gGoLinkMonitorPeriod/ gApLinkMonitorPeriod is period where link is idle and it is period
+#where we send NULL frame.
+
+#gApLinkMonitorPeriod = 10
+
+#gGoLinkMonitorPeriod = 10
+
+#gGoKeepAlivePeriod/gApKeepAlivePeriod is time to spend to check whether frame are succeed to send or not.
+#Hence total effective detection time is gGoLinkMonitorPeriod+ gGoKeepAlivePeriod/gApLinkMonitorPeriod+ gApKeepAlivePeriod.
+
+
+gGoKeepAlivePeriod = 20
+
+gApKeepAlivePeriod = 20
 
 
 #If set will start with active scan after driver load, otherwise will start with
@@ -373,17 +389,11 @@
 # gPassiveMinChannelTime=60
 # gActiveMaxChannelTime=40
 # gActiveMinChannelTime=20
-gPassiveMaxChannelTimeConc=110
-gPassiveMinChannelTimeConc=60
-gActiveMaxChannelTimeConc=27
-gActiveMinChannelTimeConc=20
-gRestTimeConc=100
-gNumChanCombinedConc=1
 
 #If set to 0, MCC is not allowed.
 gEnableMCCMode=1
 
-# 1=enable STBC; 0=disable STBC
+# 1=enable STBC; 0=disable STBC 
 gEnableRXSTBC=1
 
 # 1=enable tx STBC; 0=disable
@@ -408,9 +418,35 @@
 #disable LDPC in STA mode if the AP is TXBF capable
 gDisableLDPCWithTxbfAP=1
 
+#Enable thermal mitigation
+gThermalMitigationEnable=1
+
+gEnableFastRoamInConcurrency=1
+
+#List of Country codes for which 11ac needs to be disabled
+#Each country code must be delimited by comma(,)
+gListOfNon11acCountryCode=RU,UA,ZA
+
+#Maxium Channel time in msec
+gMaxMediumTime = 6000
+
+# 802.11K support
+gRrmEnable=1
+gRrmOperChanMax=8
+gRrmNonOperChanMax=8
+gRrmRandIntvl=100
+
 #Scan offload
 gEnableDirectedScanOffload=1
 
+#FlexConnect Power Factor
+#Default is set to 0 (disable)
+gFlexConnectPowerFactor=0
+
+#SAP/P2P-GO mode traffic monitor
+gEnableTrafficMonitor=0
+gTrafficIdleTimeout=3000
+
 #Disable split scan, the FW will take care of it
 gNumChanCombinedConc=60
 
@@ -432,11 +468,8 @@
 # Maximum MPDU length (VHT only. Valid values: 0->3895 octets, 1->7991 octets, 2->11454 octets)
 gVhtMpduLen=2
 
-# 802.11K support
-gRrmEnable=1
-gRrmOperChanMax=8
-gRrmNonOperChanMax=8
-gRrmRandIntvl=100
+# Maximum number of wow filters required
+#gMaxWoWFilters=22
 
 # WOW Enable/Disable.
 # 0 - Disable both magic pattern match and pattern byte match.
@@ -446,8 +479,9 @@
 # Default value of gEnableWoW is 3.
 # gEnableWoW=0
 
-# Maximum number of wow filters required
-#gMaxWoWFilters=22
+# Enable or Disable MCC Adaptive Scheduler at the FW
+# 1=Enable (default), 0=Disable
+gEnableMCCAdaptiveScheduler=0
 
 END